Magic Hound has conducted a network call out to a specific website as part of their initial discovery activity.(Citation: DFIR Phosphorus November 2021) |
|mitre-attack|enterprise-attack|PRE|T1591.001|Determine Physical Locations|

Magic Hound has collected location information from visitors to their phishing sites.(Citation: Google Iran Threats October 2021)|
|mitre-attack|enterprise-attack|Windows|T1562.002|Disable Windows Event Logging|

Magic Hound has executed scripts to disable the event log service.(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Windows|T1482|Domain Trust Discovery|

Magic Hound has used a web shell to execute

Magic Hound has used an encrypted http proxy in C2 communications.(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

Magic Hound has named a malicious script CacheTask.bat to mimic a legitimate task.(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,IaaS|T1486|Data Encrypted for Impact|

Magic Hound has used BitLocker and DiskCryptor to encrypt targeted workstations. (Citation: DFIR Phosphorus November 2021)(Citation: Microsoft Iranian Threat Actor Trends November 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

Magic Hound has used KPortScan 3.0 to perform SMB, RDP, and LDAP scanning.(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1078.002|Domain Accounts|

Magic Hound has used domain administrator accounts after dumping LSASS process memory.(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090|Proxy|