MITRE ATT&CK Malware

NDiskMonitor (S0272)

[NDiskMonitor](https://attack.mitre.org/software/S0272) is a custom backdoor written in .NET that appears to be unique to [Patchwork](https://attack.mitre.org/groups/G0040). (Citation: TrendMicro Patchwork Dec 2017)

Platforms: Windows

▪Techniques implemented (5)

T1033System Owner/User Discovery T1573.001Symmetric Cryptography T1105Ingress Tool Transfer T1082System Information Discovery T1083File and Directory Discovery

▪Used by groups (1)

G0040Patchwork

S0272on MITRE ATT&CK →

MITRE ATT&CK Malware

NDiskMonitor (S0272)

ShareX LinkedIn Reddit HN

Platforms: Windows

▪Techniques implemented (5)

T1033System Owner/User Discovery T1573.001Symmetric Cryptography T1105Ingress Tool Transfer T1082System Information Discovery T1083File and Directory Discovery

▪Used by groups (1)

G0040Patchwork

S0272on MITRE ATT&CK →

NDiskMonitor (S0272)

▪Techniques implemented (5)

▪Used by groups (1)

Explore Gold

Security Data & Tools

Products

Use Cases

Company

NDiskMonitor (S0272)

▪Techniques implemented (5)

▪Used by groups (1)