misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192",misp-galaxy:mitre-attack-pattern="Rundll32 - T1085",misp-galaxy:mitre-attack-pattern="User Execution - T1204",misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047",misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053",misp-galaxy:mitre-attack-pattern="Component Object Model Hijacking - T1122",misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060",misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089",misp-galaxy:mitre-attack-pattern="File Deletion - T1107",misp-galaxy:mitre-attack-pattern="Query Registry - T1012",misp-galaxy:mitre-attack-pattern="Process Discovery - T1057",misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082",misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083",misp-galaxy:mitre-attack-pattern="Data from Local System - T1005",misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039",misp-galaxy:mitre-attack-pattern="Data from Removable Media - T1025",misp-galaxy:mitre-attack-pattern="Data Staged - T1074",misp-galaxy:mitre-attack-pattern="Input Capture - T1056",misp-galaxy:mitre-attack-pattern="Screen Capture - T1113",misp-galaxy:mitre-attack-pattern="Automated Exfiltration - T1020",misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022",misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041",misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043",misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024",misp-galaxy:mitre-attack-pattern="Data Encoding - T1132",misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001",misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008",misp-galaxy:mitre-attack-pattern="Multilayer Encryption - T1079",misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071",misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032",misp-galaxy:malpedia="Zebrocy",misp-galaxy:malpedia="Zebrocy (AutoIT)",misp-galaxy:mitre-malware="Zebrocy - S0251",misp-galaxy:tool="ZEBROCY",ecsirt:intrusions="backdoor",veris:action:malware:variety="Backdoor",ms-caro-malware:malware-type="Backdoor",ms-caro-malware-full:malware-type="Backdoor",type:OSINT,osint:lifetime="perpetual",osint:certainty="50",tlp:white,workflow:todo="expansion"