MURKYTOP - S0233 (049ff071-0b3c-4712-95d2-d21c6aa54501)

MURKYTOP is a reconnaissance tool used by Leviathan. (Citation: FireEye Periscope March 2018)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
System Information Discovery - T1082 (354a7f88-63fb-41b5-a801-ce3b377b36f1)	Attack Pattern	MURKYTOP - S0233 (049ff071-0b3c-4712-95d2-d21c6aa54501)	Malware	1
MURKYTOP - S0233 (049ff071-0b3c-4712-95d2-d21c6aa54501)	Malware	Local Account - T1087.001 (25659dd6-ea12-45c4-97e6-381e3e4b593e)	Attack Pattern	1
MURKYTOP - S0233 (049ff071-0b3c-4712-95d2-d21c6aa54501)	Malware	File Deletion - T1070.004 (d63a3fb8-9452-4e9d-a60a-54be68d5998c)	Attack Pattern	1
MURKYTOP - S0233 (049ff071-0b3c-4712-95d2-d21c6aa54501)	Malware	Network Share Discovery - T1135 (3489cfc5-640f-4bb3-a103-9137b97de79f)	Attack Pattern	1
MURKYTOP - S0233 (049ff071-0b3c-4712-95d2-d21c6aa54501)	Malware	At - T1053.002 (f3d95a1f-bba2-44ce-9af7-37866cd63fd0)	Attack Pattern	1
MURKYTOP - S0233 (049ff071-0b3c-4712-95d2-d21c6aa54501)	Malware	Permission Groups Discovery - T1069 (15dbf668-795c-41e6-8219-f0447c0e64ce)	Attack Pattern	1
Network Service Discovery - T1046 (e3a12395-188d-4051-9a16-ea8e14d07b88)	Attack Pattern	MURKYTOP - S0233 (049ff071-0b3c-4712-95d2-d21c6aa54501)	Malware	1
MURKYTOP - S0233 (049ff071-0b3c-4712-95d2-d21c6aa54501)	Malware	Windows Command Shell - T1059.003 (d1fcf083-a721-4223-aedf-bf8960798d62)	Attack Pattern	1
MURKYTOP - S0233 (049ff071-0b3c-4712-95d2-d21c6aa54501)	Malware	Remote System Discovery - T1018 (e358d692-23c0-4a31-9eb6-ecc13a8d7735)	Attack Pattern	1
Local Account - T1087.001 (25659dd6-ea12-45c4-97e6-381e3e4b593e)	Attack Pattern	Account Discovery - T1087 (72b74d71-8169-42aa-92e0-e7b04b9f5a08)	Attack Pattern	2
File Deletion - T1070.004 (d63a3fb8-9452-4e9d-a60a-54be68d5998c)	Attack Pattern	Indicator Removal - T1070 (799ace7f-e227-4411-baa0-8868704f2a69)	Attack Pattern	2
Scheduled Task/Job - T1053 (35dd844a-b219-4e2b-a6bb-efa9a75995a9)	Attack Pattern	At - T1053.002 (f3d95a1f-bba2-44ce-9af7-37866cd63fd0)	Attack Pattern	2
Windows Command Shell - T1059.003 (d1fcf083-a721-4223-aedf-bf8960798d62)	Attack Pattern	Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830)	Attack Pattern	2