OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.1234567
- FireEye APT34 Dec 2017
- Palo Alto OilRig April 2017
- ClearSky OilRig Jan 2017
- Palo Alto OilRig May 2016
- Palo Alto OilRig Oct 2016
- Unit42 OilRig Playbook 2023
- Unit 42 QUADAGENT July 2018
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| uses_technique | tech_t1588.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1008 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1686.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1219 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1137.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1113 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1025 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1007 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1556.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1201 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1586.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1553.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1048.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1112 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1120 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1195 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1573.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1119 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1572 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1115 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1012 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1497.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1068 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.004 | LSA Secrets | — |
| T1003.005 | Cached Domain Credentials | — |
| T1005 | Data from Local System | — |
| T1007 | System Service Discovery | — |
| T1008 | Fallback Channels | — |
| T1012 | Query Registry | — |
| T1016 | System Network Configuration Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1021.004 | SSH | — |
| T1025 | Data from Removable Media | — |
| T1027.005 | Indicator Removal from Tools | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1033 | System Owner/User Discovery | — |
| T1036 | Masquerading | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1046 | Network Service Discovery | — |
| T1047 | Windows Management Instrumentation | — |
| T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol | — |
| T1049 | System Network Connections Discovery | — |
| T1053.005 | Scheduled Task | — |
| T1056.001 | Keylogging | — |
| T1057 | Process Discovery | — |
| T1059 | Command and Scripting Interpreter | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.005 | Visual Basic | — |
| T1068 | Exploitation for Privilege Escalation | — |
| T1069.001 | Local Groups | — |
| T1069.002 | Domain Groups | — |
| T1070.004 | File Deletion | — |
| T1071.001 | Web Protocols | — |
| T1071.004 | DNS | — |
| T1078 | Valid Accounts | — |
| T1078.002 | Domain Accounts | — |
| T1082 | System Information Discovery | — |
| T1087.001 | Local Account | — |
| T1087.002 | Domain Account | — |
| T1105 | Ingress Tool Transfer | — |
| T1110 | Brute Force | — |
| T1112 | Modify Registry | — |
| T1113 | Screen Capture | — |
| T1115 | Clipboard Data | — |
| T1119 | Automated Collection | — |
| T1120 | Peripheral Device Discovery | — |
| T1133 | External Remote Services | — |
| T1137.004 | Outlook Home Page | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1195 | Supply Chain Compromise | — |
| T1201 | Password Policy Discovery | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1218.001 | Compiled HTML File | — |
| T1219 | Remote Access Tools | — |
| T1497.001 | System Checks | — |
| T1505.003 | Web Shell | — |
| T1543.003 | Windows Service | — |
| T1552.001 | Credentials In Files | — |
| T1553.002 | Code Signing | — |
| T1555 | Credentials from Password Stores | — |
| T1555.003 | Credentials from Web Browsers | — |
| T1555.004 | Windows Credential Manager | — |
| T1556.002 | Password Filter DLL | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
| T1566.003 | Spearphishing via Service | — |
| T1572 | Protocol Tunneling | — |
| T1573.002 | Asymmetric Cryptography | — |
| T1583.001 | Domains | — |
| T1586.002 | Email Accounts | — |
| T1587.001 | Malware | — |
| T1588.002 | Tool | — |
| T1588.003 | Code Signing Certificates | — |
| T1608.001 | Upload Malware | — |
| T1686.003 | Windows Host Firewall | — |
别名
APT34 · COBALT GYPSY · Crambus · Earth Simnavaz · EUROPIUM · Evasive Serpens · Hazel Sandstorm · Helix Kitten · IRN2 · ITG13 · OilRig · TA452
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。