Primary Categories: [[BianLian]] Links: [[BianLian Articles]] / [[BianLian CVE's]] / [[BianLian Ransom Note]] / [[BianLian Tools]] # [[BianLian TTP's]] ## Resource Development | TTP Name | TTP ID | | ---------------------------------- | --------- | | Acquire Infrastructure | T1583 | | Develop Capabilities: Malware | T1587.001 | | Obtain Capabilities: Malware | T1588.001 | | Obtain Capabilities: Tool | T1588.002 | | Stage Capabilities: Upload Malware | T1608.001 | | Stage Capabilities: Upload Tool | T1608.002 | ## Execution | TTP Name | TTP ID | | -------------------------------------------------------- | --------- | | Command and Scripting Interpreter: PowerShell | T1059.001 | | Command and Scripting Interpreter: Windows Command Shell | T1059.003 | ## Defense Evasion | TTP Name | TTP ID | | ---------------------------------------- | --------- | | Valid Accounts | T1078 | | Valid Accounts: Domain Accounts | T1078.002 | | Execution Guardrails | T1480 | | Impair Defenses: Disable or Modify Tools | T1562.001 | | Impair Defenses: Safe Mode Boot | T1562.009 | | System Binary Proxy Execution | T1218 | ## Credential Access | TTP Name | TTP ID | | ----------- | ------ | | Brute Force | T1110 | ## Discovery | TTP Name | TTP ID | | ---------------------- | ------ | | Account Discovery <br> | T1087 | | Process Discovery <br> | T1057 | ## Lateral Movement | TTP Name | TTP ID | | --------------------------------------------- | --------- | | Remote Services: RDP<br> | T1021.001 | | Remote Services: SMB/Windows Admin Shares<br> | T1021.002 | ## Collection | TTP Name | TTP ID | | ------------------------------ | ------ | | Data from Local System | T1005 | | Data from Network Shared Drive | T1039 | ## Command and Control | TTP Name | TTP ID | | ------------------------------------ | --------- | | Application Layer Protocol | T1071 | | Data Encoding: Non-Standard Encoding | T1132.002 | | Remote Access Software | T1219 | ## Exfiltration | TTP Name | TTP ID | | ---------------------------------- | ------ | | Transfer Data to Cloud Account<br> | T1537 | ## Impact | TTP Name | TTP ID | | ------------------------- | ------ | | Data Destruction | T1485 | | Data Encrypted for Impact | T1486 | | Financial Theft <br> | T1657 |