HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
HAFNIUM has used 7-Zip and WinRAR to compress stolen files for exfiltration.
Technique: T1560: Archive Collected Data
Sandworm Team used the sp_addlinkedsrvlogin command in MS-SQL to create a link between a created account and other servers in the network.
Technique: T1098: Account Manipulation
MarkiRAT can check for running processes on the victim’s machine to look for Kaspersky and Bitdefender antivirus products.
Technique: T1518: Software Discovery
To change the operating system in memory, the adversary typically can use one of two methods.
Technique: T1601: Modify System Image
Cobalt Strike can collect data from a local system.
Technique: T1005: Data from Local System
An Endpoint DoS denies the availability of a service without saturating the network used to provide access to the service.
Technique: T1499: Endpoint Denial of Service
The spear phishing emails and attached malicious macro documents typically have geopolitical themes
Technique: T1566: Phishing
Zeus Panda has a command to delete a file.
Technique: T1070: Indicator Removal on Host
LightNeuron can be configured to exfiltrate data during nighttime or working hours.
Technique: T1029: Scheduled Transfer
By the end of 2017, a threat group used Invoke-PSImage to hide PowerShell commands in an image file  and execute the code on a victim's system.
Technique: T1027: Obfuscated Files or Information
This may take the many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information.
Technique: T1562: Impair Defenses
A login hook tells Mac OS X to execute a certain script when a user logs in, but unlike Startup Items, a login hook executes as the elevated root user.
Technique: T1037: Boot or Logon Initialization Scripts
APT37 has downloaded second stage malware from compromised websites.
Technique: T1105: Ingress Tool Transfer
GALLIUM used Web shells to persist in victim environments and assist in execution and exfiltration.
Technique: T1505: Server Software Component
PoetRAT has used FTP for exfiltration.
Technique: T1048: Exfiltration Over Alternative Protocol
Installation of digital certificates may take place for a number of server types, including web servers and email servers.
Technique: T1608: Stage Capabilities
OSinfo: OSInfo is a general purpose, system information gathering tool
Technique: T1082: System Information Discovery
Maze has checked the language of the machine with function GetUserDefaultUILanguage and terminated execution if the language matches with an entry in the predefined list.
Technique: T1614: System Location Discovery
BADFLICK can decode shellcode using a custom rotating XOR cipher.
Technique: T1140: Deobfuscate/Decode Files or Information
StrongPity can delete previously exfiltrated files from the compromised host.
Technique: T1070: Indicator Removal on Host
MuddyWater has used C2 infrastructure to receive exfiltrated data.
Technique: T1041: Exfiltration Over C2 Channel
IndigoZebra sent spearphishing emails containing malicious attachments that urged recipients to review modifications in the file which would trigger the attack.
Technique: T1204: User Execution
Operation Wocao has used the CreateProcessA and ShellExecute API function to launch commands after being injected into a selected process.
Technique: T1106: Native API
Specific features in web applications may be highly resource intensive.
Technique: T1499: Endpoint Denial of Service
Ajax Security Team has lured victims into executing malicious files.
Technique: T1204: User Execution
Proton modifies the tty_tickets line in the sudoers file.
Technique: T1548: Abuse Elevation Control Mechanism
Based upon the instructional guide and the provided tools, this package appears consistent with the methodologies FireEye outlined in their research on how these attacks were executed, including specific details such as the use of ICAP via a proxy passthrough, in this case specifically squid, and using certbot to create a Let’s Encrypt SSL certificate
Technique: T1521: nan
Molerats has sent phishing emails with malicious links included.
Technique: T1566: Phishing
Some Orz versions have an embedded DLL known as MockDll that uses process hollowing and Regsvr32 to execute another payload.
Technique: T1055: Process Injection
Kazuar encodes communications to the C2 server in Base64.
Technique: T1132: Data Encoding
GALLIUM used reg commands to dump specific hives from the Windows Registry, such as the SAM hive, and obtain password hashes.
Technique: T1003: OS Credential Dumping
BLINDINGCAN has uploaded files from victim machines.
Technique: T1005: Data from Local System
Okrum has used base64 to encode C2 communication.
Technique: T1132: Data Encoding
Higaisa added a spoofed binary to the start-up folder for persistence.
Technique: T1547: Boot or Logon Autostart Execution
APT41 has used hashdump, Mimikatz, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.
Technique: T1003: OS Credential Dumping
The plist file is installed in the ~/Library/LaunchAgents/ folder and configured with the path to the persistent binary located in the ~/Library/ folder.
Technique: T1543: Create or Modify System Process
Figure 10: Network traffic to download final payload (words.exe) Once executed, the file performs the following activities:  Drops a copy of itself in %AppData%\svchost.exe\svchost.exe and drops an XML file, which contains configuration information for Task Scheduler (as shown in Figure 11)
Technique: T1036: Masquerading
ZxShell has remote desktop functionality.
Technique: T1021: Remote Services
Mustang Panda has used ipconfig and arp to determine network configuration information.
Technique: T1016: System Network Configuration Discovery
Dipsind can be configured to only run during normal working hours, which would make its communications harder to distinguish from normal traffic.
Technique: T1029: Scheduled Transfer
Browser bookmarks may reveal personal information about users  as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.
Technique: T1217: Browser Bookmark Discovery
FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.
Technique: T1573: Encrypted Channel
APT40 also uses publicly available brute-forcing tools and a custom utility called DISHCLOTH to attack different protocols and services
Technique: T1110: Brute Force
MuddyWater has sent targeted spearphishing e-mails with malicious links.
Technique: T1566: Phishing
Webshell can scan networks for open ports and listening services.
Technique: T1046: Network Service Scanning
The results are Gzipped and saved under random file in the temp folder.
Technique: T1560: Archive Collected Data
Prikormka encrypts some C2 traffic with the Blowfish cipher.
Technique: T1573: Encrypted Channel
BRONZE BUTLER has used RC4 encryption  and AES  to obfuscate HTTP traffic.
Technique: T1573: Encrypted Channel
Sibot has also used the Win32_Process class to execute a malicious DLL.
Technique: T1047: Windows Management Instrumentation
Ecipekac can abuse the legitimate application policytool.exe to load a malicious DLL.
Technique: T1574: Hijack Execution Flow
Adversaries may generate these cookies in order to gain access to web resources.
Technique: T1606: Forge Web Credentials
More_eggs can download and launch additional payloads.
Technique: T1105: Ingress Tool Transfer
TrickBot uses the Windows API call, CreateProcessW, to manage execution flow.
Technique: T1106: Native API
Cobalt Strike can mimic the HTTP protocol for C2 communication, while hiding the actual data in either an HTTP header, URI parameter, the transaction body, or appending it to the URI.
Technique: T1001: Data Obfuscation
VBShower has attempted to complicate forensic analysis by deleting all the files contained in %APPDATA%\..\Local\Temporary Internet Files\Content.Word and %APPDATA%\..\Local Settings\Temporary Internet Files\Content.Word\.
Technique: T1070: Indicator Removal on Host
APT34 malware often uses HTTP and DNS for C2.
Technique: T1071: Application Layer Protocol
(Source: SecureWorks) Some payloads leveraged DLL side loading, a technique that involves running a legitimate, typically digitally signed, program that loads a malicious DLL
Technique: T1574: Hijack Execution Flow
Adversaries may use the Windows Component Object Model  for local code execution.
Technique: T1559: Inter-Process Communication
PoisonIvy creates a Registry key in the Active Setup pointing to a malicious executable.
Technique: T1547: Boot or Logon Autostart Execution
This directory will also contain the process id of the running malware in process.id and a “build name” (as it is called by the author) in build.id
Technique: T1057: Process Discovery
Enumerates running processes for “Wireshark” and “Sysinternals”
Technique: T1057: Process Discovery
Goopy has the ability to communicate with its C2 over DNS.
Technique: T1071: Application Layer Protocol
The adversary can then collect the hash information sent over the wire through tools that monitor the ports for traffic or through Network Sniffing and crack the hashes offline through Brute Force to obtain the plaintext passwords.
Technique: T1557: Adversary-in-the-Middle
QUADAGENT gathers the victim username.
Technique: T1033: System Owner/User Discovery
The initial DNS query sent by the payload to obtain the system specific identifier uses the following structure, which includes the current process identifier (PID) as the subdomain of the C2 domain: <current process id>.<c2 domain> The C2 server will provide the system specific identifier within the answer portion of the DNS response
Technique: T1071: Application Layer Protocol
The payload uses WMI queries and checks running processes for evidence that the script may be executing within an analysis environment
Technique: T1047: Windows Management Instrumentation
Adversaries may set up their own Domain Name System  servers that can be used during targeting.
Technique: T1583: Acquire Infrastructure
Email attacks often use “click-worthy” or interesting topics to convince users to click links or open attachments that could lead to various threats
Technique: T1204: User Execution
Adversaries may inject malicious code into process via process doppelgänging in order to evade process-based defenses as well as possibly elevate privileges.
Technique: T1055: Process Injection
POWERTON has used AES for encrypting C2 traffic.
Technique: T1573: Encrypted Channel
Dragonfly 2.0 used batch scripts to enumerate users on a victim domain controller.
Technique: T1087: Account Discovery
Outlook rules allow a user to define automated behavior to manage email messages.
Technique: T1137: Office Application Startup
Adversaries may gather information about the victim's organization that can be used during targeting.
Technique: T1591: Gather Victim Org Information
AppleJeus has placed a plist file within the LaunchDaemons folder and launched it manually.
Technique: T1543: Create or Modify System Process
In this latest campaign, APT34 leveraged the recent Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER
Technique: T1203: Exploitation for Client Execution
Bisonal uses HTTP for C2 communications.
Technique: T1071: Application Layer Protocol
Keydnap prompts the users for credentials.
Technique: T1056: Input Capture
Cobalt Strike can determine the NetBios name and  the IP addresses of targets machines including domain controllers.
Technique: T1016: System Network Configuration Discovery
WINERACK can enumerate files and directories.
Technique: T1083: File and Directory Discovery
2e0361fd73f60c76c69806205307ccac, update.dll (MiniDuke), 425kb (internal name = “UserCache.dll“) 9e3f3b5e9ece79102d257e8cf982e09e, cache.dll (CozyDuke), 425kb (internal name = “UserCache.dll“) The two share identical export function names in their export directories, and the naming appears to be randomly assigned at compile time
Technique: T1055: Process Injection
RDAT can communicate with the C2 via subdomains that utilize base64 with character substitutions.
Technique: T1132: Data Encoding
Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by Replication Through Removable Media.
Technique: T1092: Communication Through Removable Media
XAgent C2 Communications The macOS variant of XAgent has ability to receive commands from threat actors via its command and control channel, but is also capable of logging key strokes via its keylogger functionality
Technique: T1056: Input Capture
EKANS stops processes related to security and management software.
Technique: T1562: Impair Defenses
Once infected, victims will reach out to and be redirected by these resolvers.
Technique: T1102: Web Service
With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.
Technique: T1098: Account Manipulation
BoomBox has the ability to mask malicious data strings as PDF files.
Technique: T1036: Masquerading
Chimera has used the get -b <start ip> -e <end ip> -p command for network scanning as well as a custom Python tool  packed into a Windows executable named Get.exe to scan IP ranges for HTTP.
Technique: T1046: Network Service Scanning
It also has the ability to monitor the cryptocurrency miner file and process.
Technique: T1083: File and Directory Discovery
Adversaries may buy and/or steal capabilities that can be used during targeting.
Technique: T1588: Obtain Capabilities
[2] Threat groups use strategic web compromises (SWCs), also known as watering hole attacks, to target a wide array of potential victims
Technique: T1189: Drive-by Compromise
Ragnar Locker can delete volume shadow copies using vssadmin delete shadows /all /quiet.
Technique: T1490: Inhibit System Recovery
These programs control flow of execution before the operating system takes control.
Technique: T1542: Pre-OS Boot
KEYMARBLE can obtain a list of running processes on the system.
Technique: T1057: Process Discovery
Briba uses rundll32 within Registry Run Keys / Startup Folder entries to execute malicious DLLs.
Technique: T1218: Signed Binary Proxy Execution
These solutions differ from other storage solutions  in that there is no overarching application.
Technique: T1530: Data from Cloud Storage Object
LoudMiner used a script to gather the IP address of the infected machine before sending to the C2.
Technique: T1016: System Network Configuration Discovery
Leviathan has sent spearphishing attachments attempting to get a user to click.
Technique: T1204: User Execution
SYNful Knock has the capability to add its own custom backdoor password when it modifies the operating system of the affected network device.
Technique: T1556: Modify Authentication Process
TrickBot decodes the configuration data and modules.
Technique: T1140: Deobfuscate/Decode Files or Information
Silence has used HKCU\Software\Microsoft\Windows\CurrentVersion\Run, HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and the Startup folder to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
RainyDay can create and register a service for execution.
Technique: T1007: System Service Discovery
Valak has the ability to decode and decrypt downloaded files.
Technique: T1140: Deobfuscate/Decode Files or Information
NETWIRE can persist via startup options for Login items.
Technique: T1547: Boot or Logon Autostart Execution
The boot loader is the first piece of software that loads when the device starts that, in turn, will launch the operating system.
Technique: T1601: Modify System Image
APT18 uses HTTP for C2 communications.
Technique: T1071: Application Layer Protocol
One version of Helminth consists of VBScript scripts.
Technique: T1059: Command and Scripting Interpreter
APT29 used a forged duo-sid cookie to bypass MFA set on an email account.
Technique: T1550: Use Alternate Authentication Material
This technique bypasses some multi-factor authentication protocols since the session is already authenticated.
Technique: T1550: Use Alternate Authentication Material
Sowbug named its tools to masquerade as Windows or Adobe Reader software, such as by using the file name adobecms.exe and the directory CSIDL_APPDATA\microsoft\security.
Technique: T1036: Masquerading
These malicious applications have been delivered through popups on legitimate websites.
Technique: T1189: Drive-by Compromise
SUNSPOT used Windows API functions such as MoveFileEx and NtQueryInformationProcess as part of the SUNBURST injection process.
Technique: T1106: Native API
Bankshot can terminate a specific process by its process id.
Technique: T1543: Create or Modify System Process
Bazar can enumerate the victim's desktop.
Technique: T1083: File and Directory Discovery
Bisonal can obtain a list of running processes on the victim’s machine.
Technique: T1057: Process Discovery
In this scenario, adversaries attach a file to the spearphishing email and usually rely upon the recipient populating information then returning the file.
Technique: T1598: Phishing for Information
OSX/Shlayer uses the curl -fsL "$url" >$tmp_path command to download malicious payloads into a temporary directory.
Technique: T1105: Ingress Tool Transfer
JCry has created payloads in the Startup directory to maintain persistence.
Technique: T1547: Boot or Logon Autostart Execution
Rocke installed a cron job that downloaded and executed files from the C2.
Technique: T1053: Scheduled Task/Job
Accounts may be deleted, locked, or manipulated  to remove access to accounts.
Technique: T1531: Account Access Removal
QakBot can measure the download speed on a targeted host.
Technique: T1016: System Network Configuration Discovery
Seasalt has a command to delete a specified file.
Technique: T1070: Indicator Removal on Host
FinFisher takes a screenshot of the screen and displays it on top of all other windows for few seconds in an apparent attempt to hide some messages showed by the system during the setup process.
Technique: T1113: Screen Capture
Keylogging Functionality XAgent also has a keylogger functionality that allows the threat actors to steal credentials as the user types them
Technique: T1056: Input Capture
Cobalt Strike's "beacon" payload can collect information on process details.
Technique: T1057: Process Discovery
Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.
Technique: T1548: Abuse Elevation Control Mechanism
BBSRAT can compress data with ZLIB prior to sending it back to the C2 server.
Technique: T1560: Archive Collected Data
With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Technique: T1136: Create Account
The group has also used the ping command.
Technique: T1018: Remote System Discovery
CCBkdr was added to a legitimate, signed version 5.33 of the CCleaner software and distributed on CCleaner's distribution site.
Technique: T1195: Supply Chain Compromise
KONNI has the capability to perform keylogging.
Technique: T1056: Input Capture
menuPass has used tools to exploit the ZeroLogon vulnerability .
Technique: T1210: Exploitation of Remote Services
Exaramel for Linux has a command to download a file from  and to a remote C2 server.
Technique: T1105: Ingress Tool Transfer
It also uses AES128-CBC encrypted blobs for SUNBURST source code and data extracted from the SolarWinds Orion <MsBuild.exe process.
Technique: T1027: Obfuscated Files or Information
Chaes can download additional files onto an infected machine.
Technique: T1105: Ingress Tool Transfer
During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes.
Technique: T1056: Input Capture
Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic.
Technique: T1071: Application Layer Protocol
Winnti for Linux has decoded XOR encoded strings holding its configuration upon execution.
Technique: T1140: Deobfuscate/Decode Files or Information
Pony has used the NetUserEnum function to enumerate local accounts.
Technique: T1087: Account Discovery
The threat actors also took additional steps to replace some variable strings in the more recent samples, likely in an attempt to avoid signature-based detection from Yara rules. Once the document was opened, it prompted the user to enable the macro titled "BlackWater.bas".
Technique: T1204: User Execution
Kwampirs collects a list of users belonging to the local users and administrators groups with the commands net localgroup administrators and net localgroup users.
Technique: T1069: Permission Groups Discovery
HiddenWasp adds itself as a shared object to the LD_PRELOAD environment variable.
Technique: T1574: Hijack Execution Flow
Fysbis has installed itself as an autostart entry under ~/.config/autostart/dbus-inotifier.desktop to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
A module in CozyCar allows arbitrary commands to be executed by invoking C:\Windows\System32\cmd.exe.
Technique: T1059: Command and Scripting Interpreter
* Custom drivers.
Technique: T1056: Input Capture
BendyBear can query the host's Registry key at HKEY_CURRENT_USER\Console\QuickEdit to retrieve data.
Technique: T1012: Query Registry
Maze has delivered components for its ransomware attacks using MSI files, some of which have been executed from the command-line using msiexec.
Technique: T1218: Signed Binary Proxy Execution
Waterbear can scramble functions not to be executed again with random values.
Technique: T1027: Obfuscated Files or Information
These registrations have a five-minute average lifespan, resulting in a constant shuffle of IP address resolution.
Technique: T1568: Dynamic Resolution
TrickBot used COM to setup scheduled task for persistence.
Technique: T1559: Inter-Process Communication
BLINDINGCAN has downloaded files to a victim machine.
Technique: T1105: Ingress Tool Transfer
JHUHUGIT can retrieve an additional payload from its C2 server.
Technique: T1105: Ingress Tool Transfer
Carbanak used legitimate programs such as AmmyyAdmin and Team Viewer for remote interactive C2 to target systems.
Technique: T1219: Remote Access Software
Also, the use of the  mimikatz and pwdump tools suggests the adversary attempts to dump credentials on compromised systems
Technique: T1003: OS Credential Dumping
Variants of Emissary have added Run Registry keys to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
FinFisher uses DLL side-loading to load malicious programs.
Technique: T1574: Hijack Execution Flow
Metamorfo has encrypted payloads and strings.
Technique: T1027: Obfuscated Files or Information
Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation  event subscription.
Technique: T1546: Event Triggered Execution
PAM components, such as pam_unix.so, can be patched to accept arbitrary adversary supplied values as legitimate credentials.
Technique: T1556: Modify Authentication Process
XAgentOSX contains the ftpUpload function to use the FTPManager:uploadFile method to upload files from the target system.
Technique: T1071: Application Layer Protocol
Zeus Panda can hook GetClipboardData function to watch for clipboard pastes to collect.
Technique: T1115: Clipboard Data
njRAT has used HTTP for C2 communications.
Technique: T1071: Application Layer Protocol
A number of tools can be used to retrieve the SAM file through in-memory techniques:
* pwdumpx.exe
* gsecdump
* Mimikatz
* secretsdump.py
Alternatively, the SAM can be extracted from the Registry with Reg:
* reg save HKLM\sam sam
* reg save HKLM\system system
Creddump7 can then be used to process the SAM database locally to retrieve hashes.
Technique: T1003: OS Credential Dumping
Bazar also resolves strings and API calls at runtime.
Technique: T1140: Deobfuscate/Decode Files or Information
Adversaries may use their own abstracted file system, separate from the standard file system present on the infected system.
Technique: T1564: Hide Artifacts
GetClipboardData() 
Technique: T1115: Clipboard Data
Crimson has the ability to discover pluggable/removable drives to extract files from.
Technique: T1120: Peripheral Device Discovery
WannaCry attempts to copy itself to remote computers after gaining access via an SMB exploit.
Technique: T1570: Lateral Tool Transfer
Digital certificate data may also be available from artifacts signed by the organization .
Technique: T1596: Search Open Technical Databases
As with legitimate development efforts, different skill sets may be required for developing malware.
Technique: T1587: Develop Capabilities
Magic Hound malware can take a screenshot and upload the file to its C2 server.
Technique: T1113: Screen Capture
RogueRobin gathers BIOS versions and manufacturers, the number of CPU cores, the total physical memory, and the computer name.
Technique: T1082: System Information Discovery
Darkhotel has dropped an mspaint.lnk shortcut to disk which launches a shell script that downloads and executes a file.
Technique: T1547: Boot or Logon Autostart Execution
InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries.
Technique: T1218: Signed Binary Proxy Execution
IcedID has embedded binaries within RC4 encrypted .png files.
Technique: T1027: Obfuscated Files or Information
Several Lazarus Group malware families install themselves as new services on victims.
Technique: T1543: Create or Modify System Process
Operation Wocao has collected a list of running processes on the infected system.
Technique: T1057: Process Discovery
4 Upload edg499.dat, which includes the list of interesting files
Technique: T1083: File and Directory Discovery
Revenge RAT creates a Registry key at HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell to survive a system reboot.
Technique: T1547: Boot or Logon Autostart Execution
Ursnif droppers have used COM objects to execute the malware's full executable payload.
Technique: T1559: Inter-Process Communication
Valak can gather information regarding the user.
Technique: T1033: System Owner/User Discovery
Adversaries may modify these profiles to include arbitrary commands, functions, modules, and/or PowerShell drives to gain persistence.
Technique: T1546: Event Triggered Execution
POWERSTATS uses PowerShell for obfuscation and execution.
Technique: T1059: Command and Scripting Interpreter
Pillowmint has deleted the filepath %APPDATA%\Intel\devmonsrv.exe.
Technique: T1070: Indicator Removal on Host
After finding the process id, the shellcode uses standard functions to allocate and write memory within Explorer and then uses low-level API RtlCreateUserThread for thread injection.
Technique: T1055: Process Injection
macOS allows logon scripts  to be executed whenever a specific user logs into a system.
Technique: T1037: Boot or Logon Initialization Scripts
Since sudo was made for the system administrator, it has some useful configuration features such as a timestamp_timeout, which is the amount of time in minutes between instances of sudo before it will re-prompt for a password.
Technique: T1548: Abuse Elevation Control Mechanism
menuPass has used a script  to execute a command on a target machine via Task Scheduler.
Technique: T1053: Scheduled Task/Job
A similar process is then used to wipe content in logical drives and, finally, attempt to wipe every byte of every sector on every drive.
Technique: T1561: Disk Wipe
QakBot can use MSIExec to spawn multiple cmd.exe processes.
Technique: T1218: Signed Binary Proxy Execution
Higaisa used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.
Technique: T1140: Deobfuscate/Decode Files or Information
Proton uses VNC to connect into systems.
Technique: T1021: Remote Services
Magic Hound has downloaded additional code and files from servers onto victims.
Technique: T1105: Ingress Tool Transfer
SombRAT can communicate over DNS with the C2 server.
Technique: T1071: Application Layer Protocol
Dacls can establish persistence via a LaunchAgent.
Technique: T1543: Create or Modify System Process
Grandoreiro can send data it retrieves to the C2 server.
Technique: T1041: Exfiltration Over C2 Channel
OSX_OCEANLOTUS.D can run commands through a terminal on the victim’s machine.
Technique: T1059: Command and Scripting Interpreter
A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control  or Exfiltration Over Web Service.
Technique: T1583: Acquire Infrastructure
Clop has searched folders and subfolders for files to encrypt.
Technique: T1083: File and Directory Discovery
Higaisa used an XSL file to run VBScript code.
Technique: T1220: XSL Script Processing
InnaputRAT variants have attempted to appear legitimate by adding a new service named OfficeUpdateService.
Technique: T1036: Masquerading
Smoke Loader searches for credentials stored from web browsers.
Technique: T1555: Credentials from Password Stores
Inception has enumerated installed software on compromised systems.
Technique: T1518: Software Discovery
Mosquito's installer uses WMI to search for antivirus display names.
Technique: T1047: Windows Management Instrumentation
Operation Wocao has used the time command to retrieve the current time of a compromised system.
Technique: T1124: System Time Discovery
Clop can encrypt files using AES, RSA, and RC4 and will add the ".clop" extension to encrypted files.
Technique: T1486: Data Encrypted for Impact
WannaCry contains a thread that will attempt to scan for new attached drives every few seconds.
Technique: T1120: Peripheral Device Discovery
Astaroth searches for different processes on the system.
Technique: T1057: Process Discovery
GrimAgent can use a hardcoded server public RSA key to encrypt the first request to C2.
Technique: T1573: Encrypted Channel
ETW interruption can be achieved multiple ways, however most directly by defining conditions using the PowerShell Set-EtwTraceProvider cmdlet or by interfacing directly with the Registry to make alterations.
Technique: T1562: Impair Defenses
cmstp.exe
Technique: T1218: Signed Binary Proxy Execution
Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Technique: T1553: Subvert Trust Controls
This shellcode is decrypted in memory through EQENDT32.EXE
Technique: T1027: Obfuscated Files or Information
Cuba can enumerate local drives, disk type, and disk free space.
Technique: T1082: System Information Discovery
Elderwood has targeted manufacturers in the supply chain for the defense industry.
Technique: T1195: Supply Chain Compromise
ServHelper has commands for adding a remote desktop user and sending RDP traffic to the attacker through a reverse SSH tunnel.
Technique: T1021: Remote Services
A JHUHUGIT variant gathers network interface card information.
Technique: T1016: System Network Configuration Discovery
Configuration repositories may also facilitate remote access and administration of devices.
Technique: T1602: Data from Configuration Repository
BabyShark has executed the reg query command for HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default.
Technique: T1012: Query Registry
Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control.
Technique: T1205: Traffic Signaling
Threat Group-3390 actors look for and use VPN profiles during an operation to access the network using external VPN services.
Technique: T1133: External Remote Services
Adversaries may abuse the Windows service control manager to execute malicious commands or payloads.
Technique: T1569: System Services
Since Regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator  to file on an external Web server as an argument during invocation.
Technique: T1218: Signed Binary Proxy Execution
Adversaries may gather information about identities and roles within the victim organization that can be used during targeting.
Technique: T1591: Gather Victim Org Information
UPPERCUT has used HTTP for C2, including sending error codes in Cookie headers.
Technique: T1071: Application Layer Protocol
Penquin can encrypt communications using the BlowFish algorithm and a symmetric key exchanged with Diffie Hellman.
Technique: T1573: Encrypted Channel
Certificates are commonly used for establishing secure TLS/SSL communications within a web browser.
Technique: T1553: Subvert Trust Controls
After writing to this file, the Trojan will enter a loop to continually to check for changes to the modification time of this file, effectively waiting for the actor to make modifications to the file
Technique: T1070: Indicator Removal on Host
If this information is not present, the computer will not be able to load an operating system during the boot process, leaving the computer unavailable.
Technique: T1561: Disk Wipe
BADNEWS checks for new hard drives on the victim, such as USB devices, by listening for the WM_DEVICECHANGE window message.
Technique: T1120: Peripheral Device Discovery
Crutch has staged stolen files in the C:\AMD\Temp directory.
Technique: T1074: Data Staged
HAWKBALL has leveraged several Windows API calls to create processes, gather disk information, and detect debugger activity.
Technique: T1106: Native API
LOWBALL uses the Dropbox cloud storage service for command and control.
Technique: T1102: Web Service
APT32 used Outlook Credential Dumper to harvest credentials stored in Windows registry.
Technique: T1552: Unsecured Credentials
Kivars has the ability to conceal its activity through hiding active windows.
Technique: T1564: Hide Artifacts
Winnti for Linux has used a passive listener, capable of identifying a specific magic value before executing tasking, as a secondary command and control  mechanism.
Technique: T1205: Traffic Signaling
TEMP.Veles has used scheduled task XML triggers.
Technique: T1053: Scheduled Task/Job
In contrast, the "double-flux" method registers and de-registers an address as part of the DNS Name Server record list for the DNS zone, providing additional resilience for the connection.
Technique: T1568: Dynamic Resolution
Egregor has used BITSadmin to download and execute malicious DLLs.
Technique: T1197: BITS Jobs
The files we recovered indicate they do it by executing a script file, which uses the Sysinternals  psexec tool to move laterally by trying to copy it to every machine they can reach:
Technique: T1569: System Services
Machete retrieves the user profile data  from Chrome and Firefox browsers.
Technique: T1217: Browser Bookmark Discovery
OilRig has used net group /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to find domain group permission settings.
Technique: T1069: Permission Groups Discovery
Dragonfly has obtained and used tools such as Mimikatz, CrackMapExec, and PsExec.
Technique: T1588: Obtain Capabilities
LookBack can enumerate services on the victim machine.
Technique: T1007: System Service Discovery
Dragonfly 2.0 used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files.
Technique: T1053: Scheduled Task/Job
China Chopper's server component is capable of opening a command terminal.
Technique: T1059: Command and Scripting Interpreter
3PARA RAT uses HTTP for command and control.
Technique: T1071: Application Layer Protocol
Reaver drops and executes a malicious CPL file as its payload.
Technique: T1218: Signed Binary Proxy Execution
POORAIM can perform screen capturing.
Technique: T1113: Screen Capture
BendyBear has decrypted function blocks using a XOR key during runtime to evade detection.
Technique: T1140: Deobfuscate/Decode Files or Information
Blue Mockingbird has used Windows Scheduled Tasks to establish persistence on local and remote hosts.
Technique: T1053: Scheduled Task/Job
APT32 has attempted to lure users to execute a malicious dropper delivered via a spearphishing attachment.
Technique: T1204: User Execution
Xbash can download additional malicious files from its C2 server.
Technique: T1105: Ingress Tool Transfer
SLOTHFULMEDIA has a keylogging capability.
Technique: T1056: Input Capture
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries.
Technique: T1560: Archive Collected Data
GuLoader can use HTTP to retrieve additional binaries.
Technique: T1071: Application Layer Protocol
Likewise, one or more reflector may be used to focus traffic on the target.
Technique: T1498: Network Denial of Service
Egregor can encrypt all non-system files using a hybrid AES-RSA algorithm prior to displaying a ransom note.
Technique: T1486: Data Encrypted for Impact
BADNEWS copies documents under 15MB found on the victim system to is the user's %temp%\SMB\ folder.
Technique: T1074: Data Staged
Wizard Spider has used cmd.exe to execute commands on a victim's machine.
Technique: T1059: Command and Scripting Interpreter
Netwalker can determine the system architecture it is running on to choose which version of the DLL to use.
Technique: T1082: System Information Discovery
SslMM creates a new thread implementing a keylogging facility using Windows Keyboard Accelerators.
Technique: T1056: Input Capture
APT28 uses a tool to infect connected USB devices and transmit itself to air-gapped computers when the infected USB device is inserted.
Technique: T1091: Replication Through Removable Media
Transparent Tribe has set up websites with malicious hyperlinks and iframes to infect targeted victims with Crimson, njRAT, and other malicious tools.
Technique: T1608: Stage Capabilities
An APT32 backdoor can use HTTP over a non-standard TCP port  which is specified in the backdoor configuration.
Technique: T1571: Non-Standard Port
ShadowPad maintains a configuration block and virtual file system in the Registry.
Technique: T1112: Modify Registry
CHOPSTICK can use a DGA for Fallback Channels, domains are generated by concatenating words from lists.
Technique: T1568: Dynamic Resolution
BLUELIGHT can check to see if the infected machine has VM tools running.
Technique: T1497: Virtualization/Sandbox Evasion
Machete's Machete MSI installer has masqueraded as a legitimate Adobe Acrobat Reader installer.
Technique: T1036: Masquerading
A system info module in CozyCar gathers information on the victim host’s configuration.
Technique: T1082: System Information Discovery
Ramsay can scan for removable media which may contain documents for collection.
Technique: T1120: Peripheral Device Discovery
To establish persistence, Okrum can install itself as a new service named NtmSsvc.
Technique: T1543: Create or Modify System Process
If the first resolved domain IP address starts with 24.125.X.X, then it is set to 1
Technique: T1016: System Network Configuration Discovery
Emotet has been observed injecting in to Explorer.exe and other processes.
Technique: T1055: Process Injection
gh0st RAT has used the InterlockedExchange, SeShutdownPrivilege, and ExitWindowsEx Windows API functions.
Technique: T1106: Native API
APT32 has conducted targeted surveillance against activists and bloggers.
Technique: T1589: Gather Victim Identity Information
Sharpshooter's first-stage downloader installed Rising Sun to the startup folder %Startup%\mssync.exe.
Technique: T1547: Boot or Logon Autostart Execution
Mustang Panda has downloaded additional executables following the initial infection stage.
Technique: T1105: Ingress Tool Transfer
Indrik Spider used fake updates for FlashPlayer plugin and Google Chrome as initial infection vectors.
Technique: T1036: Masquerading
Adversaries can target various layers of the application stack that is hosted on the system used to provide the service.
Technique: T1499: Endpoint Denial of Service
APT28 uses a tool that captures information from air-gapped computers via an infected USB and transfers it to network-connected computer when the USB is inserted.
Technique: T1092: Communication Through Removable Media
NetWire has a built-in keylogger that can capture inputs from peripheral devices such as USB card readers
Technique: T1056: Input Capture
* Modify System Image may provide adversaries with hooks into the operating system of network devices to read raw keystrokes for login sessions.
Technique: T1056: Input Capture
lsass.exe 
Technique: T1547: Boot or Logon Autostart Execution
Open directory listing of hxxp://stevemike-fireforce[.]info/ Based on the contents and structure of the initial identified open directories, it was possible to find several infrastructure patterns in use
Technique: T1083: File and Directory Discovery
Adversaries may execute their own payloads by placing a malicious dynamic library  with an expected name in a path a victim application searches at runtime.
Technique: T1574: Hijack Execution Flow
ZLib has the ability to download files.
Technique: T1105: Ingress Tool Transfer
Epic has a command to delete a file from the machine.
Technique: T1070: Indicator Removal on Host
ThiefQuest uses AppleScript's osascript -e command to launch ThiefQuest's persistence via Launch Agent and Launch Daemon.
Technique: T1059: Command and Scripting Interpreter
Dragonfly 2.0 dropped and executed tools used for password cracking, including Hydra and CrackMapExec.
Technique: T1110: Brute Force
Table 4: URL parameters Additionally, the command string is hashed using the same RGPH hashing algorithm as before
Technique: T1016: System Network Configuration Discovery
Comnie uses Rundll32 to load a malicious DLL.
Technique: T1218: Signed Binary Proxy Execution
MechaFlounder has the ability to send the compromised user's account name and hostname within a URL to C2.
Technique: T1041: Exfiltration Over C2 Channel
Msiexec.exe execution may also be elevated to SYSTEM privileges if the AlwaysInstallElevated policy is enabled.
Technique: T1218: Signed Binary Proxy Execution
WannaCry enumerates current remote desktop sessions and tries to execute the malware on each session.
Technique: T1563: Remote Service Session Hijacking
Aria-body has the ability to capture screenshots on compromised hosts.
Technique: T1113: Screen Capture
Turla has used various JavaScript-based backdoors.
Technique: T1059: Command and Scripting Interpreter
ShimRat has used Windows API functions to install the service and shim.
Technique: T1106: Native API
Mustang Panda has used malicious PowerShell scripts to enable execution.
Technique: T1059: Command and Scripting Interpreter
Inception has encrypted malware payloads dropped on victim machines with AES and RC4 encryption.
Technique: T1027: Obfuscated Files or Information
Fox Kitten has searched network shares to access sensitive documents.
Technique: T1039: Data from Network Shared Drive
Hancitor has relied upon users clicking on a malicious link delivered through phishing.
Technique: T1204: User Execution
Even when we observed LuckyMouse using weaponized documents with CVE-2017-11882 (Microsoft Office Equation Editor, widely used by Chinese-speaking actors since December 2017), we can´t prove they were related to this particular attack
Technique: T1203: Exploitation for Client Execution
Some variants encrypt the collected data with AES and encode it with base64 before transmitting it to the C2 server.
Technique: T1560: Archive Collected Data
The base templates within the application are used each time an application starts.
Technique: T1137: Office Application Startup
The Trojan uses HTTP POST requests, as seen in Figure 1 to send data to the C2 server, and GET requests to receive commands from the server, as seen in Figure 2
Technique: T1071: Application Layer Protocol
The command and parameter names are hashed before being compared by the binary, making it difficult to recover the original names of commands and parameters
Technique: T1059: Command and Scripting Interpreter
Rover also automatically sends keylogger files and screenshots to the C2 server on a regular timeframe.
Technique: T1020: Automated Exfiltration
Regin appears to have functionality to modify remote Registry information.
Technique: T1112: Modify Registry
Deploying a multi-layered approach including access policies, anti-virus, network monitoring and whitelisting can help ensure customers are protected against threats such as this.  Users of Kaspersky products are protected as well against this threat by one of the following detections:  PDM:Exploit.Win32.Generic HEUR:Exploit.SWF.Generic HEUR:Exploit.MSOffice.Generic  More information about BlackOasis APT is available to customers of Kaspersky Intelligence Reporting Service
Technique: T1068: Exploitation for Privilege Escalation
NETWIRE has been executed through use of VBScripts.
Technique: T1059: Command and Scripting Interpreter
An adversary may gather the system time and/or time zone from a local or remote system.
Technique: T1124: System Time Discovery
Dyre has the ability to identify the computer name, OS version, and hardware configuration on a compromised host.
Technique: T1082: System Information Discovery
PLATINUM has sometimes used drive-by attacks against vulnerable browser plugins.
Technique: T1189: Drive-by Compromise
Cobalt Group has sent emails with URLs pointing to malicious documents.
Technique: T1566: Phishing
Inception has ensured persistence at system boot by setting the value regsvr32 %path%\ctfmonrn.dll /s.
Technique: T1218: Signed Binary Proxy Execution
The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain.
Technique: T1547: Boot or Logon Autostart Execution
OSInfo enumerates local and domain users Bankshot gathers domain and account names/information through process monitoring.
Technique: T1087: Account Discovery
Pysa can perform network reconnaissance using the Advanced Port Scanner tool.
Technique: T1046: Network Service Scanning
LoudMiner deleted installation files after completion.
Technique: T1070: Indicator Removal on Host
APT19 used an HTTP malware variant and a Port 22 malware variant to collect the victim’s username.
Technique: T1033: System Owner/User Discovery
YAHOYAH checks for the system’s Windows OS version and hostname.
Technique: T1082: System Information Discovery
ChChes is capable of downloading files, including additional modules.
Technique: T1105: Ingress Tool Transfer
The malware may modify the original entry point  of the healthy binary to ensure that it is executed before the legitimate code.
Technique: T1080: Taint Shared Content
Carbanak encrypts strings to make analysis more difficult.
Technique: T1027: Obfuscated Files or Information
FatDuke has attempted to mimic a compromised user's traffic by using the same user agent as the installed browser.
Technique: T1036: Masquerading
Zeus Panda adds persistence by creating Registry Run keys.
Technique: T1547: Boot or Logon Autostart Execution
Chimera has collected data of interest from network shares.
Technique: T1039: Data from Network Shared Drive
Compromised credentials for cloud accounts can be used to harvest sensitive data from online storage accounts and databases.
Technique: T1078: Valid Accounts
MarkiRAT can initiate communication over HTTP/HTTPS for its C2 server.
Technique: T1071: Application Layer Protocol
SUNBURST collected a list of process names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.
Technique: T1057: Process Discovery
Kimsuky has used a PowerShell-based keylogger as well as a tool called MECHANICAL to log keystrokes.
Technique: T1056: Input Capture
GoldMax can exfiltrate files over the existing C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
Conti can use CreateIoCompletionPort, PostQueuedCompletionStatus, and GetQueuedCompletionPort to rapidly encrypt files, excluding those with the extensions of .exe, .dll, and .lnk.
Technique: T1486: Data Encrypted for Impact
AppleSeed can find and collect data from removable media devices.
Technique: T1025: Data from Removable Media
These redirects were implemented by adding two malicious scripts obfuscated by a tool similar to the Dean Edwards packer
Technique: T1027: Obfuscated Files or Information