Cyb3rWard0g/ATTCKGroups huggingface dataset:
Patchwork collected the victim username and whether it was running as admin, then sent the information to its C2 server.(Citation: Cymmetria Patchwork)(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|

Patchwork attempted to use RDP to move laterally.(Citation: Cymmetria Patchwork)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Patchwork has added the path of its second-stage malware to the startup folder to achieve persistence. One of its file stealers has also persisted by adding a Registry Run key.(Citation: Cymmetria Patchwork)(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518.001|Security Software Discovery|

Patchwork scanned the “Program Files” directories for a directory with the string “Total Security” (the installation path of the “360 Total Security” antivirus tool).(Citation: Cymmetria Patchwork)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Patchwork collected the victim computer name, OS version, and architecture type and sent the information to its C2 server.

Patchwork also enumerated all available drives on the victim's machine.(Citation: Cymmetria Patchwork)(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Patchwork installed its payload in the startup programs folder as "Baidu Software Update." The group also adds its second stage payload to the startup programs as “Net Monitor."(Citation: Cymmetria Patchwork) They have also dropped

QuasarRAT binaries as files named microsoft_network.exe and crome.exe.(Citation: Volexity Patchwork June 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|
Patchwork dumped the login data database from

Patchwork used Base64 to encode C2 traffic.(Citation: Cymmetria Patchwork)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Patchwork ran a reverse shell with Meterpreter.(Citation: Cymmetria Patchwork)

Patchwork used JavaScript code and .SCT files on victim machines.(Citation: TrendMicro Patchwork Dec 2017)(Citation: Volexity Patchwork June 2018)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Patchwork used

PowerSploit to download payloads, run a reverse shell, and execute malware on the victim's machine.(Citation: Cymmetria Patchwork)(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Windows|T1548.002|Bypass User Account Control|

Patchwork bypassed User Access Control (UAC).(Citation: Cymmetria Patchwork)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

Patchwork collected and exfiltrated files from the infected system.(Citation: Cymmetria Patchwork)|
PittyTiger - G0011

Created: 2017-05-31T21:31:50.198Z

Modified: 2021-10-12T23:11:41.368Z

Contributors:

Aliases

PittyTiger

Description

PittyTiger is a threat group believed to operate out of China that uses multiple different types of malware to maintain command and control.(Citation: Bizeul 2014)(Citation: Villeneuve 2014)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|PittyTiger has obtained and used tools such as Mimikatz and gsecdump.(Citation: Bizeul 2014)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|PittyTiger attempts to obtain legitimate credentials during operations.(Citation: Bizeul 2014)|
PLATINUM - G0068

Created: 2018-04-18T17:59:24.739Z

Modified: 2021-04-22T00:39:49.529Z

Contributors: Ryan Becwar

Aliases

PLATINUM

Description

PLATINUM is an activity group that has targeted victims since at least 2009. The group has focused on targets associated with governments and related organizations in South and Southeast Asia. (Citation: Microsoft PLATINUM April 2016)

Techniques Used

PLATINUM has renamed rar.exe to avoid detection.(Citation: Twitter ItsReallyNick Platinum Masquerade)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

PLATINUM has transferred files using the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel.(Citation: Microsoft PLATINUM June 2017)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

PLATINUM has used several different keyloggers.(Citation: Microsoft PLATINUM April 2016)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

PLATINUM has sometimes used drive-by attacks against vulnerable browser plugins.(Citation: Microsoft PLATINUM April 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1055|Process Injection|

PLATINUM has used various methods of process injection including hot patching.(Citation: Microsoft PLATINUM April 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1068|Exploitation for Privilege Escalation|

PLATINUM has leveraged a zero-day vulnerability to escalate privileges.(Citation: Microsoft PLATINUM April 2016)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|
PLATINUM has used keyloggers that are also capable of dumping credentials.(Citation: Microsoft PLATINUM April 2016)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

PLATINUM has sent spearphishing emails with attachments to victims as its primary initial access vector.(Citation: Microsoft PLATINUM April 2016)|
|mitre-attack|enterprise-attack|Windows|T1056.004|Credential API Hooking|

PLATINUM is capable of using Windows hook interfaces for information gathering such as credential access.(Citation: Microsoft PLATINUM April 2016)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,Network|T1095|Non-Application Layer Protocol|

PLATINUM has used the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel for command and control.(Citation: Microsoft PLATINUM June 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

PLATINUM has attempted to get users to open malicious files by sending spearphishing emails with attachments to victims.(Citation: Microsoft PLATINUM April 2016)|
POLONIUM - G1005

Created: 2022-07-01T19:07:04.253Z

Modified: 2022-08-10T12:31:10.192Z

Contributors:

Aliases

POLONIUM

Description

POLONIUM is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information technology, and defense industry companies, since at least February 2022. Security researchers assess POLONIUM has coordinated their operations with multiple actors affiliated with Iran’s Ministry of Intelligence and Security (MOIS), based on victim overlap as well as common techniques and tooling.(Citation: Microsoft POLONIUM June 2022)

Techniques Used

POLONIUM has exfiltrated stolen data to

POLONIUM-owned OneDrive and Dropbox accounts.(Citation: Microsoft POLONIUM June 2022) |
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

POLONIUM has obtained and used tools such as AirVPN and plink in their operations.(Citation: Microsoft POLONIUM June 2022) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102.002|Bidirectional Communication|

POLONIUM has used OneDrive and DropBox for C2.(Citation: Microsoft POLONIUM June 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090|Proxy|

POLONIUM has used the AirVPN service for operational activity.(Citation: Microsoft POLONIUM June 2022)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

POLONIUM has used valid compromised credentials to gain access to victim environments.(Citation: Microsoft POLONIUM June 2022)|
|mitre-attack|enterprise-attack|Windows,SaaS,IaaS,Linux,macOS,Office 365|T1199|Trusted Relationship|
POLONIUM has used compromised credentials from an IT company to target downstream customers including a law firm and aviation company.(Citation: Microsoft POLONIUM June 2022)|
|mitre-attack|enterprise-attack|PRE|T1583.006|Web Services|

POLONIUM has created and used legitimate Microsoft OneDrive accounts for their operations.(Citation: Microsoft POLONIUM June 2022)|
Poseidon Group - G0033

Created: 2017-05-31T21:32:04.179Z

Modified: 2020-03-18T20:25:54.945Z

Contributors:

Aliases

Poseidon Group

Description

Poseidon Group is a Portuguese-speaking threat group that has been active since at least 2005. The group has a history of using information exfiltrated from victims to blackmail victim companies into contracting the Poseidon Group as a security firm. (Citation: Kaspersky Poseidon Group)

Techniques Used

Poseidon Group searches for administrator accounts on both the local victim machine and the network.(Citation: Kaspersky Poseidon Group)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1003|OS Credential Dumping|

Poseidon Group conducts credential dumping on victims, with a focus on obtaining credentials belonging to domain and database servers.(Citation: Kaspersky Poseidon Group)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.002|Domain Account|

Poseidon Group searches for administrator accounts on both the local victim machine and the network.(Citation: Kaspersky Poseidon Group)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|The

Poseidon Group's Information Gathering Tool (IGT) includes PowerShell components.(Citation: Kaspersky Poseidon Group)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Poseidon Group tools attempt to spoof anti-virus processes as a means of self-defense.(Citation: Kaspersky Poseidon Group)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|After compromising a victim,

Poseidon Group lists all running processes.(Citation: Kaspersky Poseidon Group)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|
Poseidon Group lists all running processes.(Citation: Kaspersky Poseidon Group)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

Poseidon Group obtains and saves information about victim network interfaces and addresses.(Citation: Kaspersky Poseidon Group)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1007|System Service Discovery|After compromising a victim,

Poseidon Group discovers all running services.(Citation: Kaspersky Poseidon Group)|
PROMETHIUM - G0056

Created: 2018-01-16T16:13:52.465Z

Modified: 2020-10-22T18:12:48.893Z

Contributors:

Aliases

PROMETHIUM,StrongPity

Description

PROMETHIUM is an activity group focused on espionage that has been active since at least 2012. The group has conducted operations globally with a heavy emphasis on Turkish targets. PROMETHIUM has demonstrated similarity to another activity group called NEODYMIUM due to overlapping victim and campaign characteristics.(Citation: Microsoft NEODYMIUM Dec 2016)(Citation: Microsoft SIR Vol 21)(Citation: Talos Promethium June 2020)

Techniques Used

PROMETHIUM has created self-signed certificates to sign malicious installers.(Citation: Bitdefender StrongPity June 2020)|
|mitre-attack|enterprise-attack|PRE|T1587.003|Digital Certificates|

PROMETHIUM has created self-signed digital certificates for use in HTTPS C2 traffic.(Citation: Talos Promethium June 2020)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|

PROMETHIUM has created new services and modified existing services for persistence.(Citation: Bitdefender StrongPity June 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

PROMETHIUM has named services to appear legitimate.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1078.003|Local Accounts|

PROMETHIUM has created admin accounts on a compromised host.(Citation: Bitdefender StrongPity June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1205.001|Port Knocking|
PROMETHIUM has used a script that configures the knockd service and firewall to only accept C2 connections from systems that use a specified sequence of knock ports.(Citation: Bitdefender StrongPity June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

PROMETHIUM has attempted to get users to execute compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

PROMETHIUM has disguised malicious installer files by bundling them with legitimate software installers.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|

PROMETHIUM has signed code with self-signed certificates.(Citation: Bitdefender StrongPity June 2020)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

PROMETHIUM has used Registry run keys to establish persistence.(Citation: Talos Promethium June 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

PROMETHIUM has used watering hole attacks to deliver malicious versions of legitimate installers.(Citation: Bitdefender StrongPity June 2020)|
Putter Panda - G0024

Created: 2017-05-31T21:31:56.785Z

Modified: 2020-03-30T19:15:04.771Z

Contributors:

Aliases

Putter Panda,APT2,MSUpdater

Description

Putter Panda is a Chinese threat group that has been attributed to Unit 61486 of the 12th Bureau of the PLA’s 3rd General Staff Department (GSD). (Citation: CrowdStrike Putter Panda)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|Malware used by Putter Panda attempts to terminate processes corresponding to two components of Sophos Anti-Virus (SAVAdminService.exe and SavService.exe).(Citation: CrowdStrike Putter Panda)|
|mitre-attack|enterprise-attack|Windows|T1055.001|Dynamic-link Library Injection|An executable dropped onto victims by Putter Panda aims to inject the specified DLL into a process that would normally be accessing the network, including Outlook Express (msinm.exe), Outlook (outlook.exe), Internet Explorer (iexplore.exe), and Firefox (firefox.exe).(Citation: CrowdStrike Putter Panda)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|A dropper used by Putter Panda installs itself into the ASEP Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run with a value named McUpdate.(Citation: CrowdStrike Putter Panda)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|Droppers used by Putter Panda use RC4 or a 16-byte XOR key consisting of the bytes 0xA0 – 0xAF to obfuscate payloads.(Citation: CrowdStrike Putter Panda)|
Rancor - G0075

Created: 2018-10-17T00:14:20.652Z

Modified: 2020-03-30T19:15:49.217Z

Contributors:

Aliases

Rancor

Description

Rancor is a threat group that has led targeted campaigns against the South East Asia region. Rancor uses politically-motivated lures to entice victims to open malicious documents. (Citation: Rancor Unit42 June 2018)

Techniques Used

Rancor has used VBS scripts as well as embedded macros for execution.(Citation: Rancor Unit42 June 2018)|
|mitre-attack|enterprise-attack|Windows|T1218.007|Msiexec|

Rancor has used

Rancor has used HTTP for C2.(Citation: Rancor Unit42 June 2018)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Rancor has used cmd.exe to execute commmands.(Citation: Rancor Unit42 June 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Rancor has downloaded additional malware, including by using

certutil.(Citation: Rancor Unit42 June 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Rancor attempted to get users to click on an embedded macro within a Microsoft Office Excel document to launch their malware.(Citation: Rancor Unit42 June 2018)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Rancor has attached a malicious document to an email to gain initial access.(Citation: Rancor Unit42 June 2018)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

Rancor launched a scheduled task to gain persistence using the
Rocke - G0106

Created: 2020-05-26T14:20:20.623Z

Modified: 2020-06-19T20:41:21.215Z

Contributors:

Aliases

Rocke

Description

Rocke is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name Rocke comes from the email address "rocke@live.cn" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between Rocke and the Iron Cybercrime Group, though this attribution has not been confirmed.(Citation: Talos Rocke August 2018)

Techniques Used

Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071|Application Layer Protocol|

Rocke issued wget requests from infected systems to the C2.(Citation: Talos Rocke August 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102|Web Service|

Rocke has used Pastebin, Gitee, and GitLab for Command and Control.(Citation: Anomali Rocke March 2019)(Citation: Talos Rocke August 2018)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

Rocke has extracted tar.gz files after downloading them from a C2 server.(Citation: Talos Rocke August 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Rocke has used shell scripts which download mining executables and saves them with the filename "java".(Citation: Talos Rocke August 2018)|
|mitre-attack|enterprise-attack|Linux,macOS|T1574.006|Dynamic Linker Hijacking|
Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.(Citation: Anomali Rocke March 2019)   |
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1059.006|Python|

Rocke has used Python-based malware to install and spread their coinminer.(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Rocke has modified UPX headers after packing files to break unpackers.(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.004|Compile After Delivery|

Rocke has compiled malware, delivered to victims as .c files, with the GNU Compiler Collection (GCC).(Citation: Anomali Rocke March 2019) |
|mitre-attack|enterprise-attack|Linux,macOS|T1021.004|SSH|

Rocke has spread its coinminer via SSH.(Citation: Anomali Rocke March 2019)  |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1552.004|Private Keys|

Rocke has used SSH private keys on the infected machine to spread its coinminer throughout a network.(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Rocke has used uname -m to collect the name and information about the infected system's kernel.(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS|T1070.002|Clear Linux or Mac System Logs|

Rocke has cleared log files within the /var/log/ folder.(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers|T1496|Resource Hijacking|
Rocke has distributed cryptomining malware.(Citation: Talos Rocke August 2018)(Citation: Unit 42 Rocke January 2019)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

Rocke exploited Apache Struts, Oracle WebLogic (CVE-2017-10271), and Adobe ColdFusion (CVE-2017-3066) vulnerabilities to deliver malware.(Citation: Talos Rocke August 2018)(Citation: Unit 42 Rocke January 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Rocke used malware to download additional malicious files to the target system.(Citation: Talos Rocke August 2018) |
|mitre-attack|enterprise-attack|macOS,Linux|T1059.004|Unix Shell|

Rocke used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining malware.(Citation: Talos Rocke August 2018) |
|mitre-attack|enterprise-attack|Linux,macOS|T1053.003|Cron|

Rocke installed a cron job that downloaded and executed files from the C2.(Citation: Talos Rocke August 2018)(Citation: Unit 42 Rocke January 2019)(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Rocke has executed wget and curl commands to Pastebin over the HTTPS protocol.(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

Rocke conducted scanning for exposed TCP port 7001 as well as SSH and Redis servers.(Citation: Talos Rocke August 2018)(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1562.004|Disable or Modify System Firewall|
Rocke used scripts which killed processes and added firewall rules to block traffic related to other cryptominers.(Citation: Talos Rocke August 2018)  |
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518.001|Security Software Discovery|

Rocke used scripts which detected and uninstalled antivirus software.(Citation: Talos Rocke August 2018)(Citation: Unit 42 Rocke January 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|

Rocke used scripts which detected and uninstalled antivirus software.(Citation: Talos Rocke August 2018)(Citation: Unit 42 Rocke January 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1564.001|Hidden Files and Directories|

Rocke downloaded a file "libprocesshider", which could hide files on the target system.(Citation: Talos Rocke August 2018)(Citation: Unit 42 Rocke January 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

Rocke has looked for IP addresses in the known_hosts file on the infected system and attempted to SSH into them.(Citation: Talos Rocke August 2018)  |
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.(Citation: Talos Rocke August 2018)   |
|mitre-attack|enterprise-attack|Windows|T1055.002|Portable Executable Injection|

Rocke's miner, "TermsHost.exe", evaded defenses by injecting itself into Windows processes, including Notepad.exe.(Citation: Talos Rocke August 2018)  |
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1027.002|Software Packing|