misp-galaxy:threat-actor="Turla Group",misp-galaxy:mitre-enterprise-attack-attack-pattern="PowerShell - T1086",misp-galaxy:mitre-enterprise-attack-course-of-action="Windows Management Instrumentation Event Subscription Mitigation - T1084",misp-galaxy:mitre-enterprise-attack-attack-pattern="Obfuscated Files or Information - T1027",misp-galaxy:mitre-enterprise-attack-attack-pattern="Deobfuscate/Decode Files or Information - T1140",misp-galaxy:mitre-enterprise-attack-attack-pattern="Process Injection - T1055",misp-galaxy:mitre-enterprise-attack-attack-pattern="Timestomp - T1099",misp-galaxy:mitre-enterprise-attack-attack-pattern="File and Directory Discovery - T1083",misp-galaxy:mitre-enterprise-attack-attack-pattern="Peripheral Device Discovery - T1120",misp-galaxy:mitre-enterprise-attack-attack-pattern="Process Discovery - T1057",misp-galaxy:mitre-enterprise-attack-attack-pattern="Query Registry - T1012",misp-galaxy:mitre-enterprise-attack-attack-pattern="Data from Local System - T1005",misp-galaxy:mitre-enterprise-attack-attack-pattern="Data from Removable Media - T1025",misp-galaxy:mitre-enterprise-attack-attack-pattern="Exfiltration Over Command and Control Channel - T1041",misp-galaxy:mitre-enterprise-attack-attack-pattern="Standard Application Layer Protocol - T1071",tlp:white