{"description": "Enterprise techniques used by Pysa, ATT&CK software S0583 v1.0", "name": "Pysa (S0583)", "domain": "enterprise-attack", "versions": {"layer": "4.3", "attack": "10", "navigator": "4.5"}, "techniques": [{"score": 1, "techniqueID": "T1110", "showSubtechniques": false, "comment": "[Pysa](https://attack.mitre.org/software/S0583) has used brute force attempts against a central management console, as well as some Active Directory accounts.(Citation: CERT-FR PYSA April 2020)"}, {"techniqueID": "T1059", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1059.001", "showSubtechniques": true, "comment": "[Pysa](https://attack.mitre.org/software/S0583) has used Powershell scripts to deploy its ransomware.(Citation: CERT-FR PYSA April 2020) "}, {"score": 1, "techniqueID": "T1059.006", "showSubtechniques": true, "comment": "[Pysa](https://attack.mitre.org/software/S0583) has used Python scripts to deploy ransomware.(Citation: CERT-FR PYSA April 2020)"}, {"score": 1, "techniqueID": "T1486", "showSubtechniques": false, "comment": "[Pysa](https://attack.mitre.org/software/S0583) has used RSA and AES-CBC encryption algorithm to encrypt a list of targeted file extensions.(Citation: CERT-FR PYSA April 2020) "}, {"techniqueID": "T1562", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1562.001", "showSubtechniques": true, "comment": "[Pysa](https://attack.mitre.org/software/S0583) has the capability to stop antivirus services and disable Windows Defender.(Citation: CERT-FR PYSA April 2020) "}, {"techniqueID": "T1070", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1070.004", "showSubtechniques": true, "comment": "[Pysa](https://attack.mitre.org/software/S0583) has deleted batch files after execution. (Citation: CERT-FR PYSA April 2020) "}, {"score": 1, "techniqueID": "T1490", "showSubtechniques": false, "comment": "[Pysa](https://attack.mitre.org/software/S0583) has the functionality to delete shadow copies.(Citation: CERT-FR PYSA April 2020) "}, {"techniqueID": "T1036", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1036.005", "showSubtechniques": true, "comment": "[Pysa](https://attack.mitre.org/software/S0583) has executed a malicious executable by naming it svchost.exe.(Citation: CERT-FR PYSA April 2020)"}, {"score": 1, "techniqueID": "T1112", "showSubtechniques": false, "comment": "[Pysa](https://attack.mitre.org/software/S0583) has modified the registry key \u201cSOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\u201d and added the ransom note.(Citation: CERT-FR PYSA April 2020) "}, {"score": 1, "techniqueID": "T1046", "showSubtechniques": false, "comment": "[Pysa](https://attack.mitre.org/software/S0583) can perform network reconnaissance using the Advanced Port Scanner tool.(Citation: CERT-FR PYSA April 2020)"}, {"techniqueID": "T1003", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1003.001", "showSubtechniques": true, "comment": "[Pysa](https://attack.mitre.org/software/S0583) can perform OS credential dumping using [Mimikatz](https://attack.mitre.org/software/S0002).(Citation: CERT-FR PYSA April 2020)"}, {"techniqueID": "T1021", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1021.001", "showSubtechniques": true, "comment": "[Pysa](https://attack.mitre.org/software/S0583) has laterally moved using RDP connections.(Citation: CERT-FR PYSA April 2020) "}, {"score": 1, "techniqueID": "T1489", "showSubtechniques": false, "comment": "[Pysa](https://attack.mitre.org/software/S0583) can stop services and processes.(Citation: CERT-FR PYSA April 2020) "}, {"score": 1, "techniqueID": "T1016", "showSubtechniques": false, "comment": "[Pysa](https://attack.mitre.org/software/S0583) can perform network reconnaissance using the Advanced IP Scanner tool.(Citation: CERT-FR PYSA April 2020)"}, {"techniqueID": "T1569", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1569.002", "showSubtechniques": true, "comment": "[Pysa](https://attack.mitre.org/software/S0583) has used [PsExec](https://attack.mitre.org/software/S0029) to copy and execute the ransomware.(Citation: CERT-FR PYSA April 2020)"}, {"techniqueID": "T1552", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1552.001", "showSubtechniques": true, "comment": "[Pysa](https://attack.mitre.org/software/S0583) has extracted credentials from the password database before encrypting the files.(Citation: CERT-FR PYSA April 2020) "}], "gradient": {"colors": ["#ffffff", "#66b1ff"], "minValue": 0, "maxValue": 1}, "legendItems": [{"label": "used by Pysa", "color": "#66b1ff"}]}