HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
USBferry can execute various Windows commands.
Technique: T1059: Command and Scripting Interpreter
Receiving C2 instructions from user profiles created by the adversary on legitimate websites/forums such as Github and Microsoft's TechNet portal
Technique: T1102: Web Service
VBShower has attempted to obtain a VBS script from command and control  nodes over HTTP.
Technique: T1071: Application Layer Protocol
Micropsia uses HTTP and HTTPS for C2 network communications.
Technique: T1071: Application Layer Protocol
RARSTONE downloads its backdoor component from a C2 server and loads it directly into memory.
Technique: T1105: Ingress Tool Transfer
Derusbi collects current and parent process IDs.
Technique: T1057: Process Discovery
Seasalt has a command to perform a process listing.
Technique: T1057: Process Discovery
This links the previous samples with this unique username
Technique: T1033: System Owner/User Discovery
Fox Kitten has used a Perl reverse shell to communicate with C2.
Technique: T1059: Command and Scripting Interpreter
NETWIRE has the ability to compress archived screenshots.
Technique: T1560: Archive Collected Data
Operation Wocao's backdoors have been written in Python and compiled with py2exe.
Technique: T1059: Command and Scripting Interpreter
APT28 encrypted a .dll payload using RTL and a custom encryption algorithm.
Technique: T1027: Obfuscated Files or Information
Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries , on Windows systems.
Technique: T1218: Signed Binary Proxy Execution
TrickBot has been delivered via malicious links in phishing e-mails.
Technique: T1566: Phishing
Sandworm Team has crafted spearphishing emails with hyperlinks designed to trick unwitting recipients into revealing their account credentials.
Technique: T1598: Phishing for Information
Cannon can obtain victim drive information as well as a list of folders in C:\Program Files.
Technique: T1083: File and Directory Discovery
A number of native Windows utilities have been used by adversaries to disable or delete system recovery features:
* vssadmin.exe can be used to delete all volume shadow copies on a system - vssadmin.exe delete shadows /all /quiet
* Windows Management Instrumentation can be used to delete volume shadow copies - wmic shadowcopy delete
* wbadmin.exe can be used to delete the Windows Backup Catalog - wbadmin.exe delete catalog -quiet
* bcdedit.exe can be used to disable automatic Windows recovery features by modifying boot configuration data - bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no H1N1 disable recovery options and deletes shadow copies from the victim.
Technique: T1490: Inhibit System Recovery
BACKSPACE is capable of enumerating and making modifications to an infected system's Registry.
Technique: T1012: Query Registry
Ke3chang used a .NET tool to dump data from Microsoft Exchange mailboxes.
Technique: T1114: Email Collection
Aria-body has the ability to execute a process using runas.
Technique: T1134: Access Token Manipulation
Information from these sources may reveal opportunities for other forms of reconnaissance  or Search Open Technical Databases, establishing operational resources  or Compromise Accounts, and/or initial access  or Phishing.
Technique: T1593: Search Open Websites/Domains
A tool has been developed to facilitate planting backdoors in cloud container images.
Technique: T1525: Implant Internal Image
Astaroth creates a startup item for persistence.
Technique: T1547: Boot or Logon Autostart Execution
Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel.
Technique: T1567: Exfiltration Over Web Service
For example, compromised business accounts are often used to send messages to other accounts in the network of the target business while creating inbox rules , so the messages evade spam/phishing detection mechanisms.
Technique: T1098: Account Manipulation
The downloaded document template contains the malicious macro codes, which executes a VBScript (VBS).
Technique: T1059: Command and Scripting Interpreter
Indrik Spider has used the win32_service WMI class to retrieve a list of services from the system.
Technique: T1007: System Service Discovery
In addition to purchasing malware, adversaries may steal and repurpose malware from third-party entities .
Technique: T1588: Obtain Capabilities
Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise.
Technique: T1102: Web Service
Ramsay can extract its agent from the body of a malicious document.
Technique: T1140: Deobfuscate/Decode Files or Information
A module in Prikormka collects information from the victim about Windows OS version, computer name, battery info, and physical memory.
Technique: T1082: System Information Discovery
Adversaries may attempt to find cloud groups and permission settings.
Technique: T1069: Permission Groups Discovery
APT32 regularly used stealthy techniques to blend in with legitimate user activity:  During one investigation, APT32 was observed using a privilege escalation exploit (CVE-2016-7255) masquerading as a Windows hotfix
Technique: T1068: Exploitation for Privilege Escalation
When running with root privileges after a Launch Agent is installed, ThiefQuest installs a plist file to the /Library/LaunchDaemons/ folder with the RunAtLoad key set to true establishing persistence as a Launch Daemon.
Technique: T1543: Create or Modify System Process
SoreFang has the ability to encode and RC6 encrypt data sent to C2.
Technique: T1027: Obfuscated Files or Information
ADVSTORESHELL has used rundll32.exe in a Registry value to establish persistence.
Technique: T1218: Signed Binary Proxy Execution
A custom CHM file containing embedded payloads could be delivered to a victim then triggered by User Execution.
Technique: T1218: Signed Binary Proxy Execution
Modifying or disabling a cloud firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed.
Technique: T1562: Impair Defenses
Cannon can gather system information from the victim’s machine such as the OS version, machine name, and drive information.
Technique: T1082: System Information Discovery
QakBot has gained execution through users opening malicious attachments.
Technique: T1204: User Execution
Otherwise, access is denied.
Technique: T1222: File and Directory Permissions Modification
An adversary may rely upon a user clicking a malicious link in order to gain execution.
Technique: T1204: User Execution
Webshell can delete scripts from a subdirectory of /tmp after they are run.
Technique: T1070: Indicator Removal on Host
Another variant is encoded with XOR.
Technique: T1027: Obfuscated Files or Information
Fox Kitten has used valid accounts to access SMB shares.
Technique: T1021: Remote Services
KEYMARBLE gathers the MAC address of the victim’s machine.
Technique: T1016: System Network Configuration Discovery
Revenge RAT has a plugin for credential harvesting.
Technique: T1003: OS Credential Dumping
Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes.
Technique: T1091: Replication Through Removable Media
Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust.
Technique: T1553: Subvert Trust Controls
StoneDrill has looked in the registry to find the default browser path.
Technique: T1012: Query Registry
Using at requires that the Task Scheduler service be running, and the user to be logged on as a member of the local Administrators group.
Technique: T1053: Scheduled Task/Job
For example, through behaviors such as Modify System Image, Reduce Key Space, and Disable Crypto Hardware, an adversary can negatively effect and/or eliminate a device’s ability to securely encrypt network traffic.
Technique: T1600: Weaken Encryption
DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts.
Technique: T1590: Gather Victim Network Information
Note: DLL side loading is a prevalent persistence technique that is used to launch a multitude of backdoors
Technique: T1574: Hijack Execution Flow
Thread Execution Hijacking is a method of executing arbitrary code in the address space of a separate live process.
Technique: T1055: Process Injection
Webshell can upload and download files to and from compromised hosts.
Technique: T1105: Ingress Tool Transfer
Sandworm Team has created email accounts that mimic legitimate organizations for its spearphishing operations.
Technique: T1585: Establish Accounts
PipeMon can collect and send OS version and computer name as a part of its C2 beacon.
Technique: T1082: System Information Discovery
Ltd.. Wizard Spider has used Digicert code-signing certificates for some of its malware.
Technique: T1553: Subvert Trust Controls
Hidden file systems, sometimes referred to as virtual file systems, can be implemented in numerous ways.
Technique: T1564: Hide Artifacts
HiddenWasp uses a rootkit to hook and implement functions on the system.
Technique: T1014: Rootkit
Ramsay can use netstat to enumerate network connections.
Technique: T1049: System Network Connections Discovery
Gamaredon Group has obfuscated .NET executables by inserting junk code.
Technique: T1027: Obfuscated Files or Information
Note: CTU researchers frequently observe threat actors renaming archiving tools and storing data for exfiltration in uncommon directories
Technique: T1132: Data Encoding
To enable this traffic signaling on embedded devices, adversaries must first achieve and leverage Patch System Image due to the monolithic nature of the architecture.
Technique: T1205: Traffic Signaling
Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.
Technique: T1059: Command and Scripting Interpreter
Figure 2: WindowsParentalControlsMigration CommandLineTemplate Figure 3 contains the decoded PowerShell command from the “CommandLineTemplate.”      Figure 3: Decoded CommandLineTemplate PowerShell code POSHSPY PowerShell Component The full code for a POSHSPY sample is available here
Technique: T1546: Event Triggered Execution
MISC::AddSid
Technique: T1134: Access Token Manipulation
Motherboard Check The Trojan will perform the following WMI query:   Select * from Win32_BaseBoard   The Trojan will check the Manufacturer and Product fields in the results for the strings VMware, Virtual, VBox, VM or Oracle
Technique: T1497: Virtualization/Sandbox Evasion
Chaes has used Installutill to download content.
Technique: T1218: Signed Binary Proxy Execution
PROMETHIUM has created self-signed digital certificates for use in HTTPS C2 traffic.
Technique: T1587: Develop Capabilities
Other tools may also be used, such as a remote access tool, which may contain functionality to interact with the Registry through the Windows API.
Technique: T1112: Modify Registry
Common public key encryption algorithms include RSA and ElGamal.
Technique: T1573: Encrypted Channel
ZIRCONIUM has used AES encrypted communications in C2.
Technique: T1573: Encrypted Channel
AppleSeed has the ability to use multiple dynamically resolved API calls.
Technique: T1106: Native API
Carbanak obtains Windows logon password details.
Technique: T1003: OS Credential Dumping
The malware drops the Windows batch file dx.bat, which attempts to kill the task daumcleaner.exe; a Korean security program
Technique: T1036: Masquerading
Chimera has cleared event logs on compromised hosts.
Technique: T1070: Indicator Removal on Host
DDKONG downloads and uploads files on the victim’s machine.
Technique: T1105: Ingress Tool Transfer
PoisonIvy hides any strings related to its own indicators of compromise.
Technique: T1027: Obfuscated Files or Information
Bundlore uses the pkill cfprefsd command to prevent users from inspecting processes.
Technique: T1562: Impair Defenses
HALFBAKED can obtain information about running processes on the victim.
Technique: T1057: Process Discovery
Goopy's decrypter have been inflated with junk code in between legitimate API functions, and also included infinite loops to avoid analysis.
Technique: T1027: Obfuscated Files or Information
The JHUHUGIT dropper can delete itself from the victim.
Technique: T1070: Indicator Removal on Host
JCry has used PowerShell to execute payloads.
Technique: T1059: Command and Scripting Interpreter
Adversaries may search and gather information about victims from closed sources that can be used during targeting.
Technique: T1597: Search Closed Sources
MegaCortex can parse the available drives and directories to determine which files to encrypt.
Technique: T1083: File and Directory Discovery
Proc memory injection is commonly performed by overwriting the target processes’ stack using memory mappings provided by the /proc filesystem.
Technique: T1055: Process Injection
DEATHRANSOM can enumerate logical drives on a target system.
Technique: T1082: System Information Discovery
captures window titles.
Technique: T1010: Application Window Discovery
All forms of phishing are electronically delivered social engineering.
Technique: T1566: Phishing
Ramsay can take screenshots every 30 seconds as well as when an external removable storage device is connected.
Technique: T1113: Screen Capture
GrimAgent has the ability to enumerate files and directories on a compromised host.
Technique: T1083: File and Directory Discovery
Adversaries may install malicious ISAPI extensions and filters to observe and/or modify traffic, execute commands on compromised machines, or proxy command and control traffic.
Technique: T1505: Server Software Component
As we discover new tools used by this group, we have consistently discovered overlapping artifacts with previously used tools and infrastructure
Technique: T1518: Software Discovery
APT37 has used strategic web compromises, particularly of South Korean websites, to distribute malware.
Technique: T1189: Drive-by Compromise
MechaFlounder uses a python-based payload.
Technique: T1059: Command and Scripting Interpreter
APT38 has identified security software, configurations, defensive tools, and sensors installed on a compromised system.
Technique: T1518: Software Discovery
* .plist.
Technique: T1547: Boot or Logon Autostart Execution
Tropic Trooper also decrypted image files which contained a payload.
Technique: T1140: Deobfuscate/Decode Files or Information
Babuk can use “WNetOpenEnumW” and “WNetEnumResourceW” to enumerate files in network resources for encryption.
Technique: T1049: System Network Connections Discovery
Figure 12 and Figure 13 show the RSA keys used in FELIXROOT, and Figure 14 shows the AES encryption parameters
Technique: T1521: nan
Final1stspy uses Python code to deobfuscate base64-encoded strings.
Technique: T1140: Deobfuscate/Decode Files or Information
WannaCry uses Tor for command and control traffic.
Technique: T1090: Proxy
BADCALL uses a FakeTLS method during C2.
Technique: T1001: Data Obfuscation
Ecipekac can download additional payloads to a compromised host.
Technique: T1105: Ingress Tool Transfer
Some of the key obfuscation techniques used are:   Character Replacement: Several instances of character replacement and string reversing techniques (Figure 10) make analysis difficult
Technique: T1027: Obfuscated Files or Information
Unlike in Cloud Service Discovery, this technique focuses on the discovery of components of the provided services rather than the services themselves.
Technique: T1580: Cloud Infrastructure Discovery
After running a virtual instance, adversaries may create a shared folder between the guest and host with permissions that enable the virtual instance to interact with the host file system.
Technique: T1564: Hide Artifacts
APT39 has modified LNK shortcuts.
Technique: T1547: Boot or Logon Autostart Execution
Adversaries may abuse time providers to execute DLLs when the system boots.
Technique: T1547: Boot or Logon Autostart Execution
Threat Group-3390 has also obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network.
Technique: T1133: External Remote Services
One persistence mechanism used by CozyCar is to register itself as a scheduled task.
Technique: T1053: Scheduled Task/Job
InvisiMole has used a custom implementation of DNS tunneling to embed C2 communications in DNS requests and replies.
Technique: T1071: Application Layer Protocol
Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system.
Technique: T1053: Scheduled Task/Job
It also uses a one-byte xor against 0x91 to encode configuration data.
Technique: T1027: Obfuscated Files or Information
PoetRAT has used LZMA and base64 libraries to decode obfuscated scripts.
Technique: T1140: Deobfuscate/Decode Files or Information
FIN8 has used environment variables and standard input  to obfuscate command-line arguments.
Technique: T1027: Obfuscated Files or Information
System firmware like BIOS and EFI underly the functionality of a computer and may be modified by an adversary to perform or assist in malicious activity.
Technique: T1542: Pre-OS Boot
The security command-line utility, which is built into macOS by default, provides a useful way to manage these credentials.
Technique: T1555: Credentials from Password Stores
SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.
Technique: T1547: Boot or Logon Autostart Execution
Pteranodon can capture screenshots at a configurable interval.
Technique: T1113: Screen Capture
Several operating system administration utilities exist that can be used to gather this information.
Technique: T1016: System Network Configuration Discovery
If one is identified, it will encrypt the files on the attached device.
Technique: T1120: Peripheral Device Discovery
Gazer identifies a proxy server if it exists and uses it to make HTTP requests.
Technique: T1090: Proxy
Adversaries may modify the kernel to automatically execute programs on system boot.
Technique: T1547: Boot or Logon Autostart Execution
Comnie uses RC4 and Base64 to obfuscate strings.
Technique: T1027: Obfuscated Files or Information
APT29 gained initial network access to some victims via a trojanized update of SolarWinds Orion software.
Technique: T1195: Supply Chain Compromise
ObliqueRAT can gain persistence by a creating a shortcut in the infected user's Startup directory.
Technique: T1547: Boot or Logon Autostart Execution
KONNI can gather the OS version, architecture information, connected drives, hostname, and computer name from the victim’s machine and has used systeminfo.exe to get a snapshot of the current system state of the target machine.
Technique: T1082: System Information Discovery
Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries.
Technique: T1574: Hijack Execution Flow
They may do this, for example, by retrieving account usernames or by using OS Credential Dumping.
Technique: T1033: System Owner/User Discovery
Windows SSP DLLs are loaded into the Local Security Authority  process at system start.
Technique: T1547: Boot or Logon Autostart Execution
An adversary may also be able to escalate privileges if a script in a PowerShell profile is loaded and executed by an account with higher privileges, such as a domain administrator.
Technique: T1546: Event Triggered Execution
Transparent Tribe has used websites with malicious hyperlinks and iframes to infect targeted victims with Crimson, njRAT, and other malicious tools.
Technique: T1189: Drive-by Compromise
Lokibot has tricked recipients into enabling malicious macros by getting victims to click "enable content" in email attachments.
Technique: T1204: User Execution
The C&C server then replies with the encrypted serialized configuration
Technique: T1027: Obfuscated Files or Information
APT39 has exfiltrated stolen victim data through C2 communications.
Technique: T1041: Exfiltration Over C2 Channel
HTTP/S packets have many fields and headers in which data can be concealed.
Technique: T1071: Application Layer Protocol
SombRAT can enumerate services on a victim machine.
Technique: T1007: System Service Discovery
The first stage may have automated capabilities to collect basic host information, update tools, and upload additional files.
Technique: T1104: Multi-Stage Channels
JHUHUGIT has a command to download files to the victim’s machine.
Technique: T1105: Ingress Tool Transfer
MarkiRAT can utilize cmd.exe to execute commands in a victim's environment.
Technique: T1059: Command and Scripting Interpreter
Dragonfly 2.0 has performed screen captures of victims, including by using a tool, scr.exe .
Technique: T1113: Screen Capture
Ke3chang regained access after eviction via the corporate VPN solution with a stolen VPN certificate, which they had extracted from a compromised host.
Technique: T1133: External Remote Services
This campaign began with a handful of spear phishing emails to South Korean targets and containing malicious attachments
Technique: T1566: Phishing
The Trojan checks to see if the result of this query returned a class with more than 0 elements, which would most likely be true in a non-virtual environment
Technique: T1018: Remote System Discovery
UNC2452 also created a scheduled task to maintain SUNSPOT persistence when the host booted.
Technique: T1053: Scheduled Task/Job
ShimRat can download additional files.
Technique: T1105: Ingress Tool Transfer
New services created by RawPOS are made to appear like legitimate Windows services, with names such as "Windows Management Help Service", "Microsoft Support", and "Windows Advanced Task Manager".
Technique: T1036: Masquerading
APT32 has moved and renamed pubprn.vbs to a .txt file to avoid detection.
Technique: T1036: Masquerading
Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Technique: T1571: Non-Standard Port
FIN8 has used valid accounts for persistence and lateral movement.
Technique: T1078: Valid Accounts
Operation Wocao has used a custom collection method to intercept two-factor authentication soft tokens.
Technique: T1111: Two-Factor Authentication Interception
Anchor can use secondary C2 servers for communication after establishing connectivity and relaying victim information to primary C2 servers.
Technique: T1008: Fallback Channels
Access to login hook scripts may allow an adversary to insert additional malicious code.
Technique: T1037: Boot or Logon Initialization Scripts
LightNeuron uses SMTP for C2.
Technique: T1071: Application Layer Protocol
Pasam creates a backdoor through which remote attackers can retrieve information such as hostname and free disk space.
Technique: T1082: System Information Discovery
* **Inline hooking**, which overwrites the first bytes in an API function to redirect code flow.
Technique: T1056: Input Capture
Leviathan has inserted garbage characters into code, presumably to avoid anti-virus detection.
Technique: T1027: Obfuscated Files or Information
Figure 3 – A list of file extensions targeted for destruction by new variant of KillDisk component As well as being able to delete system files to make the system unbootable – functionality typical for such destructive trojans – the KillDisk variant detected in the electricity distribution companies also appears to contain some additional functionality specifically intended to sabotage industrial systems
Technique: T1083: File and Directory Discovery
19-1 regsvr32 running the .dlls  Fig
Technique: T1218: Signed Binary Proxy Execution
Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel.
Technique: T1048: Exfiltration Over Alternative Protocol
When the device is inserted into another system, it opens autorun.inf and loads the malware.
Technique: T1091: Replication Through Removable Media
Fox Kitten has obtained files from the victim's cloud storage instances.
Technique: T1530: Data from Cloud Storage Object
APT37 has used Windows DDE for execution of commands and a malicious VBS.
Technique: T1559: Inter-Process Communication
Some variants of ADVSTORESHELL achieve persistence by registering the payload as a Shell Icon Overlay handler COM object.
Technique: T1546: Event Triggered Execution
Siloscape connects to an IRC server for C2.
Technique: T1071: Application Layer Protocol
CallMe uses AES to encrypt C2 traffic.
Technique: T1573: Encrypted Channel
If a networked device does not have the link layer address of a particular networked device, it may send out a broadcast ARP request to the local network to translate the IP address to a MAC address.
Technique: T1557: Adversary-in-the-Middle
These difficulties can slow down the incident response process and help adversaries hide their tactics, techniques, and procedures .
Technique: T1480: Execution Guardrails
Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems.
Technique: T1539: Steal Web Session Cookie
Andariel has collected large numbers of files from compromised network systems for later extraction.
Technique: T1005: Data from Local System
FELIXROOT uses HTTP and HTTPS to communicate with the C2 server.
Technique: T1071: Application Layer Protocol
Silence can capture victim screen activity.
Technique: T1113: Screen Capture
Adversaries may abuse these mechanisms to evade defenses, such as those blocking processes spawning directly from Office documents, and analysis targeting unusual/potentially malicious parent-child process relationships, such as spoofing the PPID of PowerShell/Rundll32 to be explorer.exe rather than an Office document delivered as part of Spearphishing Attachment.
Technique: T1134: Access Token Manipulation
To make profile pages appear more legitimate, APT17 has created biographical sections and posted in forum threads.
Technique: T1585: Establish Accounts
InvisiMole has disguised its droppers as legitimate software or documents, matching their original names and locations, and saved its files as mpr.dll in the Windows folder.
Technique: T1036: Masquerading
For example, an adversary may copy source code for the client software, add a backdoor, compile for the target, and replace the legitimate application binary  with the backdoored one.
Technique: T1554: Compromise Client Software Binary
Agent Tesla can collect the system's computer name and also has the capability to collect information on the processor, memory, OS, and video card from the system.
Technique: T1082: System Information Discovery
Adversaries may search digital certificate data to gather actionable information.
Technique: T1596: Search Open Technical Databases
Crutch has exfiltrated stolen data to Dropbox.
Technique: T1567: Exfiltration Over Web Service
Grandoreiro can hook APIs, kill processes, break file system paths, and change ACLs to prevent security tools from running.
Technique: T1562: Impair Defenses
On Linux or macOS, when the setuid or setgid bits are set for an application, the application will run with the privileges of the owning user or group respectively. .
Technique: T1548: Abuse Elevation Control Mechanism
PlugX uses Pastebin to store C2 addresses.
Technique: T1102: Web Service
Leviathan has sent spearphishing email links attempting to get a user to click.
Technique: T1204: User Execution
PoetRAT has used a Python tool named Bewmac to record the webcam on compromised hosts.
Technique: T1125: Video Capture
POWERSTATS can use WMI queries to retrieve data from compromised hosts.
Technique: T1047: Windows Management Instrumentation
A Threat Group-3390 tool can create a new service, naming it after the config information, to gain persistence.
Technique: T1543: Create or Modify System Process
Spark has used a custom XOR algorithm to decrypt the payload.
Technique: T1140: Deobfuscate/Decode Files or Information
This IP is of particular interest as historical domain resolutions of this IP revealed that it had resolved to the domain hotmai1l[.]com in the past as well, which was a domain we had previously identified as having a high likelihood of association with DarkHydrus infrastructure
Technique: T1016: System Network Configuration Discovery
SPACESHIP identifies files and directories for collection by searching for specific file extensions or file modification time.
Technique: T1083: File and Directory Discovery
TajMahal has the ability to capture VoiceIP application audio on an infected host.
Technique: T1123: Audio Capture
Turla RPC backdoors can be used to transfer files to/from victim machines on the local network.
Technique: T1570: Lateral Tool Transfer
BadPatch uses HTTP for C2.
Technique: T1071: Application Layer Protocol
Skidmap has the ability to install several loadable kernel modules  on infected machines.
Technique: T1547: Boot or Logon Autostart Execution
Permissions to interact with local and remote server COM objects are specified by access control lists  in the Registry.
Technique: T1021: Remote Services
RogueRobin collects the victim’s username and whether that user is an admin.
Technique: T1033: System Owner/User Discovery
Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol.
Technique: T1040: Network Sniffing
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
Technique: T1078: Valid Accounts
ZIRCONIUM has used a tool to capture the time on a compromised host in order to register it with C2.
Technique: T1124: System Time Discovery
AppleSeed can identify the OS version of a targeted system.
Technique: T1082: System Information Discovery
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.
Technique: T1090: Proxy
Additionally, system configuration changes  may cause folders such as usr/local/bin to become globally writeable.
Technique: T1543: Create or Modify System Process
Shamoon attempts to copy itself to remote machines on the network.
Technique: T1570: Lateral Tool Transfer
Common client software types are SSH clients, FTP clients, email clients, and web browsers.
Technique: T1554: Compromise Client Software Binary
http://www.cankayasrc[.]com/style/js/main.php http://ektamservis[.]com/includes/main.php http://gtme[.]ae/font-awesome/css/main.php  Recommendations for organizations Effective protection from targeted attacks focuses on advanced detective, preventive and investigative capabilities via solutions and training, allowing an organization to control any activities on their network or suspicious files on user systems
Technique: T1071: Application Layer Protocol
It is possible to delegate GPO access control permissions, e.g.
Technique: T1484: Domain Policy Modification
MuddyWater has used malware to collect the victim’s IP address and domain name.
Technique: T1016: System Network Configuration Discovery
APT41 used cmd.exe /c to execute commands on remote machines.
Technique: T1059: Command and Scripting Interpreter
HOPLIGHT has used its C2 channel to exfiltrate data.
Technique: T1041: Exfiltration Over C2 Channel
Botnets are commonly used to conduct DDoS attacks against networks and services.
Technique: T1499: Endpoint Denial of Service
OwaAuth DES-encrypts captured credentials using the key 12345678 before writing the credentials to a log file.
Technique: T1560: Archive Collected Data
In one example, the Word document contained a button with the label “First click “Enable Content” above the page, then click here to fill out the form”  This string attempts to trick the user into enabling macros to execute the malicious code within the macro
Technique: T1204: User Execution
Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Technique: T1542: Pre-OS Boot
RTM can detect if it is running within a sandbox or other virtualized analysis environment.
Technique: T1497: Virtualization/Sandbox Evasion
APT39 has used stolen credentials to compromise Outlook Web Access .
Technique: T1078: Valid Accounts
Carbanak’s Harpy backdoor malware can use DNS as a backup channel for C2 if HTTP fails.
Technique: T1008: Fallback Channels
Adversaries may do this to execute commands as other users or spawn processes with higher privileges.
Technique: T1548: Abuse Elevation Control Mechanism
Exfiltrate data using HTTP over HTTP over AES over XOR, or any combination of the available transports
Technique: T1071: Application Layer Protocol
Remexi uses AutoIt and VBS scripts throughout its execution process.
Technique: T1059: Command and Scripting Interpreter
Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP.
Technique: T1021: Remote Services
This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container.
Technique: T1204: User Execution
Chimera has used gzip for Linux OS and a modified RAR software to archive data on Windows hosts.
Technique: T1560: Archive Collected Data
As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.
Technique: T1003: OS Credential Dumping
Atypical root certificates have also been pre-installed on systems by the manufacturer or in the software supply chain and were used in conjunction with malware/adware to provide Adversary-in-the-Middle capability for intercepting information transmitted over secure TLS/SSL communications.
Technique: T1553: Subvert Trust Controls
These credentials can be stored and/or misplaced in many locations on a system, including plaintext files , operating system or application-specific repositories , or other specialized files/artifacts .
Technique: T1552: Unsecured Credentials
Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection.
Technique: T1567: Exfiltration Over Web Service
Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is.
Technique: T1587: Develop Capabilities
njRAT has used a fast flux DNS for C2 IP resolution.
Technique: T1568: Dynamic Resolution
The Windows utility Nltest is known to be used by adversaries to enumerate domain trusts.
Technique: T1482: Domain Trust Discovery
Adversaries may abuse launchctl to execute commands or programs.
Technique: T1569: System Services
at can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account.
Technique: T1053: Scheduled Task/Job
Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how.
Technique: T1070: Indicator Removal on Host
APT29 has leveraged numerous pieces of malware that appear to be unique to APT29 and were likely developed for or by the group.
Technique: T1587: Develop Capabilities
Turla RPC backdoors have also retrieved registered RPC interface information from process memory.
Technique: T1016: System Network Configuration Discovery
The majority of businesses still maintain Windows-heavy user environments where certain core infrastructure components also operate under Windows servers (e.g., Active Directory, SharePoint, etc.)
Technique: T1010: Application Window Discovery
USBStealer monitors victims for insertion of removable drives.
Technique: T1120: Peripheral Device Discovery
Adversaries may leverage Microsoft Office-based applications for persistence between startups.
Technique: T1137: Office Application Startup
Siloscape searches for the Kubernetes config file and other related files using a regular expression.
Technique: T1083: File and Directory Discovery
Patchwork hides base64-encoded and encrypted C2 server locations in comments on legitimate websites.
Technique: T1102: Web Service
KGH_SPY has the ability to steal data from the Chrome, Edge, Firefox, Thunderbird, and Opera browsers.
Technique: T1555: Credentials from Password Stores
BACKSPACE uses HTTP as a transport to communicate with its command server.
Technique: T1071: Application Layer Protocol
Leviathan has used PowerShell for execution.
Technique: T1059: Command and Scripting Interpreter
APT32 used GetPassword_x64 to harvest credentials.
Technique: T1003: OS Credential Dumping
OSX_OCEANLOTUS.D has changed permissions of a second-stage payload to an executable via chmod.
Technique: T1222: File and Directory Permissions Modification
A version of Daserf uses the MPRESS packer.
Technique: T1027: Obfuscated Files or Information
admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about the OS: ver >> %temp%\download systeminfo >> %temp%\download OilRig has run hostname and systeminfo on a victim.
Technique: T1082: System Information Discovery
Visitors are asked to download the “University Of Oxford Job Symposium Pre-Register Tool”:  The downloaded file (which is also signed with an AI Squared certificate), is a fake registration tool built by the attackers: OxfordSymposiumRegTool.exe f77ee804de304f7c3ea6b87824684b33 If run by the victim, their computer would get infected, while they are shown this registration process:    Note that after completing the “registration process”, the victim is asked to send the form to an email address in oxford-careers[.]com, which also belongs to the attackers
Technique: T1057: Process Discovery
Webshell has the ability to list files and file characteristics including extension, size, ownership, and permissions.
Technique: T1083: File and Directory Discovery
Adversaries may create fake social media accounts and message employees for potential job opportunities.
Technique: T1598: Phishing for Information
APT29 was able to get SUNBURST signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle.
Technique: T1553: Subvert Trust Controls
Conti has decrypted its payload using a hardcoded AES-256 key.
Technique: T1140: Deobfuscate/Decode Files or Information
Higaisa exfiltrated data over its C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread or additional code .
Technique: T1055: Process Injection
VERMIN encrypts the collected files using 3-DES.
Technique: T1560: Archive Collected Data
Adversaries may attempt to find domain-level groups and permission settings.
Technique: T1069: Permission Groups Discovery
Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.
Technique: T1106: Native API
BackdoorDiplomacy has disguised their backdoor droppers with naming conventions designed to blend into normal operations.
Technique: T1036: Masquerading
iKitten lists the current processes running.
Technique: T1057: Process Discovery
DDKONG lists files on the victim’s machine.
Technique: T1083: File and Directory Discovery
A gh0st RAT variant has used DLL side-loading.
Technique: T1574: Hijack Execution Flow
Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence.
Technique: T1543: Create or Modify System Process
The DNS protocol serves an administrative function in computer networking and thus may be very common in environments.
Technique: T1071: Application Layer Protocol
InvisiMole determines a working directory where it stores all the gathered data about the compromised machine.
Technique: T1074: Data Staged
njRAT can browse file systems using a file manager module.
Technique: T1083: File and Directory Discovery
Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site.
Technique: T1553: Subvert Trust Controls
PlugX checks if VMware tools is running in the background by searching for any process named "vmtoolsd".
Technique: T1497: Virtualization/Sandbox Evasion
The FIVEHANDS payload is encrypted with AES-128.
Technique: T1027: Obfuscated Files or Information
Patchwork uses malicious documents to deliver remote execution exploits as part of.
Technique: T1203: Exploitation for Client Execution
GreyEnergy encrypts communications using RSA-2048.
Technique: T1573: Encrypted Channel
After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access.
Technique: T1555: Credentials from Password Stores
Adversaries may leverage information repositories to mine valuable information.
Technique: T1213: Data from Information Repositories
The wormDll32 module attempts to identify servers and domain controllers in the network using NetServerEnum and LDAP queries.
Technique: T1482: Domain Trust Discovery
PsExec can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.
Technique: T1569: System Services
APT41 used a keylogger called GEARSHIFT on a target system.
Technique: T1056: Input Capture
Bankshot generates a false TLS handshake using a public certificate to disguise C2 network communications.
Technique: T1001: Data Obfuscation
The relay step can happen in conjunction with poisoning but may also be independent of it.
Technique: T1557: Adversary-in-the-Middle
FIN5 scripts save memory dump data into a specific directory on hosts in the victim environment.
Technique: T1074: Data Staged
Network Indicators​     Hostname IP Address Notes   mailcenter.support 221.121.138.139 Domain used to for sending spear phishes and user tracking
Technique: T1016: System Network Configuration Discovery
PoisonIvy creates a Registry subkey that registers a new service.
Technique: T1543: Create or Modify System Process
APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits.
Technique: T1071: Application Layer Protocol
Threat Group-3390 actors installed a credential logger on Microsoft Exchange servers.
Technique: T1056: Input Capture
The dropper will delete itself at the end of the process
Technique: T1070: Indicator Removal on Host
BBSRAT can start, stop, or delete services.
Technique: T1569: System Services
Carbon can list the processes on the victim’s machine.
Technique: T1057: Process Discovery
In one version of KeyBoy, string obfuscation routines were used to hide many of the critical values referenced in the malware.
Technique: T1027: Obfuscated Files or Information
H1N1 kills and disables services for Windows Security Center, and Windows Defender.
Technique: T1562: Impair Defenses
Window listings could convey information about how the system is used or give context to information collected by a keylogger.
Technique: T1010: Application Window Discovery
Public IP addresses may be allocated to organizations by block, or a range of sequential addresses.
Technique: T1590: Gather Victim Network Information
menuPass has used the Microsoft administration tool csvde.exe to export Active Directory data.
Technique: T1087: Account Discovery
Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system.
Technique: T1033: System Owner/User Discovery
FinFisher enumerates directories and scans for certain files.
Technique: T1083: File and Directory Discovery
Turla has used PowerShell profiles to maintain persistence on an infected machine.
Technique: T1546: Event Triggered Execution
APT32 has used cmd.exe for execution.
Technique: T1059: Command and Scripting Interpreter
RobbinHood will search for an RSA encryption key and then perform its encryption process on the system files.
Technique: T1486: Data Encrypted for Impact
For example, security products may load their own modules and/or modify those loaded by processes to facilitate data collection.
Technique: T1562: Impair Defenses
It also gathers network information such as the MAC address, IP address, WINS, DHCP server, and gateway
Technique: T1016: System Network Configuration Discovery
POWRUNER may collect active network connections by running netstat -an on a victim.
Technique: T1049: System Network Connections Discovery
ZxShell has a command, ps, to obtain a listing of processes on the system.
Technique: T1057: Process Discovery
Turian can use WinRAR to create a password-protected archive for files of interest.
Technique: T1560: Archive Collected Data
SUNBURST collected hostname, OS version, and device uptime.
Technique: T1082: System Information Discovery
For C2 over DNS, Helminth converts ASCII characters into their hexadecimal values and sends the data in cleartext.
Technique: T1132: Data Encoding
TA505 has used a wide variety of ransomware, such as Locky, Jaff, Bart, Philadelphia, and GlobeImposter, to encrypt victim files and demand a ransom payment.
Technique: T1486: Data Encrypted for Impact
Avaddon uses wmic.exe to delete shadow copies.
Technique: T1047: Windows Management Instrumentation
GoldMax has been packed for obfuscation.
Technique: T1027: Obfuscated Files or Information
ComRAT can check the victim's default browser to determine which process to inject its communications module into.
Technique: T1518: Software Discovery
Some Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic, creating port-protocol mismatches.
Technique: T1571: Non-Standard Port
DropBook can unarchive data downloaded from the C2 to obtain the payload and persistence modules.
Technique: T1140: Deobfuscate/Decode Files or Information
Having access to software's source code may allow adversaries to develop Exploits, while credentials may provide access to additional resources using Valid Accounts.
Technique: T1213: Data from Information Repositories
If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS.
Technique: T1082: System Information Discovery
Anchor can install itself as a cron job.
Technique: T1053: Scheduled Task/Job
XCSSET uses the plutil command to modify the LSUIElement, DFBundleDisplayName, and CFBundleIdentifier keys in the /Contents/Info.plist file.
Technique: T1547: Boot or Logon Autostart Execution
T9000 gathers and beacons the MAC and IP addresses during installation.
Technique: T1016: System Network Configuration Discovery
Utilities used to perform software packing are called packers.
Technique: T1027: Obfuscated Files or Information
Custom implementations of well-known compression algorithms have also been used.
Technique: T1560: Archive Collected Data
SHUTTERSPEED can collect system information.
Technique: T1082: System Information Discovery
Execute noninteractive commands on multiple hosts at once
Technique: T1059: Command and Scripting Interpreter
Remsec is capable of deleting files on the victim.
Technique: T1070: Indicator Removal on Host
Pteranodon can delete files that may interfere with it executing.
Technique: T1070: Indicator Removal on Host
Adversaries may compromise third-party servers that can be used during targeting.
Technique: T1584: Compromise Infrastructure
InvisiMole lists local users and session information.
Technique: T1033: System Owner/User Discovery
Chaes requires the user to click on the malicious Word document to execute the next part of the attack.
Technique: T1204: User Execution
IcedID has used SSL and TLS in communications with C2.
Technique: T1573: Encrypted Channel
Turla has encrypted files stolen from connected USB drives into a RAR file before exfiltration.
Technique: T1560: Archive Collected Data
Several Unix-like systems have moved to Systemd and deprecated the use of RC scripts.
Technique: T1037: Boot or Logon Initialization Scripts