IceApple

IceApple is a modular Internet Information Services (IIS) post-exploitation framework, that has been used since at least 2021 against the technology, academic, and government sectors.

View graph Watch Export

Indicators tracked

Intelligence Reports10

10 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium

Connections

19 relationships

T1560.001: Archive via Utility

source

T1003.002: Security Account Manager

source

T1036.005: Match Legitimate Resource Name or Location

source

T1003.004: LSA Secrets

source

T1087.002: Domain Account

source

T1573.001: Symmetric Cryptography

source

T1552.002: Credentials in Registry

source

T1082: System Information Discovery

source

T1005: Data from Local System

source

T1140: Deobfuscate/Decode Files or Information

source

T1620: Reflective Code Loading

source

T1056.003: Web Portal Capture

source

T1016: System Network Configuration Discovery

source

T1083: File and Directory Discovery

source

T1041: Exfiltration Over C2 Channel

source

T1505.004: IIS Components

source

T1027.010: Command Obfuscation

source

T1070.004: File Deletion

source

T1071.001: Web Protocols

source