Turla has used VBS scripts throughout its operations.(Citation: Symantec Waterbug Jun 2019) |
|mitre-attack|enterprise-attack|Windows|T1555.004|Windows Credential Manager|

Turla has gathered credentials from the Windows Credential Manager tool.(Citation: Symantec Waterbug Jun 2019)    |
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Turla RPC backdoors have used cmd.exe to execute commands.(Citation: ESET Turla PowerShell May 2019)(Citation: Symantec Waterbug Jun 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

Turla RPC backdoors can upload files from victim machines.(Citation: ESET Turla PowerShell May 2019)|
|mitre-attack|enterprise-attack|Windows|T1134.002|Create Process with Token|

Turla RPC backdoors can impersonate or steal process tokens before executing commands.(Citation: ESET Turla PowerShell May 2019)   |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1025|Data from Removable Media|

Turla RPC backdoors can collect files from USB thumb drives.(Citation: ESET Turla PowerShell May 2019)(Citation: Symantec Waterbug Jun 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090|Proxy|

Turla RPC backdoors have included local UPnP RPC proxies.(Citation: ESET Turla PowerShell May 2019)    |
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or

PowerShell Profile, to decode encrypted PowerShell payloads.(Citation: ESET Turla PowerShell May 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|