type:OSINT,osint:lifetime="perpetual",osint:certainty="50",tlp:white,misp-galaxy:mitre-attack-pattern="Native API - T1106",misp-galaxy:mitre-attack-pattern="Pre-OS Boot - T1542",misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547",misp-galaxy:mitre-attack-pattern="Dynamic-link Library Injection - T1055.001",misp-galaxy:mitre-attack-pattern="Hidden Files and Directories - T1564.001",misp-galaxy:mitre-attack-pattern="Hidden File System - T1564.005",misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140",misp-galaxy:mitre-attack-pattern="Impair Defenses - T1562",misp-galaxy:mitre-attack-pattern="Rename System Utilities - T1036.003",misp-galaxy:mitre-attack-pattern="Modify Registry - T1112",misp-galaxy:mitre-attack-pattern="Patch System Image - T1601.001",misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1406",misp-galaxy:mitre-attack-pattern="Software Packing - T1027.002",misp-galaxy:mitre-attack-pattern="Bootkit - T1542.003",misp-galaxy:mitre-attack-pattern="Code Signing Policy Modification - T1553.006",misp-galaxy:mitre-attack-pattern="Time Based Evasion - T1497.003",misp-galaxy:mitre-attack-pattern="Keylogging - T1056.001",misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010",misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083",misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1420",misp-galaxy:mitre-attack-pattern="Peripheral Device Discovery - T1120",misp-galaxy:mitre-attack-pattern="Process Discovery - T1424",misp-galaxy:mitre-attack-pattern="Query Registry - T1012",misp-galaxy:mitre-attack-pattern="System Information Discovery - T1426",misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124",misp-galaxy:mitre-attack-pattern="Automated Collection - T1119",misp-galaxy:mitre-attack-pattern="Data from Removable Media - T1025",misp-galaxy:mitre-attack-pattern="Local Data Staging - T1074.001",misp-galaxy:mitre-attack-pattern="Input Capture - T1417",misp-galaxy:mitre-attack-pattern="Input Capture - T1056",misp-galaxy:mitre-attack-pattern="Screen Capture - T1513",misp-galaxy:mitre-attack-pattern="Screen Capture - T1113",misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001",misp-galaxy:mitre-attack-pattern="Symmetric Cryptography - T1573.001",misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105",misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095",misp-galaxy:mitre-attack-pattern="Multi-Stage Channels - T1104",misp-galaxy:mitre-attack-pattern="Automated Exfiltration - T1020",misp-galaxy:mitre-attack-pattern="Exfiltration Over C2 Channel - T1041",misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041",misp-galaxy:mitre-attack-pattern="Scheduled Transfer - T1029",misp-galaxy:tool="ESPecter bootkit"