Cyb3rWard0g/ATTCKGroups huggingface dataset:
menuPass has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as

UPPERCUT.(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: FireEye APT10 Sept 2018)(Citation: Symantec Cicada November 2020)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

menuPass has used a script (atexec.py) to execute a command on a target machine via Task Scheduler.(Citation: PWC Cloud Hopper Technical Annex April 2017)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|

menuPass has used RDP connections to move across the victim network.(Citation: PWC Cloud Hopper April 2017)(Citation: District Court of NY APT10 Indictment December 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.002|External Proxy|

menuPass has used a global service provider's IP as a proxy for C2 traffic from a victim.(Citation: FireEye APT10 April 2017)(Citation: FireEye APT10 Sept 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

menuPass has installed updates and new malware on victims.(Citation: PWC Cloud Hopper April 2017)(Citation: District Court of NY APT10 Indictment December 2018)|
Metador - G1013

Created: 2023-01-25T23:57:51.818Z

Modified: 2023-04-14T12:25:35.434Z

Contributors: Massimiliano Romano, BT Security,Sittikorn Sangrattanapitak

Aliases

Metador

Description

Metador is a suspected cyber espionage group that was first reported in September 2022. Metador has targeted a limited number of telecommunication companies, internet service providers, and universities in the Middle East and Africa. Security researchers named the group Metador based on the "I am meta" string in one of the group's malware samples and the expectation of Spanish-language responses from C2 servers.(Citation: SentinelLabs Metador Sept 2022)

Techniques Used

Metador has encrypted their payloads.(Citation: SentinelLabs Metador Sept 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Metador has quickly deleted

Metador has used Microsoft's Console Debugger in some of their operations.(Citation: SentinelLabs Metador Sept 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Metador has downloaded tools and malware onto a compromised system.(Citation: SentinelLabs Metador Sept 2022)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Metador has used the Windows command line to execute commands.(Citation: SentinelLabs Metador Sept 2022)|
|mitre-attack|enterprise-attack|Windows|T1546.003|Windows Management Instrumentation Event Subscription|

Metador has established persistence through the use of a WMI event subscription combined with unusual living-off-the-land binaries such as

Metador has used unique malware in their operations, including

metaMain and

Mafalda.(Citation: SentinelLabs Metador Sept 2022)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,Network|T1095|Non-Application Layer Protocol|
Mafalda.(Citation: SentinelLabs Metador Sept 2022)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,Network|T1095|Non-Application Layer Protocol|

Metador has used TCP for C2.(Citation: SentinelLabs Metador Sept 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Metador has used HTTP for C2.(Citation: SentinelLabs Metador Sept 2022)|
Moafee - G0002

Created: 2017-05-31T21:31:46.025Z

Modified: 2020-03-30T19:09:42.298Z

Contributors:

Aliases

Moafee

Description

Moafee is a threat group that appears to operate from the Guandong Province of China. Due to overlapping TTPs, including similar custom tools, Moafee is thought to have a direct or indirect relationship with the threat group DragonOK. (Citation: Haq 2014)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.001|Binary Padding|Moafee has been known to employ binary padding.(Citation: Haq 2014)|
Mofang - G0103

Created: 2020-05-12T21:23:59.021Z

Modified: 2020-05-29T03:30:39.739Z

Contributors:

Aliases

Mofang

Description

Mofang is a likely China-based cyber espionage group, named for its frequent practice of imitating a victim's infrastructure. This adversary has been observed since at least May 2012 conducting focused attacks against government and critical infrastructure in Myanmar, as well as several other countries and sectors including military, automobile, and weapons industries.(Citation: FOX-IT May 2016 Mofang)

Techniques Used

Mofang delivered spearphishing emails with malicious links included.(Citation: FOX-IT May 2016 Mofang)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

Mofang's spearphishing emails required a user to click the link to connect to a compromised website.(Citation: FOX-IT May 2016 Mofang)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Mofang delivered spearphishing emails with malicious documents, PDFs, or Excel files attached.(Citation: FOX-IT May 2016 Mofang)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Mofang's malicious spearphishing attachments required a user to open the file after receiving.(Citation: FOX-IT May 2016 Mofang)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Mofang has compressed the

ShimRat executable within malicious email attachments.

Mofang has also encrypted payloads before they are downloaded to victims.(Citation: FOX-IT May 2016 Mofang)|
Molerats - G0021

Created: 2017-05-31T21:31:55.093Z

Modified: 2021-04-27T20:16:16.057Z

Contributors:

Aliases

Molerats,Operation Molerats,Gaza Cybergang

Description

Molerats is an Arabic-speaking, politically-motivated threat group that has been operating since 2012. The group's victims have primarily been in the Middle East, Europe, and the United States.(Citation: DustySky)(Citation: DustySky2)(Citation: Kaspersky MoleRATs April 2019)(Citation: Cybereason Molerats Dec 2020)

Techniques Used

Molerats has used msiexec.exe to execute an MSI payload.(Citation: Unit42 Molerat Mar 2020) |
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

Molerats has created scheduled tasks to persistently run VBScripts.(Citation: Unit42 Molerat Mar 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

Molerats decompresses ZIP files once on the victim machine.(Citation: Kaspersky MoleRATs April 2019)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Molerats used PowerShell implants on target machines.(Citation: Kaspersky MoleRATs April 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.007|JavaScript|

Molerats used various implants, including those built with JS, on target machines.(Citation: Kaspersky MoleRATs April 2019)   |
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|
Molerats used various implants, including those built with VBScript, on target machines.(Citation: Kaspersky MoleRATs April 2019)(Citation: Unit42 Molerat Mar 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

Molerats has sent phishing emails with malicious links included.(Citation: Kaspersky MoleRATs April 2019)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Molerats has sent phishing emails with malicious Microsoft Word and PDF attachments.(Citation: Kaspersky MoleRATs April 2019)(Citation: Unit42 Molerat Mar 2020)(Citation: Cybereason Molerats Dec 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Molerats has sent malicious files via email that tricked users into clicking Enable Content to run an embedded macro and to download malicious archives.(Citation: Kaspersky MoleRATs April 2019)(Citation: Unit42 Molerat Mar 2020)(Citation: Cybereason Molerats Dec 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

Molerats has sent malicious links via email trick users into opening a RAR archive and running an executable.(Citation: Kaspersky MoleRATs April 2019)(Citation: Unit42 Molerat Mar 2020) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Molerats has delivered compressed executables within ZIP files to victims.(Citation: Kaspersky MoleRATs April 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|
Molerats used executables to download malicious files from different sources.(Citation: Kaspersky MoleRATs April 2019)(Citation: Unit42 Molerat Mar 2020) |
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Molerats saved malicious files within the AppData and Startup folders to maintain persistence.(Citation: Kaspersky MoleRATs April 2019)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|

Molerats has used forged Microsoft code-signing certificates on malware.(Citation: FireEye Operation Molerats)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|

Molerats used the public tool BrowserPasswordDump10 to dump passwords saved in browsers on victims.(Citation: DustySky)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.(Citation: DustySky)|
Moses Staff - G1009

Created: 2022-08-11T22:47:27.686Z

Modified: 2022-10-24T18:50:12.653Z

Contributors: Hiroki Nagahama, NEC Corporation,Pooja Natarajan, NEC Corporation India,Manikantan Srinivasan, NEC Corporation India

Aliases

Moses Staff

Description

Moses Staff is a suspected Iranian threat group that has primarily targeted Israeli companies since at least September 2021. Moses Staff openly stated their motivation in attacking Israeli companies is to cause damage by leaking stolen sensitive data and encrypting the victim's networks without a ransom demand.(Citation: Checkpoint MosesStaff Nov 2021)

Security researchers assess Moses Staff is politically motivated, and has targeted government, finance, travel, energy, manufacturing, and utility companies outside of Israel as well, including those in Italy, India, Germany, Chile, Turkey, the UAE, and the US.(Citation: Cybereason StrifeWater Feb 2022)

Techniques Used

Moses Staff has used batch scripts that can disable the Windows firewall on specific remote machines.(Citation: Checkpoint MosesStaff Nov 2021)|
|mitre-attack|enterprise-attack|Windows|T1021.002|SMB/Windows Admin Shares|

Moses Staff has used batch scripts that can enable SMB on a compromised host.(Citation: Checkpoint MosesStaff Nov 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.001|Local Account|

Moses Staff has collected the administrator username from a compromised host.(Citation: Checkpoint MosesStaff Nov 2021)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|

Moses Staff has used signed drivers from an open source tool called DiskCryptor to evade detection.(Citation: Checkpoint MosesStaff Nov 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Moses Staff has downloaded and installed web shells to following path
Moses Staff has downloaded and installed web shells to following path

Moses Staff collected information about the infected host, including the machine names and OS architecture.(Citation: Checkpoint MosesStaff Nov 2021)
|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Moses Staff has collected the domain name of a compromised network.(Citation: Checkpoint MosesStaff Nov 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Moses Staff has used obfuscated web shells in their operations.(Citation: Checkpoint MosesStaff Nov 2021)|
|mitre-attack|enterprise-attack|PRE|T1587.001|Malware|

Moses Staff has built malware, such as

DCSrv and

PyDCrypt, for targeting victims' machines.(Citation: Checkpoint MosesStaff Nov 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

Moses Staff has used the commercial tool DiskCryptor.(Citation: Checkpoint MosesStaff Nov 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

Moses Staff has dropped a web shell onto a compromised system.(Citation: Checkpoint MosesStaff Nov 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

Moses Staff has exploited known vulnerabilities in public-facing infrastructure such as Microsoft Exchange Servers.(Citation: Checkpoint MosesStaff Nov 2021)|
MuddyWater - G0069

Created: 2018-04-18T17:59:24.739Z

Modified: 2023-03-22T04:59:16.032Z

Contributors: Ozer Sarilar, @ozersarilar, STM,Daniyal Naeem, BT Security

Aliases

MuddyWater,Earth Vetala,MERCURY,Static Kitten,Seedworm,TEMP.Zagros

Description

MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).(Citation: CYBERCOM Iranian Intel Cyber January 2022) Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, defense, and oil and natural gas organizations, in the Middle East, Asia, Africa, Europe, and North America.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: ClearSky MuddyWater June 2019)(Citation: Reaqta MuddyWater November 2017)(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: Talos MuddyWater Jan 2022)

Techniques Used

MuddyWater maintains persistence on victim networks through side-loading dlls to trick legitimate programs into running malware.(Citation: DHS CISA AA22-055A MuddyWater February 2022)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1573.001|Symmetric Cryptography|

MuddyWater has used AES to encrypt C2 responses.(Citation: Talos MuddyWater Jan 2022)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

MuddyWater has exploited the Microsoft Exchange memory corruption vulnerability (CVE-2020-0688).(Citation: DHS CISA AA22-055A MuddyWater February 2022)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1210|Exploitation of Remote Services|
MuddyWater has exploited the Microsoft Netlogon vulnerability (CVE-2020-1472).(Citation: DHS CISA AA22-055A MuddyWater February 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

MuddyWater has stored a decoy PDF file within a victim's

MuddyWater has used JavaScript files to execute its

POWERSTATS payload.(Citation: ClearSky MuddyWater Nov 2018)(Citation: FireEye MuddyWater Mar 2018)(Citation: DHS CISA AA22-055A MuddyWater February 2022)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|

MuddyWater can disable the system's local proxy settings.(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1219|Remote Access Software|

MuddyWater has used a legitimate application, ScreenConnect, to manage systems remotely and move laterally.(Citation: Trend Micro Muddy Water March 2021)(Citation: Anomali Static Kitten February 2021) |
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518|Software Discovery|

MuddyWater has used a PowerShell backdoor to check for Skype connectivity on the target machine.(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

MuddyWater has used a PowerShell backdoor to check for Skype connections on the target machine.(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1059.006|Python|

MuddyWater has used developed tools in Python including

Out1.(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.002|Domain Account|
Out1.(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.002|Domain Account|

MuddyWater has used

MuddyWater has sent targeted spearphishing e-mails with malicious links.(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

MuddyWater has distributed URLs in phishing e-mails that link to lure documents.(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|PRE|T1589.002|Email Addresses|

MuddyWater has specifically targeted government agency employees with spearphishing e-mails.(Citation: Anomali Static Kitten February 2021)   |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102.002|Bidirectional Communication|

MuddyWater has used web services including OneHub to distribute remote access tools.(Citation: Anomali Static Kitten February 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|MuddyWater has made use of legitimate tools ConnectWise and Remote Utilities to gain access to target environment.(Citation: Anomali Static Kitten February 2021)|
|mitre-attack|enterprise-attack|PRE|T1583.006|Web Services|

MuddyWater has used file sharing services including OneHub to distribute tools.(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|

MuddyWater has used C2 infrastructure to receive exfiltrated data.(Citation: Reaqta MuddyWater November 2017)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|
MuddyWater has used scheduled tasks to establish persistence.(Citation: Reaqta MuddyWater November 2017)|
|mitre-attack|enterprise-attack|Windows,Office 365|T1137.001|Office Template Macros|

MuddyWater has used a Word Template, Normal.dotm, for persistence.(Citation: Reaqta MuddyWater November 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1132.001|Standard Encoding|

MuddyWater has used tools to encode C2 communications including Base64 encoding.(Citation: ClearSky MuddyWater June 2019)(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

MuddyWater has exploited the Office vulnerability CVE-2017-0199 for execution.(Citation: ClearSky MuddyWater June 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

MuddyWater has used HTTP for C2 communications.(Citation: ClearSky MuddyWater June 2019)(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555|Credentials from Password Stores|

MuddyWater has performed credential dumping with

LaZagne and other tools, including by dumping passwords saved in victim email.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Windows|T1003.005|Cached Domain Credentials|

MuddyWater has performed credential dumping with

LaZagne.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)|
|mitre-attack|enterprise-attack|Windows|T1003.004|LSA Secrets|

MuddyWater has performed credential dumping with
MuddyWater has performed credential dumping with

LaZagne.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

MuddyWater has used VBScript files to execute its

POWERSTATS payload, as well as macros.(Citation: FireEye MuddyWater Mar 2018)(Citation: MuddyWater TrendMicro June 2018)(Citation: Securelist MuddyWater Oct 2018)(Citation: Symantec MuddyWater Dec 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: ClearSky MuddyWater June 2019)(Citation: Reaqta MuddyWater November 2017)(Citation: Trend Micro Muddy Water March 2021)(Citation: Talos MuddyWater Jan 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.003|Steganography|

MuddyWater has stored obfuscated JavaScript code in an image file named temp.jpg.(Citation: ClearSky MuddyWater Nov 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|

MuddyWater has run tools including Browser64 to steal passwords saved in victim web browsers.(Citation: Symantec MuddyWater Dec 2018)(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1104|Multi-Stage Channels|

MuddyWater has used one C2 to obtain enumeration scripts and monitor web logs, but a different C2 to send data back.(Citation: Talos MuddyWater May 2019) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.004|Compile After Delivery|
MuddyWater has used the .NET csc.exe tool to compile executables from downloaded C# code.(Citation: ClearSky MuddyWater Nov 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

MuddyWater has used malware that can collect the victim’s username.(Citation: Securelist MuddyWater Oct 2018)(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

MuddyWater has used malware to collect the victim’s IP address and domain name.(Citation: Securelist MuddyWater Oct 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1113|Screen Capture|

MuddyWater has used malware that can capture screenshots of the victim’s machine.(Citation: Securelist MuddyWater Oct 2018)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518.001|Security Software Discovery|

MuddyWater has used malware to check running processes against a hard-coded list of security tools often used by malware researchers.(Citation: Securelist MuddyWater Oct 2018)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

MuddyWater has used malware that can collect the victim’s OS version and machine name.(Citation: Securelist MuddyWater Oct 2018)(Citation: Talos MuddyWater May 2019)(Citation: Reaqta MuddyWater November 2017)(Citation: Trend Micro Muddy Water March 2021)(Citation: Talos MuddyWater Jan 2022)|
|mitre-attack|enterprise-attack|Windows|T1559.002|Dynamic Data Exchange|

MuddyWater has used malware that can execute PowerShell scripts via DDE.(Citation: Securelist MuddyWater Oct 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|