Classe: Worm
Les vers se propagent sur les réseaux informatiques via des ressources réseau. Contrairement à Net-Worms, un utilisateur doit lancer un ver afin qu'il soit activé. Ce type de ver recherche les réseaux informatiques distants et se copie dans les répertoires accessibles en lecture / écriture (s'il en trouve). En outre, ces vers utilisent les fonctions intégrées du système d'exploitation pour rechercher des répertoires réseau accessibles et / ou ils recherchent au hasard des ordinateurs sur Internet, s'y connectent et tentent d'accéder pleinement aux disques de ces ordinateurs. Cette catégorie couvre également les vers qui, pour une raison ou une autre, ne rentrent dans aucune des autres catégories définies ci-dessus (par exemple les vers pour les appareils mobiles).Plus d'informations
Plateforme: VBS
Visual Basic Scripting Edition (VBScript) est un langage de script interprété par Windows Script Host. VBScript est largement utilisé pour créer des scripts sur les systèmes d'exploitation Microsoft Windows.Famille: Worm.VBS.Dinihou
No family descriptionExamples
F265471E1D2685892964150395F31F332788BA07FD38915754E0503441D32A0B
1207384CDBE67A07C5AF038B92164B75
251E2FCC1DFD435A79264EE93D3737F5
01E6830C1F155FE897F73984BDDE8A89
Tactics and Techniques: Mitre*
TA0007
Discovery
The adversary is trying to figure out your environment.
Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what’s around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective.
Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what’s around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective.
T1082
System Information Discovery
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tools such as Systeminfo can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the
Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API)
Tools such as Systeminfo can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the
systemsetup configuration tool on macOS. As an example, adversaries with user-level access can execute the df -aH command to obtain currently mounted disks and associated freely available space. Adversaries may also leverage a Network Device CLI on network devices to gather detailed system information (e.g. show version).(Citation: US-CERT-TA18-106A) System Information Discovery combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.(Citation: OSX.FairyTale)(Citation: 20 macOS Common Tools and Techniques)Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API)
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.