Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.1234
- ClearkSky Fox Kitten February 2020
- CrowdStrike PIONEER KITTEN August 2020
- Dragos PARISITE
- ClearSky Pay2Kitten December 2020
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| also_known_as | Fox Kitten | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | UNC757 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Parisite | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Pioneer Kitten | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | RUBIDIUM | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Lemon Sandstorm | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1530 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1210 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.010 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.005 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1217 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213.005 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.002 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.005 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.003 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.004 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.004 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1012 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1572 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1039 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1546.008 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2020 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.003 | NTDS | — |
| T1005 | Data from Local System | — |
| T1012 | Query Registry | — |
| T1018 | Remote System Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1021.002 | SMB/Windows Admin Shares | — |
| T1021.004 | SSH | — |
| T1021.005 | VNC | — |
| T1027.010 | Command Obfuscation | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1036.004 | Masquerade Task or Service | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1039 | Data from Network Shared Drive | — |
| T1046 | Network Service Discovery | — |
| T1053.005 | Scheduled Task | — |
| T1059 | Command and Scripting Interpreter | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1078 | Valid Accounts | — |
| T1083 | File and Directory Discovery | — |
| T1087.001 | Local Account | — |
| T1087.002 | Domain Account | — |
| T1090 | Proxy | — |
| T1102 | Web Service | — |
| T1105 | Ingress Tool Transfer | — |
| T1110 | Brute Force | — |
| T1136.001 | Local Account | — |
| T1190 | Exploit Public-Facing Application | — |
| T1210 | Exploitation of Remote Services | — |
| T1213.005 | Messaging Applications | — |
| T1217 | Browser Information Discovery | — |
| T1505.003 | Web Shell | — |
| T1530 | Data from Cloud Storage | — |
| T1546.008 | Accessibility Features | — |
| T1552.001 | Credentials In Files | — |
| T1555.005 | Password Managers | — |
| T1560.001 | Archive via Utility | — |
| T1572 | Protocol Tunneling | — |
| T1585 | Establish Accounts | — |
| T1585.001 | Social Media Accounts | — |
别名
Fox Kitten · Lemon Sandstorm · Parisite · Pioneer Kitten · RUBIDIUM · UNC757
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。