Cyb3rWard0g/ATTCKGroups huggingface dataset:
BITTER - G1002

Created: 2022-06-01T20:26:53.880Z

Modified: 2022-06-01T21:20:18.113Z

Contributors:

Aliases

BITTER,T-APT-17

Description

BITTER is a suspected South Asian cyber espionage threat group that has been active since at least 2013. BITTER has primarily targeted government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia.(Citation: Cisco Talos Bitter Bangladesh May 2022)(Citation: Forcepoint BITTER Pakistan Oct 2016)

Techniques Used

BITTER has registered domains to stage payloads.(Citation: Forcepoint BITTER Pakistan Oct 2016)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

BITTER has registered a variety of domains to host malicious payloads and for C2.(Citation: Forcepoint BITTER Pakistan Oct 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1068|Exploitation for Privilege Escalation|

BITTER has exploited CVE-2021-1732 for privilege escalation.(Citation: DBAPPSecurity BITTER zero-day Feb 2021)(Citation: Microsoft CVE-2021-1732 Feb 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

BITTER has obtained tools such as PuTTY for use in their operations.(Citation: Forcepoint BITTER Pakistan Oct 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1568|Dynamic Resolution|

BITTER has used DDNS for C2 communications.(Citation: Forcepoint BITTER Pakistan Oct 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1573|Encrypted Channel|

BITTER has encrypted their C2 communications.(Citation: Forcepoint BITTER Pakistan Oct 2016)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,Network|T1095|Non-Application Layer Protocol|
BITTER has used TCP for C2 communications.(Citation: Forcepoint BITTER Pakistan Oct 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

BITTER has used HTTP POST requests for C2.(Citation: Cisco Talos Bitter Bangladesh May 2022)(Citation: Forcepoint BITTER Pakistan Oct 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

BITTER has used a RAR SFX dropper to deliver malware.(Citation: Forcepoint BITTER Pakistan Oct 2016)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

BITTER has used scheduled tasks for persistence and execution.(Citation: Cisco Talos Bitter Bangladesh May 2022)|
|mitre-attack|enterprise-attack|Windows|T1559.002|Dynamic Data Exchange|

BITTER has executed OLE objects using Microsoft Equation Editor to download and run malicious payloads.(Citation: Cisco Talos Bitter Bangladesh May 2022) |
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

BITTER has disguised malware as a Windows Security update service.(Citation: Cisco Talos Bitter Bangladesh May 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

BITTER has downloaded additional malware and tools onto a compromised host.(Citation: Cisco Talos Bitter Bangladesh May 2022)(Citation: Forcepoint BITTER Pakistan Oct 2016) |
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|
BITTER has exploited Microsoft Office vulnerabilities CVE-2012-0158, CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802.(Citation: Cisco Talos Bitter Bangladesh May 2022)(Citation: Forcepoint BITTER Pakistan Oct 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

BITTER has attempted to lure victims into opening malicious attachments delivered via spearphishing.(Citation: Cisco Talos Bitter Bangladesh May 2022)(Citation: Forcepoint BITTER Pakistan Oct 2016)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

BITTER has sent spearphishing emails with a malicious RTF document or Excel spreadsheet.(Citation: Cisco Talos Bitter Bangladesh May 2022)(Citation: Forcepoint BITTER Pakistan Oct 2016)|
BlackOasis - G0063

Created: 2018-04-18T17:59:24.739Z

Modified: 2018-10-17T00:14:20.652Z

Contributors:

Aliases

BlackOasis

Description

BlackOasis is a Middle Eastern threat group that is believed to be a customer of Gamma Group. The group has shown interest in prominent figures in the United Nations, as well as opposition bloggers, activists, regional news correspondents, and think tanks. (Citation: Securelist BlackOasis Oct 2017) (Citation: Securelist APT Trends Q2 2017) A group known by Microsoft as NEODYMIUM is reportedly associated closely with BlackOasis operations, but evidence that the group names are aliases has not been identified. (Citation: CyberScoop BlackOasis Oct 2017)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|BlackOasis's first stage shellcode contains a NOP sled with alternative instructions that was likely designed to bypass antivirus tools.(Citation: Securelist BlackOasis Oct 2017)|
BlackTech - G0098

Created: 2020-05-05T18:36:45.970Z

Modified: 2022-04-06T13:14:27.477Z

Contributors: Tatsuya Daitoku, Cyber Defense Institute, Inc.,Hannah Simes, BT Security

Aliases

BlackTech,Palmerworm

Description

BlackTech is a suspected Chinese cyber espionage group that has primarily targeted organizations in East Asia--particularly Taiwan, Japan, and Hong Kong--and the US since at least 2013. BlackTech has used a combination of custom malware, dual-use tools, and living off the land tactics to compromise media, construction, engineering, electronics, and financial company networks.(Citation: TrendMicro BlackTech June 2017)(Citation: Symantec Palmerworm Sep 2020)(Citation: Reuters Taiwan BlackTech August 2020)

Techniques Used

BlackTech has obtained and used tools such as Putty, SNScan, and

PsExec for its operations.(Citation: Symantec Palmerworm Sep 2020)|
|mitre-attack|enterprise-attack|PRE|T1588.004|Digital Certificates|

BlackTech has used valid, stolen digital certificates for some of their malware and tools.(Citation: ESET PLEAD Malware July 2018)|
|mitre-attack|enterprise-attack|PRE|T1588.003|Code Signing Certificates|

BlackTech has used stolen code-signing certificates for its malicious payloads.(Citation: Symantec Palmerworm Sep 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

BlackTech has used the SNScan tool to find other potential targets on victim networks.(Citation: Symantec Palmerworm Sep 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1106|Native API|

BlackTech has used built-in API functions.(Citation: IronNet BlackTech Oct 2021)|
|mitre-attack|enterprise-attack|Linux,macOS|T1021.004|SSH|
BlackTech has used built-in API functions.(Citation: IronNet BlackTech Oct 2021)|
|mitre-attack|enterprise-attack|Linux,macOS|T1021.004|SSH|

BlackTech has used Putty for remote access.(Citation: Symantec Palmerworm Sep 2020)|
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|

BlackTech has used DLL side loading by giving DLLs hardcoded names and placing them in searched directories.(Citation: Trend Micro Waterbear December 2019) |
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

BlackTech has used spearphishing e-mails with malicious password-protected archived files (ZIP or RAR) to deliver malware.(Citation: TrendMicro BlackTech June 2017)(Citation: NTT Security Flagpro new December 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

BlackTech has used e-mails with malicious documents to lure victims into installing malware.(Citation: TrendMicro BlackTech June 2017)(Citation: NTT Security Flagpro new December 2021)   |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

BlackTech has used spearphishing e-mails with links to cloud services to deliver malware.(Citation: TrendMicro BlackTech June 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

BlackTech has used e-mails with malicious links to lure victims into installing malware.(Citation: TrendMicro BlackTech June 2017)     |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1036.002|Right-to-Left Override|
BlackTech has used right-to-left-override to obfuscate the filenames of malicious e-mail attachments.(Citation: TrendMicro BlackTech June 2017)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.(Citation: TrendMicro BlackTech June 2017)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

BlackTech has exploited a buffer overflow vulnerability in Microsoft Internet Information Services (IIS) 6.0, CVE-2017-7269, in order to establish a new HTTP or command and control (C2) server.(Citation: TrendMicro BlackTech June 2017)|
Blue Mockingbird - G0108

Created: 2020-05-26T20:09:39.139Z

Modified: 2021-10-12T21:46:13.007Z

Contributors: Tony Lambert, Red Canary

Aliases

Blue Mockingbird

Description

Blue Mockingbird is a cluster of observed activity involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. The earliest observed Blue Mockingbird tools were created in December 2019.(Citation: RedCanary Mockingbird May 2020)

Techniques Used

Blue Mockingbird has obtained and used tools such as

Mimikatz.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1574.012|COR_PROFILER|

Blue Mockingbird has used wmic.exe and Windows Registry modifications to set the COR_PROFILER environment variable to execute a malicious DLL whenever a process loads the .NET CLR.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Blue Mockingbird has obfuscated the wallet address in the payload binary.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

Blue Mockingbird has used wmic.exe to set environment variables.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|

Blue Mockingbird has used Windows Registry modifications to specify a DLL payload.(Citation: RedCanary Mockingbird May 2020) |
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Blue Mockingbird has collected hardware details for the victim's system, including CPU and memory information.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|
Blue Mockingbird has made their XMRIG payloads persistent as a Windows Service.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Blue Mockingbird has masqueraded their XMRIG payload name by naming it wercplsupporte.dll after the legitimate wercplsupport.dll file.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1134|Access Token Manipulation|

Blue Mockingbird has used JuicyPotato to abuse the

Blue Mockingbird has used Mimikatz to retrieve credentials from LSASS memory.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|

Blue Mockingbird has used Remote Desktop to log on to servers interactively and manually copy files to remote hosts.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1021.002|SMB/Windows Admin Shares|

Blue Mockingbird has used Windows Explorer to manually copy malicious files to remote hosts over SMB.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Blue Mockingbird has used PowerShell reverse TCP shells to issue interactive commands over a network connection.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090|Proxy|

Blue Mockingbird has used frp, ssf, and Venom to establish SOCKS proxy connections.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers|T1496|Resource Hijacking|
Blue Mockingbird has used XMRIG to mine cryptocurrency on victim systems.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1546.003|Windows Management Instrumentation Event Subscription|

Blue Mockingbird has used mofcomp.exe to establish WMI Event Subscription persistence mechanisms configured from a *.mof file.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Blue Mockingbird has used batch script files to automate execution and deployment of payloads.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

Blue Mockingbird has used Windows Scheduled Tasks to establish persistence on local and remote hosts.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

Blue Mockingbird has gained initial access by exploiting CVE-2019-18935, a vulnerability within Telerik UI for ASP.NET AJAX.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1218.011|Rundll32|

Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using rundll32.exe.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1218.010|Regsvr32|

Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using regsvr32.exe.(Citation: RedCanary Mockingbird May 2020)    |
|mitre-attack|enterprise-attack|Windows|T1569.002|Service Execution|

Blue Mockingbird has executed custom-compiled XMRIG miner DLLs by configuring them to execute via the "wercplsupport" service.(Citation: RedCanary Mockingbird May 2020)   |
BRONZE BUTLER - G0060

Created: 2018-01-16T16:13:52.465Z

Modified: 2021-10-12T19:42:16.869Z

Contributors: Trend Micro Incorporated

Aliases

BRONZE BUTLER,REDBALDKNIGHT,Tick

Description

BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.(Citation: Trend Micro Daserf Nov 2017)(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)

Techniques Used

BRONZE BUTLER has obtained and used open-source tools such as

Mimikatz,

gsecdump, and

Windows Credential Editor.(Citation: Symantec Tick Apr 2016)|
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|

BRONZE BUTLER has used legitimate applications to side-load malicious DLLs.(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1007|System Service Discovery|

BRONZE BUTLER has used TROJ_GETVERSION to discover system services.(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|

BRONZE BUTLER has incorporated code into several tools that attempts to terminate anti-virus processes.(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.003|Steganography|

BRONZE BUTLER has used steganography in multiple operations to conceal malicious payloads.(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518|Software Discovery|
BRONZE BUTLER has used tools to enumerate software installed on an infected host.(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036|Masquerading|

BRONZE BUTLER has masked executables with document file icons including Word and Adobe PDF.(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1059.006|Python|

BRONZE BUTLER has made use of Python-based remote access tools.(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1036.002|Right-to-Left Override|

BRONZE BUTLER has used Right-to-Left Override to deceive victims into executing several strains of malware.(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Windows,Office 365,SaaS,Linux,macOS|T1080|Taint Shared Content|

BRONZE BUTLER has placed malware on file shares and given it the same name as legitimate documents on the share.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

BRONZE BUTLER has used VBS and VBE scripts for execution.(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

BRONZE BUTLER has used

schtasks to register a scheduled task to execute malware during lateral movement.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

BRONZE BUTLER compromised three Japanese websites using a Flash exploit to perform watering hole attacks.(Citation: Symantec Tick Apr 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|
BRONZE BUTLER has attempted to get users to launch malicious Microsoft Word attachments delivered via spearphishing emails.(Citation: Symantec Tick Apr 2016)(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.(Citation: Symantec Tick Apr 2016)(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

BRONZE BUTLER used spearphishing emails with malicious Microsoft Word attachments to infect victims.(Citation: Symantec Tick Apr 2016)(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102.001|Dead Drop Resolver|

BRONZE BUTLER's MSGET downloader uses a dead drop resolver to access malicious payloads.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|The

BRONZE BUTLER uploader or malware the uploader uses

BRONZE BUTLER tools encode data with base64 when posting it to a C2 server.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Windows|T1550.003|Pass the Ticket|

BRONZE BUTLER has created forged Kerberos Ticket Granting Ticket (TGT) and Ticket Granting Service (TGS) tickets to maintain administrative access.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|
BRONZE BUTLER has used batch scripts and the command-line interface for execution.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

BRONZE BUTLER has given malware the same name as an existing file on the file share server to cause users to unwittingly launch and install the malware on additional systems.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1053.002|At|

BRONZE BUTLER has used

at to register a scheduled task to execute malware during lateral movement.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

BRONZE BUTLER has compressed data into password-protected RAR archives prior to exfiltration.(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Windows,Network|T1124|System Time Discovery|

BRONZE BUTLER has used

BRONZE BUTLER has used various tools to download files, including DGet (a similar tool to wget).(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Windows|T1548.002|Bypass User Account Control|

BRONZE BUTLER has used a Windows 10 specific tool and xxmm to bypass UAC for privilege escalation.(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

BRONZE BUTLER malware has used HTTP for C2.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|
BRONZE BUTLER has exfiltrated files stolen from local systems.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

BRONZE BUTLER has used PowerShell for execution.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1573.001|Symmetric Cryptography|

BRONZE BUTLER has used RC4 encryption (for Datper malware) and AES (for xxmm malware) to obfuscate HTTP traffic.

BRONZE BUTLER has also used a tool called RarStar that encodes data with a custom XOR algorithm when posting it to a C2 server.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.001|Binary Padding|

BRONZE BUTLER downloader code has included "0" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection.(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

BRONZE BUTLER has used various tools (such as Mimikatz and WCE) to perform credential dumping.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.002|Domain Account|

BRONZE BUTLER has used

BRONZE BUTLER typically use

Net to enumerate systems.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1113|Screen Capture|

BRONZE BUTLER has used a tool to capture screenshots.(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|
BRONZE BUTLER has collected a list of files from the victim and uploaded it to its C2 server, and then created a new list of specific files to steal.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

BRONZE BUTLER downloads encoded payloads and decodes them on the victim.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1039|Data from Network Shared Drive|

BRONZE BUTLER has exfiltrated files stolen from file shares.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

BRONZE BUTLER has used a batch script that adds a Registry Run key to establish malware persistence.(Citation: Secureworks BRONZE BUTLER Oct 2017)|