Article Content During an incident response engagement in September 2016, SecureWorks® incident response analysts observed payment card data being collected by a generic remote access trojan (RAT) rather than typical memory-scraping malware The malware copies card data from the running processes, a technique known as memory scraping, to encoded files on disk The threat actor sells the card data or uses it for fraudulent purchases In the September 2016 incident, SecureWorks analysts observed card data being collected by the NetWire RAT instead of traditional POS malware The attack methodology is very similar to traditional POS malware A threat actor sends a phishing email with a malicious attachment to an employee working on a POS computer If the employee opens the attachment, malware to harvest card data is downloaded or installed Without proper security protections in place, these infections can remain undetected for months or years Keyloggers expose more than just card data; credentials for online accounts and applications such as email, property management systems (PMS), and Internet browsers are at risk Other sensitive information typed by the user, including Social Security numbers, phone numbers, addresses, and birthdates, can also be compromised Using a RAT with keylogging capabilities, a threat actor could gather necessary information to commit identify theft and further compromise an organization’s network The generic NetWire RAT variant used in this incident did not contain specific capabilities to target POS systems NetWire Details The NetWire RAT variant observed by SecureWorks analysts has the file description “TeamViewer 10” (see Table 1); however, this binary is not associated with the legitimate TeamViewer application Windows Folder.exe   378e72e9e4c7ba4ca 7498a262c501a54  May 30, 2016  TeamViewer 10  10.0.38475.0     Table 1 NetWire RAT binary details The Microsoft Autoruns for Windows tool reveals the autostart mechanism that the NetWire RAT creates and uses (see Figure 1) This persistence mechanism ensures that NetWire launches automatically when the victim logs into the system Figure 1 NetWire persistence mechanism 35 138 227 over port 4588 The notepad.exe process should never have an active network connection Figure 2 Child process created by the NetWire RAT (Source: SecureWorks)  Conclusion Payment card data breaches can cause significant financial and reputational damages for an organization, and can lead to restrictions imposed by compliance bodies and loss of future business Prevention and detection is critical to ensure that threats to customer data are prevented or detected Organizations should apply endpoint detection mechanisms that apply behavioral analysis and human intelligence to detect threat actor activity 
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content During an incident response engagement in September 2016, SecureWorks® incident response analysts observed payment card data being collected by a generic remote access trojan (RAT) rather than typical memory-scraping malware The malware copies card data from the running processes, a technique known as memory scraping, to encoded files on disk The threat actor sells the card data or uses it for fraudulent purchases In the September 2016 incident, SecureWorks analysts observed card data being collected by the NetWire RAT instead of traditional POS malware The attack methodology is very similar to traditional POS malware A threat actor sends a phishing email with a malicious attachment to an employee working on a POS computer If the employee opens the attachment, malware to harvest card data is downloaded or installed Without proper security protections in place, these infections can remain undetected for months or years Keyloggers expose more than just card data; credentials for online accounts and applications such as email, property management systems (PMS), and Internet browsers are at risk Other sensitive information typed by the user, including Social Security numbers, phone numbers, addresses, and birthdates, can also be compromised Using a RAT with keylogging capabilities, a threat actor could gather necessary information to commit identify theft and further compromise an organization’s network The generic NetWire RAT variant used in this incident did not contain specific capabilities to target POS systems NetWire Details The NetWire RAT variant observed by SecureWorks analysts has the file description “TeamViewer 10” (see Table 1); however, this binary is not associated with the legitimate TeamViewer application Windows Folder.exe   378e72e9e4c7ba4ca 7498a262c501a54  May 30, 2016  TeamViewer 10  10.0.38475.0     Table 1 NetWire RAT binary details The Microsoft Autoruns for Windows tool reveals the autostart mechanism that the NetWire RAT creates and uses (see Figure 1) This persistence mechanism ensures that NetWire launches automatically when the victim logs into the system Figure 1 NetWire persistence mechanism 35 138 227 over port 4588 The notepad.exe process should never have an active network connection Figure 2 Child process created by the NetWire RAT (Source: SecureWorks)  Conclusion Payment card data breaches can cause significant financial and reputational damages for an organization, and can lead to restrictions imposed by compliance bodies and loss of future business Prevention and detection is critical to ensure that threats to customer data are prevented or detected Organizations should apply endpoint detection mechanisms that apply behavioral analysis and human intelligence to detect threat actor activity  ### Response: .