Orz

ATP Sandbox Adv. Heuristics

Stats

First seen: July 2022
Last seen: October 2026

MITRE ATT&CK techniques

13 techniques across 5 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell

TA0005 Stealth

T1027Obfuscated Files or Information
T1055Process Injection
- T1055.012Process Hollowing
T1070Indicator Removal
T1218System Binary Proxy Execution
- T1218.010Regsvr32

TA0007 Discovery

T1016System Network Configuration Discovery
T1057Process Discovery
T1082System Information Discovery
T1083File and Directory Discovery
T1518Software Discovery

TA0011 Command and Control

T1102Web Service
- T1102.002Bidirectional Communication
T1105Ingress Tool Transfer

TA0112 Defense Impairment

T1112Modify Registry

Associated groups

G0065Leviathan

Alert name variants

Alert Name	Engine
Script-JS.Downloader.Airbreak	ATP Sandbox Adv. Heuristics

Related families

QakBot Cobalt Strike TrickBot Clambling InvisiMole