Cyb3rWard0g/ATTCKGroups huggingface dataset:
admin@338 - G0018

Created: 2017-05-31T21:31:53.579Z

Modified: 2020-03-18T19:54:59.120Z

Contributors: Tatsuya Daitoku, Cyber Defense Institute, Inc.

Aliases

admin@338

Description

admin@338 is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as PoisonIvy, as well as some non-public backdoors. (Citation: FireEye admin@338)

Techniques Used

admin@338 has sent emails with malicious Microsoft Office documents attached.(Citation: FireEye admin@338)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

admin@338 has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails.(Citation: FireEye admin@338)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

admin@338 has exploited client software vulnerabilities for execution, such as Microsoft Word CVE-2012-0158.(Citation: FireEye admin@338)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

admin@338 actors used the following command following exploitation of a machine with

LOWBALL malware to display network connections:

admin@338 actors used the following commands after exploiting a machine with

LOWBALL malware to obtain information about files and directories:

admin@338 actors used the following command after exploiting a machine with

LOWBALL malware to acquire information about local networks:

admin@338 actors used the following commands after exploiting a machine with

LOWBALL malware to obtain information about the OS:

admin@338 actors used the following command to rename one of their tools to a benign file name:

admin@338 actors used the following command following exploitation of a machine with

LOWBALL malware to obtain information about services:

admin@338 actors used the following commands following exploitation of a machine with

LOWBALL malware to enumerate user accounts:
admin@338 actors used the following command following exploitation of a machine with

LOWBALL malware to obtain information about services:

admin@338 actors used the following commands following exploitation of a machine with

LOWBALL malware to enumerate user accounts:

admin@338 actors used the following command following exploitation of a machine with

LOWBALL malware to list local groups:

LOWBALL malware,

admin@338 actors created a file containing a list of commands to be executed on the compromised computer.(Citation: FireEye admin@338)|
Ajax Security Team - G0130

Created: 2021-04-14T13:17:43.941Z

Modified: 2021-12-17T19:27:27.246Z

Contributors:

Aliases

Ajax Security Team,Operation Woolen-Goldfish,AjaxTM,Rocket Kitten,Flying Kitten,Operation Saffron Rose

Description

Ajax Security Team is a group that has been active since at least 2010 and believed to be operating out of Iran. By 2014 Ajax Security Team transitioned from website defacement operations to malware-based cyber espionage campaigns targeting the US defense industrial base and Iranian users of anti-censorship technologies.(Citation: FireEye Operation Saffron Rose 2013)

Techniques Used

Ajax Security Team has used FireMalv custom-developed malware, which collected passwords from the Firefox browser storage.(Citation: Check Point Rocket Kitten)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

Ajax Security Team has used CWoolger and MPK, custom-developed malware, which recorded all keystrokes on an infected system.(Citation: Check Point Rocket Kitten)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1566.003|Spearphishing via Service|

Ajax Security Team has used various social media channels to spearphish victims.(Citation: FireEye Operation Saffron Rose 2013)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Ajax Security Team has used personalized spearphishing attachments.(Citation: Check Point Rocket Kitten)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Ajax Security Team has used Wrapper/Gholee, custom-developed malware, which downloaded additional malware to the infected system.(Citation: Check Point Rocket Kitten)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Ajax Security Team has lured victims into executing malicious files.(Citation: FireEye Operation Saffron Rose 2013)|
ALLANITE - G1000

Created: 2017-05-31T21:31:57.307Z

Modified: 2022-05-24T19:26:10.721Z

Contributors: Dragos Threat Intelligence

Aliases

ALLANITE,Palmetto Fusion

Description

ALLANITE is a suspected Russian cyber espionage group, that has primarily targeted the electric utility sector within the United States and United Kingdom. The group's tactics and techniques are reportedly similar to Dragonfly, although ALLANITEs technical capabilities have not exhibited disruptive or destructive abilities. It has been suggested that the group maintains a presence in ICS for the purpose of gaining understanding of processes and to maintain persistence. (Citation: Dragos)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|ics-attack|Control Server,Data Historian,Engineering Workstation,Field Controller/RTU/PLC/IED,Human-Machine Interface,Input/Output Server,Safety Instrumented System/Protection Relay|T0859|Valid Accounts|ALLANITE utilized credentials collected through phishing and watering hole attacks. (Citation: Dragos)|
|mitre-attack|ics-attack|Engineering Workstation,Human-Machine Interface,Control Server,Data Historian|T0865|Spearphishing Attachment|ALLANITE utilized spear phishing to gain access into energy sector environments. (Citation: Jeff Jones May 2018)|
|mitre-attack|ics-attack|Human-Machine Interface|T0852|Screen Capture|ALLANITE has been identified to collect and distribute screenshots of ICS systems such as HMIs. (Citation: Dragos) (Citation: ICS-CERT October 2017)|
|mitre-attack|ics-attack|None|T0817|Drive-by Compromise|ALLANITE leverages watering hole attacks to gain access into electric utilities. (Citation: Eduard Kovacs May 2018)|
Andariel - G0138

Created: 2021-09-29T15:10:19.236Z

Modified: 2022-11-30T22:51:40.270Z

Contributors: Kyoung-ju Kwak (S2W)

Aliases

Andariel,Silent Chollima

Description

Andariel is a North Korean state-sponsored threat group that has been active since at least 2009. Andariel has primarily focused its operations--which have included destructive attacks--against South Korean government agencies, military organizations, and a variety of domestic companies; they have also conducted cyber financial operations against ATMs, banks, and cryptocurrency exchanges. Andariel's notable activity includes Operation Black Mine, Operation GoldenAxe, and Campaign Rifle.(Citation: FSI Andariel Campaign Rifle July 2017)(Citation: IssueMakersLab Andariel GoldenAxe May 2017)(Citation: AhnLab Andariel Subgroup of Lazarus June 2018)(Citation: TrendMicro New Andariel Tactics July 2018)(Citation: CrowdStrike Silent Chollima Adversary September 2021)

Andariel is considered a sub-set of Lazarus Group, and has been attributed to North Korea's Reconnaissance General Bureau.(Citation: Treasury North Korean Cyber Groups September 2019)

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

Techniques Used

Andariel has limited its watering hole attacks to specific IP address ranges.(Citation: AhnLab Andariel Subgroup of Lazarus June 2018)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

Andariel has used watering hole attacks, often with zero-day exploits, to gain initial access to victims within a specific IP range.(Citation: AhnLab Andariel Subgroup of Lazarus June 2018)(Citation: TrendMicro New Andariel Tactics July 2018)|
|mitre-attack|enterprise-attack|PRE|T1592.002|Software|
Andariel has inserted a malicious script within compromised websites to collect potential victim information such as browser type, system language, Flash Player version, and other data.(Citation: TrendMicro New Andariel Tactics July 2018)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

Andariel has used the

Andariel has attempted to lure victims into enabling malicious macros within email attachments.(Citation: AhnLab Andariel Subgroup of Lazarus June 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Andariel has used

Andariel has downloaded additional tools and malware onto compromised hosts.(Citation: AhnLab Andariel Subgroup of Lazarus June 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.003|Steganography|

Andariel has hidden malicious executables within PNG files.(Citation: MalwareBytes Lazarus-Andariel Conceals Code April 2021)(Citation: Kaspersky Andariel Ransomware June 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

Andariel has collected large numbers of files from compromised network systems for later extraction.(Citation: FSI Andariel Campaign Rifle July 2017)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Andariel has conducted spearphishing campaigns that included malicious Word or Excel attachments.(Citation: AhnLab Andariel Subgroup of Lazarus June 2018)(Citation: MalwareBytes Lazarus-Andariel Conceals Code April 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|
Andariel has exploited numerous ActiveX vulnerabilities, including zero-days.(Citation: FSI Andariel Campaign Rifle July 2017)(Citation: IssueMakersLab Andariel GoldenAxe May 2017)(Citation: TrendMicro New Andariel Tactics July 2018)|
|mitre-attack|enterprise-attack|PRE|T1588.001|Malware|

Andariel has used a variety of publicly-available remote access Trojans (RATs) for its operations.(Citation: FSI Andariel Campaign Rifle July 2017)|
Aoqin Dragon - G1007

Created: 2022-07-14T14:32:47.582Z

Modified: 2022-10-24T18:50:40.179Z

Contributors: Hiroki Nagahama, NEC Corporation,Pooja Natarajan, NEC Corporation India,Manikantan Srinivasan, NEC Corporation India

Aliases

Aoqin Dragon

Description

Aoqin Dragon is a suspected Chinese cyber espionage threat group that has been active since at least 2013. Aoqin Dragon has primarily targeted government, education, and telecommunication organizations in Australia, Cambodia, Hong Kong, Singapore, and Vietnam. Security researchers noted a potential association between Aoqin Dragon and UNC94, based on malware, infrastructure, and targets.(Citation: SentinelOne Aoqin Dragon June 2022)

Techniques Used

Aoqin Dragon has used a dropper that employs a worm infection strategy using a removable device to breach a secure network environment.(Citation: SentinelOne Aoqin Dragon June 2022)|
|mitre-attack|enterprise-attack|PRE|T1587.001|Malware|

Aoqin Dragon has used custom malware, including

Mongall and

Heyoka Backdoor, in their operations.(Citation: SentinelOne Aoqin Dragon June 2022)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

Aoqin Dragon obtained the Heyoka open source exfiltration tool and subsequently modified it for their operations.(Citation: SentinelOne Aoqin Dragon June 2022)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1027.002|Software Packing|

Aoqin Dragon has used the Themida packer to obfuscate malicious payloads.(Citation: SentinelOne Aoqin Dragon June 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1570|Lateral Tool Transfer|

Aoqin Dragon has spread malware in target networks by copying modules to folders masquerading as removable devices.(Citation: SentinelOne Aoqin Dragon June 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|
Aoqin Dragon has run scripts to identify file formats including Microsoft Word.(Citation: SentinelOne Aoqin Dragon June 2022)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

Aoqin Dragon has exploited CVE-2012-0158 and CVE-2010-3333 for execution against targeted systems.(Citation: SentinelOne Aoqin Dragon June 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Aoqin Dragon has used fake icons including antivirus and external drives to disguise malicious payloads.(Citation: SentinelOne Aoqin Dragon June 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Aoqin Dragon has lured victims into opening weaponized documents, fake external drives, and fake antivirus to execute malicious payloads.(Citation: SentinelOne Aoqin Dragon June 2022)|
APT-C-36 - G0099

Created: 2020-05-05T18:53:08.166Z

Modified: 2021-05-26T20:17:53.085Z

Contributors: Jose Luis Sánchez Martinez

Aliases

APT-C-36,Blind Eagle

Description

APT-C-36 is a suspected South America espionage group that has been active since at least 2018. The group mainly targets Colombian government institutions as well as important corporations in the financial sector, petroleum industry, and professional manufacturing.(Citation: QiAnXin APT-C-36 Feb2019)

Techniques Used

APT-C-36 obtained and used a modified variant of

Imminent Monitor.(Citation: QiAnXin APT-C-36 Feb2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

APT-C-36 has downloaded binary data from a specified domain after the malicious document is opened.(Citation: QiAnXin APT-C-36 Feb2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.(Citation: QiAnXin APT-C-36 Feb2019)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

APT-C-36 has disguised its scheduled tasks as those used by Google.(Citation: QiAnXin APT-C-36 Feb2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1571|Non-Standard Port|

APT-C-36 has used port 4050 for C2 communications.(Citation: QiAnXin APT-C-36 Feb2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|
APT-C-36 has prompted victims to accept macros in order to execute the subsequent payload.(Citation: QiAnXin APT-C-36 Feb2019)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google.(Citation: QiAnXin APT-C-36 Feb2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

APT-C-36 has used ConfuserEx to obfuscate its variant of

Imminent Monitor, compressed payload and RAT packages, and password protected encrypted email attachments to avoid detection.(Citation: QiAnXin APT-C-36 Feb2019)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

APT-C-36 has used spearphishing emails with password protected RAR attachment to avoid being detected by the email gateway.(Citation: QiAnXin APT-C-36 Feb2019) |
APT1 - G0006

Created: 2017-05-31T21:31:47.955Z

Modified: 2021-05-26T12:23:48.842Z

Contributors:

Aliases

APT1,Comment Crew,Comment Group,Comment Panda

Description

APT1 is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398. (Citation: Mandiant APT1)

Techniques Used

APT1 has used various open-source tools for privilege escalation purposes.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|PRE|T1588.001|Malware|

APT1 used publicly available malware for privilege escalation.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|PRE|T1585.002|Email Accounts|

APT1 has created email accounts for later use in social engineering, phishing, and when registering domains.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

APT1 has sent spearphishing emails containing malicious attachments.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

APT1 has sent spearphishing emails containing hyperlinks to malicious files.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|PRE|T1584.001|Domains|

APT1 hijacked FQDNs associated with legitimate websites hosted by hop points.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

APT1 has registered hundreds of domains for use in operations.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|Office 365,Windows,Google Workspace|T1114.002|Remote Email Collection|
APT1 uses two utilities, GETMAIL and MAPIGET, to steal email. MAPIGET steals email still on Exchange servers that has not yet been archived.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

APT1 gathered a list of running processes on the system using

APT1 listed connected network shares.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

APT1 used the

APT1 used a batch script to perform a series of discovery techniques and saves it to a text file.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.001|Local Account|

APT1 used the commands

APT1 used the

APT1 used the commands

APT1 has collected files from a local victim.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

APT1 has used RAR to compress files before moving them outside of the victim network.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

APT1 has been known to use credential dumping using

Mimikatz.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|The file name AcroRD32.exe, a legitimate process name for Adobe's Acrobat Reader, was used by

APT1 as a name for malware.(Citation: Mandiant APT1)(Citation: Mandiant APT1 Appendix)|
|mitre-attack|enterprise-attack|Windows|T1114.001|Local Email Collection|
APT1 as a name for malware.(Citation: Mandiant APT1)(Citation: Mandiant APT1 Appendix)|
|mitre-attack|enterprise-attack|Windows|T1114.001|Local Email Collection|

APT1 uses two utilities, GETMAIL and MAPIGET, to steal email. GETMAIL extracts emails from archived Outlook .pst files.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|The

APT1 group is known to have used RDP during operations.(Citation: FireEye PLA)|
|mitre-attack|enterprise-attack|Windows|T1550.002|Pass the Hash|The

APT1 group is known to have used pass the hash.(Citation: Mandiant APT1)|
APT12 - G0005

Created: 2017-05-31T21:31:47.537Z

Modified: 2020-03-30T18:44:59.268Z

Contributors:

Aliases

APT12,IXESHE,DynCalc,Numbered Panda,DNSCALC

Description

APT12 is a threat group that has been attributed to China. The group has targeted a variety of victims including but not limited to media outlets, high-tech companies, and multiple governments.(Citation: Meyers Numbered Panda)

Techniques Used

APT12 has used multiple variants of

DNS Calculation including multiplying the first two octets of an IP address and adding the third octet to that value in order to get a resulting command and control port.(Citation: Meyers Numbered Panda)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102.002|Bidirectional Communication|

APT12 has used blogs and WordPress for C2 infrastructure.(Citation: Meyers Numbered Panda)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

APT12 has sent emails with malicious Microsoft Office documents and PDFs attached.(Citation: Moran 2014)(Citation: Trend Micro IXESHE 2012)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

APT12 has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities (CVE-2009-3129, CVE-2012-0158) and vulnerabilities in Adobe Reader and Flash (CVE-2009-4324, CVE-2009-0927, CVE-2011-0609, CVE-2011-0611).(Citation: Moran 2014)(Citation: Trend Micro IXESHE 2012)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

APT12 has attempted to get victims to open malicious Microsoft Word and PDF attachment sent via spearphishing.(Citation: Moran 2014)(Citation: Trend Micro IXESHE 2012)|
APT16 - G0023

Created: 2017-05-31T21:31:56.270Z

Modified: 2022-07-26T23:33:26.354Z

Contributors:

Aliases

APT16

Description

APT16 is a China-based threat group that has launched spearphishing campaigns targeting Japanese and Taiwanese organizations. (Citation: FireEye EPS Awakens Part 2)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|PRE|T1584.004|Server|APT16 has compromised otherwise legitimate sites as staging servers for second-stage payloads.(Citation: FireEye EPS Awakens Part 2)|
APT17 - G0025

Created: 2017-05-31T21:31:57.307Z

Modified: 2020-10-13T22:33:14.018Z

Contributors:

Aliases

APT17,Deputy Dog

Description

APT17 is a China-based threat group that has conducted network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and non-government organizations. (Citation: FireEye APT17)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|PRE|T1585|Establish Accounts|APT17 has created and cultivated profile pages in Microsoft TechNet. To make profile pages appear more legitimate, APT17 has created biographical sections and posted in forum threads.(Citation: FireEye APT17)|
|mitre-attack|enterprise-attack|PRE|T1583.006|Web Services|APT17 has created profile pages in Microsoft TechNet that were used as C2 infrastructure.(Citation: FireEye APT17)|
APT18 - G0026

Created: 2017-05-31T21:31:57.733Z

Modified: 2020-03-30T18:46:16.853Z

Contributors:

Aliases

APT18,TG-0416,Dynamite Panda,Threat Group-0416

Description

APT18 is a threat group that has operated since at least 2009 and has targeted a range of industries, including technology, manufacturing, human rights groups, government, and medical. (Citation: Dell Lateral Movement)

Techniques Used

APT18 uses DNS for C2 communications.(Citation: PaloAlto DNS Requests May 2016)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

APT18 establishes persistence via the

APT18 obfuscates strings in the payload.(Citation: PaloAlto DNS Requests May 2016)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

APT18 uses cmd.exe to execute commands on the victim’s machine.(Citation: PaloAlto DNS Requests May 2016)(Citation: Anomali Evasive Maneuvers July 2015)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

APT18 can upload a file to the victim’s machine.(Citation: PaloAlto DNS Requests May 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

APT18 can list files information for specific directories.(Citation: PaloAlto DNS Requests May 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

APT18 uses HTTP for C2 communications.(Citation: PaloAlto DNS Requests May 2016)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|