{ "name": "Guacamaya Pronico operation — observed TTPs", "versions": { "attack": "19", "navigator": "5.3.2", "layer": "4.5" }, "domain": "enterprise-attack", "description": "Techniques mapped from the public Hack Back recording using a detailed frame transcription and a second transcript sampling the complete video every ten seconds. Scores encode evidence tier, not severity, frequency, or confidence.", "filters": {}, "sorting": 3, "layout": { "layout": "side", "aggregateFunction": "average", "showID": true, "showName": true, "showAggregateScores": false, "countUnscored": false }, "hideDisabled": false, "techniques": [ { "techniqueID": "T1003.001", "score": 5, "comment": "Video-confirmed: WDigest was enabled and Mimikatz, through Meterpreter's kiwi extension, dumped passwords from memory.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1003.004", "score": 5, "comment": "Video-confirmed: Mimikatz, through Meterpreter's kiwi extension, recovered a domain-admin service password from LSA secrets.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1003.006", "score": 3, "comment": "Caption-reported: An unchanged domain-controller machine secret was later used to replicate replacement hashes.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Caption-reported" } ], "showSubtechniques": false }, { "techniqueID": "T1005", "score": 5, "comment": "Video-confirmed: Files and credentials were collected from administrator endpoints and servers.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1016", "score": 5, "comment": "Video-confirmed: Routes, interfaces, egress constraints, and iSCSI paths were enumerated.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1018", "score": 5, "comment": "Video-confirmed: AD exports and ping sweeps identified reachable servers and workstations.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1021.001", "score": 5, "comment": "Video-confirmed: RDP provided interactive administration of domain controllers and servers.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1021.002", "score": 5, "comment": "Video-confirmed: SMB shares and administrative shares carried tools, exports, and commands.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1021.004", "score": 5, "comment": "Video-confirmed: SSH reached routers, storage, and pivot systems.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1027.005", "score": 3, "comment": "Caption-reported: Strings and logging code were removed from custom dnscat2 and Mimikatz builds.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Caption-reported" } ], "showSubtechniques": false }, { "techniqueID": "T1027.010", "score": 5, "comment": "Video-confirmed: Encoded PowerShell and staged command material appeared in the recording.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1027.013", "score": 5, "comment": "Video-confirmed: Encoded payloads and transport were used to reduce inspection and signature exposure.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1036", "score": 5, "comment": "Video-confirmed: Tools and tasks were renamed to resemble legitimate processes and security software.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1039", "score": 5, "comment": "Video-confirmed: Large file shares and employee desktop shares were copied.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1046", "score": 5, "comment": "Video-confirmed: Network scans located SMB, Telnet, SSH, routers, switches, and storage interfaces.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1047", "score": 5, "comment": "Video-confirmed: Remote WMI execution was used to run commands and fan out destructive actions.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1048.002", "score": 5, "comment": "Video-confirmed: WinSCP sent staged documents and PST files to an external SFTP server.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1053.003", "score": 5, "comment": "Video-confirmed: A DNS backdoor was placed in cron.hourly on a Fibre Channel switch.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1053.005", "score": 5, "comment": "Video-confirmed: Group Policy scheduled tasks distributed reboot and destructive jobs across the domain. Scheduled tasks were created through Group Policy. Domain-controlled scheduled tasks executed with elevated context.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1055", "score": 5, "comment": "Video-confirmed: Meterpreter migrated into another privileged process before credential operations. Meterpreter process migration and in-memory loading reduced standalone artifacts.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1057", "score": 5, "comment": "Video-confirmed: Process lists were inspected to choose migration targets and imitate process names.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1059.001", "score": 5, "comment": "Video-confirmed: PowerShell drove payload loading, Exchange administration, cloud deletion, and BitLocker.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1059.003", "score": 5, "comment": "Video-confirmed: cmd.exe was used throughout execution, discovery, transfer, and impact activity.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1069.002", "score": 5, "comment": "Video-confirmed: Domain-admin group membership was queried.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1070.004", "score": 5, "comment": "Video-confirmed: Temporary files, web shells, exports, and tool artifacts were deleted after use.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1070.006", "score": 5, "comment": "Video-confirmed: WinSCP and implant timestamps were copied from older files.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1071.001", "score": 5, "comment": "Video-confirmed: Meterpreter used reverse HTTPS and web downloads moved payloads.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1071.004", "score": 5, "comment": "Video-confirmed: dnscat, dnscat2, and dns2tcp operated through permitted DNS traffic.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1074.001", "score": 5, "comment": "Video-confirmed: An old, rarely used server staged files and mailbox exports.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1078", "score": 5, "comment": "Video-confirmed: Stolen domain, VPN, device, cloud, and replacement-domain accounts were used repeatedly. Compromised accounts, hashes, and device credentials provided durable access. A service account recovered from LSA secrets already held domain-admin privilege. Legitimate identities blended activity into normal administrative paths.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1082", "score": 5, "comment": "Video-confirmed: Operating system, architecture, kernel, and domain details were queried.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1083", "score": 5, "comment": "Video-confirmed: The operators searched user systems, file shares, mailboxes, and administrative notes.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1087.002", "score": 5, "comment": "Video-confirmed: A csvde export enumerated thousands of Active Directory objects and users.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1090.001", "score": 5, "comment": "Video-confirmed: Internal routers and compromised hosts provided SOCKS and port-forwarding pivots.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1090.003", "score": 5, "comment": "Video-confirmed: Traffic crossed nested external and internal router proxies.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1105", "score": 5, "comment": "Video-confirmed: Backdoors, utilities, and custom payloads were uploaded or downloaded.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1110.003", "score": 3, "comment": "Caption-reported: Old user/hash pairs and common passwords were tried against the rebuilt domain.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Caption-reported" } ], "showSubtechniques": false }, { "techniqueID": "T1114.002", "score": 5, "comment": "Video-confirmed: Exchange mailboxes were exported to PST files.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1119", "score": 5, "comment": "Video-confirmed: Scripts watched for target availability and moved batches of exports.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1135", "score": 5, "comment": "Video-confirmed: Advanced IP Scanner and share-focused tooling located file servers and shares.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1136.002", "score": 5, "comment": "Video-confirmed: The PrintNightmare payload created a new domain administrator account.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1190", "score": 5, "comment": "Video-confirmed: ProxyLogon was used against the Internet-facing Exchange server.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1210", "score": 5, "comment": "Video-confirmed: EternalBlue and PrintNightmare were used against internal Windows systems.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1213.002", "score": 5, "comment": "Video-confirmed: SharePoint and OneDrive material was accessed, and later cloud sites were deleted.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1485", "score": 5, "comment": "Video-confirmed: SAN volumes, server disks, desktops, mailboxes, users, and SharePoint sites were deleted or overwritten.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1486", "score": 5, "comment": "Video-confirmed: BitLocker was distributed through Group Policy with attacker-controlled recovery material.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1490", "score": 1, "comment": "ATT&CK-inferred: Backup volumes and cloud recycle-bin content were deliberately removed.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "ATT&CK-inferred" } ], "showSubtechniques": false }, { "techniqueID": "T1497.001", "score": 3, "comment": "Caption-reported: Target-specific builds checked host attributes before starting.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Caption-reported" } ], "showSubtechniques": false }, { "techniqueID": "T1505.003", "score": 5, "comment": "Video-confirmed: ProxyLogon placed a temporary ASPX web shell on Exchange.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1518.001", "score": 5, "comment": "Video-confirmed: Defender and Kaspersky presence and behavior shaped payload choices.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1529", "score": 5, "comment": "Video-confirmed: Remote and scheduled shutdowns attempted to lock partially encrypted systems.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1531", "score": 5, "comment": "Video-confirmed: Microsoft 365 users were bulk-deleted.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1543.003", "score": 3, "comment": "Caption-reported: The operators described svchost service-DLL persistence and a service failure-action attempt.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Caption-reported" } ], "showSubtechniques": false }, { "techniqueID": "T1550.002", "score": 5, "comment": "Video-confirmed: NTLM hashes authenticated Impacket tooling without plaintext passwords.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1550.003", "score": 5, "comment": "Video-confirmed: Forged Kerberos tickets were loaded and used for remote access.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1552.001", "score": 5, "comment": "Video-confirmed: Passwords were collected from desktop text files and IT documents.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1555.003", "score": 5, "comment": "Video-confirmed: Saved browser credentials and history exposed VPN, router, printer, and SAN access.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1558.001", "score": 5, "comment": "Video-confirmed: Golden tickets were forged to preserve domain access through password changes.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1564.001", "score": 5, "comment": "Video-confirmed: The new administrator profile was marked hidden.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1569.002", "score": 5, "comment": "Video-confirmed: PsExec-style service execution moved from Exchange to internal Windows systems.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1570", "score": 5, "comment": "Video-confirmed: Payloads and utilities were copied between compromised systems.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1571", "score": 5, "comment": "Video-confirmed: Port 53 was reused for non-DNS proxy and callback traffic.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1572", "score": 5, "comment": "Video-confirmed: SSH, SMB, RDP, and iSCSI paths were carried through layered tunnels.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1595.002", "score": 5, "comment": "Video-confirmed: Nmap was used to test the public Exchange service for ProxyLogon.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1620", "score": 5, "comment": "Video-confirmed: A .NET assembly was loaded into memory through PowerShell reflection.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1685", "score": 5, "comment": "Video-confirmed: Logging was disabled on pivot routers before they were used.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false }, { "techniqueID": "T1685.005", "score": 5, "comment": "Video-confirmed: Windows event logs and Exchange-related traces were cleared or removed.", "enabled": true, "metadata": [ { "name": "Evidence", "value": "Video-confirmed" } ], "showSubtechniques": false } ], "gradient": { "colors": [ "#718096", "#e49a2f", "#b83e35" ], "minValue": 1, "maxValue": 5 }, "legendItems": [ { "label": "Video-confirmed", "color": "#b83e35" }, { "label": "Caption-reported", "color": "#e49a2f" }, { "label": "ATT&CK-inferred", "color": "#718096" } ], "metadata": [ { "name": "Source", "value": "Hack Back! A DIY Guide to Digital Monkeywrenching" }, { "name": "ATT&CK", "value": "Enterprise ATT&CK v19.2" }, { "name": "Mapped techniques", "value": "67" } ], "links": [ { "label": "Source video page", "url": "https://enlacehacktivista.org/index.php/Pronico" } ], "showTacticRowBackground": false, "tacticRowBackground": "#dddddd", "selectTechniquesAcrossTactics": true, "selectSubtechniquesWithParent": false, "selectVisibleTechniques": false }