HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
Fysbis can use Base64 to encode its C2 traffic.
Technique: T1132: Data Encoding
Chimera has used legitimate credentials to login to an external VPN, Citrix, SSH, and other remote services.
Technique: T1133: External Remote Services
APT32 has used CVE-2016-7255 to escalate privileges.
Technique: T1068: Exploitation for Privilege Escalation
Xbash has maliciously encrypted victim's database systems and demanded a cryptocurrency ransom be paid.
Technique: T1486: Data Encrypted for Impact
of the Win32 API.
Technique: T1129: Shared Modules
Agent Tesla  has achieved persistence via scheduled tasks.
Technique: T1053: Scheduled Task/Job
This account modification may immediately follow Create Account or other malicious account activity.
Technique: T1098: Account Manipulation
Exaramel for Linux has a command to execute a shell command on the system.
Technique: T1059: Command and Scripting Interpreter
Credentials targeted by PinchDuke include ones associated with many sources such as The Bat!, Yahoo!, Mail.ru, Passport.Net, Google Talk, and Microsoft Outlook.
Technique: T1555: Credentials from Password Stores
Denis queries the Registry for keys and values.
Technique: T1012: Query Registry
In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted.
Technique: T1486: Data Encrypted for Impact
This command will automatically set the DNS type to use for actual C2   $showconfig Uploads the current configuration of the payload to the C2   slpx:\d+ Sets the sleep interval between outbound DNS requests   $fileUpload Downloads contents from the C2 server and writes them to a specified file    Table 3 Commands available to payload Campaign Analysis The following domains are configured within the payload to be used as C2s
Technique: T1071: Application Layer Protocol
APT32 has obtained and used tools such as Mimikatz and Cobalt Strike, and a variety of other open-source tools from GitHub.
Technique: T1588: Obtain Capabilities
Calisto collects information on bookmarks from Google Chrome.
Technique: T1217: Browser Bookmark Discovery
HotCroissant can remotely open applications on the infected host with the ShellExecuteA command.
Technique: T1059: Command and Scripting Interpreter
Fox Kitten has named the task for a reverse proxy lpupdate to appear legitimate.
Technique: T1036: Masquerading
Also, this variant of OopsIE uses the output of the whoami command as the parameter within the URL when communicating with the C2 server, which differs from the previous OopsIE variant that used the hostname and username from the environment variables
Technique: T1033: System Owner/User Discovery
Wizard Spider has lured victims to execute malware with spearphishing attachments containing macros to download either Emotet, Bokbot, TrickBot, or Bazar.
Technique: T1204: User Execution
Sandworm Team's research of potential victim organizations included the identification and collection of employee information.
Technique: T1589: Gather Victim Identity Information
Adversaries may abuse BITS to download, execute, and even clean up after running malicious code.
Technique: T1197: BITS Jobs
Environmental keying uses cryptography to constrain execution or actions based on adversary supplied environment specific conditions that are expected to be present on the target.
Technique: T1480: Execution Guardrails
With control over a DNS server, adversaries can configure DNS applications to provide conditional responses to malware and, generally, have more flexibility in the structure of the DNS-based C2 channel.
Technique: T1583: Acquire Infrastructure
Zebrocy is delivered primarily via phishing attacks that contain malicious Microsoft Office documents with macros as well as simple executable file attachments
Technique: T1566: Phishing
In the order to run the SSH server, the attackers created a VBS file with the following content: Set WshShell = CreateObject(“WScript.Shell”) WshShell.CurrentDirectory = “C:\WINDOWS\TEMP\Dropbear\” WshShell.Run “dropbear.exe -r rsa -d dss -a -p 6789”, 0, false As is evident here, the SSH server will accept connections on port number 6789
Technique: T1547: Boot or Logon Autostart Execution
The following tools and scripts can be used to gather and decrypt the password file from Group Policy Preference XML files:
* Metasploit’s post exploitation module: post/windows/gather/credentials/gpp
* Get-GPPPassword
* gpprefdecrypt.py
On the SYSVOL share, adversaries may use the following command to enumerate potential GPP XML files: dir /s * .xml
 APT33 has used a variety of publicly available tools like Gpppassword to gather credentials.
Technique: T1552: Unsecured Credentials
Sibot has used WMI to discover network connections and configurations.
Technique: T1047: Windows Management Instrumentation
The Windows Credential Manager separates website credentials from application or network credentials in two lockers.
Technique: T1555: Credentials from Password Stores
Bundlore has used the ps command to list processes.
Technique: T1057: Process Discovery
(For more on steganography, see the McAfee Labs Threats Report, June 2017, page 33.) The implants covered in this research establish a permanent presence on the victim’s system once the PowerShell implant is executed
Technique: T1546: Event Triggered Execution
Pasam creates a backdoor through which remote attackers can retrieve lists of files.
Technique: T1083: File and Directory Discovery
Mis-Type may create a file containing the results of the command cmd.exe /c net user {Username}.
Technique: T1087: Account Discovery
The simplest, "single-flux" method, involves registering and de-registering an addresses as part of the DNS A  record list for a single DNS name.
Technique: T1568: Dynamic Resolution
Interestingly, the delivery document borrowed a technique which was publicized in late 2017 as being used by the Sofacy threat actors, embedding the main malicious code in a EXIF metadata property of the document
Technique: T1140: Deobfuscate/Decode Files or Information
You can see that in addition to the code, the author copy-pasted English typos such as "IE Registery":PDB PathsWe can clearly identify a pattern in the PDB naming convention of all the binaries mentioned in this article.ROKRAT:e:\Happy\Work\Source\version 12\T+M\Result\DocPrint.pdb (from the "Evil New Year" campaign)d:\HighSchool\version 13\2ndBD\T+M\T+M\Result\DocPrint.pdb (from the "North Korean Human Rights" campaignD:\HighSchool\version 13\First-Dragon(VS2015)\Sample\Release\DogCall.pdb (ROKRAT Sample from an unidentified campaign from June)Wiper:D:\HighSchool\version 13\VC2008(Version15)\T+M\T+M\TMProject\Release\ErasePartition.pdb (From the "Are You Happy?" campaign)Summary GraphHere is a graph to visualize the similarities and differences between each campaign mentioned in this article:ConclusionSouth Korea is becoming an important target for malicious actors and the techniques used are becoming specific to the region (for example: use of native language to try and ensure the targets feel that the information, document or email being sent to them has added legitimacy)
Technique: T1082: System Information Discovery
Agent Tesla can capture screenshots of the victim’s desktop.
Technique: T1113: Screen Capture
Kasidet has the ability to search for a given process name in processes currently running in the system.
Technique: T1057: Process Discovery
Regular Expressions   ([^r-v\\s])[r-v]([\\w\\d+\\/=]+)-\\w+.(<domainList[0]>|<domainList[1]>|<domainList[n]>)   Address:\\s+(([a-fA-F0-9]{0,4}:{1,4}[\\w|:]+){1,8})   Address:\\s+(([a-fA-F0-9]{0,4}:{1,2}){1,8})   ([^r-v\\s]+)[r-v]([\\w\\d+\\/=]+).(<domainList[0]>|<domainList[1]>|<domainList[n]>)   (\\w+).(<domainList[0]>|<domainList[1]>|<domainList[n]>)   Address:\\s+(\\d+.\\d+.\\d+.\\d+)    Table 3 Regular expressions used by RogueRobin The C# variant, like its PowerShell relative, will issue DNS queries to determine which query types can successfully communicate with its C2 servers
Technique: T1016: System Network Configuration Discovery
Pysa has used RSA and AES-CBC encryption algorithm to encrypt a list of targeted file extensions.
Technique: T1486: Data Encrypted for Impact
APT28 has routed traffic over Tor and VPN servers to obfuscate their activities.
Technique: T1090: Proxy
SamSam has been seen using AES or DES to encrypt payloads and payload components.
Technique: T1027: Obfuscated Files or Information
Some variants of Cherry Picker use AppInit_DLLs to achieve persistence by creating the following Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows "AppInit_DLLs"="pserver32.dll" Ramsay can insert itself into the address space of other applications using the AppInit DLL Registry key.
Technique: T1546: Event Triggered Execution
SUNBURST checked for a variety of antivirus/endpoint detection agents prior to execution.
Technique: T1518: Software Discovery
Information about an organization’s business relationships may include a variety of details, including second or third-party organizations/domains  that have connected  network access.
Technique: T1591: Gather Victim Org Information
Reaver encrypts some of its files with XOR.
Technique: T1027: Obfuscated Files or Information
Even when these registered DLLs do not comply with the CPL file specification and do not export CPlApplet functions, they are loaded and executed through its DllEntryPoint when Control Panel is executed.
Technique: T1218: Signed Binary Proxy Execution
A task can also be scheduled on a remote system, provided the proper authentication is met .
Technique: T1053: Scheduled Task/Job
CookieMiner can steal saved usernames and passwords in Chrome as well as credit card credentials.
Technique: T1555: Credentials from Password Stores
Adversaries may abuse traffic mirroring to mirror or redirect network traffic through other network infrastructure they control.
Technique: T1020: Automated Exfiltration
Elise encrypts exfiltrated data with RC4.
Technique: T1573: Encrypted Channel
TrickBot uses non-descriptive names to hide functionality and uses an AES CBC  encryption algorithm for its loader and configuration files.
Technique: T1027: Obfuscated Files or Information
Agent Tesla has had its code obfuscated in an apparent attempt to make analysis difficult.
Technique: T1027: Obfuscated Files or Information
Adversaries may abuse the at utility to perform task scheduling for initial, recurring, or future execution of malicious code.
Technique: T1053: Scheduled Task/Job
APT28 downloads and executes PowerShell scripts and performs PowerShell commands.
Technique: T1059: Command and Scripting Interpreter
Sandworm Team has used the BlackEnergy KillDisk component to overwrite files on Windows-based Human-Machine Interfaces.
Technique: T1485: Data Destruction
The TAINTEDSCRIBE command and execution module can perform target system enumeration.
Technique: T1018: Remote System Discovery
More_eggs has the capability to gather the IP address from the victim's machine.
Technique: T1016: System Network Configuration Discovery
ShadowPad has injected a DLL into svchost.exe.
Technique: T1055: Process Injection
HAFNIUM has used open-source C2 frameworks, including Covenant.
Technique: T1071: Application Layer Protocol
Adversaries may install SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic  with Web Protocols or lending credibility to a credential harvesting site.
Technique: T1608: Stage Capabilities
Operation Wocao has enabled Wdigest by changing the registry value from 0 to 1.
Technique: T1112: Modify Registry
Honeybee gathers computer name and information using the systeminfo command.
Technique: T1082: System Information Discovery
Adversaries can add other programs or processes to this registry value which will automatically launch at boot.
Technique: T1547: Boot or Logon Autostart Execution
Wizard Spider has used “systeminfo” and similar commands to acquire detailed configuration information of a victim machine.
Technique: T1082: System Information Discovery
Adversaries can also use internationalized domain names  to create visually similar lookalike domains for use in operations.
Technique: T1583: Acquire Infrastructure
When performing NAT, the network device will rewrite the source and/or destination addresses of the IP address header.
Technique: T1599: Network Boundary Bridging
When entered, these credentials are then sent to the C2 server, which allows DarkHydrus to collect the user account credentials
Technique: T1003: OS Credential Dumping
Golden tickets require adversaries to interact with the Key Distribution Center  in order to obtain TGS.
Technique: T1558: Steal or Forge Kerberos Tickets
Part of APT28's operation involved using CHOPSTICK modules to copy itself to air-gapped machines, using files written to USB sticks to transfer data and command traffic.
Technique: T1092: Communication Through Removable Media
Helminth has used Tasklist to get information on processes.
Technique: T1057: Process Discovery
TrickBot can enumerate computers and network devices.
Technique: T1018: Remote System Discovery
Adversaries may poison Address Resolution Protocol  caches to position themselves between the communication of two or more networked devices.
Technique: T1557: Adversary-in-the-Middle
Ursnif has injected HTML codes into banking sites to steal sensitive online banking information .
Technique: T1185: Browser Session Hijacking
File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions .
Technique: T1222: File and Directory Permissions Modification
Similar to Accessibility Features, on Windows Vista and later as well as Windows Server 2008 and later, a Registry key may be modified that configures "cmd.exe," or another program that provides backdoor access, as a "debugger" for an accessibility program .
Technique: T1546: Event Triggered Execution
BlackEnergy communicates with its C2 server over HTTP.
Technique: T1071: Application Layer Protocol
Adversaries may post content, known as a dead drop resolver, on Web services with embedded  domains or IP addresses.
Technique: T1102: Web Service
AutoIt backdoor is capable of identifying documents on the victim with the following extensions: .doc; .pdf, .csv, .ppt, .docx, .pst, .xls, .xlsx, .pptx, and .jpeg.
Technique: T1083: File and Directory Discovery
APT38 has identified primary users, currently logged in users, sets of users that commonly use a system, or inactive users.
Technique: T1033: System Owner/User Discovery
RedLeaves can enumerate and search for files and directories.
Technique: T1083: File and Directory Discovery
HotCroissant has the ability to clean up installed files, delete files, and delete itself from the victim’s machine.
Technique: T1070: Indicator Removal on Host
Kimsuky has collected Office, PDF, and HWP documents from its victims.
Technique: T1005: Data from Local System
Derusbi variants have been seen that use Registry persistence to proxy execution through regsvr32.exe.
Technique: T1218: Signed Binary Proxy Execution
Tropic Trooper has created a hidden directory under C:\ProgramData\Apple\Updates\ and C:\Users\Public\Documents\Flash\.
Technique: T1564: Hide Artifacts
The OwaAuth web shell enables a threat actor to upload and download files, launch processes, and execute SQL queries
Technique: T1105: Ingress Tool Transfer
PubPrn.vbs is a Visual Basic script that publishes a printer to Active Directory Domain Services.
Technique: T1216: Signed Script Proxy Execution
Mustang Panda has executed PowerShell scripts via WMI.
Technique: T1047: Windows Management Instrumentation
ZIRCONIUM has spoofed legitimate applications in phishing lures and changed file extensions to conceal  installation of malware.
Technique: T1036: Masquerading
Zebrocy also runs the echo %APPDATA% command to list the contents of the directory.
Technique: T1083: File and Directory Discovery
Chaes has used a script that extracts the web session cookie and sends it to the C2 server.
Technique: T1539: Steal Web Session Cookie
IFEOs enable a developer to attach a debugger to an application.
Technique: T1546: Event Triggered Execution
QUADAGENT uses multiple protocols  for its C2 server as fallback channels if communication with one is unsuccessful.
Technique: T1008: Fallback Channels
JPIN checks for the presence of certain security-related processes and deletes its installer/uninstaller component if it identifies any of them.
Technique: T1518: Software Discovery
The document can include, for example, a request similar to file://remote address/Normal.dotm to trigger the SMB request.
Technique: T1187: Forced Authentication
Adversaries may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and network resources.
Technique: T1561: Disk Wipe
Bazar can enumerate shared drives on the domain.
Technique: T1135: Network Share Discovery
USBStealer drops commands for a second victim onto a removable media drive inserted into the first victim, and commands are executed when the drive is inserted into the second victim.
Technique: T1092: Communication Through Removable Media
OceanSalt can delete files from the system.
Technique: T1070: Indicator Removal on Host
Shamoon contains base64-encoded strings.
Technique: T1027: Obfuscated Files or Information
menuPass has used Wevtutil to remove PowerShell execution logs.
Technique: T1070: Indicator Removal on Host
Emotet has used cmd.exe to run a PowerShell script.
Technique: T1059: Command and Scripting Interpreter
These credentials are used with PsExec and Windows Management Instrumentation to help the malware propagate itself across a network.
Technique: T1003: OS Credential Dumping
Anchor has used NTFS to hide files.
Technique: T1564: Hide Artifacts
GrimAgent has the ability to add bytes to change the file hash.
Technique: T1027: Obfuscated Files or Information
This screenshot is via an RDP session as indicated by the tab located at the top of the screen and is located at 164.132.67[.]216 which is hosted by OVH
Technique: T1113: Screen Capture
Turla has used multiple backdoors which communicate with a C2 server via email attachments.
Technique: T1071: Application Layer Protocol
Add-ins can be used to obtain persistence because they can be set to execute code when an Office application starts.
Technique: T1137: Office Application Startup
Chaes can steal login credentials and stored financial information from the browser.
Technique: T1555: Credentials from Password Stores
Adversaries may use this technique in conjunction with administrator-level Valid Accounts to remotely access a networked system over SMB, to interact with systems using remote procedure calls , transfer files, and run transferred binaries through remote Execution.
Technique: T1021: Remote Services
Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system.
Technique: T1546: Event Triggered Execution
Hildegard has searched for private keys in .ssh.
Technique: T1552: Unsecured Credentials
FIN8 has retrieved a list of trusted domains by using Nltest.exe /domain_trusts.
Technique: T1482: Domain Trust Discovery
PoetRAT has the ability to list files upon receiving the ls command from C2.
Technique: T1083: File and Directory Discovery
Penquin can use the command code do_vslist to send file names, size, and status to C2.
Technique: T1083: File and Directory Discovery
Adversaries may search in private threat intelligence vendor data to gather actionable information.
Technique: T1597: Search Closed Sources
By assigning one or both user permissions to a folder, the adversary can utilize any other account in the tenant to maintain persistence to the target user’s mail folders.
Technique: T1098: Account Manipulation
DLL injection is a method of executing arbitrary code in the address space of a separate live process.
Technique: T1055: Process Injection
This “downloaded” file is actually not dropped onto the system.
Technique: T1055: Process Injection
By default, access to these ccache entries is federated through the KCM daemon process via the Mach RPC protocol, which uses the caller's environment to determine access.
Technique: T1558: Steal or Forge Kerberos Tickets
APT29 has bypassed UAC.
Technique: T1548: Abuse Elevation Control Mechanism
AppleSeed has the ability to rename its payload to ESTCommon.dll to masquerade as a DLL belonging to ESTsecurity.
Technique: T1036: Masquerading
Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.
Technique: T1071: Application Layer Protocol
This may occur through compromising the SSH agent itself or by having access to the agent's socket.
Technique: T1563: Remote Service Session Hijacking
Cobalt Strike uses a custom command and control protocol that can encapsulated in DNS.
Technique: T1071: Application Layer Protocol
These platforms may not be well maintained and may break intermittently
Technique: T1083: File and Directory Discovery
Gamaredon Group's backdoor malware has also been written to a batch file.
Technique: T1059: Command and Scripting Interpreter
Stealth Falcon malware gathers passwords from the Windows Credential Vault.
Technique: T1555: Credentials from Password Stores
NBT-NS identifies systems on a local network by their NetBIOS name.
Technique: T1557: Adversary-in-the-Middle
The majority of native system logging is stored under the /var/log/ directory.
Technique: T1070: Indicator Removal on Host
EvilBunny has an integrated scripting engine to download and execute Lua scripts.
Technique: T1059: Command and Scripting Interpreter
Periodic low resolution screenshots
Technique: T1113: Screen Capture
Stealth Falcon malware gathers passwords from multiple sources, including Windows Credential Vault and Outlook.
Technique: T1555: Credentials from Password Stores
Threat Group-3390 actors use at to schedule tasks to run self-extracting RAR archives, which install HTTPBrowser or PlugX on other victims on a network.
Technique: T1053: Scheduled Task/Job
TinyZBot contains functionality to collect information from the clipboard.
Technique: T1115: Clipboard Data
Figure 6: Difference between a stock UPX packed file and the modified one A patch for UPX is available on ESET’s malware-research Github repository that allows unpacking Keydnap’s backdoor with the usual upx -d
Technique: T1027: Obfuscated Files or Information
PowerDuke has a command to get text of the current foreground window.
Technique: T1010: Application Window Discovery
Get-MsolRoleMember
Technique: T1087: Account Discovery
Cardinal RAT establishes Persistence by setting the  HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load Registry key to point to its executable.
Technique: T1547: Boot or Logon Autostart Execution
APT29 has exfiltrated collected data over a simple HTTPS request to a password-protected archive staged on a victim's OWA servers.
Technique: T1048: Exfiltration Over Alternative Protocol
IFEOs can be set directly via the Registry or in Global Flags via the GFlags tool.
Technique: T1546: Event Triggered Execution
FIN6 used PowerShell to execute an encoded command
Technique: T1546: Event Triggered Execution
Cobalt Strike can use rundll32.exe to load DLL from the command line.
Technique: T1218: Signed Binary Proxy Execution
InnaputRAT uses an 8-byte XOR key to obfuscate API names and other strings contained in the payload.
Technique: T1027: Obfuscated Files or Information
Attached to this email was a malicious Microsoft Word document (MD5: f6fafb7c30b1114befc93f39d0698560) that exploited CVE-2012-0158
Technique: T1566: Phishing
Adversaries may use information acquired via Vulnerabilities to focus exploit development efforts.
Technique: T1587: Develop Capabilities
Avaddon has searched for specific files prior to encryption.
Technique: T1083: File and Directory Discovery
This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.
Technique: T1588: Obtain Capabilities
BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.
Technique: T1203: Exploitation for Client Execution
TeamTNT has removed system logs from /var/log/syslog.
Technique: T1070: Indicator Removal on Host
Bankshot encodes commands from the control server using a range of characters and gzip.
Technique: T1132: Data Encoding
KillDisk registers as a service under the Plug-And-Play Support name.
Technique: T1036: Masquerading
SOUNDBITE is capable of gathering system information.
Technique: T1082: System Information Discovery
The file, named Microsoft.Win32.TaskScheduler.dll, is digitally signed by a certificate from AirVPN
Technique: T1553: Subvert Trust Controls
njRAT has a module that steals passwords saved in victim web browsers.
Technique: T1555: Credentials from Password Stores
Industroyer attempts to perform an HTTP CONNECT via an internal proxy to establish a tunnel.
Technique: T1572: Protocol Tunneling
Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Technique: T1033: System Owner/User Discovery
By default, Excel does not allow the download of data from the remote server, but will ask for the user’s consent by presenting the dialog box in Figure 2:  Figure 2 Excel security notice for .iqy files By enabling this data connection, the user allows Excel to obtain content from the URL in the .iqy file
Technique: T1204: User Execution
Raindrop decrypted its Cobalt Strike payload using an AES-256 encryption algorithm in CBC mode with a unique key per sample.
Technique: T1140: Deobfuscate/Decode Files or Information
Backdoor analysis The main loop of the backdoor has two main functions, infoClient and runHandle
Technique: T1140: Deobfuscate/Decode Files or Information
The attackers typically distribute Netwalker ransomware with the use of a reflective PowerShell loader script that has been protected from casual analysis with several layers of obfuscation.
Technique: T1059: Command and Scripting Interpreter
PLEAD has the ability to list drives and files on the compromised host.
Technique: T1083: File and Directory Discovery
Cadelspy has the ability to log keystrokes on the compromised host.
Technique: T1056: Input Capture
Azorult can steal credentials in files belonging to common software such as Skype, Telegram, and Steam.
Technique: T1552: Unsecured Credentials
NOKKI can collect the username from the victim’s machine.
Technique: T1033: System Owner/User Discovery
EKANS removes backups of Volume Shadow Copies to disable any restoration capabilities.
Technique: T1490: Inhibit System Recovery
S-Type also runs tests to determine the privilege level of the compromised user.
Technique: T1087: Account Discovery
SOUNDBITE is capable of enumerating application windows.
Technique: T1010: Application Window Discovery
BOOSTWRITE has encoded its payloads using a ChaCha stream cipher with a 256-bit key and 64-bit Initialization vector  to evade detection.
Technique: T1027: Obfuscated Files or Information
APT33 has attempted to use WMI event subscriptions to establish persistence on compromised hosts.
Technique: T1546: Event Triggered Execution
Fox Kitten has used scripts to access credential information from the KeePass database.
Technique: T1555: Credentials from Password Stores
Appendix Malware Family Descriptions    Malware Family  Description  Availability    DROPSHOT  Dropper that has been observed dropping and launching the TURNEDUP backdoor, as well as the SHAPESHIFT wiper malware  Non-Public    NANOCORE  Publicly available remote access Trojan (RAT) available for purchase
Technique: T1070: Indicator Removal on Host
If the requested host belongs to a resource that requires identification/authentication, the username and NTLMv2 hash will then be sent to the adversary controlled system.
Technique: T1557: Adversary-in-the-Middle
iKitten prompts the user for their credentials.
Technique: T1056: Input Capture
Turla has also used PowerSploit's Invoke-ReflectivePEInjection.ps1 to reflectively load a PowerShell payload into a random process on the victim system.
Technique: T1055: Process Injection
NETWIRE can use Native API including CreateProcess GetProcessById, and WriteProcessMemory.
Technique: T1106: Native API
JSS Loader has the ability to download and execute PowerShell scripts.
Technique: T1059: Command and Scripting Interpreter
SpeakUp uses POST and GET requests over HTTP to communicate with its main C&C server.
Technique: T1071: Application Layer Protocol
Chaes has added persistence via the Registry key software\microsoft\windows\currentversion\run\microsoft windows html help.
Technique: T1547: Boot or Logon Autostart Execution
With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.
Technique: T1136: Create Account
Shamoon can also spread via PsExec.
Technique: T1569: System Services
Adversaries may also compromise sites then include malicious content designed to collect website authentication cookies from visitors.
Technique: T1589: Gather Victim Identity Information
Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.
Technique: T1053: Scheduled Task/Job
Figure 6 Authentication dialog box with fake credentials entered On the C2 server, we observed Phishery receiving the inbound request and capturing the credentials, as seen in Figure 7
Technique: T1003: OS Credential Dumping
POWERSTATS can use DDE to execute additional payloads on compromised hosts.
Technique: T1559: Inter-Process Communication
Azure tools and APIs, such as the Azure AD Graph API and Azure Resource Manager API, can enumerate resources and services, including applications, management groups, resources and policy definitions, and their relationships that are accessible by an identity.
Technique: T1526: Cloud Service Discovery
The group often uses the trial version of Cobalt Strike, a publicly available commercial software for “Adversary Simulations and Red Team Operations.” Other public tools used by the group are Metasploit, a well-known free and open source framework for developing and executing exploit code against a remote target machine; Mimikatz, a post-exploitation tool that performs credential dumping; and Empire, “a PowerShell and Python post-exploitation agent.” For detection and exploitation of internet-facing web servers, CopyKittens use Havij, Acunetix and sqlmap
Technique: T1059: Command and Scripting Interpreter
Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Technique: T1518: Software Discovery
Nebulae uses functions named StartUserModeBrowserInjection and StopUserModeBrowserInjection indicating that it's trying to imitate chrome_frame_helper.dll.
Technique: T1036: Masquerading
The CAB file contains the following files and functions:  dll: A malicious DLL used to launch batch files (used with cliconfg.exe for UAC bypass)
Technique: T1548: Abuse Elevation Control Mechanism
Adversaries may register malicious password filter dynamic link libraries  into the authentication process to acquire user credentials as they are validated.
Technique: T1556: Modify Authentication Process
USBferry can use net view to gather information about remote systems.
Technique: T1018: Remote System Discovery
The malware’s capabilities include taking a system survey, access to the filesystem, executing commands and a reverse shell
Technique: T1059: Command and Scripting Interpreter
Adversaries have used this technique to avoid security warnings prompting users when compromised systems connect over HTTPS to adversary controlled web servers that spoof legitimate websites in order to collect login credentials.
Technique: T1553: Subvert Trust Controls
WindTail has the ability to enumerate the users home directory and the path to its own application bundle.
Technique: T1083: File and Directory Discovery
Magic Hound has used the command-line interface.
Technique: T1059: Command and Scripting Interpreter
This backdoor collects system information, including the operating system version and hostname, and includes functionality to check, upload, and register plugins that can further enhance its capabilities
Technique: T1082: System Information Discovery
Adversaries may modify code signing policies to enable execution of unsigned or self-signed code.
Technique: T1553: Subvert Trust Controls
DDE is a client-server protocol for one-time and/or continuous inter-process communication  between applications.
Technique: T1559: Inter-Process Communication
One archive sample analyzed by CTU researchers contained a legitimate PDF file, a benign image of interest to targets (see Figure 8), and an HttpBrowser installer disguised as an image file
Technique: T1036: Masquerading
Inception has used specific malware modules to gather domain membership.
Technique: T1069: Permission Groups Discovery
FIVEHANDS has the ability to decrypt its payload prior to execution.
Technique: T1140: Deobfuscate/Decode Files or Information
Mustang Panda has used junk code within their DLL files to hinder analysis.
Technique: T1027: Obfuscated Files or Information
DustySky achieves persistence by creating a Registry entry in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
Technique: T1547: Boot or Logon Autostart Execution
Ngrok can tunnel RDP and other services securely over internet connections.
Technique: T1572: Protocol Tunneling
T9000 searches through connected drives for removable storage devices.
Technique: T1120: Peripheral Device Discovery
Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.
Technique: T1027: Obfuscated Files or Information
Ptrace system call injection involves attaching to and modifying a running process.
Technique: T1055: Process Injection
Downgrading of a system image can be done on its own, or it can be used in conjunction with Patch System Image.
Technique: T1601: Modify System Image
Dyre injects into other processes to load modules.
Technique: T1055: Process Injection
PLAINTEE gains persistence by adding the Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce.
Technique: T1547: Boot or Logon Autostart Execution
Egregor has used rundll32 during execution.
Technique: T1218: Signed Binary Proxy Execution
This simply acts as cleanup to ensure original file artifacts no longer reside on the infected machine
Technique: T1070: Indicator Removal on Host
Get2 has the ability to inject DLLs into processes.
Technique: T1055: Process Injection
Malicious Document   Decoy Document  The attack starts with a spear-phishing email containing the HWP document named "미북 정상회담 전망 및 대비.hwp" (Prospects for US-North Korea Summit .hwp)
Technique: T1566: Phishing
Most libraries include functionality to encrypt and/or compress data.
Technique: T1560: Archive Collected Data
APT32's backdoor has used Windows services as a way to execute its malicious payload.
Technique: T1569: System Services
Adversaries may create email accounts that can be used during targeting.
Technique: T1585: Establish Accounts
This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like CreateProcess, LoadLibrary, etc.
Technique: T1129: Shared Modules
BoomBox can check its current working directory and for the presence of a specific file and terminate if specific values are not found.
Technique: T1480: Execution Guardrails
Adversaries may also install user level timers to achieve user level persistence.
Technique: T1053: Scheduled Task/Job
The adversaries modify publicly available tools such as ASPXSpy to remove identifying characteristics that network defenders use to identify web shells
Technique: T1505: Server Software Component
FIN7 has used fragmented strings, environment variables, standard input , and native character-replacement functionalities to obfuscate commands.
Technique: T1027: Obfuscated Files or Information
Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it.
Technique: T1021: Remote Services
Additional tools were recovered during the incident, including a network scanning/enumeration tool, the archiving tool WinRAR and a bespoke Microsoft SharePoint enumeration and data dumping tool, known as 'spwebmember'
Technique: T1018: Remote System Discovery
Inception has used HTTP, HTTPS, and WebDav in network communications.
Technique: T1071: Application Layer Protocol
For example, an adversary may use a script or utility that creates new ingress rules in existing security groups to allow any TCP/IP connectivity.
Technique: T1562: Impair Defenses
This technique differs from Screen Capture due to use of specific devices or applications for video recording rather than capturing the victim's screen.
Technique: T1125: Video Capture
APT38 has used a utility called CLOSESHAVE that can securely delete a file from the system.
Technique: T1070: Indicator Removal on Host
TeamTNT has also used libprocesshider to modify /etc/ld.so.preload.
Technique: T1049: System Network Connections Discovery
The use of a shared folder specified in the configuration enables Ragnar Locker to encrypt files on the host operating system, including files on any mapped drives.
Technique: T1564: Hide Artifacts
HTTPBrowser is capable of capturing keystrokes on victims.
Technique: T1056: Input Capture
MuddyWater has used malware that checked if the ProgramData folder had folders or files with the keywords "Kasper," "Panda," or "ESET."
Technique: T1083: File and Directory Discovery
Opening document starts a template injection technique for loading the document template from the internet.
Technique: T1221: Template Injection
This differs from Steal Web Session Cookie and other similar behaviors in that the cookies are new and forged by the adversary, rather than stolen or intercepted from legitimate users.
Technique: T1606: Forge Web Credentials
CrossRAT can list all files on a system.
Technique: T1083: File and Directory Discovery
PowerDuke uses rundll32.exe to load.
Technique: T1218: Signed Binary Proxy Execution
APT32 has used Web shells to maintain access to victim websites.
Technique: T1505: Server Software Component
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
Technique: T1059: Command and Scripting Interpreter
Skeleton Key is used to patch an enterprise domain controller authentication process with a backdoor password.
Technique: T1556: Modify Authentication Process
KGH_SPY has been spread through Word documents containing malicious macros.
Technique: T1204: User Execution
There was a slight deviation in the November grouping, where the three samples we collected still used the Joohn author name for the last modified field but reverted to a default USER/user author name for the creator field
Technique: T1033: System Owner/User Discovery
Windshift has used WMI to collect information about target machines.
Technique: T1047: Windows Management Instrumentation
Crimson contains a command to collect the victim MAC address and LAN IP.
Technique: T1016: System Network Configuration Discovery
BADFLICK: a backdoor that is capable of modifying the file system, generating a reverse shell, and modifying its command and control (C2) configuration
Technique: T1059: Command and Scripting Interpreter
Caterpillar WebShell has a module to perform brute force attacks on a system.
Technique: T1110: Brute Force
Ursnif has copied itself to and infected removable drives for propagation.
Technique: T1091: Replication Through Removable Media
Launch Daemons require elevated privileges to install, are executed for every user on a system prior to login, and run in the background without the need for user interaction.
Technique: T1543: Create or Modify System Process
SUNBURST used the WMI query Select * From Win32_SystemDriver to retrieve a driver listing.
Technique: T1047: Windows Management Instrumentation
The actor has the following demonstrated capabilities:To include exploits (for Hangul and Microsoft Office) in its workflows.To modify its campaigns by splitting the payload in to multiple stages To use compromised web servers or legitimate cloud based platforms
Technique: T1102: Web Service
Industroyer collects the victim machine’s Windows GUID.
Technique: T1082: System Information Discovery
Ebury can hook logging functions so that nothing from the backdoor gets sent to the logging facility.
Technique: T1562: Impair Defenses
NanHaiShu encodes files in Base64.
Technique: T1027: Obfuscated Files or Information
BLINDINGCAN has encrypted its C2 traffic with RC4.
Technique: T1573: Encrypted Channel
Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption.
Technique: T1573: Encrypted Channel
There have been examples of malware targeting session cookies to bypass multi-factor authentication systems.
Technique: T1550: Use Alternate Authentication Material
KEYMARBLE can capture screenshots of the victim’s machine.
Technique: T1113: Screen Capture
Hydraq connects to a predefined domain on port 443 to exfil gathered information.
Technique: T1048: Exfiltration Over Alternative Protocol
Remexi has a command to capture active windows on the machine and retrieve window titles.
Technique: T1010: Application Window Discovery
Doing so allows a plausible reason for asking about services, policies, and information about their environment.
Technique: T1598: Phishing for Information
Ragnar Locker may attempt to connect to removable drives and mapped network drives.
Technique: T1120: Peripheral Device Discovery
JPIN's installer/uninstaller component deletes itself if it encounters a version of Windows earlier than Windows XP or identifies security-related processes running.
Technique: T1070: Indicator Removal on Host
SLOWDRIFT downloads additional payloads.
Technique: T1105: Ingress Tool Transfer
BISCUIT has a command to download a file from the C2 server.
Technique: T1105: Ingress Tool Transfer
LightNeuron can store email data in files and directories specified in its configuration, such as C:\Windows\ServiceProfiles\NetworkService\appdata\Local\Temp\.
Technique: T1074: Data Staged
Skidmap has the ability to download, unpack, and decrypt tar.gz files .
Technique: T1140: Deobfuscate/Decode Files or Information
Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities.
Technique: T1036: Masquerading
Dragonfly 2.0 has gathered hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems.
Technique: T1187: Forced Authentication
PowerShower has the ability to deploy a reconnaissance module to retrieve a list of the active processes.
Technique: T1057: Process Discovery
Tor plugin 
Technique: T1090: Proxy
MacSpy uses HTTP for command and control.
Technique: T1071: Application Layer Protocol
Xbash can use scripts to invoke PowerShell to download a malicious PE executable or PE DLL for execution.
Technique: T1059: Command and Scripting Interpreter
Mosquito executes cmd.exe and uses a pipe to read the results and send back the output to the C2 server.
Technique: T1059: Command and Scripting Interpreter
RTM has named the scheduled task it creates "Windows Update".
Technique: T1036: Masquerading
There are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files.
Technique: T1566: Phishing
yty gathers information on victim’s drives and has a plugin for document listing.
Technique: T1083: File and Directory Discovery
Some Sakula samples use cmd.exe to delete temporary files.
Technique: T1070: Indicator Removal on Host
BRONZE BUTLER downloads encoded payloads and decodes them on the victim.
Technique: T1140: Deobfuscate/Decode Files or Information
ROKRAT lists the current running processes on the system.
Technique: T1057: Process Discovery
BUBBLEWRAP collects system information, including the operating system version and hostname.
Technique: T1082: System Information Discovery
Agent Tesla can gather credentials from a number of browsers.
Technique: T1555: Credentials from Password Stores
ObliqueRAT can check for blocklisted process names on a compromised host.
Technique: T1057: Process Discovery
If KillDisk gets the access token, then it attempt to modify the token privileges with AdjustTokenPrivileges.
Technique: T1134: Access Token Manipulation
Bundlore can persist via a LaunchAgent.
Technique: T1543: Create or Modify System Process
Magic Hound has attempted to get users to execute malware via social media and spearphishing emails.
Technique: T1204: User Execution
Daserf uses encrypted Windows APIs and also encrypts data using the alternative base64+RC4 or the Caesar cipher.
Technique: T1027: Obfuscated Files or Information
Threat Group-3390 has obtained and used tools such as Impacket, pwdump, Mimikatz, gsecdump, NBTscan, and Windows Credential Editor.
Technique: T1588: Obtain Capabilities
RTM uses the command line and rundll32.exe to execute.
Technique: T1059: Command and Scripting Interpreter
Hildegard has modified /etc/ld.so.preload to intercept shared library import functions.
Technique: T1574: Hijack Execution Flow
All of this can be done by using native Windows commands, but it has also been added as a feature in red teaming tools.
Technique: T1563: Remote Service Session Hijacking
APT39 has used a command line utility and a network scanner written in python.
Technique: T1059: Command and Scripting Interpreter
Kobalos encrypts all strings using RC4 and bundles all functionality into a single function call.
Technique: T1027: Obfuscated Files or Information
Fox Kitten has used a Twitter account to communicate with ransomware victims.
Technique: T1585: Establish Accounts
Lokibot has used several packing methods for obfuscation.
Technique: T1027: Obfuscated Files or Information
ESET’s analysis of a recent backdoor used by TeleBots – the group behind the massive NotPetya ransomware outbreak – uncovers strong code similarities to the Industroyer main backdoor, revealing a rumored connection that was not previously proven The post New TeleBots backdoor: First evidence linking Industroyer to NotPetya appeared first on WeLiveSecurity
Technique: T1140: Deobfuscate/Decode Files or Information
In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.
Technique: T1552: Unsecured Credentials
P8RAT has the ability to "sleep" for a specified time to evade detection.
Technique: T1497: Virtualization/Sandbox Evasion
RDAT can also embed data within a BMP image prior to exfiltration.
Technique: T1027: Obfuscated Files or Information
Information from these sources may reveal opportunities for other forms of reconnaissance  or Search Open Websites/Domains, establishing operational resources  or Compromise Infrastructure, and/or initial access  or Trusted Relationship.
Technique: T1596: Search Open Technical Databases
GALLIUM compressed and staged files in multi-part archives in the Recycle Bin prior to exfiltration.
Technique: T1074: Data Staged
SEASHARPEE can execute commands on victims.
Technique: T1059: Command and Scripting Interpreter
These files can be parsed with lnk-parser to extract all contents
Technique: T1547: Boot or Logon Autostart Execution
TrickBot collects a list of install programs and services on the system’s machine.
Technique: T1007: System Service Discovery
TrickBot has used a VNC module to monitor the victim and collect information to pivot to valuable systems on the network  GCMAN uses VNC for lateral movement.
Technique: T1021: Remote Services
Shamoon can impersonate tokens using LogonUser, ImpersonateLoggedOnUser, and ImpersonateNamedPipeClient.
Technique: T1134: Access Token Manipulation
DEATHRANSOM can use HTTPS to download files.
Technique: T1071: Application Layer Protocol
By default, VNC uses the system's authentication, but it can be configured to use credentials specific to VNC.
Technique: T1021: Remote Services