Snowflake: discovery after access
According to Mandiant, after signing in UNC5537 listed all databases and tables with the SHOW TABLES command. In ATT&CK this is classified separately as post-access Discovery. Google Cloud (Mandiant)
The attacker collecting information about the organization, employees and systems to choose a target and plan the attack.
MITRE ATT&CK treats reconnaissance as the first tactic, in which the attacker gathers information about the target: open sources, domains, employee names, software in use and internet-facing systems. MITRE ATT&CK
Stealer logs shorten reconnaissance: which login addresses the organization uses and which employee’s credentials are exposed can be seen with a single search. Google Cloud (Mandiant)
The website, social media and registration records are examined. MITRE ATT&CK
Internet-facing services and their versions are identified. MITRE ATT&CK
Logs and leak lists are searched by organization name. MITRE ATT&CK
According to Mandiant, after signing in UNC5537 listed all databases and tables with the SHOW TABLES command. In ATT&CK this is classified separately as post-access Discovery. Google Cloud (Mandiant)
We use cookies to ensure proper operation of our website, analyze usage, and deliver relevant content and advertisements. You can manage your preferences at any time. Cookie Policy