HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
In this case, after the payload is delivered via an exploit the threat actor places files (named upload.bat, upload.rar, and period.txt, download.txt or silent.txt) in a directory on a Dropbox account
Technique: T1105: Ingress Tool Transfer
APT32 has stood up websites containing numerous articles and content scraped from the Internet to make them appear legitimate, but some of these pages include malicious JavaScript to profile the potential victim or infect them via a fake software update.
Technique: T1608: Stage Capabilities
Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion.
Technique: T1090: Proxy
Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.
Technique: T1614: System Location Discovery
It exploits CVE-2017-0199 to download the second stage payload from 193.23.181.151 (Figure 3)
Technique: T1105: Ingress Tool Transfer
Helminth can provide a remote shell.
Technique: T1059: Command and Scripting Interpreter
Taidoor can use DeleteFileA to remove files from infected hosts.
Technique: T1070: Indicator Removal on Host
At the same time, Enc.exe will start the encryption routine and append “. jcry ” as file extension to the encrypted file.
Technique: T1486: Data Encrypted for Impact
In some of the worst cases for DDoS, so many systems are used to generate requests that each one only needs to send out a small amount of traffic to produce enough volume to exhaust the target's resources.
Technique: T1499: Endpoint Denial of Service
Leviathan used ssh for internal reconnaissance.
Technique: T1021: Remote Services
POWERSOURCE is a PowerShell backdoor.
Technique: T1059: Command and Scripting Interpreter
Metamorfo's C2 communication has been encrypted using OpenSSL.
Technique: T1573: Encrypted Channel
Olympic Destroyer overwrites files locally and on remote shares.
Technique: T1485: Data Destruction
Adversaries may search WHOIS data to gather actionable information.
Technique: T1596: Search Open Technical Databases
Dark Caracal leveraged a compiled HTML file that contained a command to download and run an executable.
Technique: T1218: Signed Binary Proxy Execution
The purpose is to download and execute an additional payload hosted on a compromised website: NavRAT
Technique: T1105: Ingress Tool Transfer
They may be executed from within mach-O binaries by using the macOS Native APIs NSAppleScript or OSAScript, both of which execute code independent of the /usr/bin/osascript command line utility.
Technique: T1059: Command and Scripting Interpreter
Adversaries may change this file in storage, to be loaded in a future boot, or in memory during runtime.
Technique: T1601: Modify System Image
TYPEFRAME can install encrypted configuration data under the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\laxhost.dll and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs.
Technique: T1112: Modify Registry
Adversaries may also perform DLL preloading, also called binary planting attacks,  by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL.
Technique: T1574: Hijack Execution Flow
Okrum can collect the victim username.
Technique: T1033: System Owner/User Discovery
Denis can launch a remote shell to execute arbitrary commands on the victim’s machine.
Technique: T1059: Command and Scripting Interpreter
Comnie uses the net user command.
Technique: T1087: Account Discovery
Dragonfly 2.0 compressed data into .zip files prior to exfiltrating it.
Technique: T1560: Archive Collected Data
Rifdoor has the ability to identify the Windows version on the compromised host.
Technique: T1082: System Information Discovery
Cobalt Strike conducts peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol.
Technique: T1071: Application Layer Protocol
RTM runs its core DLL file using rundll32.exe.
Technique: T1218: Signed Binary Proxy Execution
Exfiltration servers can be separately configured from C2 servers.
Technique: T1048: Exfiltration Over Alternative Protocol
JSS Loader has the ability to download malicious executables to a compromised host.
Technique: T1105: Ingress Tool Transfer
XCSSET exfiltrates data stolen from a system over its C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
SilverTerrier uses HTTP for C2 communications.
Technique: T1071: Application Layer Protocol
Stuxnet schedules a network job to execute two minutes after host infection.
Technique: T1053: Scheduled Task/Job
SLOTHFULMEDIA has uploaded files and information from victim machines.
Technique: T1005: Data from Local System
This location data gives the attacker a unique edge, as they can specify a target country or city to attack and maximize their accuracy when choosing a particular target.    The .txt file contains information about the C2 domain and infected machine, as detected in a Cybereason Lab environment
Technique: T1041: Exfiltration Over C2 Channel
Whitefly has used search order hijacking to run the loader Vcrodat.
Technique: T1574: Hijack Execution Flow
NOKKI can collect data from the victim and stage it in LOCALAPPDATA%\MicroSoft Updatea\uplog.tmp.
Technique: T1074: Data Staged
Adversaries may commandeer these sessions to carry out actions on remote systems.
Technique: T1563: Remote Service Session Hijacking
KillDisk loads and executes functions from a DLL.
Technique: T1129: Shared Modules
capture microphone 
Technique: T1123: Audio Capture
RainyDay can use services to establish persistence.
Technique: T1543: Create or Modify System Process
The two variants of MPK share the same registry key that the Trojan uses to automatically run each time the system starts, specifically: [HKLM and HKCU]\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer Both MPK variants include key loggers that are extremely similar in functionality in addition to having the same strings used for headers within the key log file
Technique: T1547: Boot or Logon Autostart Execution
Adversaries may establish persistence by executing malicious content triggered by user inactivity.
Technique: T1546: Event Triggered Execution
Cobalt Strike can be configured to use TCP, ICMP, and UDP for C2 communications.
Technique: T1095: Non-Application Layer Protocol
The ZLib backdoor compresses communications using the standard Zlib compression library.
Technique: T1560: Archive Collected Data
AppleJeus's spearphishing links required user interaction to navigate to the malicious website.
Technique: T1204: User Execution
FIN8 has injected malicious code into a new svchost.exe process.
Technique: T1055: Process Injection
BitPaymer has used RC4-encrypted strings and string hashes to avoid identifiable strings within the binary.
Technique: T1027: Obfuscated Files or Information
Adversaries may establish persistence by executing malicious content triggered by a file type association.
Technique: T1546: Event Triggered Execution
A Linux version of Derusbi checks if the victim user ID is anything other than zero , and the malware will not execute if it does not have root privileges.
Technique: T1033: System Owner/User Discovery
[1] https://www.clearskysec.com/report-the-copykittens-are-targeting-israelis/ [2] https://www.clearskysec.com/copykitten-jpost/
Technique: T1071: Application Layer Protocol
The adversary can then send malicious links or attachments through these services.
Technique: T1566: Phishing
Ebury can deactivate PAM modules to tamper with the sshd configuration.
Technique: T1556: Modify Authentication Process
StrongPity can automatically exfiltrate collected documents to the C2 server.
Technique: T1020: Automated Exfiltration
There have also been instances of botnets using a persistent backdoor through malicious Chrome extensions.
Technique: T1176: Browser Extensions
Mimikatz can be used to extract secrets from memory.
Technique: T1003: OS Credential Dumping
These implementations exist for every major OS but are typically platform specific.
Technique: T1055: Process Injection
OopsIE can download files from its C2 server to the victim's machine.
Technique: T1105: Ingress Tool Transfer
njRAT can collect data from a local system.
Technique: T1005: Data from Local System
IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern.
Technique: T1559: Inter-Process Communication
It has used a different AES-256 encryption key per file with a bundled RAS-4096 public encryption key that is unique for each victim.
Technique: T1486: Data Encrypted for Impact
ASPXTool — A modified version of the ASPXSpy web shell (see Figure 6)
Technique: T1505: Server Software Component
Adversaries may search for VME artifacts in memory, processes, file system, hardware, and/or the Registry.
Technique: T1497: Virtualization/Sandbox Evasion
Indicators  File  Hash  Description  x.js  3fefa55daeb167931975c22df3eca20a  HOMEFRY, a 64-bit Windows password dumper/cracker  mt.exe  40528e368d323db0ac5c3f5e1efe4889  MURKYTOP, a command-line reconnaissance tool   com4.js  a68bf5fce22e7f1d6f999b7a580ae477  AIRBREAK, a JavaScript-based backdoor which retrieves commands from hidden strings in compromised webpages   Historical Indicators  File  Hash  Description  green.ddd  3eb6f85ac046a96204096ab65bbd3e7e  AIRBREAK, a JavaScript-based backdoor which retrieves commands from hidden strings in compromised webpages  BGij  6e843ef4856336fe3ef4ed27a4c792b1  Beacon, a commercially available backdoor  msresamn.ttf  a9e7539c1ebe857bae6efceefaa9dd16  PHOTO, also reported as Derusbi  1024-aa6a121f98330df2edee6c4391df21ff43a33604  bd9e4c82bf12c4e7a58221fc52fed705  BADFLICK, backdoor that is capable of modifying the file system, generating a reverse shell, and modifying its command-and-control configuration
Technique: T1140: Deobfuscate/Decode Files or Information
Screen captures are taken at specified intervals based on the system.
Technique: T1113: Screen Capture
MegaCortex has used the open-source library, Mbed Crypto, and generated AES keys to carry out the file encryption process.
Technique: T1486: Data Encrypted for Impact
The APT1 group is known to have used pass the hash.
Technique: T1550: Use Alternate Authentication Material
For macOS, the functionality of this technique is similar but may leverage zsh, the default shell for macOS 10.15+.
Technique: T1546: Event Triggered Execution
Frankenstein has run encoded commands from the command line.
Technique: T1027: Obfuscated Files or Information
To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disk content may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.
Technique: T1561: Disk Wipe
This document was also the first of the mid-November cluster which used the user/USER author name instead of Joohn, further supporting the scenario of the document being copied between systems
Technique: T1033: System Owner/User Discovery
SombRAT can store harvested data in a custom database under the %TEMP% directory.
Technique: T1074: Data Staged
FIN8 has deleted tmp and prefetch files during post compromise cleanup activities.
Technique: T1070: Indicator Removal on Host
Devices in a local network segment communicate with each other by using link layer addresses.
Technique: T1557: Adversary-in-the-Middle
Figure 2: Exploit Shellcode used to Locate and Decode Payload The shellcode (Figure 2) searches for and decodes the executable payload contained in memory between the beginning and ending file markers 0xBABABABA and 0xBBBBBBBB, respectively
Technique: T1140: Deobfuscate/Decode Files or Information
XAgentOSX contains the getFirefoxPassword function to attempt to locate Firefox passwords.
Technique: T1555: Credentials from Password Stores
InvisiMole can list information about files in a directory and recently opened or used documents.
Technique: T1083: File and Directory Discovery
Astaroth checks for the presence of Avast antivirus in the C:\Program\Files\ folder.
Technique: T1518: Software Discovery
Hildegard has collected the host's OS, CPU, and memory information.
Technique: T1082: System Information Discovery
XCSSET uses scp to access the ~/Library/Cookies/Cookies.binarycookies file.
Technique: T1539: Steal Web Session Cookie
Adversaries may search DNS data for information about victims that can be used during targeting.
Technique: T1596: Search Open Technical Databases
WastedLocker checks for specific registry keys related to the UCOMIEnumConnections and IActiveScriptParseProcedure32 interfaces.
Technique: T1012: Query Registry
When operating systems boot up, they can start processes that perform background system functions.
Technique: T1543: Create or Modify System Process
CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX.
Technique: T1218: Signed Binary Proxy Execution
Similar to DLL Search Order Hijacking, side-loading involves hijacking which DLL a program loads.
Technique: T1574: Hijack Execution Flow
BADNEWS identifies files with certain extensions from USB devices, then copies them to a predefined directory.
Technique: T1083: File and Directory Discovery
BRONZE BUTLER has incorporated code into several tools that attempts to terminate anti-virus processes.
Technique: T1562: Impair Defenses
Kerrdown has gained execution through victims opening malicious links.
Technique: T1204: User Execution
3PARA RAT will use an 8-byte XOR key derived from the string HYF54&%9&jkMCXuiS if the DES decoding fails Sys10 uses an XOR 0x1 loop to encrypt its C2 domain.
Technique: T1573: Encrypted Channel
GoldMax has RSA-encrypted its communication with the C2 server.
Technique: T1573: Encrypted Channel
Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility.
Technique: T1218: Signed Binary Proxy Execution
Elise executes net start after initial communication is made to the remote server.
Technique: T1007: System Service Discovery
ZIRCONIUM has used a tool to query the Registry for proxy settings.
Technique: T1012: Query Registry
Additionally, If adversaries launch their malicious services using svchost.exe, the service’s file may be identified using HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\servicename\Parameters\ServiceDll.
Technique: T1574: Hijack Execution Flow
Operation Wocao has used SMB to copy files to and from target systems.
Technique: T1570: Lateral Tool Transfer
OnionDuke uses HTTP and HTTPS for C2.
Technique: T1071: Application Layer Protocol
Rover has keylogging functionality.
Technique: T1056: Input Capture
JHUHUGIT tests if it can reach its C2 server by first attempting a direct connection, and if it fails, obtaining proxy settings and sending the connection through a proxy, and finally injecting code into a running browser if the proxy method fails.
Technique: T1008: Fallback Channels
If the user clicks on the link, he will be prompted to download a RAR file that contains the stage 1 malware/lure, which he will execute afterwards
Technique: T1105: Ingress Tool Transfer
APT40 leverages exploits in their phishing operations, often weaponizing vulnerabilities within days of their disclosure
Technique: T1068: Exploitation for Privilege Escalation
Inception has used weaponized documents attached to spearphishing emails for reconnaissance and initial compromise.
Technique: T1566: Phishing
ZLib has the ability to enumerate files and drives.
Technique: T1083: File and Directory Discovery
While sending to the C2 server, the data is formatted as follows: @{SYSINFO  = $get.ToString(); ACTION = "REGISTER";}  Ability to take screenshots
Technique: T1113: Screen Capture
ThiefQuest uses the function kill_unwanted to obtain a list of running processes and kills each process matching a list of security related processes.
Technique: T1562: Impair Defenses
APT3 has been known to side load DLLs with a valid version of Chrome with one of their tools.
Technique: T1574: Hijack Execution Flow
It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system.
Technique: T1563: Remote Service Session Hijacking
If running with root permissions, OSX_OCEANLOTUS.D can create a persistence file in the folder /Library/LaunchDaemons.
Technique: T1543: Create or Modify System Process
Dacls has had its payload named with a dot prefix to make it hidden from view in the Finder application.
Technique: T1564: Hide Artifacts
Attor has encrypted data symmetrically using a randomly generated Blowfish  key which is encrypted with a public RSA key.
Technique: T1573: Encrypted Channel
For example, this may be useful for when the target user has a non-network logon session on the system.
Technique: T1134: Access Token Manipulation
Mivast has the capability to gather NTLM password information.
Technique: T1003: OS Credential Dumping
Adversaries may try to get information about registered services.
Technique: T1007: System Service Discovery
StrongPity has been signed with self-signed certificates.
Technique: T1553: Subvert Trust Controls
HAMMERTOSS binaries contain an algorithm that generates a different Twitter handle for the malware to check for instructions every day.
Technique: T1102: Web Service
In order to meet the phishing emails’ infrastructure requirements, disposable domains and emails were used as the delivery medium
Technique: T1566: Phishing
BADNEWS collects C2 information via a dead drop resolver.
Technique: T1102: Web Service
Industroyer uses a custom DoS tool that leverages CVE-2015-5374 and targets hardcoded IP addresses of Siemens SIPROTEC devices.
Technique: T1499: Endpoint Denial of Service
Goopy has the ability to exfiltrate documents from infected systems.
Technique: T1005: Data from Local System
Rising Sun can modify file attributes to hide files.
Technique: T1564: Hide Artifacts
Naid collects the domain name from a compromised host.
Technique: T1016: System Network Configuration Discovery
Once a persona has been developed an adversary can use it to create connections to targets of interest.
Technique: T1585: Establish Accounts
APT29 also used PowerShell to create new tasks on remote machines, identify configuration settings, evade defenses, exfiltrate data, and to execute other commands.
Technique: T1059: Command and Scripting Interpreter
Calisto can collect data from user directories.
Technique: T1005: Data from Local System
Kinsing has used ps to list processes.
Technique: T1057: Process Discovery
FIN8 has used the Plink utility to tunnel RDP back to C2 infrastructure.
Technique: T1573: Encrypted Channel
An account registered to a domain, with or without special privileges, can be abused to list all domain accounts that have preauthentication disabled by utilizing Windows tools like PowerShell with an LDAP filter.
Technique: T1558: Steal or Forge Kerberos Tickets
Sandworm Team's BCS-server tool uses base64 encoding and HTML tags for the communication traffic between the C2 server.
Technique: T1132: Data Encoding
Figure 9: Command logs after execution Network Communications FELIXROOT communicates with its C2 via HTTP and HTTPS POST protocols
Technique: T1071: Application Layer Protocol
APT41 used the storescyncsvc.dll BEACON backdoor to download a secondary backdoor.
Technique: T1104: Multi-Stage Channels
NavRAT copies itself into a running Internet Explorer process to evade detection.
Technique: T1055: Process Injection
These certificates, such as those used for encrypted web traffic , contain information about the registered organization such as name and location.
Technique: T1596: Search Open Technical Databases
creates a backdoor through which remote attackers can upload files.
Technique: T1105: Ingress Tool Transfer
The initial beacon packet for Mis-Type contains the operating system version and file system of the victim.
Technique: T1082: System Information Discovery
Lokibot has stolen credentials from multiple applications and data sources including Windows OS credentials, email clients, FTP, and SFTP clients.
Technique: T1555: Credentials from Password Stores
BitPaymer can use the tokens of users to create processes on infected systems.
Technique: T1134: Access Token Manipulation
Gold Dragon lists the directories for Desktop, program files, and the user’s recently accessed files.
Technique: T1083: File and Directory Discovery
In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC  prompts without user interaction and gain access to data.
Technique: T1021: Remote Services
FIN7 has used RDP to move laterally in victim environments.
Technique: T1021: Remote Services
An audit policy, maintained by the Local Security Policy , defines which system events the EventLog service logs.
Technique: T1562: Impair Defenses
The reconnaissance modules used with Duqu can collect information on network configuration.
Technique: T1016: System Network Configuration Discovery
Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process-based defenses as well as possibly elevate privileges.
Technique: T1055: Process Injection
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software.
Technique: T1003: OS Credential Dumping
HiddenWasp uses a cipher to implement a decoding function.
Technique: T1140: Deobfuscate/Decode Files or Information
TEMP.Veles has used a publicly-available PowerShell-based tool, WMImplant.
Technique: T1059: Command and Scripting Interpreter
Skidmap has used pm.sh to download and install its main payload.
Technique: T1059: Command and Scripting Interpreter
Rules may be created or modified within email clients or through external features such as the New-InboxRule or Set-InboxRule PowerShell cmdlets on Windows systems.
Technique: T1564: Hide Artifacts
OilRig has used netstat -an on a victim to get a listing of network connections.
Technique: T1049: System Network Connections Discovery
APT38 has conducted spearphishing campaigns using malicious email attachments.
Technique: T1566: Phishing
QakBot can deobfuscate and re-assemble code strings for execution.
Technique: T1140: Deobfuscate/Decode Files or Information
Bankshot writes data into the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Pniumj.
Technique: T1112: Modify Registry
NotPetya can use two exploits in SMBv1, EternalBlue and EternalRomance, to spread itself to other remote systems on the network.
Technique: T1210: Exploitation of Remote Services
Sandworm Team has used move to transfer files to a network share.
Technique: T1570: Lateral Tool Transfer
Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain.
Technique: T1583: Acquire Infrastructure
APT-C-36 has used spearphishing emails with password protected RAR attachment to avoid being detected by the email gateway.
Technique: T1566: Phishing
Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack.
Technique: T1498: Network Denial of Service
PoetRAT was delivered with documents using DDE to execute malicious code.
Technique: T1559: Inter-Process Communication
Accounts created by Dragonfly masqueraded as legitimate service accounts.
Technique: T1036: Masquerading
This requires an exchange or pre-arranged agreement/possession of the value used to encrypt and decrypt data.
Technique: T1048: Exfiltration Over Alternative Protocol
The encoded payload was a Cobalt Strike httpsstager that was injected into the PowerShell process that ran the command
Technique: T1055: Process Injection
AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.
Technique: T1059: Command and Scripting Interpreter
Chimera has used WinRM for lateral movement.
Technique: T1021: Remote Services
This version injects a malicious module into one of Avast's processes, whereas early versions of the campaign detected Avast and quit
Technique: T1055: Process Injection
FIN7 malware has created scheduled tasks to establish persistence.
Technique: T1053: Scheduled Task/Job
(On the left is NavRAT, and on the right is the shellcode of ROKRAT):    We performed the same analysis for the shellcode located in the downloaded image file and the shellcode is not exactly the same, but the design is very similar
Technique: T1059: Command and Scripting Interpreter
menuPass has attempted to get victims to open malicious files such as Windows Shortcuts  and/or Microsoft Office documents, sent via email as part of spearphishing campaigns.
Technique: T1204: User Execution
Filename  Part-I.doc    File Size  11349102 bytes    MD5  92942c54224cd462dd201ae11a560bb8    SHA1  85a21624df2211af3daf05c86a3fbea8271059d3    Notes Malicious RTF document that exploits CVE-2017-8570 and drops QuasarRAT file qrat.exe
Technique: T1036: Masquerading
15 Database dump Decoded, it reveals a detailed log of each affected machine
Technique: T1003: OS Credential Dumping
Cobian RAT obfuscates communications with the C2 server using Base64 encoding.
Technique: T1132: Data Encoding
Audit ISAPI filters and search for web shells on Microsoft Exchange servers
Technique: T1505: Server Software Component
One variant of CloudDuke uses a Microsoft OneDrive account to exchange commands and stolen data with its operators.
Technique: T1102: Web Service
Gazer uses custom encryption for C2 that uses 3DES.
Technique: T1573: Encrypted Channel
Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.
Technique: T1014: Rootkit
Adversaries may assign the Default or Anonymous user permissions or roles to the Top of Information Store , Inbox, or other mailbox folders.
Technique: T1098: Account Manipulation
SLOTHFULMEDIA can open a command line to execute commands.
Technique: T1059: Command and Scripting Interpreter
Ke3chang is known to use RAR with passwords to encrypt data prior to exfiltration.
Technique: T1560: Archive Collected Data
Upon finding a vulnerable version, exploit code is delivered to the browser.
Technique: T1189: Drive-by Compromise
Kasidet has the ability to search for a given filename on a victim.
Technique: T1083: File and Directory Discovery
Evilnum has used a component called TerraLoader to check certain hardware and file information to detect sandboxed environments.
Technique: T1497: Virtualization/Sandbox Evasion
BlackEnergy attempts to bypass default User Access Control  settings by exploiting a backward-compatibility setting found in Windows 7 and later.
Technique: T1548: Abuse Elevation Control Mechanism
Higher level execution mediums, such as those of Command and Scripting Interpreters, may also leverage underlying IPC mechanisms.
Technique: T1559: Inter-Process Communication
Okrum uses HTTP for communication with its C2.
Technique: T1071: Application Layer Protocol
This may be a necessary step for an adversary compromising an endpoint system that has been properly configured and limits other privilege escalation methods.
Technique: T1068: Exploitation for Privilege Escalation
Threat Group-3390 also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.
Technique: T1056: Input Capture
Pillowmint has collected credit card data using native API functions.
Technique: T1005: Data from Local System
Gamaredon Group tools have contained an application to check performance of USB flash drives.
Technique: T1120: Peripheral Device Discovery
The most notable change to this variant of Zebrocy, other than the programming language used, is the way the tool gathers the system information and running processes
Technique: T1057: Process Discovery
Zeus Panda can launch an interface where it can execute several commands on the victim’s PC.
Technique: T1059: Command and Scripting Interpreter
Kessel can use a proxy during exfiltration if set in the configuration.
Technique: T1090: Proxy
UNC2452 obtained Ticket Granting Service  tickets for Active Directory Service Principle Names to crack offline.
Technique: T1558: Steal or Forge Kerberos Tickets
WastedLocker has copied a random file from the Windows System32 folder to the %APPDATA% location under a different hidden filename.
Technique: T1564: Hide Artifacts
Explosive has a function to call the OpenClipboard wrapper.
Technique: T1106: Native API
Decrypted OwaAuth log file format
Technique: T1140: Deobfuscate/Decode Files or Information
Aria-body has the ability to identify the username on a compromised host.
Technique: T1033: System Owner/User Discovery
KONNI has used certutil to download and decode base64 encoded strings.
Technique: T1140: Deobfuscate/Decode Files or Information
On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file.
Technique: T1601: Modify System Image
Operation Wocao has used the command net localgroup administrators to list all administrators part of a local group.
Technique: T1069: Permission Groups Discovery
There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic.
Technique: T1059: Command and Scripting Interpreter
Dacls can use HTTPS in C2 communications.
Technique: T1071: Application Layer Protocol
T9000 gathers and beacons the username of the logged in account during installation.
Technique: T1033: System Owner/User Discovery
write access, to specific users or groups in the domain.
Technique: T1484: Domain Policy Modification
OilRig has used Putty to access compromised systems.
Technique: T1021: Remote Services
Pysa has laterally moved using RDP connections.
Technique: T1021: Remote Services
Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.
Technique: T1497: Virtualization/Sandbox Evasion
WMI Filters define conditions that will trigger a Consumer, including system startup, the execution of a program, the passing of a specified time and many others
Technique: T1047: Windows Management Instrumentation
Build Tool Most of CARBANAK’s strings are encrypted in order to make analysis more difficult
Technique: T1027: Obfuscated Files or Information
Adversaries may also use compromised websites to deliver a user to a malicious application designed to Steal Application Access Tokens, like OAuth tokens, to gain access to protected applications and information.
Technique: T1189: Drive-by Compromise
DarkVishnya scanned the network for public shared folders.
Technique: T1135: Network Share Discovery
Maze has gathered all of the running system processes.
Technique: T1057: Process Discovery
Leviathan has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.
Technique: T1140: Deobfuscate/Decode Files or Information
POSHSPY appends a file signature header  to encrypted data prior to upload or download.
Technique: T1027: Obfuscated Files or Information
Javali has achieved execution through victims opening malicious attachments, including MSI files with embedded VBScript.
Technique: T1204: User Execution
MobileOrder has a command to upload to its C2 server victim browser bookmarks.
Technique: T1217: Browser Bookmark Discovery
DustySky can delete files it creates from the infected system.
Technique: T1070: Indicator Removal on Host
BBK has the ability to use HTTP in communications with C2.
Technique: T1071: Application Layer Protocol
Knowledge of a vulnerability may cause an adversary to search for an existing exploit  Exploits or to attempt to develop one themselves  Exploits.
Technique: T1588: Obtain Capabilities
menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.
Technique: T1003: OS Credential Dumping
HDoor scans to identify open ports on the victim.
Technique: T1046: Network Service Scanning
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
Technique: T1539: Steal Web Session Cookie
In Windows environments, adversaries could obtain details on running processes using the Tasklist utility via cmd or Get-Process via PowerShell.
Technique: T1057: Process Discovery
gh0st RAT can execute its service if the Service key exists.
Technique: T1569: System Services
APT41 used VMProtected binaries in multiple intrusions.
Technique: T1027: Obfuscated Files or Information
Malicious obfuscated VBA code is executed when the macro is first enabled
Technique: T1027: Obfuscated Files or Information
The configuration blob is encoded using a simple single-byte XOR scheme
Technique: T1027: Obfuscated Files or Information
The malware accepts up to two arguments at the command line: one to display cleartext credentials for each login session, and a second to display cleartext credentials, NTLM hashes, and malware version for each login session
Technique: T1003: OS Credential Dumping
In some cases, windows that would typically be displayed when an application carries out an operation can be hidden.
Technique: T1564: Hide Artifacts
Sandworm Team has used dedicated network connections from one victim organization to gain unauthorized access to a separate organization.
Technique: T1199: Trusted Relationship
A snapshot is a point-in-time copy of an existing cloud compute component such as a virtual machine , virtual hard drive, or volume.
Technique: T1578: Modify Cloud Compute Infrastructure
APT41 has configured payloads to load via LD_PRELOAD.
Technique: T1574: Hijack Execution Flow
BlackMould has the ability to find files on the targeted system.
Technique: T1083: File and Directory Discovery
Spearphishing with a link is a specific variant of spearphishing.
Technique: T1566: Phishing
Kazuar can also be configured to inject and execute within specific processes.
Technique: T1055: Process Injection
CHM content is displayed using underlying components of the Internet Explorer browser  loaded by the HTML Help executable program .
Technique: T1218: Signed Binary Proxy Execution
UNC2452 changed domain federation trust settings using Azure AD administrative permissions to configure the domain to accept authorization tokens signed by their own SAML signing certificate.
Technique: T1484: Domain Policy Modification
In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser.
Technique: T1598: Phishing for Information
BLUELIGHT can collect process filenames and SID authority level.
Technique: T1057: Process Discovery
Adversaries may abuse rundll32.exe to proxy execution of malicious code.
Technique: T1218: Signed Binary Proxy Execution
BendyBear can check for analysis environments and signs of debugging using the Windows API kernel32!GetTickCountKernel32 call.
Technique: T1497: Virtualization/Sandbox Evasion
QakBot can target and steal locally stored emails to support thread hijacking phishing campaigns.
Technique: T1114: Email Collection
This behavior may bypass signature validation restrictions and application control solutions that do not account for abuse of this script.
Technique: T1216: Signed Script Proxy Execution
The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group.
Technique: T1069: Permission Groups Discovery
Sys10 uses HTTP for C2.
Technique: T1071: Application Layer Protocol
The dynamic loader will try to find the dylibs based on the sequential order of the search paths.
Technique: T1574: Hijack Execution Flow
SUNBURST dynamically resolved C2 infrastructure for randomly-generated subdomains within a parent domain.
Technique: T1568: Dynamic Resolution
Pass the hash  is a method of authenticating as a user without having access to the user's cleartext password.
Technique: T1550: Use Alternate Authentication Material
ZIRCONIUM has used a tool to capture the username on a compromised host in order to register it with C2.
Technique: T1033: System Owner/User Discovery
Epic uses the net use, net session, and netstat commands to gather information on network connections.
Technique: T1049: System Network Connections Discovery
Nomadic Octopus executed PowerShell in a hidden window.
Technique: T1564: Hide Artifacts
Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees.
Technique: T1591: Gather Victim Org Information
Information about network security appliances may also be exposed to adversaries via online or other accessible data sets .
Technique: T1590: Gather Victim Network Information
ROKRAT steals credentials stored in Web browsers by querying the sqlite database.
Technique: T1555: Credentials from Password Stores
StoneDrill can wipe the accessible physical or logical drives of the infected machine.
Technique: T1561: Disk Wipe
RobbinHood disconnects all network shares from the computer with the command net use * /DELETE /Y.
Technique: T1070: Indicator Removal on Host
APT28 has enumerated installed applications on macOS devices with built-in utilities such as ls -al /Applications.
Technique: T1082: System Information Discovery
SpeakUp checks for availability of specific ports on servers.
Technique: T1046: Network Service Scanning
Sykipot may gather a list of running processes by running tasklist /v.
Technique: T1057: Process Discovery
APT33 has used HTTP for command and control.
Technique: T1071: Application Layer Protocol
If this function is successfully loaded, it will ultimately spawn a new instance of itself with the Rundll32Call export via a call to rundll32.exe
Technique: T1218: Signed Binary Proxy Execution
LoudMiner used shell scripts to launch various services and to start/stop the QEMU virtualization.
Technique: T1059: Command and Scripting Interpreter
Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations.
Technique: T1568: Dynamic Resolution
njRAT enumerates the current user during the initial infection.
Technique: T1033: System Owner/User Discovery
LookBack removes itself after execution and can delete files on the system.
Technique: T1070: Indicator Removal on Host
Kwampirs collects a list of accounts with the command net users.
Technique: T1087: Account Discovery
The example C2s used by older variants of Comnie demonstrates this:  Figure 9 Old Comnie variants collecting C2 information Please refer to the Appendix for a script that may be used to decode C2 information from the older Comnie variants
Technique: T1071: Application Layer Protocol
Adversaries can modify paths to executed binaries, add command line arguments, and insert key/pair values to plist files in auto-run locations which execute upon user logon or system startup.
Technique: T1547: Boot or Logon Autostart Execution
In macOS and Linux, the currently logged in user can be identified with w and who.
Technique: T1033: System Owner/User Discovery
reg query HKLM /f password /t REG_SZ /s 
Technique: T1552: Unsecured Credentials
Cobalt Strike can deliver additional payloads to victim machines.
Technique: T1105: Ingress Tool Transfer
Anchor can create and execute services to load its payload.
Technique: T1569: System Services
CARROTBAT has the ability to determine the operating system of the compromised host and whether Windows is being run with x86 or x64 architecture.
Technique: T1082: System Information Discovery
Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads.
Technique: T1127: Trusted Developer Utilities Proxy Execution
KARAE can collect system information.
Technique: T1082: System Information Discovery
BRONZE BUTLER has used various tools to download files, including DGet .
Technique: T1105: Ingress Tool Transfer
This has the advantage of making it much harder for defenders block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.
Technique: T1568: Dynamic Resolution
FELIXROOT executes batch scripts on the victim’s machine, and can launch a reverse shell for command execution.
Technique: T1059: Command and Scripting Interpreter
Manipulating the domain trusts may allow an adversary to escalate privileges and/or evade defenses by modifying settings to add objects which they control.
Technique: T1484: Domain Policy Modification
Silent Librarian has also made use of a variety of URL shorteners for these staged websites.
Technique: T1608: Stage Capabilities
Maze has used the ChaCha algorithm, based on Salsa20, and an RSA algorithm to encrypt files.
Technique: T1486: Data Encrypted for Impact
TG-3390 actors have deployed the OwaAuth web shell to Exchange servers, disguising it as an ISAPI filter
Technique: T1505: Server Software Component
KeyBoy installs a keylogger for intercepting credentials and keystrokes.
Technique: T1056: Input Capture
Blue Mockingbird has used JuicyPotato to abuse the SeImpersonate token privilege to escalate from web application pool accounts to NT Authority\SYSTEM.
Technique: T1134: Access Token Manipulation
admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: net localgroup administrator >> %temp%\download OilRig has used net localgroup administrators to find local administrators on compromised systems.
Technique: T1069: Permission Groups Discovery
CARROTBAT itself is a dropper that allows an attacker to drop and open an embedded decoy file, followed by the execution of a command that will download and run a payload on the targeted machine
Technique: T1105: Ingress Tool Transfer
Adversaries may abuse email-forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.
Technique: T1114: Email Collection
The adversary will need to complete registration of their application with the authorization server, for example Microsoft Identity Platform using Azure Portal, the Visual Studio IDE, the command-line interface, PowerShell, or REST API calls.
Technique: T1528: Steal Application Access Token
Micropsia gathers the hostname and OS version from the victim’s machine.
Technique: T1082: System Information Discovery
CHOPSTICK is capable of performing remote file transmission.
Technique: T1105: Ingress Tool Transfer
* Uploading malware or tools to a location accessible to a victim network to enable Ingress Tool Transfer.
Technique: T1608: Stage Capabilities
FatDuke has been regularly repacked by its operators to create large binaries and evade detection.
Technique: T1027: Obfuscated Files or Information
APT39 has used PowerShell to execute malicious code.
Technique: T1059: Command and Scripting Interpreter
Gazer performs thread execution hijacking to inject its orchestrator into a running thread from a remote process.
Technique: T1055: Process Injection
TA551 has used mshta.exe to execute malicious payloads.
Technique: T1218: Signed Binary Proxy Execution
Analysis of their configurations show that the C2 servers used both fully-qualified domain names and IP addresses
Technique: T1016: System Network Configuration Discovery
Doki’s container was configured to bind the host root directory.
Technique: T1611: Escape to Host
QakBot has the ability to create scheduled tasks for persistence.
Technique: T1053: Scheduled Task/Job
Unlike Keylogging,  this technique focuses specifically on API functions that include parameters that reveal user credentials.
Technique: T1056: Input Capture
Kerrdown can encrypt, encode, and compress multiple layers of shellcode.
Technique: T1027: Obfuscated Files or Information
An adversary may forge SAML tokens with any permissions claims and lifetimes if they possess a valid SAML token-signing certificate.
Technique: T1606: Forge Web Credentials
Code snippet of the obfuscated document After deobfuscation, we can see that the payload is written in the Perl programming language
Technique: T1027: Obfuscated Files or Information
FinFisher queries Registry values as part of its anti-sandbox checks.
Technique: T1012: Query Registry
They combine reconnaissance of GPO (Group Policy Object management for execution) with digitally-signed malware to avoid detection or blocking during their infection phases
Technique: T1553: Subvert Trust Controls
For attacks attempting to saturate the providing network, see Network Denial of Service.
Technique: T1499: Endpoint Denial of Service
Adversaries may target system-wide logging or just that of a particular application.
Technique: T1562: Impair Defenses
GALLIUM used a modified version of NBTscan to identify available NetBIOS name servers over the network as well as ping to identify remote systems.
Technique: T1018: Remote System Discovery
Gathering this information may reveal opportunities for other forms of reconnaissance  or Search Open Websites/Domains, establishing operational resources  or Obtain Capabilities, and/or initial access  or Hardware Additions.
Technique: T1591: Gather Victim Org Information
An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on system utilities executing from non-standard paths.
Technique: T1036: Masquerading
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.
Technique: T1027: Obfuscated Files or Information
Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions.
Technique: T1021: Remote Services
RATANKBA performs a reflective DLL injection using a given pid.
Technique: T1055: Process Injection
Explosive has collected the username from the infected host.
Technique: T1033: System Owner/User Discovery
Patchwork used PowerSploit to download payloads, run a reverse shell, and execute malware on the victim's machine.
Technique: T1059: Command and Scripting Interpreter
Gazer can establish persistence by creating a .lnk file in the Start menu.
Technique: T1547: Boot or Logon Autostart Execution
Trickbot uses this encrypted module to scan the network and steal relevant network information.
Technique: T1016: System Network Configuration Discovery
creates a backdoor through which remote attackers can steal system information.
Technique: T1005: Data from Local System
GALLIUM used a modified version of Mimikatz along with a PowerShell-based Mimikatz to dump credentials on the victim machines.
Technique: T1003: OS Credential Dumping
These scripts can vary based on operating system and whether applied locally or remotely.
Technique: T1037: Boot or Logon Initialization Scripts
Adversaries may insert, delete, or manipulate data at rest in order to manipulate external outcomes or hide activity.
Technique: T1565: Data Manipulation
Attack Lifecycle  Initial Compromise APT40 has been observed leveraging a variety of techniques for initial compromise, including web server exploitation, phishing campaigns delivering publicly available and custom backdoors, and strategic web compromises
Technique: T1505: Server Software Component
Figure 7 shows just how similar these two batch scripts are with several of the headers being exactly the same and a majority of the commands being the same with the Helminth commands having the 2>&1 suffix to include command errors with the output
Technique: T1059: Command and Scripting Interpreter