WINDSHIELD - S0155 (98e8a977-3416-43aa-87fa-33e287e9c14c)

WINDSHIELD is a signature backdoor used by APT32. (Citation: FireEye APT32 May 2017)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
System Information Discovery - T1082 (354a7f88-63fb-41b5-a801-ce3b377b36f1)	Attack Pattern	WINDSHIELD - S0155 (98e8a977-3416-43aa-87fa-33e287e9c14c)	Malware	1
File Deletion - T1070.004 (d63a3fb8-9452-4e9d-a60a-54be68d5998c)	Attack Pattern	WINDSHIELD - S0155 (98e8a977-3416-43aa-87fa-33e287e9c14c)	Malware	1
WINDSHIELD - S0155 (98e8a977-3416-43aa-87fa-33e287e9c14c)	Malware	Non-Application Layer Protocol - T1095 (c21d5a77-d422-4a69-acd7-2c53c1faa34b)	Attack Pattern	1
Query Registry - T1012 (c32f7008-9fea-41f7-8366-5eb9b74bd896)	Attack Pattern	WINDSHIELD - S0155 (98e8a977-3416-43aa-87fa-33e287e9c14c)	Malware	1
System Owner/User Discovery - T1033 (03d7999c-1f4c-42cc-8373-e7690d318104)	Attack Pattern	WINDSHIELD - S0155 (98e8a977-3416-43aa-87fa-33e287e9c14c)	Malware	1
File Deletion - T1070.004 (d63a3fb8-9452-4e9d-a60a-54be68d5998c)	Attack Pattern	Indicator Removal - T1070 (799ace7f-e227-4411-baa0-8868704f2a69)	Attack Pattern	2