medusa

T1078Valid Accounts

Initial access through brute force or compromised credentials of legitimate RDP accounts.

T1133External Remote Services

Accesses the victim's network via an RDP service.

T1566Phishing

Initial access through phishing email attachments.

T1047Windows Management Instrumentation

Uses a series of Windows commands, such as bcdedit.exe and vssadmin.

T1059Command and Scripting Interpreter

Uses a series of Windows commands, such as bcdedit.exe and vssadmin.

T1562Impair Defenses

Employs Windows Management Instrumentation (WMIC) command-line to delete shadow copies.

T1562.001Disable or Modify Tools

Terminates services or processes related to antivirus/security tools.

T1562.009Safe Mode Boot

Abuses Safe Mode to evade endpoint detection.

T1110Brute Force

Uses brute force on local RDP account passwords.

T1083File and Directory Discovery

Queries specified files, folders, and file extensions.

T1135Network Share Discovery

Enumerates network shares.

T1021Remote Services

Uses remote services for login and lateral movement via RDP and SMB.

T1045Exfiltration Over C2 Channel

Transfers data to attacker-controlled servers via an existing command-and-control (C2) channel.

T1048Exfiltration Over Alternative Protocol

Exfiltrates data using alternative protocols, such as FTP/SFTP, to avoid detection by traditional methods.

T1567Exfiltration Over Web Service

Exfiltrates data using web services like cloud services (e.g., Google Drive, Dropbox, etc.).

T1105Ingress Tool Transfer

Uses certutil to download malicious files.

T1486Data Encrypted for Impact

Uses the AES-256 algorithm to encrypt files on the computer.

T1489Service Stop

Terminates processes and services related to database servers, email servers, and backups.

T1490Inhibit System Recovery

Deletes shadow copies and disables the Windows System Restore feature.