{"description": "Enterprise techniques used by OSX_OCEANLOTUS.D, ATT&CK software S0352 v2.1", "name": "OSX_OCEANLOTUS.D (S0352)", "domain": "enterprise-attack", "versions": {"layer": "4.3", "attack": "10", "navigator": "4.5"}, "techniques": [{"techniqueID": "T1071", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1071.001", "showSubtechniques": true, "comment": "[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) can use HTTP POST and GET requests to send and receive C2 information.(Citation: Trend Micro MacOS Backdoor November 2020)"}, {"techniqueID": "T1560", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1560.003", "showSubtechniques": true, "comment": "[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) scrambles and encrypts data using AES256 before sending it to the C2 server.(Citation: TrendMicro MacOS April 2018)(Citation: Trend Micro MacOS Backdoor November 2020)"}, {"techniqueID": "T1059", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1059.001", "showSubtechniques": true, "comment": "[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) uses PowerShell scripts.(Citation: TrendMicro MacOS April 2018)"}, {"score": 1, "techniqueID": "T1059.004", "showSubtechniques": true, "comment": "[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) uses a shell script as the main executable inside an app bundle and drops an embedded base64-encoded payload to the /tmp folder.(Citation: Trend Micro MacOS Backdoor November 2020)(Citation: sentinelone apt32 macOS backdoor 2020)"}, {"score": 1, "techniqueID": "T1059.005", "showSubtechniques": true, "comment": "[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) uses Word macros for execution.(Citation: TrendMicro MacOS April 2018)"}, {"techniqueID": "T1543", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1543.001", "showSubtechniques": true, "comment": "[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) can create a persistence file in the folder /Library/LaunchAgents.(Citation: TrendMicro MacOS April 2018)(Citation: Trend Micro MacOS Backdoor November 2020)"}, {"score": 1, "techniqueID": "T1543.004", "showSubtechniques": true, "comment": "If running with root permissions, [OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) can create a persistence file in the folder /Library/LaunchDaemons.(Citation: TrendMicro MacOS April 2018)(Citation: sentinelone apt32 macOS backdoor 2020)"}, {"score": 1, "techniqueID": "T1005", "showSubtechniques": false, "comment": "[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) has the ability to upload files from a compromised host.(Citation: Trend Micro MacOS Backdoor November 2020)"}, {"score": 1, "techniqueID": "T1222", "showSubtechniques": false, "comment": "[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) has changed permissions of a second-stage payload to an executable via chmod.(Citation: sentinelone apt32 macOS backdoor 2020)"}, {"techniqueID": "T1564", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1564.001", "showSubtechniques": true, "comment": "[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) sets the main loader file\u2019s attributes to hidden.(Citation: TrendMicro MacOS April 2018)"}, {"techniqueID": "T1070", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1070.004", "showSubtechniques": true, "comment": "[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) has a command to delete a file from the system. [OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) deletes the app bundle and dropper after execution.(Citation: TrendMicro MacOS April 2018)(Citation: Trend Micro MacOS Backdoor November 2020)"}, {"score": 1, "techniqueID": "T1070.006", "showSubtechniques": true, "comment": "[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) can use the touch -t command to change timestamps.(Citation: Trend Micro MacOS Backdoor November 2020)(Citation: 20 macOS Common Tools and Techniques)"}, {"score": 1, "techniqueID": "T1105", "showSubtechniques": false, "comment": "[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) has a command to download and execute a file on the victim\u2019s machine.(Citation: TrendMicro MacOS April 2018)(Citation: Trend Micro MacOS Backdoor November 2020)"}, {"techniqueID": "T1036", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1036.004", "showSubtechniques": true, "comment": "[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) has disguised its app bundle by adding special characters to the filename and using the icon for legitimate Word documents.(Citation: Trend Micro MacOS Backdoor November 2020)"}, {"score": 1, "techniqueID": "T1027", "showSubtechniques": true, "comment": "[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) encrypts its strings in RSA256 and encodes them in a custom base64 scheme and XOR.(Citation: TrendMicro MacOS April 2018)"}, {"score": 1, "techniqueID": "T1027.002", "showSubtechniques": true, "comment": "[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) has a variant that is packed with UPX.(Citation: ESET OceanLotus macOS April 2019)"}, {"techniqueID": "T1553", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1553.001", "showSubtechniques": true, "comment": "[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) uses the command xattr -d com.apple.quarantine to remove the quarantine file attribute used by Gatekeeper and Notarization checks.(Citation: Trend Micro MacOS Backdoor November 2020)(Citation: 20 macOS Common Tools and Techniques)"}, {"score": 1, "techniqueID": "T1082", "showSubtechniques": false, "comment": "[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) collects processor information, memory information, computer name, hardware UUID, serial number, and operating system version. [OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) has used the ioreg command to gather some of this information.(Citation: TrendMicro MacOS April 2018)(Citation: Trend Micro MacOS Backdoor November 2020)(Citation: 20 macOS Common Tools and Techniques)"}, {"score": 1, "techniqueID": "T1016", "showSubtechniques": false, "comment": "[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) can collect the network interface MAC address on the infected host.(Citation: TrendMicro MacOS April 2018)(Citation: Trend Micro MacOS Backdoor November 2020)"}, {"techniqueID": "T1497", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1497.001", "showSubtechniques": true, "comment": "[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) has variants that check a number of system parameters to see if it is being run on real hardware or in a virtual machine environment, such as sysctl hw.model.(Citation: ESET OceanLotus macOS April 2019)(Citation: 20 macOS Common Tools and Techniques)"}], "gradient": {"colors": ["#ffffff", "#66b1ff"], "minValue": 0, "maxValue": 1}, "legendItems": [{"label": "used by OSX_OCEANLOTUS.D", "color": "#66b1ff"}]}