Primary Categories: [[Cactus]] Links: [[Cactus Articles]] / [[Cactus CVE's]] / [[Cactus Ransom Note]] / [[Cactus Tools]] # [[Cactus TTP's]] ## Initial Access | TTP Name | TTP ID | | ---------------------------------- | --------- | | Exploit Public-Facing Application | T1190<br> | ## Execution | TTP Name | TTP ID | | ---------------------------------- | --------- | | Command and Scripting Interpreter | T1059 | | Windows Management Instrumentation | T1047<br> | | Shared Modules | T1129 | | Software Deployment Tools | T1072 | ## Persistence | TTP Name | TTP ID | | ------------------ | ------------- | | DLL Side-Loading | T1574.002 | | Scheduled Task/Job | T1053<br> | | Scheduled Task | T1053.005<br> | | Create Account | T1136 | ## Privilege Escalation | TTP Name | TTP ID | | ----------------- | --------- | | Process Injection | T1055 | | DLL Side-Loading | T1574.002 | ## Defense Evasion | TTP Name | TTP ID | | -------------------------------- | ------------- | | Process Injection | T1055<br> | | Obfuscated Files or Information | T1027 | | Masquerading | T1036 | | Virtualization/Sandbox Evasion | T1497<br> | | Hidden Files and Directories | T1564.001<br> | | DLL Side-Loading | T1574.002 | | Impair Defenses | T1562 | | Disable or Modify Tools | T1562.001<br> | | Obfuscated Files or Information | T1027 | | Software Packing | T1027.002 | ## Credential Access | TTP Name | TTP ID | | -------------------------------- | ------------- | | Input Capture | T1056 | | Credentials from Password Stores | T1555 | | Credentials from Web Browsers | T1555.003<br> | | OS Credential Dumping | T1003 | ## Discovery | TTP Name | TTP ID | | ------------------------------------ | ------------- | | System Information Discovery <br> | T1082<br> | | Security Software Discovery<br> | T1518.001 | | Remote System Discovery | T1018 | | Process Discovery | T1057 | | File and Directory Discovery | T1083 | | Virtualization/Sandbox Evasion | T1497<br> | | System Network Connections Discovery | T1049 | | Account Discovery | T1087 | | Domain Account | T1087.002<br> | ## Lateral Movement | TTP Name | TTP ID | | ------------------------ | --------- | | Remote Services | T1021 | | Remote Services: RDP<br> | T1021.001 | | Lateral Tool Transfer | T1570 | ## Collection | TTP Name | TTP ID | | -------------------- | ------ | | Input Capture | T1056 | | Automated Collection | T1119 | ## Command and Control | TTP Name | TTP ID | | ------------------------------ | --------- | | Application Layer Protocol | T1071 | | Non-Application Layer Protocol | T1095 | | Non-Standard Port | T1571 | | Encrypted Channel | T1573<br> | | Remote Access Software | T1219 | | Proxy | T1090<br> | ## Exfiltration | TTP Name | TTP ID | | ------------------------------------------------------------ | ------------- | | Exfiltration Over Web Service <br> | T1567 | | Exfiltration Over Web Service: Exfiltration to Cloud Storage | T1567.002<br> | ## Impact | TTP Name | TTP ID | | ------------------------- | ------ | | Data Encrypted for Impact | T1486 |