WIRTE has used

WIRTE has downloaded PowerShell code from the C2 server to be executed.(Citation: Lab52 WIRTE Apr 2019)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

WIRTE has used PowerShell for script execution.(Citation: Lab52 WIRTE Apr 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

WIRTE has used VBScript  in its operations.(Citation: Lab52 WIRTE Apr 2019) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

WIRTE has used HTTP for network communication.(Citation: Lab52 WIRTE Apr 2019) |