tengu

T1078Valid Accounts

Abuse of valid accounts (obtained via infostealers or IABs).

T1059.001Command and Scripting Interpreter: PowerShell

Intensive use of PowerShell for command and script execution.

T1059.003Command and Scripting Interpreter: Windows Command Shell

Use of CMD for command execution.

T1053.005Scheduled Task/Job: Scheduled Task

Creation of Scheduled Tasks that run with SYSTEM privileges to ensure re-infection.

T1070Indicator Removal

Cleaning of event logs.

T1218System Binary Proxy Execution

Use of rundll32.exe for proxy execution.

T1021.001Remote Services: Remote Desktop Protocol

Lateral movement via RDP after compromising administrative credentials.

T1041Exfiltration Over C2 Channel

Data exfiltration via C2 channels before starting the encryption routine.

T1486Data Encrypted for Impact

File encryption.

T1490Inhibit System Recovery

Deletion of Shadow Copies to prevent local recovery.