Indrik Spider has used malicious JavaScript files for several components of their attack.(Citation: Symantec WastedLocker June 2020)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

Indrik Spider used

Cobalt Strike to carry out credential dumping using ProcDump.(Citation: Symantec WastedLocker June 2020)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,IaaS,Linux,macOS,Google Workspace,Network|T1136|Create Account|

Indrik Spider used

Indrik Spider used

PsExec to leverage Windows Defender to disable scanning of all downloaded files and to restrict real-time monitoring.(Citation: Symantec WastedLocker June 2020)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

Indrik Spider has used WMIC to execute commands on remote computers.(Citation: Symantec WastedLocker June 2020) |
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1007|System Service Discovery|

Indrik Spider has used the win32_service WMI class to retrieve a list of services from the system.(Citation: Symantec WastedLocker June 2020) |
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Indrik Spider has used batch scripts on victim's machines.(Citation: Crowdstrike Indrik November 2018) |
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Indrik Spider has used PowerShell

Empire for execution of malware.(Citation: Crowdstrike Indrik November 2018)(Citation: Symantec WastedLocker June 2020) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1078.002|Domain Accounts|

Indrik Spider has collected credentials from infected systems, including domain accounts.(Citation: Crowdstrike Indrik November 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|