Class: Worm
Worms spread on computer networks via network resources. Unlike Net-Worms, a user must launch a Worm in order for it to be activated. This kind of worm searches remote computer networks and copies itself to directories that are read/write accessible (if it finds any). Furthermore, these worms either use built-in operating system functions to search for accessible network directories and/or they randomly search for computers on the Internet, connect to them, and attempt to gain full access to the disks of these computers. This category also covers those worms which, for one reason or another, do not fit into any of the other categories defined above (e.g. worms for mobile devices).Read more
Platform: Script
A script is a program or set of actions used to automate a task. Many different scripting languages exist.Family: Trojan.VBS.AutoRun
No family descriptionExamples
90DF2576A16F9472756FA780A411A8888514EEFAE56FBFE0A47856FE2C836794
D133D4BEF063AFDD45E4480AEDC5D460
247D4E26F0F0BAA9F4A89B352FF86395
1E44107373ADF10917400A4C749374D3
Tactics and Techniques: Mitre*
Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.
Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.
* © 2025 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.