View source for Software/S0010

{{Software
|Type=Malware
|Description={{LinkThisPage}} was the first publicly reported piece of malware to specifically target industrial control systems devices.  {{LinkThisPage}} is a large and complex piece of malware that utilized multiple different complex tactics including multiple zero-day vulnerabilites, a sophisticated Windows rootkit, and network infection routines.[[CiteRef::Stuxnet - Symantec - 201102]][[CiteRef::Stuxnet - Symantec writeup]][[CiteRef::Stuxnet - CISA ICSA-10-238-01B - 201401]][[CiteRef::Stuxnet - SCADAHacker - 201401]]
|WindowsBuiltin=No
|AliasDescriptions={{Alias Description
|Alias=Stuxnet
|Description=[[CiteRef::Stuxnet - Symantec - 201102]]
}}
|TechniqueObjects={{Technique Object
|Technique=Technique/T0885
|Description={{LinkThisPage}} attempts to contact command and control servers on port 80 to send basic information about the computer it has compromised.[[CiteRef::Stuxnet - Symantec - 201102]]
}}{{Technique Object
|Technique=Technique/T0879
|Description={{LinkThisPage}} attacks were designed to over-pressure and damage centrifuge rotors by manipulating process pressure and rotor speeds over time. One focused on a routine to change centrifuge rotor speeds, while the other manipulated critical resonance speeds to over-pressure them.[[CiteRef:: Stuxnet - Langner - 201311]]
}}{{Technique Object
|Technique=Technique/T0812
|Description={{LinkThisPage}} uses a default password hardcoded the WinCC software's database server as one of the mechanisms used to propagate to nearby systems.[[CiteRef::Stuxnet - Symantec - 201102]]
}}{{Technique Object
|Technique=Technique/T0871
|Description={{LinkThisPage}} utilizes the PLC communication and management API to {{LinkByID|T0821}} and {{LinkByID|T0889}}.[[CiteRef::Stuxnet - Symantec - 201102]]
}}{{Technique Object
|Technique=Technique/T0866
|Description={{LinkThisPage}} executes malicious SQL commands in the WinCC database server to propagate to remote systems. The malicious SQL commands include xp_cmdshell, sp_dumpdbilog, and sp_addextendedproc.[[CiteRef::Stuxnet - Symantec - 201102]]
}}{{Technique Object
|Technique=Technique/T0874
|Description={{LinkThisPage}} modifies the Import Address Tables DLLs to hook specific APIs that are used to open project files.[[CiteRef::Stuxnet - Symantec - 201102]]
}}{{Technique Object
|Technique=Technique/T0877
|Description={{LinkThisPage}} copies the input area of an I/O image into data blocks with a one second interval between copies, forming a 21 second recording of the input area. The input area contains information being passed to the PLC from a peripheral. For example, the current state of a valve or the temperature of a device.[[CiteRef::Stuxnet - Symantec - 201102]]
}}{{Technique Object
|Technique=Technique/T0835
|Description=When the peripheral output is written to, sequence C intercepts the output and ensures it is not written to the process image output. The output is the instructions the PLC sends to a device to change its operating behavior. By intercepting the peripheral output, {{LinkThisPage}} prevents an operator from noticing unauthorized commands sent to the peripheral.[[CiteRef::Stuxnet - Symantec - 201102]]
}}{{Technique Object
|Technique=Technique/T0831
|Description={{LinkThisPage}} can reprogram a PLC and change critical parameters in such a way that legitimate commands can be overridden or intercepted. In addition, Stuxnet can apply inappropriate command sequences or parameters to cause damage to property.[[CiteRef::Stuxnet - Symantec - 201102]]
}}{{Technique Object
|Technique=Technique/T0832
|Description={{LinkThisPage}} manipulates the view of operators replaying process input and manipulating the I/O image to evade detection and inhibit protection functions.[[CiteRef::Stuxnet - Langner - 201311]][[CiteRef:: Stuxnet - Symantec - 201102]]
}}{{Technique Object
|Technique=Technique/T0849
|Description={{LinkThisPage}} renames s7otbxdx.dll, a dll responsible for handling communications with a PLC. It replaces this dll file with its own version that allows it to intercept any calls that are made to access the PLC.[[CiteRef::Stuxnet - Symantec - 201102]]
}}{{Technique Object
|Technique=Technique/T0821
|Description={{LinkThisPage}} infects OB1 so that its malicious code sequence is executed at the start of a cycle. It also infects OB35. OB35 acts as a watchdog, and on certain conditions, it can stop the execution of OB1.[[CiteRef::Stuxnet - Symantec - 201102]]
}}{{Technique Object
|Technique=Technique/T0836
|Description=In states 3 and 4 {{LinkThisPage}} sends two network bursts (done through the DP_SEND primitive). The data in the frames are instructions for the frequency converter drives. For example one of the frames contains records that change the maximum frequency (the speed at which the motor will operate). The frequency converter drives consist of parameters, which can be remotely configured via Profibus. One can write new values to these parameters changing the behavior of the device.[[CiteRef::Stuxnet - Symantec - 201102]]
}}{{Technique Object
|Technique=Technique/T0889
|Description={{LinkThisPage}} infects PLCs with different code depending on the characteristics of the target system. An infection sequence consists of code blocks and data blocks that will be downloaded to the PLC to alter its behavior.[[CiteRef::Stuxnet - Symantec - 201102]]
}}{{Technique Object
|Technique=Technique/T0801
|Description={{LinkThisPage}} examines fields recorded by the DP_RECV monitor to determine if the target system is in a particular state of operation.[[CiteRef::Stuxnet - Symantec - 201102]]
}}{{Technique Object
|Technique=Technique/T0834
|Description={{LinkThisPage}} calls system function blocks which are part of the operating system running on the PLC. They’re used to execute system tasks, such as reading the system clock (SFC1) and generating data blocks on the fly.[[CiteRef::Stuxnet - Symantec - 201102]]
}}{{Technique Object
|Technique=Technique/T0842
|Description=DP_RECV is the name of a standard function block used by network coprocessors. It is used to receive network frames on the Profibus – a standard industrial network bus used for distributed I/O. The original block is copied to FC1869, and then replaced by a malicious block. Each time the function is used to receive a packet, the malicious {{LinkThisPage}} block takes control: it will call the original DP_RECV in FC1869 and then perform postprocessing on the packet data. The replaced DP_RECV block (later on referred to as the “DP_RECV monitor”) is meant to monitor data sent by the frequency converter drives to the 315-2 CPU via CP 342-5 Profibus communication modules.[[CiteRef::Stuxnet - Symantec - 201102]]
}}{{Technique Object
|Technique=Technique/T0843
|Description={{LinkThisPage}}'s infection sequence consists of code blocks and data blocks that will be downloaded to the PLC to alter its behavior.[[CiteRef::Stuxnet - Symantec - 201102]]
}}{{Technique Object
|Technique=Technique/T0873
|Description={{LinkThisPage}} copies itself into Step 7 projects in such a way that it automatically executes when the Step 7 project is loaded.[[CiteRef::Stuxnet - Symantec - 201102]]
}}{{Technique Object
|Technique=Technique/T0888
|Description={{LinkThisPage}} was specifically targeting CPUs 6ES7-315-2 (Series 300) with special system data block characteristics for sequence A or B and 6ES7-315-2 for sequence C. The PLC type can also be checked using the s7ag_read_szl API.[[CiteRef::Stuxnet - Symantec - 201102]]
}}{{Technique Object
|Technique=Technique/T0888
|Description={{LinkThisPage}} enumerates and parses the System Data Blocks (SDB) using the s7blk_findfirst and s7blk_findnext API calls in s7otbxdx.dll. Stuxnet must find an SDB with the DWORD at offset 50h equal to 0100CB2Ch. This specifies that the system uses the Profibus communications processor module CP 342-5. In addition, specific values are searched for and counted: 7050h and 9500h. 7050h is assigned to part number KFC750V3 which appears to be a frequency converter drive (also known as variable frequency drive) manufactured by Fararo Paya in Teheran, Iran. 9500h is assigned to Vacon NX frequency converter drives manufactured by Vacon based in Finland.[[CiteRef::Stuxnet - Symantec - 201102]]
}}{{Technique Object
|Technique=Technique/T0847
|Description={{LinkThisPage}} was able to self-replicate by being spread through removable drives. A willing insider or unknown third party, such as a contractor, may have brought the removable media into the target environment.[[CiteRef:: Stuxnet - Symantec - 201102]] The earliest version of Stuxnet relied on physical installation, infecting target systems when an infected configuration file carried by a USB stick was opened.[[CiteRef:: Stuxnet - Langner - 201311]]
}}{{Technique Object
|Technique=Technique/T0851
|Description=One of {{LinkThisPage}}'s rootkits is contained entirely in the fake s7otbxdx.dll. In order to continue existing undetected on the PLC it needs to account for at least the following situations: read requests for its own malicious code blocks, read requests for infected blocks (OB1, OB35, DP_RECV), and write requests that could overwrite Stuxnet’s own code. Stuxnet contains code to monitor and intercept these types of requests. The rootkit modifies these requests so that Stuxnet’s PLC code is not discovered or damaged.[[CiteRef::Stuxnet - Langner - 201311]]
}}{{Technique Object
|Technique=Technique/T0869
|Description={{LinkThisPage}} uses a thread to monitor a data block DB890 of sequence A or B. This thread is constantly running and probing this block (every 5 minutes). On an infected PLC, if block DB890 is found and contains a special magic value (used by Stuxnet to identify his own block DB890), this block’s data can be read and written. This thread is likely used to optimize the way sequences A and B work, and modify their behavior when the Step7 editor is opened.[[CiteRef::Stuxnet - Symantec - 201102]]
}}{{Technique Object
|Technique=Technique/T0855
|Description={{LinkThisPage}} sends two network bursts (done through the DP_SEND primitive). The data in the frames are instructions for the frequency converter drives.[[CiteRef::Stuxnet - Symantec - 201102]]
}}{{Technique Object
|Technique=Technique/T0863
|Description={{LinkThisPage}} infects DLL's associated with the WinCC Simatic manager which are responsible for opening project files. If a user opens an uninfected project file using a compromised manager, the file will be infected with Stuxnet code. If an infected project is opened with the Simatic manager, the modified data file will trigger a search for the "xyz.dll" file. If the "xyz.dll" file is not found in any of the specified locations, the malicious DLL will be loaded and executed by the manager.[[CiteRef::Stuxnet - Symantec - 201102]]
}}{{Technique Object
|Technique=Technique/T0886
|Description={{LinkThisPage}} executes malicious SQL commands in the WinCC database server to propagate to remote systems. The malicious SQL commands include xp_cmdshell, sp_dumpdbilog, and sp_addextendedproc.[[CiteRef::Stuxnet - Symantec - 201102]]
}}{{Technique Object
|Technique=Technique/T0807
|Description={{LinkThisPage}} will store and execute SQL code that will extract and execute Stuxnet from the saved CAB file using xp_cmdshell with the following command: set @s = ’master..xp _ cmdshell ‘’extrac32 /y “‘+@t+‘” “’+@t+‘x”‘’’; exec(@s);[[CiteRef::Stuxnet - Symantec - 201102]]
}}{{Technique Object
|Technique=Technique/T0867
|Description={{LinkThisPage}} sends an SQL statement that creates a table and inserts a binary value into the table. The binary value is a hex string representation of the main Stuxnet DLL as an executable file (formed using resource 210) and an updated configuration data block.[[CiteRef::Stuxnet - Symantec - 201102]]
}}
}}