HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
Infrastructure as a Service  cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs.
Technique: T1082: System Information Discovery
Hosts can be forced into safe mode after the next reboot via modifications to Boot Configuration Data  stores, which are files that manage boot application settings.
Technique: T1562: Impair Defenses
Silence has injected a DLL library containing a Trojan into the fwmain32.exe process.
Technique: T1055: Process Injection
An adversary may disable cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection.
Technique: T1562: Impair Defenses
APT39 has utilized malicious VBS scripts in malware.
Technique: T1059: Command and Scripting Interpreter
Some strings are obfuscated with XOR x56
Technique: T1027: Obfuscated Files or Information
searches for files
Technique: T1083: File and Directory Discovery
Ebury has encoded C2 traffic in hexadecimal format.
Technique: T1132: Data Encoding
ZeroT gathers the victim's IP address and domain information, and then sends it to its C2 server.
Technique: T1016: System Network Configuration Discovery
StrongPity has been executed via compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.
Technique: T1204: User Execution
In principle, containerized resources should provide a clear separation of application functionality and be isolated from the host environment.
Technique: T1611: Escape to Host
ZxShell has a feature to create local user accounts.
Technique: T1136: Create Account
InvisiMole uses a variation of the XOR cipher to encrypt files before exfiltration.
Technique: T1560: Archive Collected Data
Hi-Zor encrypts C2 traffic with a double XOR using two distinct single-byte keys.
Technique: T1573: Encrypted Channel
By achieving sufficient rights on the device, an adversary can reconfigure the device to allow the traffic they want, allowing them to then further achieve goals such as command and control via Multi-hop Proxy or exfiltration of data via Traffic Duplication.
Technique: T1599: Network Boundary Bridging
In cases where traffic manipulation is used, there may be points in the the global network  where packets can be altered and cause legitimate clients to execute code that directs network packets toward a target in high volume.
Technique: T1499: Endpoint Denial of Service
Ramsay has used base64 to encode its C2 traffic.
Technique: T1132: Data Encoding
Security monitoring and control mechanisms may be in place for system utilities adversaries are capable of abusing.
Technique: T1036: Masquerading
More information about the OwaAuth web shell is available in Appendix C
Technique: T1505: Server Software Component
Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel.
Technique: T1011: Exfiltration Over Other Network Medium
A Golden Ticket can be obtained for the domain using the Key Distribution Service account KRBTGT account NTLM hash, which enables generation of TGTs for any account in Active Directory.
Technique: T1550: Use Alternate Authentication Material
PUPY LOADER The Pupy RAT comes packaged by default with loaders that can run the RAT on a variety of platforms such as Windows, macOS, Linux and Android
Technique: T1571: Non-Standard Port
Grandoreiro can list installed security products including the Trusteer and Diebold Warsaw GAS Tecnologia online banking protections.
Technique: T1518: Software Discovery
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Technique: T1068: Exploitation for Privilege Escalation
NanoCore’s plugins were obfuscated with Eazfuscater.NET 3.3.
Technique: T1027: Obfuscated Files or Information
FrameworkPOS can use DNS tunneling for exfiltration of credit card data.
Technique: T1048: Exfiltration Over Alternative Protocol
Okrum has used DriveLetterView to enumerate drive information.
Technique: T1083: File and Directory Discovery
REvil can use vssadmin to delete volume shadow copies and bcdedit to disable recovery features.
Technique: T1490: Inhibit System Recovery
Stuxnet uses an RPC server that contains a file dropping routine and support for payload version updates for P2P communications within a victim network.
Technique: T1570: Lateral Tool Transfer
APT38 has used VBScript to execute commands and other operational tasks.
Technique: T1059: Command and Scripting Interpreter
The ZIP archive contains a RAR SFX which installs the malware and shows an empty PDF decoy
Technique: T1560: Archive Collected Data
Gamaredon Group has inserted malicious macros into existing documents, providing persistence when they are reopened.
Technique: T1137: Office Application Startup
Information about assigned IP addresses may include a variety of details, such as which IP addresses are in use.
Technique: T1590: Gather Victim Network Information
Hydraq creates a backdoor through which remote attackers can monitor services.
Technique: T1007: System Service Discovery
TajMahal has the ability to steal written CD images and files of interest from previously connected removable drives when they become available again.
Technique: T1025: Data from Removable Media
KillDisk has called the Windows API to retrieve the hard disk handle and shut down the machine.
Technique: T1106: Native API
These settings may be stored on the system in configuration files and/or in the Registry as well as being accessible via administrative utilities such as PowerShell or Windows Management Instrumentation.
Technique: T1562: Impair Defenses
Conti can use “Windows Restart Manager” to ensure files are unlocked and open for encryption.
Technique: T1486: Data Encrypted for Impact
Adversaries may send phishing messages to elicit sensitive information that can be used during targeting.
Technique: T1598: Phishing for Information
RTM has used spearphishing attachments to distribute its malware.
Technique: T1566: Phishing
Adversaries may create accounts that only have access to specific cloud services, which can reduce the chance of detection.
Technique: T1136: Create Account
Information about networks may include a variety of details, including administrative data  as well as specifics regarding its topology and operations.
Technique: T1590: Gather Victim Network Information
Epic recursively searches for all .doc files on the system and collects a directory listing of the Desktop, %TEMP%, and %WINDOWS%\Temp directories.
Technique: T1083: File and Directory Discovery
POSHSPY downloads and executes additional PowerShell code and Windows binaries.
Technique: T1105: Ingress Tool Transfer
Bankshot exfiltrates data over its C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs.
Technique: T1574: Hijack Execution Flow
Darkhotel malware can collect a list of running processes on a system.
Technique: T1057: Process Discovery
Adversaries may gain access to and use third-party software suites installed within an enterprise network, such as administration, monitoring, and deployment systems, to move laterally through the network.
Technique: T1072: Software Deployment Tools
Shamoon attempts to access the ADMIN$, C$\Windows, D$\Windows, and E$\Windows shares on the victim with its current privileges.
Technique: T1083: File and Directory Discovery
PLATINUM has used various methods of process injection including hot patching.
Technique: T1055: Process Injection
Crutch can persist via DLL search order hijacking on Google Chrome, Mozilla Firefox, or Microsoft OneDrive.
Technique: T1574: Hijack Execution Flow
APT29 has downloaded source code from code repositories.
Technique: T1213: Data from Information Repositories
NanHaiShu can gather information about the victim proxy server.
Technique: T1016: System Network Configuration Discovery
Stuxnet installs an RPC server for P2P communications.
Technique: T1090: Proxy
PoisonIvy starts a rootkit from a malicious file dropped to disk.
Technique: T1014: Rootkit
APT29 has created self-signed digital certificates to enable mutual TLS authentication for malware.
Technique: T1587: Develop Capabilities
A JPIN uses a encrypted and compressed payload that is disguised as a bitmap within the resource section of the installer.
Technique: T1027: Obfuscated Files or Information
ShadowPad has encoded data as readable Latin characters.
Technique: T1132: Data Encoding
Chimera has used the Windows Command Shell and batch scripts for execution on compromised hosts.
Technique: T1059: Command and Scripting Interpreter
Melcoz has gained execution through victims opening malicious links.
Technique: T1204: User Execution
Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
Technique: T1547: Boot or Logon Autostart Execution
Figure 3 shows this webshell’s code that will run supplied JScript provided in base64 encoded format within the URL within a parameter
Technique: T1027: Obfuscated Files or Information
Crimson uses a custom TCP protocol for C2.
Technique: T1095: Non-Application Layer Protocol
Mis-Type may create a temporary user on the system named “Lost_{Unique Identifier}.” Flame can create backdoor accounts with login “HelpAssistant” on domain connected systems if appropriate rights are available.
Technique: T1136: Create Account
If Irdsnhrxxxfery64 is loaded using regsvr32.exe, it will target three processes:   It will target unins000.exe if it is available
Technique: T1218: Signed Binary Proxy Execution
Bazar can use Nltest tools to obtain information about the domain.
Technique: T1482: Domain Trust Discovery
Ursnif has used a 30 minute delay after execution to evade sandbox monitoring tools.
Technique: T1497: Virtualization/Sandbox Evasion
Machete searches the File system for files of interest.
Technique: T1005: Data from Local System
SMOKEDHAM has modified the Registry to hide created user accounts from the Windows logon screen.
Technique: T1564: Hide Artifacts
A Threat Group-3390 tool can use WMI to execute a binary.
Technique: T1047: Windows Management Instrumentation
Operation Wocao has used their own web shells, as well as those previously placed on target systems by other threat actors, for reconnaissance and lateral movement.
Technique: T1505: Server Software Component
RTM has also hidden Pony C2 server IP addresses within transactions on the Bitcoin and Namecoin blockchain.
Technique: T1102: Web Service
Metamorfo has downloaded a zip file for execution on the system.
Technique: T1102: Web Service
The actions performed are likely the same types of discovery techniques depending on the operating system, but the resulting information may include details about the networked cloud environment relevant to the adversary's goals.
Technique: T1049: System Network Connections Discovery
Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel.
Technique: T1048: Exfiltration Over Alternative Protocol
This command history is not available to other sessions and is deleted when the session ends.
Technique: T1070: Indicator Removal on Host
Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior.
Technique: T1203: Exploitation for Client Execution
OopsIE creates and uses a VBScript as part of its persistent execution.
Technique: T1059: Command and Scripting Interpreter
Cobalt Strike can make tokens from known credentials.
Technique: T1134: Access Token Manipulation
jRAT can browse file systems.
Technique: T1083: File and Directory Discovery
GALLIUM used WMI for execution to assist in lateral movement as well as for installing tools across multiple assets.
Technique: T1047: Windows Management Instrumentation
NETWIRE has the ability to communicate over HTTP.
Technique: T1071: Application Layer Protocol
Launch Agents are created with user level privileges and execute with user level permissions.
Technique: T1543: Create or Modify System Process
Certificates can be uploaded to a server, then the server can be configured to use the certificate to enable encrypted communication with it.
Technique: T1608: Stage Capabilities
If both attempts fail and the payload is unable to obtain a session ID and pre-shared key via HTTP or HTTPS, it will try to use DNS tunneling
Technique: T1071: Application Layer Protocol
The malware performs the following activities:  Builds imports by dynamically loading APIs Decrypts strings needed for control server communications Performs control server communications Handles commands issued by the control server Uninstalls self from the system  The malicious thread dynamically loads the APIs it needs at the beginning of its execution using LoadLibrary() and GetProcAddress()
Technique: T1041: Exfiltration Over C2 Channel
GALLIUM used ipconfig /all to obtain information about the victim network configuration.
Technique: T1016: System Network Configuration Discovery
Lokibot has performed a time-based anti-debug check before downloading its third stage.
Technique: T1497: Virtualization/Sandbox Evasion
LoudMiner started the cryptomining virtual machine as a service on the infected machine.
Technique: T1569: System Services
BRONZE BUTLER has exfiltrated files stolen from file shares.
Technique: T1039: Data from Network Shared Drive
4H RAT sends an OS version identifier in its beacons.
Technique: T1082: System Information Discovery
Cobalt Strike can determine the IP addresses of domain controllers.
Technique: T1016: System Network Configuration Discovery
Attor's dispatcher can establish persistence by registering a new service.
Technique: T1543: Create or Modify System Process
Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity  drivers and data source names.
Technique: T1218: Signed Binary Proxy Execution
Cobalt Group has created Windows tasks to establish persistence.
Technique: T1053: Scheduled Task/Job
NETWIRE can copy itself to and launch itself from hidden folders.
Technique: T1564: Hide Artifacts
Indrik Spider has attempted to get users to click on a malicious zipped file.
Technique: T1204: User Execution
GoldMax can check the current date-time value of the compromised system, comparing it to the hardcoded execution trigger and can send the current timestamp to the C2 server.
Technique: T1124: System Time Discovery
Remsec can exfiltrate data via a DNS tunnel or email, separately from its C2 channel.
Technique: T1048: Exfiltration Over Alternative Protocol
Adversaries may opt to use these encrypted mechanisms that are baked into a protocol.
Technique: T1048: Exfiltration Over Alternative Protocol
Nebulae can create a service to establish persistence.
Technique: T1543: Create or Modify System Process
The Komplex C2 channel uses an 11-byte XOR algorithm to hide data.
Technique: T1573: Encrypted Channel
They also manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.
Technique: T1053: Scheduled Task/Job
SpicyOmelette has collected data and other information from a compromised host.
Technique: T1005: Data from Local System
APT32 has used scheduled tasks to persist on victim systems.
Technique: T1053: Scheduled Task/Job
The permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the third-party system, or specific domain credentials may be required.
Technique: T1072: Software Deployment Tools
An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence.
Technique: T1578: Modify Cloud Compute Infrastructure
Ramsay has been distributed through spearphishing emails with malicious attachments.
Technique: T1566: Phishing
OilRig has used .doc file extensions to mask malicious executables.
Technique: T1036: Masquerading
APT29 leveraged privileged accounts to replicate directory service data with domain controllers.
Technique: T1003: OS Credential Dumping
Miner-C copies itself into the public folder of Network Attached Storage  devices and infects new victims who open the file.
Technique: T1080: Taint Shared Content
LightNeuron is capable of modifying email content, headers, and attachments during transit.
Technique: T1565: Data Manipulation
BackConfig has compromised victims via links to URLs hosting malicious content.
Technique: T1204: User Execution
Volgmer executes payloads using the Windows API call CreateProcessW.
Technique: T1106: Native API
gh0st RAT can inject malicious code into process created by the “Command_Create&Inject” function.
Technique: T1055: Process Injection
The original file may be overwritten, or a new file may be written alongside of it and the device reconfigured to boot to the compromised image.
Technique: T1601: Modify System Image
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Technique: T1219: Remote Access Software
TrickBot uses web injects and browser redirection to trick the user into providing their login credentials on a fake or modified web page.
Technique: T1185: Browser Session Hijacking
OilRig has used VBSscipt macros for execution on compromised hosts.
Technique: T1059: Command and Scripting Interpreter
ServHelper has created a new user and added it to the "Remote Desktop Users" and "Administrators" groups.
Technique: T1136: Create Account
NavRAT is able to download and execute files located in the attachment of a received email
Technique: T1105: Ingress Tool Transfer
KeyBoy can launch interactive shells for communicating with the victim machine.
Technique: T1059: Command and Scripting Interpreter
Stolen Pencil has used tools that are capable of obtaining credentials from saved mail.
Technique: T1552: Unsecured Credentials
This DLL serves three main functions: killing antimalware, unpacking and executing the main RAT DLL, and obtaining persistence
Technique: T1140: Deobfuscate/Decode Files or Information
APT39 has used CrackMapExec and a custom port scanner known as BLUETORCH for network scanning.
Technique: T1046: Network Service Scanning
Adversaries may install a new service or modify an existing service by using system utilities to interact with services, by directly modifying the Registry, or by using custom tools to interact with the Windows API.
Technique: T1543: Create or Modify System Process
The Regin malware platform can use Windows admin shares to move laterally.
Technique: T1021: Remote Services
To do so, adversaries may set the second script: parameter to reference a scriptlet file  hosted on a remote site.
Technique: T1216: Signed Script Proxy Execution
If so, NETEAGLE will send beacons via an HTTP POST request; otherwise it will send beacons via UDP/6000.
Technique: T1008: Fallback Channels
Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts.
Technique: T1001: Data Obfuscation
Cardinal RAT lures victims into executing malicious macros embedded within Microsoft Excel documents.
Technique: T1204: User Execution
Next, it checks the running processes against a list of hard-coded process names; if any are found, the machine is forcefully rebooted
Technique: T1057: Process Discovery
A Dipsind variant registers as a Winlogon Event Notify DLL to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
Pony has used a small dictionary of common passwords against a collected list of local accounts.
Technique: T1110: Brute Force
Sibot will delete an associated registry key if a certain server response is received.
Technique: T1070: Indicator Removal on Host
Seasalt has the capability to identify the drive type on a victim.
Technique: T1083: File and Directory Discovery
Denis has several commands to search directories for files.
Technique: T1083: File and Directory Discovery
In order to decide which domain xparis() holds, a variable pingadori() uses the radador() function to randomize the domain
Technique: T1016: System Network Configuration Discovery
Network logon scripts can be assigned using Active Directory or Group Policy Objects.
Technique: T1037: Boot or Logon Initialization Scripts
RogueRobin uses regsvr32.exe to run a .sct file for execution.
Technique: T1218: Signed Binary Proxy Execution
Conclusion CVE-2017-0199 and CVE-2017-11882 are two of the more commonly exploited vulnerabilities that we are currently seeing
Technique: T1203: Exploitation for Client Execution
OilRig has encrypted and encoded data in its malware, including by using base64.
Technique: T1027: Obfuscated Files or Information
Attack chain of Tropic Trooper’s operations Here’s a summary of the attack chain of Tropic Trooper’s recent campaigns:  Execute a command through exploits for CVE-2017-11882 or CVE-2018-0802, security flaws in Microsoft Office’s Equation Editor (EQNEDT32.EXE)
Technique: T1203: Exploitation for Client Execution
APT41 has transferred implant files using Windows Admin Shares.
Technique: T1021: Remote Services
SodaMaster can use a hardcoded RSA key to encrypt some of its C2 traffic.
Technique: T1573: Encrypted Channel
ServHelper has a module to delete itself from the infected machine.
Technique: T1070: Indicator Removal on Host
Caterpillar WebShell can gather a list of processes running on the machine.
Technique: T1057: Process Discovery
Grandoreiro can use a DGA for hiding C2 addresses, including use of an algorithm with a user-specific key that changes daily.
Technique: T1568: Dynamic Resolution
An adversary who can determine that the malware was quarantined because of its file signature may modify the file to explicitly avoid that signature, and then re-use the malware.
Technique: T1027: Obfuscated Files or Information
Umbreon hides from defenders by hooking libc function calls, hiding artifacts that would reveal its presence, such as the user account it creates to provide access and undermining strace, a tool often used to identify malware.
Technique: T1014: Rootkit
Comnie uses ipconfig /all and route PRINT to identify network adapter and interface information.
Technique: T1016: System Network Configuration Discovery
UNC2452 used encoded PowerShell commands.
Technique: T1027: Obfuscated Files or Information
This code can then be invoked by redirecting the execution flow of the process via patched memory address references stored in a process' global offset table .
Technique: T1055: Process Injection
On Windows, users can mark specific files as hidden by using the attrib.exe binary.
Technique: T1564: Hide Artifacts
PS1 can inject its payload DLL Into memory.
Technique: T1055: Process Injection
Mofang has also encrypted payloads before they are downloaded to victims.
Technique: T1027: Obfuscated Files or Information
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Technique: T1499: Endpoint Denial of Service
Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Technique: T1560: Archive Collected Data
TrickBot utilizes EternalBlue and EternalRomance exploits for lateral movement in the modules wormwinDll, wormDll, mwormDll, nwormDll, tabDll.
Technique: T1210: Exploitation of Remote Services
Exploitation of this vulnerability allows an attacker to escalate privileges on the affected system
Technique: T1068: Exploitation for Privilege Escalation
ObliqueRAT can discover pluggable/removable drives to extract files from.
Technique: T1120: Peripheral Device Discovery
Adversaries may also rename malicious DLL files  with Control Panel file extensions  and register them to HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls.
Technique: T1218: Signed Binary Proxy Execution
These snap-ins may be used to manage Windows systems locally or remotely.
Technique: T1218: Signed Binary Proxy Execution
SUNBURST was digitally signed by SolarWinds from March - May 2020.
Technique: T1553: Subvert Trust Controls
wmic.exe is a powerful, native Windows command line utility used to interact with Windows Management Instrumentation (WMI)
Technique: T1047: Windows Management Instrumentation
LookBack has a C2 proxy tool that masquerades as GUP.exe, which is software used by Notepad++.
Technique: T1036: Masquerading
QakBot can identify the user name on a compromised system.
Technique: T1033: System Owner/User Discovery
APT38 used a backdoor, QUICKRIDE, to communicate to the C2 server over HTTP and HTTPS.
Technique: T1071: Application Layer Protocol
In doing so, adversaries can hide the presence of malicious components and file input/output from security tools.
Technique: T1564: Hide Artifacts
Crimson contains a command to list processes.
Technique: T1057: Process Discovery
China Chopper's server component can perform brute force password guessing against authentication portals.
Technique: T1110: Brute Force
Turla surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, the Program Files directory, and Recent.
Technique: T1083: File and Directory Discovery
Industroyer uses a custom port scanner to map out a network.
Technique: T1046: Network Service Scanning
BLUELIGHT has captured a screenshot of the display every 30 seconds for the first 5 minutes after initiating a C2 loop, and then once every five minutes thereafter.
Technique: T1113: Screen Capture
FIN8 has also executed commands remotely via cmd.
Technique: T1059: Command and Scripting Interpreter
Leviathan has used publicly available tools to dump password hashes, including ProcDump and WCE.
Technique: T1003: OS Credential Dumping
APT38 has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools.
Technique: T1218: Signed Binary Proxy Execution
PowerShower has the ability to save and execute VBScript.
Technique: T1059: Command and Scripting Interpreter
Various implementations of CHOPSTICK communicate with C2 over HTTP.
Technique: T1071: Application Layer Protocol
APT38 has created new services or modified existing ones to run executables, commands, or scripts.
Technique: T1569: System Services
KRBTGT is the Kerberos Key Distribution Center  service account and is responsible for encrypting and signing all Kerberos tickets.
Technique: T1558: Steal or Forge Kerberos Tickets
NOKKI has used HTTP for C2 communications.
Technique: T1071: Application Layer Protocol
HyperBro can run shellcode it injects into a newly created process.
Technique: T1055: Process Injection
Inception used chains of compromised routers to proxy C2 communications between them and cloud service providers.
Technique: T1090: Proxy
SHARPSTATS has used base64 encoding and XOR to obfuscate PowerShell scripts.
Technique: T1027: Obfuscated Files or Information
SharpStage has the ability to capture the victim's screen.
Technique: T1113: Screen Capture
Chimera has used Cobalt Strike C2 beacons for data exfiltration.
Technique: T1041: Exfiltration Over C2 Channel
Turla has used encryption 's Out-EncryptedScript.ps1, random variable names, and base64 encoding to obfuscate PowerShell commands and payloads.
Technique: T1027: Obfuscated Files or Information
When the malicious ISAPI filter captures a username matching this variable, it knows to handle the incoming HTTP request as a command to the web shell
Technique: T1033: System Owner/User Discovery
Windshift has created LNK files in the Startup folder to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
Olympic Destroyer will attempt to clear the System and Security event logs using wevtutil.
Technique: T1070: Indicator Removal on Host
Adversaries may search public WHOIS data for information about victims that can be used during targeting.
Technique: T1596: Search Open Technical Databases
Adversaries may abuse the at.exe utility to perform task scheduling for initial or recurring execution of malicious code.
Technique: T1053: Scheduled Task/Job
System Information Discovery combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.
Technique: T1082: System Information Discovery
Waterbear has used DLL side loading to import and load a malicious DLL loader.
Technique: T1574: Hijack Execution Flow
Kobalos can record the hostname and kernel version of the target machine.
Technique: T1082: System Information Discovery
ECCENTRICBANDWAGON has stored keystrokes and screenshots within the %temp%\GoogleChrome, %temp%\Downloads, and %temp%\TrendMicroUpdate directories.
Technique: T1074: Data Staged
While performing the analysis on the delivery documents using the .sct file AppLocker bypass, we noticed the C# payload was functionally similar to the original RogueRobin payload
Technique: T1027: Obfuscated Files or Information
Operation Wocao has exfiltrated files and directories of interest from the targeted system.
Technique: T1005: Data from Local System
The group has used a modified version of pentesting script wmiexec.vbs to execute commands.
Technique: T1059: Command and Scripting Interpreter
Adversaries may further interrupt efforts to track their infrastructure by using varied registration information and purchasing domains with different domain registrars.
Technique: T1583: Acquire Infrastructure
Many DGAs are time-based, generating a different domain for each time period .
Technique: T1568: Dynamic Resolution
Systemd utilizes configuration files known as service units to control how services boot and under what conditions.
Technique: T1543: Create or Modify System Process
The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts.
Technique: T1110: Brute Force
REvil can identify the username, machine name, system language, keyboard layout, OS version, and system drive information on a compromised host.
Technique: T1082: System Information Discovery
gh0st RAT has altered the InstallTime subkey.
Technique: T1112: Modify Registry
Wizard Spider has used taskkill.exe and net.exe to stop backup, catalog, cloud, and other services prior to network encryption.
Technique: T1489: Service Stop
Figure 3: Screen capture of the downloader executed on OS X El Capitan
Technique: T1113: Screen Capture
APT3 has exploited the Adobe Flash Player vulnerability CVE-2015-3113 and Internet Explorer vulnerability CVE-2014-1776.
Technique: T1203: Exploitation for Client Execution
The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Technique: T1548: Abuse Elevation Control Mechanism
APT32 has added JavaScript to victim websites to download additional frameworks that profile and compromise website visitors.
Technique: T1105: Ingress Tool Transfer
Chaes changed the template target of the settings.xml file embedded in the Word document and populated that field with the downloaded URL of the next payload.
Technique: T1221: Template Injection
Alerts for credential theft tools and privileged account lockouts should be investigated
Technique: T1003: OS Credential Dumping
Wingbird performs multiple process injections to hijack system processes and execute malicious code.
Technique: T1055: Process Injection
Dtrack contains a function that calls LoadLibrary and GetProcAddress.
Technique: T1129: Shared Modules
RedLeaves can enumerate drives and Remote Desktop sessions.
Technique: T1049: System Network Connections Discovery
BackConfig has the ability to identify folders and files related to previous infections.
Technique: T1083: File and Directory Discovery
S-Type runs the command net user on a victim.
Technique: T1087: Account Discovery
Methods for performing this technique could include use of a Command and Scripting Interpreter to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals.
Technique: T1119: Automated Collection
TeamTNT has disabled and uninstalled security tools.
Technique: T1562: Impair Defenses
This may be accomplished by many means, such as stopping a local process responsible for forwarding telemetry and/or creating a host-based firewall rule to block traffic to specific hosts responsible for aggregating events, such as security information and event management  products.
Technique: T1562: Impair Defenses
Chimera has performed file deletion to evade detection.
Technique: T1070: Indicator Removal on Host
Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Technique: T1102: Web Service
Sibot communicated with its C2 server via HTTP GET requests.
Technique: T1071: Application Layer Protocol
Adversaries may build capabilities that can be used during targeting.
Technique: T1587: Develop Capabilities
Seth-Locker can encrypt files on a targeted system, appending them with the suffix .seth.
Technique: T1486: Data Encrypted for Impact
Helminth splits data into chunks up to 23 bytes and sends the data in DNS queries to its C2 server.
Technique: T1030: Data Transfer Size Limits
Campaign Code and Compile Time Correlation In some cases, there is a close proximity of the compile time of a CARBANAK sample to the month specified in a particular campaign code
Technique: T1124: System Time Discovery
SpicyOmelette can identify the system name of a compromised host.
Technique: T1082: System Information Discovery
XCSSET builds a malicious application bundle to resemble Safari through using the Safari icon and Info.plist.
Technique: T1036: Masquerading
Ursnif droppers have used PowerShell in download cradles to download and execute the malware's full executable payload.
Technique: T1059: Command and Scripting Interpreter
Attor has staged collected data in a central upload directory prior to exfiltration.
Technique: T1074: Data Staged
Verifies that there is no process with the name “rsyncd” on the active process list (“dbus-inotifier” if the Trojan does not have root privileges)
Technique: T1057: Process Discovery
Team Viewer 
Technique: T1219: Remote Access Software
Various Lazarus Group malware enumerates logged-on users.
Technique: T1033: System Owner/User Discovery
Encrypted directories have had a ransom note of RyukReadMe.txt written to the directory.
Technique: T1486: Data Encrypted for Impact
SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems.
Technique: T1213: Data from Information Repositories
RunningRAT contains code to clear event logs.
Technique: T1070: Indicator Removal on Host
collect usernames
Technique: T1033: System Owner/User Discovery
Frankenstein has collected information via Empire, which is automatically sent the data back to the adversary's C2.
Technique: T1020: Automated Exfiltration
Acquiring a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers.
Technique: T1583: Acquire Infrastructure
POWERTON has used HTTP/HTTPS for C2 traffic.
Technique: T1071: Application Layer Protocol
Domain accounts can cover users, administrators, and services.
Technique: T1078: Valid Accounts
BLACKCOFFEE has the capability to enumerate files.
Technique: T1083: File and Directory Discovery
This may include things such as firewall rules and anti-virus.
Technique: T1518: Software Discovery
Socksbot can list all running processes.
Technique: T1057: Process Discovery
InvisiMole uses HTTP for C2 communications.
Technique: T1071: Application Layer Protocol
Adversaries may create a local account to maintain access to victim systems.
Technique: T1136: Create Account
APT41 used legitimate executables to perform DLL side-loading of their malware.
Technique: T1574: Hijack Execution Flow
The file uses a character insertion obfuscation technique, making it appear to contain Chinese characters.
Technique: T1027: Obfuscated Files or Information
On Windows systems, the PSReadLine module tracks commands used in all PowerShell sessions and writes them to a file .
Technique: T1562: Impair Defenses
OSX provides a native command, pbpaste, to grab clipboard contents.
Technique: T1115: Clipboard Data
An adversary can leverage a computer's peripheral devices  or applications  to capture video recordings for the purpose of gathering information.
Technique: T1125: Video Capture
PoisonIvy creates run key Registry entries pointing to a malicious executable dropped to disk.
Technique: T1547: Boot or Logon Autostart Execution
Sandworm Team used malware to enumerate email settings, including usernames and passwords, from the M.E.Doc application.
Technique: T1087: Account Discovery
Adversaries may also use RDP in conjunction with the Accessibility Features technique for Persistence.
Technique: T1021: Remote Services
Vasport creates a backdoor by making a connection using a HTTP POST.
Technique: T1071: Application Layer Protocol
With direct write access to a disk, adversaries may attempt to overwrite portions of disk data.
Technique: T1561: Disk Wipe
On macOS the dscl .
Technique: T1087: Account Discovery
InvisiMole has a command to list account information on the victim’s machine.
Technique: T1087: Account Discovery
APT1 used publicly available malware for privilege escalation.
Technique: T1588: Obtain Capabilities
InvisiMole can check for the presence of network sniffers, AV, and BitDefender firewall.
Technique: T1518: Software Discovery
### Office Applications
Common office and productivity applications such as Microsoft Office are also targeted through Phishing.
Technique: T1203: Exploitation for Client Execution
One of the discovered config files contained a URL with an as yet unidentified md5: hxxps://46.165.222(dot)28/upgrade/bf0dac805798cc1f633f19ce8ed6382f/upgrade.php Victim set #4 A set of victims discovered installed Siemens SCADA software in their ICS environment was responsible for downloading and executing BlackEnergy
Technique: T1105: Ingress Tool Transfer
APT41 has created services to appear as benign system tools.
Technique: T1036: Masquerading
Sandworm Team has exfiltrated internal documents, files, and other data from compromised hosts.
Technique: T1005: Data from Local System
Dok proxies web traffic to potentially monitor and alter victim HTTP traffic.
Technique: T1557: Adversary-in-the-Middle
Grandoreiro can utilize web services including Google sites to send and receive C2 data.
Technique: T1102: Web Service
It uses Shortcut Modification of directory .LNK files that use Masquerading to look like the real directories, which are hidden through Hidden Files and Directories.
Technique: T1080: Taint Shared Content
TrickBot uses module networkDll for process list discovery.
Technique: T1057: Process Discovery
TEMP.Veles has planted Web shells on Outlook Exchange servers.
Technique: T1505: Server Software Component
IcedID can inject itself into a suspended msiexec.exe process to send beacons to C2 while appearing as a normal msi application.
Technique: T1218: Signed Binary Proxy Execution
Magic Hound has used PowerShell for execution and privilege escalation.
Technique: T1059: Command and Scripting Interpreter
FIN4 has accessed and hijacked online email communications using stolen credentials.
Technique: T1114: Email Collection
The tokens for each platform are hardcoded within the sample:November 2016 to January 2017: "Evil New Year" CampaignIn the early part of 2017, Group123 started the "Evil New Year" campaign
Technique: T1134: Access Token Manipulation
Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.
Technique: T1555: Credentials from Password Stores
Gamaredon Group has deployed scripts on compromised systems that automatically scan for interesting documents.
Technique: T1119: Automated Collection
Goopy has had null characters padded in its malicious DLL payload.
Technique: T1027: Obfuscated Files or Information
HISTCONTROL can also be set to ignore duplicate commands by setting it to "ignoredups".
Technique: T1562: Impair Defenses
Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open attachments.
Technique: T1204: User Execution
Suckfly used legitimate account credentials that they dumped to navigate the internal victim network as though they were the legitimate account owner.
Technique: T1078: Valid Accounts
WhiskeyDelta can overwrite the first 132MB or 1.5MB of each drive with random data from heap memory.
Technique: T1561: Disk Wipe
BRONZE BUTLER has used a Windows 10 specific tool and xxmm to bypass UAC for privilege escalation.
Technique: T1548: Abuse Elevation Control Mechanism
Wizard Spider has sent phishing emails containing a link to an actor-controlled Google Drive document or other free online file hosting services.
Technique: T1566: Phishing
A remote build request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or local registry and then builds a custom image upon it.
Technique: T1612: Build Image on Host
SoreFang can collect usernames from the local system via net.exe user.
Technique: T1087: Account Discovery
Carbon decrypts task and configuration files for execution.
Technique: T1140: Deobfuscate/Decode Files or Information
njRAT will attempt to detect if the victim system has a camera during the initial infection.
Technique: T1120: Peripheral Device Discovery
The Glimpse panel showing three compromised systems To interact with a specific agent, the actor selects the entry to open in the agent control panel
Technique: T1543: Create or Modify System Process
BackConfig can download and run batch files to execute commands on a compromised host.
Technique: T1059: Command and Scripting Interpreter
Duqu is capable of loading executable code via process hollowing.
Technique: T1055: Process Injection
Sandworm Team has used remote administration tools or remote industrial control system client software to maliciously release electricity breakers.
Technique: T1219: Remote Access Software
Hancitor has deleted files using the VBA kill function.
Technique: T1070: Indicator Removal on Host
Public file scanning services, such as VirusTotal, limits the maximum size of an uploaded file to be analyzed.
Technique: T1027: Obfuscated Files or Information
This functionality has been implemented in the MimiPenguin, an open source tool inspired by Mimikatz.
Technique: T1003: OS Credential Dumping
Leviathan has used publicly available tools to dump password hashes, including HOMEFRY.
Technique: T1003: OS Credential Dumping
Nebulae has the ability to delete files and directories.
Technique: T1070: Indicator Removal on Host
MuddyWater has used tools to encode C2 communications including Base64 encoding.
Technique: T1132: Data Encoding
There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in.
Technique: T1547: Boot or Logon Autostart Execution
Ramsay can detect system information--including disk names, total space, and remaining space--to create a hardware profile GUID which acts as a system identifier for operators.
Technique: T1082: System Information Discovery
PowerStallion uses Microsoft OneDrive as a C2 server via a network drive mapped with net use.
Technique: T1102: Web Service
Misdat is capable of deleting the backdoor file.
Technique: T1070: Indicator Removal on Host
In an enterprise environment, servers and workstations can be organized into domains.
Technique: T1021: Remote Services
Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller.
Technique: T1552: Unsecured Credentials
Carberp has installed a bootkit on the system to maintain persistence.
Technique: T1542: Pre-OS Boot
BRONZE BUTLER has exfiltrated files stolen from local systems.
Technique: T1005: Data from Local System
Exaramel uses RC4 for encrypting the configuration.
Technique: T1027: Obfuscated Files or Information
This may include enumerating time-based properties, such as uptime or the system clock, as well as the use of timers or other triggers to avoid a virtual machine environment  or sandbox, specifically those that are automated or only operate for a limited amount of time.
Technique: T1497: Virtualization/Sandbox Evasion
During the T9000 installation process, it drops a copy of the legitimate Microsoft binary igfxtray.exe.
Technique: T1574: Hijack Execution Flow
RTM can use the FindNextUrlCacheEntryA and FindFirstUrlCacheEntryA functions to search for specific strings within browser history.
Technique: T1106: Native API
We believe this access was abused, for example, by inserting malicious scripts in the country’s official websites in order to conduct watering hole attacks
Technique: T1189: Drive-by Compromise
Adversaries may create self-signed SSL/TLS certificates that can be used during targeting.
Technique: T1587: Develop Capabilities
Bad Rabbit has encrypted files and disks using AES-128-CBC and RSA-2048.
Technique: T1486: Data Encrypted for Impact
Derusbi injects itself into the secure shell  process.
Technique: T1055: Process Injection
Zeus Panda uses PowerShell to download and execute the payload.
Technique: T1059: Command and Scripting Interpreter
Starting in Mac OS X 10.7 , users can specify certain applications to be re-opened when a user logs into their machine after reboot.
Technique: T1547: Boot or Logon Autostart Execution
Other possibilities include social engineering a domain registration help desk to gain access to an account or taking advantage of renewal process gaps.
Technique: T1584: Compromise Infrastructure
Dtrack can list files on available disk volumes.
Technique: T1083: File and Directory Discovery
CozyCar uses Twitter as a backup C2 channel to Twitter accounts specified in its configuration file.
Technique: T1102: Web Service
PoisonIvy creates a backdoor through which remote attackers can open a command-line interface.
Technique: T1059: Command and Scripting Interpreter
Watches uninstall time, checks time diff (local time vs internet time)
Technique: T1124: System Time Discovery
Threat Group-3390 has deleted existing logs and exfiltrated file archives from a victim.
Technique: T1070: Indicator Removal on Host
Launch Agents can also be executed using the Launchctl command.
Technique: T1543: Create or Modify System Process
The Microsoft Windows Application Compatibility Infrastructure/Framework  was created to allow for backward compatibility of software as the operating system codebase changes over time.
Technique: T1546: Event Triggered Execution
[Screenshot 1] Encrypted Login Packet sent by Gh0stRAT infected PC  In addition to a standard malware analysis blog post, I’d also like to take this time to document and describe my methods for analysis, in the hopes that you as a reader will use these techniques in the future
Technique: T1113: Screen Capture
APT39 has utilized tools to aggregate data prior to exfiltration.
Technique: T1074: Data Staged
Molerats has sent malicious links via email trick users into opening a RAR archive and running an executable.
Technique: T1204: User Execution
Anchor can determine the public IP and location of a compromised host.
Technique: T1016: System Network Configuration Discovery
This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services.
Technique: T1580: Cloud Infrastructure Discovery
Goopy has checked for the Google Updater process to ensure Goopy was loaded properly.
Technique: T1057: Process Discovery
Windshift has used malware to identify the username on a compromised host.
Technique: T1033: System Owner/User Discovery
WastedLocker has used cmd to execute commands on the system.
Technique: T1059: Command and Scripting Interpreter
Adversaries may also compromise web servers to support watering hole operations, as in Drive-by Compromise.
Technique: T1584: Compromise Infrastructure