OilRig has run

OilRig has used

OilRig has tested malware samples to determine AV detection and subsequently modified the samples to ensure AV evasion.(Citation: Palo Alto OilRig April 2017)(Citation: Unit42 OilRig Nov 2018)|
|mitre-attack|enterprise-attack,ics-attack|Engineering Workstation|T0853|Scripting|

OilRig has embedded a macro within spearphishing attachments that has been made up of both a VBScript and a PowerShell script.(Citation: Robert Falcone, Bryan Lee May 2016)|
|mitre-attack|enterprise-attack,ics-attack|Control Server,Data Historian,Engineering Workstation,Field Controller/RTU/PLC/IED,Human-Machine Interface,Input/Output Server,Safety Instrumented System/Protection Relay|T0859|Valid Accounts|

OilRig utilized stolen credentials to gain access to victim machines.(Citation: Dragos)|
|mitre-attack|enterprise-attack,ics-attack|Engineering Workstation,Human-Machine Interface,Control Server,Data Historian|T0865|Spearphishing Attachment|

OilRig used spearphishing emails with malicious Microsoft Excel spreadsheet attachments. (Citation: Robert Falcone, Bryan Lee May 2016)|
|mitre-attack|enterprise-attack,ics-attack|None|T0817|Drive-by Compromise|

OilRig has been seen utilizing watering hole attacks to collect credentials which could be used to gain access into ICS networks. (Citation: Eduard Kovacs May 2018)|
|mitre-attack|enterprise-attack,ics-attack|Human-Machine Interface,Control Server,Data Historian,Engineering Workstation|T0869|Standard Application Layer Protocol|

OilRig communicated with its command and control using HTTP requests. (Citation: Robert Falcone, Bryan Lee May 2016)|