FrameworkPOS - S0503 (1cdbbcab-903a-414d-8eb0-439a97343737)

FrameworkPOS is a point of sale (POS) malware used by FIN6 to steal payment card data from sytems that run physical POS devices.(Citation: SentinelOne FrameworkPOS September 2019)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Local Data Staging - T1074.001 (1c34f7aa-9341-4a48-bfab-af22e51aca6c)	Attack Pattern	FrameworkPOS - S0503 (1cdbbcab-903a-414d-8eb0-439a97343737)	Malware	1
Exfiltration Over Alternative Protocol - T1048 (a19e86f8-1c0a-4fea-8407-23b73d615776)	Attack Pattern	FrameworkPOS - S0503 (1cdbbcab-903a-414d-8eb0-439a97343737)	Malware	1
Data from Local System - T1005 (3c4a2599-71ee-4405-ba1e-0e28414b4bc5)	Attack Pattern	FrameworkPOS - S0503 (1cdbbcab-903a-414d-8eb0-439a97343737)	Malware	1
Process Discovery - T1057 (8f4a33ec-8b1f-4b80-a2f6-642b2e479580)	Attack Pattern	FrameworkPOS - S0503 (1cdbbcab-903a-414d-8eb0-439a97343737)	Malware	1
Archive via Custom Method - T1560.003 (143c0cbb-a297-4142-9624-87ffc778980b)	Attack Pattern	FrameworkPOS - S0503 (1cdbbcab-903a-414d-8eb0-439a97343737)	Malware	1
Local Data Staging - T1074.001 (1c34f7aa-9341-4a48-bfab-af22e51aca6c)	Attack Pattern	Data Staged - T1074 (7dd95ff6-712e-4056-9626-312ea4ab4c5e)	Attack Pattern	2
Archive via Custom Method - T1560.003 (143c0cbb-a297-4142-9624-87ffc778980b)	Attack Pattern	Archive Collected Data - T1560 (53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a)	Attack Pattern	2