HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Technique: T1087: Account Discovery
Kimsuky has exfiltrated data over its email C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
Unknown Logger is capable of downloading remote files.
Technique: T1105: Ingress Tool Transfer
BlackMould can enumerate local drives on a compromised host.
Technique: T1082: System Information Discovery
FLASHFLOOD searches for interesting files  on the local system.
Technique: T1005: Data from Local System
Capabilities can also be staged on web services, such as GitHub or Pastebin.
Technique: T1608: Stage Capabilities
QakBot has gained execution through users opening malicious links.
Technique: T1204: User Execution
adbupd can use a WMI script to achieve persistence.
Technique: T1546: Event Triggered Execution
OSX/Shlayer can use the chmod utility to set a file as executable, such as chmod 777 or chmod +x.
Technique: T1222: File and Directory Permissions Modification
Metamorfo has used HTTP for C2.
Technique: T1071: Application Layer Protocol
When used with frequently used network directories, the technique may result in frequent reinfections and broad access to systems and potentially to new and higher privileged accounts.
Technique: T1080: Taint Shared Content
Carbanak stores a configuration files in the startup directory to automatically execute commands in order to persist across reboots.
Technique: T1547: Boot or Logon Autostart Execution
It also added additional permissions  to compromised Application or Service Principals.
Technique: T1098: Account Manipulation
Figure 4: Embedded URL in OLE object    Figure 5: HTTP GET request to download the next level payload The downloaded file, doc.doc, is XML-based and contains a PowerShell command (shown in Figure 6) that subsequently downloads the binary Pause.ps1
Technique: T1105: Ingress Tool Transfer
Information about hosts may include a variety of details, including administrative data  as well as specifics regarding its configuration .
Technique: T1592: Gather Victim Host Information
RDAT can use HTTP communications for C2, as well as using the WinHTTP library to make requests to the Exchange Web Services API.
Technique: T1071: Application Layer Protocol
MechaFlounder has the ability to use base16 encoded strings in C2.
Technique: T1132: Data Encoding
DarkComet can listen in to victims' conversations through the system’s microphone.
Technique: T1123: Audio Capture
BRONZE BUTLER's MSGET downloader uses a dead drop resolver to access malicious payloads.
Technique: T1102: Web Service
Adversaries may use the information from System Network Configuration Discovery during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.
Technique: T1016: System Network Configuration Discovery
Adversaries may purchase domains that can be used during targeting.
Technique: T1583: Acquire Infrastructure
InvisiMole has a command to disable routing and the Firewall on the victim’s machine.
Technique: T1562: Impair Defenses
FIN7 created new Windows services and added them to the startup directories for persistence.
Technique: T1543: Create or Modify System Process
SUPERNOVA had to receive an HTTP GET request containing a specific set of parameters in order to execute.
Technique: T1071: Application Layer Protocol
China Chopper's server component is a Web Shell payload.
Technique: T1505: Server Software Component
InvisiMole can place a lnk file in the Startup Folder to achieve persistence.
Technique: T1547: Boot or Logon Autostart Execution
HiddenWasp encrypts its configuration and payload.
Technique: T1027: Obfuscated Files or Information
PLATINUM has renamed rar.exe to avoid detection.
Technique: T1036: Masquerading
Mustang Panda has installed TeamViewer on targeted systems.
Technique: T1219: Remote Access Software
POWRUNER is written in PowerShell.
Technique: T1059: Command and Scripting Interpreter
PowerShell File Analysis The PowerShell script employs several layers of obfuscation to hide its actual functionality
Technique: T1546: Event Triggered Execution
APT33 has used a publicly available exploit for CVE-2017-0213 to escalate privileges on a local system.
Technique: T1068: Exploitation for Privilege Escalation
Turla has used the VPS infrastructure of compromised Iranian threat actors.
Technique: T1584: Compromise Infrastructure
Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups.
Technique: T1098: Account Manipulation
The MBR is the section of disk that is first loaded after completing hardware initialization by the BIOS.
Technique: T1542: Pre-OS Boot
GreyEnergy modifies conditions in the Registry and adds keys.
Technique: T1112: Modify Registry
GALLIUM exploited a publicly-facing servers including Wildfly/JBoss servers to gain access to the network.
Technique: T1190: Exploit Public-Facing Application
Adversaries may abuse various implementations of JavaScript to execute various behaviors.
Technique: T1059: Command and Scripting Interpreter
ObliqueRAT can capture images from webcams on compromised hosts.
Technique: T1125: Video Capture
Adversaries may modify the configuration settings of a domain to evade defenses and/or escalate privileges in domain environments.
Technique: T1484: Domain Policy Modification
HAFNIUM has created and granted privileges to domain accounts.
Technique: T1136: Create Account
Leveraging Existing Windows Services to Deliver Malware Windows Management Instrumentation Console (WMIC) provides a command line interface to WMI
Technique: T1047: Windows Management Instrumentation
Since it is a very long term group, some victims may be impossible to identify now
Technique: T1083: File and Directory Discovery
This version of the campaign made malicious use of unins000.exe, a process that belongs to the Brazilian information security company GAS Tecnologia, to gather personal information undetected
Technique: T1082: System Information Discovery
SynAck encrypts the victims machine followed by asking the victim to pay a ransom.
Technique: T1486: Data Encrypted for Impact
The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary.
Technique: T1565: Data Manipulation
The Windows Registry stores configuration information that can be used by the system or other programs.
Technique: T1552: Unsecured Credentials
APT32 has sent spearphishing emails with a malicious executable disguised as a document or spreadsheet.
Technique: T1566: Phishing
NETWIRE has masqueraded as legitimate software including TeamViewer and macOS Finder.
Technique: T1036: Masquerading
This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as Remote Services, SMB/Windows Admin Shares, or Windows Remote Management.
Technique: T1134: Access Token Manipulation
Nomadic Octopus used cmd.exe /c within a malicious macro.
Technique: T1059: Command and Scripting Interpreter
xCaon has a command to start an interactive shell.
Technique: T1059: Command and Scripting Interpreter
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
Technique: T1202: Indirect Command Execution
ADVSTORESHELL can perform keylogging.
Technique: T1056: Input Capture
Attack Overview The attack starts with Microsoft Word documents containing a malicious VBA macro being attached to spear phishing emails
Technique: T1566: Phishing
Conti can spread itself by infecting other remote machines via network shared drives.
Technique: T1080: Taint Shared Content
When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.
Technique: T1546: Event Triggered Execution
BabyShark has used mshta.exe to download and execute applications from a remote server.
Technique: T1218: Signed Binary Proxy Execution
Types of attacks possibly averted include Structured Query Language (SQL) injection, cross-site scripting, and command injection.Use stringent file reputation settings – Tune the file reputation systems of your anti-virus software to the most aggressive setting possible
Technique: T1518: Software Discovery
SNUGRIDE communicates with its C2 server over HTTP.
Technique: T1071: Application Layer Protocol
Adversaries may use scripts signed with trusted certificates to proxy execution of malicious files.
Technique: T1216: Signed Script Proxy Execution
Adversaries may find vulnerability information by searching open databases or gaining access to closed vulnerability databases.
Technique: T1588: Obtain Capabilities
GoldenSpy has gathered operating system information.
Technique: T1082: System Information Discovery
ShadowPad has used DNS tunneling for C2 communications.
Technique: T1071: Application Layer Protocol
Some Backdoor.Oldrea samples contain a publicly available Web browser password recovery tool.
Technique: T1555: Credentials from Password Stores
Darkhotel's selective infector modifies executables stored on removable media as a method of spreading across computers.
Technique: T1091: Replication Through Removable Media
Anchor can determine the hostname and linux version on a compromised host.
Technique: T1082: System Information Discovery
Agent Tesla can list the current running processes on the system.
Technique: T1057: Process Discovery
Kazuar gathers information on users.
Technique: T1033: System Owner/User Discovery
Tropic Trooper sent spearphishing emails that contained malicious Microsoft Office and fake installer file attachments.
Technique: T1566: Phishing
BADNEWS copies files with certain extensions from USB devices to
a predefined directory.
Technique: T1025: Data from Removable Media
TrickBot searches the system for all of the following file extensions: .avi, .mov, .mkv, .mpeg, .mpeg4, .mp4, .mp3, .wav, .ogg, .jpeg, .jpg, .png, .bmp, .gif, .tiff, .ico, .xlsx, and .zip.
Technique: T1083: File and Directory Discovery
Umbreon provides access using both standard facilities like SSH and additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet PowerDuke runs cmd.exe /c and sends the output to its C2.
Technique: T1059: Command and Scripting Interpreter
WannaCry uses vssadmin, wbadmin, bcdedit, and wmic to delete and disable operating system recovery features.
Technique: T1490: Inhibit System Recovery
Sensitive data can be collected from any removable media  connected to the compromised system prior to Exfiltration.
Technique: T1025: Data from Removable Media
jRAT can list and manage startup entries.
Technique: T1037: Boot or Logon Initialization Scripts
Machete has used AES to exfiltrate documents.
Technique: T1573: Encrypted Channel
Taidoor can query the Registry on compromised hosts using RegQueryValueExA.
Technique: T1012: Query Registry
JPIN can obtain system information such as OS version and disk space.
Technique: T1082: System Information Discovery
Magic Hound malware can use a SOAP Web service to communicate with its C2 server.
Technique: T1102: Web Service
After decompiling it from the PE file, it is heavily obfuscated and still almost unreadable.We deobfuscated the script to understand how the infection process works
Technique: T1027: Obfuscated Files or Information
JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the Component Object Model and Internet Explorer HTML Application  pages.
Technique: T1059: Command and Scripting Interpreter
By leveraging Patch System Image, adversaries can add custom code to the affected network devices that will implement onion routing between those nodes.
Technique: T1090: Proxy
Exaramel for Linux uses HTTPS for C2 communications.
Technique: T1071: Application Layer Protocol
However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level.
Technique: T1134: Access Token Manipulation
Revenge RAT has a plugin for keylogging.
Technique: T1056: Input Capture
An adversary may enumerate resources using a compromised user's access keys to determine which are available to that user.
Technique: T1580: Cloud Infrastructure Discovery
Rising Sun decrypted itself using a single-byte XOR scheme.
Technique: T1140: Deobfuscate/Decode Files or Information
APT38 has prepended a space to all of their terminal commands to operate without leaving traces in the HISTCONTROL environment.
Technique: T1562: Impair Defenses
Techniques for name service resolution poisoning, such as LLMNR/NBT-NS Poisoning and SMB Relay, can also be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary.
Technique: T1040: Network Sniffing
Cobalt Strike can use VBA to perform execution.
Technique: T1059: Command and Scripting Interpreter
BackConfig has the ability to use HTTPS for C2 communiations.
Technique: T1071: Application Layer Protocol
tfvn[.]com[.]vnshirkeswitch[.]netguideofgeorgia[.]orggulfclouds[.]sitejhssourcingltd[.]comkamagra4uk[.]compioneerfitting[.]compositronicsindia[.]comscseguros[.]ptspldernet[.]comtoshioco[.]comwww[.]happytohelpyou[.]inIP addressesThe following IP addresses have been observed to be associated with malware campaigns.112.213.89[.]4067.23.254[.]6162.212.33[.]98153.92.5[.]124185.117.22[.]19723.94.188[.]24667.23.254[.]17072.52.150[.]218148.66.136[.]62107.180.24[.]253108.179.246[.]13818.221.35[.]21494.46.15[.]20066.23.237[.]18672.52.150[.]218URLs:The following URLs have been observed to be associated with malware campaigns.https[:]//a[.]pomf[.]cat/http[:]//pomf[.]cat/upload[.]php
Technique: T1071: Application Layer Protocol
TA459 has targeted victims using spearphishing emails with malicious Microsoft Word attachments.
Technique: T1566: Phishing
TYPEFRAME has used a malicious Word document for delivery with VBA macros for execution.
Technique: T1059: Command and Scripting Interpreter
Cobalt Strike will timestomp any files or payloads placed on a target machine to help them blend in.
Technique: T1070: Indicator Removal on Host
Net Crawler uses Windows admin shares to establish authenticated sessions to remote systems over SMB as part of lateral movement.
Technique: T1021: Remote Services
Daserf uses custom base64 encoding to obfuscate HTTP traffic.
Technique: T1132: Data Encoding
Ajax Security Team has used personalized spearphishing attachments.
Technique: T1566: Phishing
Adversaries may gather information about the victim's identity that can be used during targeting.
Technique: T1589: Gather Victim Identity Information
BackConfig has the ability to set folders or files to be hidden from the Windows Explorer default view.
Technique: T1564: Hide Artifacts
The COR_PROFILER environment variable can be set at various scopes  resulting in different levels of influence.
Technique: T1574: Hijack Execution Flow
iKitten saves itself with a leading "."
Technique: T1564: Hide Artifacts
ShadowPad has collected the username of the victim system.
Technique: T1033: System Owner/User Discovery
HAFNIUM has interacted with Office 365 tenants to gather details regarding target's environments.
Technique: T1592: Gather Victim Host Information
SharpStage has the ability to download and execute additional payloads via a DropBox API.
Technique: T1105: Ingress Tool Transfer
Adversaries may buy, steal, or download malware that can be used during targeting.
Technique: T1588: Obtain Capabilities
creates a backdoor through which remote attackers can open a command-line interface.
Technique: T1059: Command and Scripting Interpreter
Valak has used HTTP in communications with C2.
Technique: T1071: Application Layer Protocol
For example, Apple Remote Desktop  on macOS is native software used for remote management.
Technique: T1021: Remote Services
OilRig has run ipconfig /all on a victim.
Technique: T1016: System Network Configuration Discovery
Rising Sun executed commands using cmd.exe.
Technique: T1059: Command and Scripting Interpreter
A Word document delivering TYPEFRAME prompts the user to enable macro execution.
Technique: T1204: User Execution
APT28 close-access teams have used Wi-Fi pineapples to intercept Wi-Fi signals and user credentials.
Technique: T1040: Network Sniffing
CCBkdr can use a DGA for Fallback Channels if communications with the primary command and control server are lost.
Technique: T1568: Dynamic Resolution
Shamoon can download an executable to run on the victim.
Technique: T1105: Ingress Tool Transfer
Gold Dragon encrypts data using Base64 before being sent to the command and control server.
Technique: T1560: Archive Collected Data
Information about host firmware may include a variety of details such as type and versions on specific hosts, which may be used to infer more information about hosts in the environment .
Technique: T1592: Gather Victim Host Information
Turian can retrieve the internal IP address of a compromised host.
Technique: T1016: System Network Configuration Discovery
The startup folder path for all users is C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp.
Technique: T1547: Boot or Logon Autostart Execution
Windows Event Logs are a record of a computer's alerts and notifications.
Technique: T1070: Indicator Removal on Host
Flame has a module named BeetleJuice that contains Bluetooth functionality that may be used in different ways, including transmitting encoded information from the infected system over the Bluetooth protocol, acting as a Bluetooth beacon, and identifying other Bluetooth devices in the vicinity.
Technique: T1011: Exfiltration Over Other Network Medium
Further, PowerShell provides cmdlets that can be used to retrieve or modify file and directory DACLs.
Technique: T1222: File and Directory Permissions Modification
Fox Kitten has used valid credentials with various services during lateral movement.
Technique: T1078: Valid Accounts
Cobalt Strike uses a custom command and control protocol that is encapsulated in HTTP, HTTPS, or DNS.
Technique: T1572: Protocol Tunneling
EnvyScout can use protocol handlers to coax the operating system to send NTLMv2 authentication responses to attacker-controlled infrastructure.
Technique: T1187: Forced Authentication
APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory.
Technique: T1218: Signed Binary Proxy Execution
The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe,  PowerShell, or Reg.
Technique: T1574: Hijack Execution Flow
Adversaries may develop exploits that can be used during targeting.
Technique: T1587: Develop Capabilities
Final1stspy obtains a list of running processes.
Technique: T1057: Process Discovery
Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW and runas.
Technique: T1134: Access Token Manipulation
Gamaredon Group has created a scheduled task to launch an executable every 10 minutes.
Technique: T1053: Scheduled Task/Job
Kimsuky has manipulated timestamps for creation or compilation dates to defeat anti-forensics.
Technique: T1070: Indicator Removal on Host
UNC2452 used 7-Zip to compress stolen emails into password-protected archives prior to exfiltration.
Technique: T1560: Archive Collected Data
An adversary may leverage permissions to create a snapshot in order to bypass restrictions that prevent access to existing compute service infrastructure, unlike in Revert Cloud Instance where an adversary may revert to a snapshot to evade detection and remove evidence of their presence.
Technique: T1578: Modify Cloud Compute Infrastructure
SynAck enumerates all running services.
Technique: T1007: System Service Discovery
Skidmap has the ability to check if /usr/sbin/setenforce exists.
Technique: T1518: Software Discovery
Invoke-Obfuscation calls the string obfuscation used by the actors to further obfuscate this script Reorder, which uses the string formatting functionality within PowerShell to reconstruct strings from out of order substrings (ex
Technique: T1027: Obfuscated Files or Information
HAFNIUM has used TCP for C2.
Technique: T1095: Non-Application Layer Protocol
APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.
Technique: T1059: Command and Scripting Interpreter
Adversaries may also utilize cloud APIs to discover the configurations of firewall rules within an environment.
Technique: T1518: Software Discovery
Clop can use code signing to evade detection.
Technique: T1553: Subvert Trust Controls
Sidewinder has exploited vulnerabilities to gain execution including CVE-2017-11882 and CVE-2020-0674.
Technique: T1203: Exploitation for Client Execution
Additionally, a Turla custom executable containing Metasploit shellcode is saved to the Startup folder to gain persistence.
Technique: T1547: Boot or Logon Autostart Execution
When creating a user, you can specify the userID for that account.
Technique: T1564: Hide Artifacts
Astaroth uses the LoadLibraryExW function to load additional modules.
Technique: T1129: Shared Modules
T9000 gathers and beacons the system time during installation.
Technique: T1124: System Time Discovery
These methods can differ from platform-as-a-service , to infrastructure-as-a-service , or software-as-a-service .
Technique: T1526: Cloud Service Discovery
WellMess has used Base64 encoding to uniquely identify communication to and from the C2.
Technique: T1132: Data Encoding
Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.
Technique: T1547: Boot or Logon Autostart Execution
Kwampirs collects a list of files and directories in C:\ with the command dir /s /a c:\ >> "C:\windows\TEMP\RANDOM.tmp".
Technique: T1083: File and Directory Discovery
yty runs ipconfig /all and collects the domain name.
Technique: T1016: System Network Configuration Discovery
Transparent Tribe has compromised domains for use in targeted malicious campaigns.
Technique: T1584: Compromise Infrastructure
APT39 has created accounts on multiple compromised hosts to perform actions within the network.
Technique: T1136: Create Account
Ursnif has used strings from legitimate system files and existing folders for its file, folder, and Registry entry names.
Technique: T1036: Masquerading
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Technique: T1219: Remote Access Software
LogMeing 
Technique: T1219: Remote Access Software
Gold Dragon collects the endpoint victim's username and uses it as a basis for downloading additional components from the C2 server.
Technique: T1033: System Owner/User Discovery
PowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.
Technique: T1059: Command and Scripting Interpreter
One of Attor's plugins can collect user credentials via capturing keystrokes and can capture keystrokes pressed within the window of the injected process.
Technique: T1056: Input Capture
BoxCaon uploads files and data from a compromised host over the existing C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
Kessel has collected the DNS address of the infected host.
Technique: T1016: System Network Configuration Discovery
Additionally, since StartupItems run during the bootup phase of macOS, they will run as the elevated root user.
Technique: T1037: Boot or Logon Initialization Scripts
Metamorfo has used mshta.exe to execute a HTA payload.
Technique: T1218: Signed Binary Proxy Execution
An adversary may use at in Linux environments to execute programs at system startup or on a scheduled basis for persistence.
Technique: T1053: Scheduled Task/Job
Explosive has collected the computer name from the infected host.
Technique: T1082: System Information Discovery
A file name may include a secondary file type extension that may cause only the first extension to be displayed .
Technique: T1036: Masquerading
Denis also used the Wow64SetThreadContext API as part of a process hollowing process.
Technique: T1106: Native API
Despite being superseded by Component Object Model, DDE may be enabled in Windows 10 and most of Microsoft Office 2016 via Registry keys.
Technique: T1559: Inter-Process Communication
Adversaries may develop malware and malware components that can be used during targeting.
Technique: T1587: Develop Capabilities
ADVSTORESHELL can enumerate registry keys.
Technique: T1012: Query Registry
Agent Tesla can inject into known, vulnerable binaries on targeted hosts.
Technique: T1055: Process Injection
It also has commands to obtain information about logical drives, drive type, and free space.
Technique: T1083: File and Directory Discovery
The malware proceeds to decrypt and embedded configuration of 128 bytes using a simple XOR routine
Technique: T1140: Deobfuscate/Decode Files or Information
CHOPSTICK may store RC4 encrypted configuration information in the Windows Registry.
Technique: T1112: Modify Registry
It should be noted that in most of these cases the backdoor was embedded as a packed payload in another executable or in a weaponized document file of some kind
Technique: T1027: Obfuscated Files or Information
~/.bashrc 
Technique: T1546: Event Triggered Execution
Log.php validates the sender by User-Agent, saves the data in the “UP” server directory and stores the metadata in the mssql database for later reference
Technique: T1074: Data Staged
NETWIRE has the ability to search for files on the compromised host.
Technique: T1083: File and Directory Discovery
To get a job from the Google Drive account, the Trojan starts by creating a string that has the following structure with each element within the subdomain subjected to the number to character substitution from Table 4: c<unique identifier><job identifier padded with ‘0’ to make three digits><sequence number>c.<C2 domain> The Trojan will then obtain an OAUTH access token to the Google Drive in the same manner as before when obtaining the unique identifier
Technique: T1102: Web Service
Frankenstein has uploaded and downloaded files to utilize additional plugins.
Technique: T1105: Ingress Tool Transfer
After re-establishing access to a victim network, Threat Group-3390 actors download tools including gsecdump and WCE that are staged temporarily on websites that were previously compromised but never used.
Technique: T1105: Ingress Tool Transfer
NETWIRE can create a scheduled task to establish persistence.
Technique: T1053: Scheduled Task/Job
FatDuke has the ability to execute PowerShell scripts.
Technique: T1059: Command and Scripting Interpreter
Anchor has been signed with valid certificates to evade detection by security tools.
Technique: T1553: Subvert Trust Controls
APT37 uses HTTPS to conceal C2 communications.
Technique: T1071: Application Layer Protocol
There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering.
Technique: T1127: Trusted Developer Utilities Proxy Execution
Carbanak enables concurrent Remote Desktop Protocol  sessions.
Technique: T1021: Remote Services
APT37 leverages social networking sites and cloud platforms  for C2.
Technique: T1102: Web Service
MuddyWater has used malware that can collect the victim’s OS version and machine name.
Technique: T1082: System Information Discovery
LoudMiner can automatically launch a Linux virtual machine as a service at startup if the AutoStart option is enabled in the VBoxVmService configuration file.
Technique: T1543: Create or Modify System Process
StrongPity has created new services and modified existing services for persistence.
Technique: T1543: Create or Modify System Process
It is used to create new processes, perform as a command line shell, and several other tasks
Technique: T1059: Command and Scripting Interpreter
InvisiMole can spread within a network via the BlueKeep  and EternalBlue  vulnerabilities in RDP and SMB respectively.
Technique: T1210: Exploitation of Remote Services
The following capabilities have been observed in this payload:  Get drive information Modify files Modify directories Modify registry Spawn process Terminate process Modify services Kill self   Ties to SunOrcal Reaver was used concurrently with SunOrcal over the past year, to include two Reaver samples dropped from zip files hosted on a domain also being used as a SunOrcal C2 (www.fyoutside[.]com), and there is also passive DNS overlap amongst the C2s
Technique: T1112: Modify Registry
REvil can encrypt files on victim systems and demands a ransom to decrypt the files.
Technique: T1486: Data Encrypted for Impact
Organizations that Buckeye targeted over time, per region Malware and tools Buckeye uses a number of hacking tools as well as malware
Technique: T1518: Software Discovery
These credentials include both x509 keys and passwords.
Technique: T1098: Account Manipulation
Uroburos is a rootkit used by Turla.
Technique: T1014: Rootkit
This can be done using a syntax similar to this: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write;GetObject"  This behavior has been seen used by malware such as Poweliks.
Technique: T1218: Signed Binary Proxy Execution
NETWIRE has been executed through luring victims into opening malicious documents.
Technique: T1204: User Execution
WastedLocker can perform a UAC bypass if it is not executed with administrator rights or if the infected host runs Windows Vista or later.
Technique: T1548: Abuse Elevation Control Mechanism
Ryuk can create .dll files that actually contain a Rich Text File format document.
Technique: T1036: Masquerading
Silent Librarian has collected e-mail addresses from targeted organizations from open Internet searches.
Technique: T1589: Gather Victim Identity Information
NDiskMonitor uses AES to encrypt certain information sent over its C2 channel.
Technique: T1573: Encrypted Channel
Fox Kitten has used Scheduled Tasks for persistence and to load and execute a reverse proxy binary.
Technique: T1053: Scheduled Task/Job
jRAT uses WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.
Technique: T1047: Windows Management Instrumentation
In addition it will break large data sets into smaller chunks for exfiltration.
Technique: T1029: Scheduled Transfer
KeyBoy uses custom SSL libraries to impersonate SSL in C2 traffic.
Technique: T1001: Data Obfuscation
As part of their compromises, the group has used a Javascript based profiler called RICECURRY to profile a victim's web browser and deliver malicious code accordingly.
Technique: T1189: Drive-by Compromise
Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.
Technique: T1560: Archive Collected Data
After this file is copied, the original ‘Update.~tmp’ file is deleted
Technique: T1070: Indicator Removal on Host
RDAT has masqueraded as VMware.exe.
Technique: T1036: Masquerading
ComRAT has encrypted and stored its orchestrator code in the Registry as well as a PowerShell script into the WsqmCons Registry key.
Technique: T1112: Modify Registry
APT41 has used rundll32.exe to execute a loader.
Technique: T1218: Signed Binary Proxy Execution
The command handle looks for the following command strings in Table 3:    Command Description   $fileDownload Uploads the contents of a specified file to C2   $importModule Adds a specified PowerShell module to the current script   $screenshot Executes the contents of the command, which should be the string ‘$screenshot’
Technique: T1113: Screen Capture
Penquin can sniff network traffic to look for packets matching specific conditions.
Technique: T1040: Network Sniffing
PUNCHTRACK is loaded and executed by a highly obfuscated launcher.
Technique: T1027: Obfuscated Files or Information
Firewall rules may also already exist to permit traffic to these services.
Technique: T1567: Exfiltration Over Web Service
Adversaries may attempt to cause a denial of service by reflecting a high-volume of network traffic to a target.
Technique: T1498: Network Denial of Service
Additionally it checks to determine if common analysis tools are currently running on the infected system
Technique: T1518: Software Discovery
BackConfig has used a custom routine to decrypt strings.
Technique: T1140: Deobfuscate/Decode Files or Information
It is possible to extract passwords from backups or saved virtual machines through OS Credential Dumping.
Technique: T1552: Unsecured Credentials
Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure.
Technique: T1597: Search Closed Sources
Magic Hound gathered credentials from two victims that they then attempted to validate across 75 different websites.
Technique: T1589: Gather Victim Identity Information
NavRAT uses the email platform, Naver, for C2 communications, leveraging SMTP.
Technique: T1071: Application Layer Protocol
One of the first steps that several Mosquito installer packages performed after writing and running this local_update js file was to export all local host’s WiFi profiles (settings and passwords) to %APPDATA%\<profile>.xml with a command line call: cmd.exe /c netsh wlan export profile key=clear folder="%APPDATA%" They then gather more network information with a call to ipconfig and arp -a
Technique: T1016: System Network Configuration Discovery
Adversaries may abuse Unix shells to execute various commands or payloads.
Technique: T1059: Command and Scripting Interpreter
SoreFang has the ability to list directories.
Technique: T1083: File and Directory Discovery
GrimAgent can use Native API including GetProcAddress and ShellExecuteW.
Technique: T1106: Native API
TSCookie has the ability to inject code into the svchost.exe, iexplorer.exe, explorer.exe, and default browser processes.
Technique: T1055: Process Injection
Leveraging data from Kaspersky Security Network, we identified two other similar exploit chains used by BlackOasis in June 2015 which were zero days at the time.  Those include CVE-2015-5119 and CVE-2016-0984, which were patched in July 2015 and February 2016 respectively.  These exploit chains also delivered FinSpy installation packages
Technique: T1068: Exploitation for Privilege Escalation
QakBot can execute WMI queries to gather information.
Technique: T1047: Windows Management Instrumentation
A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.
Technique: T1547: Boot or Logon Autostart Execution
IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows Dynamic Data Exchange or Component Object Model.
Technique: T1559: Inter-Process Communication
Dok gives all users execute permissions for the application using the command chmot +x /Users/Shared/AppStore.app.
Technique: T1222: File and Directory Permissions Modification
Fysbis can perform keylogging.
Technique: T1056: Input Capture
Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism.
Technique: T1110: Brute Force
FIN7 has exfiltrated stolen data to the MEGA file sharing site.
Technique: T1567: Exfiltration Over Web Service
BlackEnergy2 was eventually seen downloading more crimeware plugins – a custom spam plugin and a banking information stealer custom plugin
Technique: T1027: Obfuscated Files or Information
KGH_SPY can perform keylogging by polling the GetAsyncKeyState function.
Technique: T1056: Input Capture
Adversaries may search social media for information about victims that can be used during targeting.
Technique: T1593: Search Open Websites/Domains
When an adversary gains control of a network boundary device, they can either leverage existing NAT configurations to send traffic between two separated networks, or they can implement NAT configurations of their own design.
Technique: T1599: Network Boundary Bridging
InvisiMole can inject itself into another process to avoid detection including use of a technique called ListPlanting that customizes the sorting algorithm in a ListView structure.
Technique: T1055: Process Injection
Adversaries may create a new process with a different token to escalate privileges and bypass access controls.
Technique: T1134: Access Token Manipulation
Kivars has the ability to list drives on the infected host.
Technique: T1083: File and Directory Discovery
11/1/18 sahro.bella7 trala.cosh2 Bishtr.cam47 Lobrek.chizh Cervot.woprov    Table 5 Gathered C# Cannon samples As mentioned in our initial blog, the actor controlled email address acting as the C2 was sahro.bella7[at]post.cz, but all previous samples of Cannon used sym777.g[at]post.cz
Technique: T1071: Application Layer Protocol
Hydraq's backdoor also enables remote attackers to modify and delete subkeys.
Technique: T1112: Modify Registry
For example, functions such as the Windows API CreateProcess or GNU fork will allow programs and scripts to start other processes.
Technique: T1106: Native API
Sandworm Team has also used VPN tunnels established in legitimate software company infrastructure to gain access to internal networks of that software company's users.
Technique: T1133: External Remote Services
HAWKBALL has downloaded additional files from the C2.
Technique: T1105: Ingress Tool Transfer
AppleSeed has the ability to use JavaScript to execute PowerShell.
Technique: T1059: Command and Scripting Interpreter
Comnie collects the hostname of the victim machine.
Technique: T1082: System Information Discovery
BackConfig has hidden malicious payloads in %USERPROFILE%\Adobe\Driver\dwg\ and mimicked the legitimate DHCP service binary.
Technique: T1036: Masquerading
MuddyWater has used malware to check running processes against a hard-coded list of security tools often used by malware researchers.
Technique: T1518: Software Discovery
The initial beacon packet for S-Type contains the operating system version and file system of the victim.
Technique: T1082: System Information Discovery
Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis.
Technique: T1140: Deobfuscate/Decode Files or Information
There is usually a delay between when an exploit is discovered and when it is made public.
Technique: T1588: Obtain Capabilities
RegDuke can hide data in images, including use of the Least Significant Bit .
Technique: T1027: Obfuscated Files or Information
PoetRAT has the ability to overwrite scripts and delete itself if a sandbox environment is detected.
Technique: T1070: Indicator Removal on Host
Many network devices such as routers, switches, and firewalls, perform encryption on network traffic to secure transmission across networks.
Technique: T1600: Weaken Encryption
Ramsay has included a rootkit to evade defenses.
Technique: T1014: Rootkit
This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash.
Technique: T1550: Use Alternate Authentication Material
MuddyWater has used PowerShell for execution.
Technique: T1059: Command and Scripting Interpreter
InvisiMole can remotely activate the victim’s webcam to capture content.
Technique: T1125: Video Capture
APT29 named tasks \Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager in order to appear legitimate.
Technique: T1036: Masquerading
Stuxnet can create registry keys to load driver files.
Technique: T1112: Modify Registry
This ensures that only the intended recipient can read the encrypted data.
Technique: T1573: Encrypted Channel
URL parameter Sample data Description   c= Victim->Administrator Hostname and username   l= 192.168.1.100 Compromised system's IP address   o= 5,1,1,32 Windows major and minor version, coupled with architecture (32 v
Technique: T1082: System Information Discovery
Kimsuky has used Win7Elevate to inject malicious code into explorer.exe.
Technique: T1055: Process Injection
RedLeaves can gather extended system information including the hostname, OS version number, platform, memory information, time elapsed since system startup, and CPU information.
Technique: T1082: System Information Discovery
Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster.
Technique: T1053: Scheduled Task/Job
Xbash can use mshta for executing scripts.
Technique: T1218: Signed Binary Proxy Execution
The Eye Pyramid campaign used phishing emails with malicious attachments for lateral movement between victims, compromising nearly 18,000 email accounts in the process.
Technique: T1534: Internal Spearphishing
jRAT can serve as a SOCKS proxy server.
Technique: T1090: Proxy
APT29 has used steganography to hide C2 communications in images.
Technique: T1001: Data Obfuscation
The TAINTEDSCRIBE main executable has disguised itself as Microsoft’s Narrator.
Technique: T1036: Masquerading
njRAT can also detect any removable drives connected to the system.
Technique: T1120: Peripheral Device Discovery
Additionally, a PROPERTY=VALUE pair containing a 56-bit encryption key has been used to decrypt the main payload from the installer packages.
Technique: T1218: Signed Binary Proxy Execution
Although sensitive details  may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures.
Technique: T1597: Search Closed Sources
Adversaries may establish persistence by modifying RC scripts which are executed during a Unix-like system’s startup.
Technique: T1037: Boot or Logon Initialization Scripts
ShimRat's loader has been packed with the compressed ShimRat core DLL and the legitimate DLL for it to hijack.
Technique: T1027: Obfuscated Files or Information
TrickBot obtains the IP address, location, and other relevant network information from the victim’s machine.
Technique: T1016: System Network Configuration Discovery
MESSAGETAP checks for the existence of two configuration files  and attempts to read the files every 30 seconds.
Technique: T1083: File and Directory Discovery
Stolen Pencil has a tool to add a Windows admin account in order to allow them to ensure continued access via RDP.
Technique: T1078: Valid Accounts
DarkComet can use HTTP for C2 communications.
Technique: T1071: Application Layer Protocol
Fox Kitten has used the PuTTY and Plink tools for lateral movement.
Technique: T1021: Remote Services
Lokibot has reflectively loaded the decoded DLL into memory.
Technique: T1620: Reflective Code Loading
For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.
Technique: T1190: Exploit Public-Facing Application
How the operating system locates libraries to be used by a program can also be intercepted.
Technique: T1574: Hijack Execution Flow
Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.
Technique: T1587: Develop Capabilities
The CARROTBAT malware family is a somewhat unique dropper and while it supports various types of decoy documents, and employs rudimentary command obfuscation, it should be made clear that it is not sophisticated
Technique: T1027: Obfuscated Files or Information
The directory creation.  Downloading the Payloads The remote XSL script downloads twelve files from the C2 server that masquerade themselves as JPEG, GIF, and extensionless files
Technique: T1105: Ingress Tool Transfer
BLUELIGHT has collected the computer name and OS version from victim machines.
Technique: T1082: System Information Discovery
Wizard Spider has used "whoami" to identify the local user and their privileges.
Technique: T1033: System Owner/User Discovery
PLEAD has the ability to proxy network communications.
Technique: T1090: Proxy
Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.
Technique: T1110: Brute Force
WannaCry utilizes wmic to delete shadow copies.
Technique: T1047: Windows Management Instrumentation
Whitefly has obtained and used tools such as Mimikatz.
Technique: T1588: Obtain Capabilities
MSBuild.exe  is a software build platform used by Visual Studio.
Technique: T1127: Trusted Developer Utilities Proxy Execution
Pisloader establishes persistence via a Registry Run key.
Technique: T1547: Boot or Logon Autostart Execution
Pisloader uses DNS as its C2 protocol.
Technique: T1071: Application Layer Protocol
list /Users | grep -v '_' command can also be used to enumerate user accounts.
Technique: T1033: System Owner/User Discovery
ZxShell can collect the local hostname, operating system details, CPU speed, and total physical memory.
Technique: T1082: System Information Discovery
This presentation by Christopher Glyer and Devon Kerr contains additional information on attacker use of WMI in past Mandiant investigations
Technique: T1047: Windows Management Instrumentation
Kessel has exfiltrated data via hexadecimal-encoded subdomain fields of DNS queries.
Technique: T1132: Data Encoding
NanHaiShu can gather the victim computer name and serial number.
Technique: T1082: System Information Discovery
Comnie executes VBS scripts.
Technique: T1059: Command and Scripting Interpreter
Carberp has hooked several Windows API functions to steal credentials.
Technique: T1056: Input Capture
Bisonal adds itself to the Registry key HKEY_CURRENT_USER\Software\Microsoft\CurrentVersion\Run\ for persistence.
Technique: T1547: Boot or Logon Autostart Execution
Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.
Technique: T1518: Software Discovery
USBferry can detect the victim's file or folder list.
Technique: T1083: File and Directory Discovery
Adversaries may make and impersonate tokens to escalate privileges and bypass access controls.
Technique: T1134: Access Token Manipulation
Traffic will appear to be going to domain-x, however the CDN may route it to domain-y.
Technique: T1090: Proxy
ZxShell hooks several API functions to spawn system threads.
Technique: T1056: Input Capture
PoetRAT has made registry modifications to alter its behavior upon execution.
Technique: T1112: Modify Registry
Adversaries may gather information about the victim's network domain that can be used during targeting.
Technique: T1590: Gather Victim Network Information
The following code snippet was used to decode strings within OopsIE:out = "" for e in obfuscated_string.split("-"):    out += chr(int(e)-1)When first run, this OopsIE variant runs a variety of checks to avoid running in an analysis environment, as discussed in the previous section
Technique: T1140: Deobfuscate/Decode Files or Information
The attackers orchestrate attacks using batch or PowerShell scripts that are executed, with the help of domain controllers, on any machine the DC can reach.
Technique: T1059: Command and Scripting Interpreter
Ragnar Locker encrypts files on the local machine and mapped drives prior to displaying a note demanding a ransom.
Technique: T1486: Data Encrypted for Impact
BabyShark has executed the ipconfig /all command.
Technique: T1016: System Network Configuration Discovery
Digitally signed malware The entire bundle (VPN client and malware) was digitally signed with a valid code signing certificate issued by Symantec to AI Squared, a legitimate software company that develops accessibility software:  Thumbprint: F340C0D841F9D99DBC289151C13391000366631C Serial number: 45 E4 7F 56 0B 01 B6 4E 68 39 5E 5D 79 2F 2E 09 Another Helminth sample, 1c23b3f11f933d98febfd5a92eb5c715, was signed with a different AI Squared code signing certificate: Thumbprint: 92B8C0872BACDC226B9CE4D783D5CCAD61C6158A Serial number:62 E0 44 E7 37 24 61 2D 79 4B 93 AF 97 46 13 48 This suggest that the attackers had got a hold of an Ai Squared signing key, potentially after compromising their network
Technique: T1553: Subvert Trust Controls
In Mac and Linux, netstat and lsof can be used to list current connections.
Technique: T1049: System Network Connections Discovery