HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
The r1.log file stores information for exfiltration
Technique: T1074: Data Staged
BLINDINGCAN has modified file and directory timestamps.
Technique: T1070: Indicator Removal on Host
UNC2452 has used GoldFinder to perform HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request travels through.
Technique: T1016: System Network Configuration Discovery
This spoofing could be executed via Visual Basic within a malicious Office document or any code that can perform Native API.
Technique: T1134: Access Token Manipulation
SSH is a protocol that allows authorized users to open remote shells on other computers.
Technique: T1021: Remote Services
BackConfig has used VBS to install its downloader component and malicious documents with VBA macro code.
Technique: T1059: Command and Scripting Interpreter
Phishing may also involve social engineering techniques, such as posing as a trusted source.
Technique: T1566: Phishing
PolyglotDuke can use LoadLibraryW and CreateProcess to load and execute code.
Technique: T1106: Native API
There are many different ways to inject code into a process, many of which abuse legitimate functionalities.
Technique: T1055: Process Injection
Gamaredon Group has attempted to get users to click on Office attachments with malicious macros embedded.
Technique: T1204: User Execution
Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user.
Technique: T1565: Data Manipulation
Frankenstein has enumerated hosts via Empire, gathering various local system information.
Technique: T1005: Data from Local System
The Downloader After the exploit or script executes, the system downloads install.exe, which has the following metadata: MD5             5a0c4e1925c76a959ab0588f683ab437 Size            46592 bytes Compile Time    2014-11-19 08:55:10Z Import Hash     6b8611f8148a6b51e37fd68e75b6a81c The file install.exe attempts to write two files (doc.exe and test.exe) to the hard-coded path “C:\Users\Public”, which fails on Windows XP because that path is not present by default
Technique: T1036: Masquerading
Tropic Trooper delivered malicious documents with the XLSX extension, typically used by OpenXML documents, but the file itself was actually an OLE  document.
Technique: T1221: Template Injection
Chimera has harvested data from victim's e-mail including through execution of wmic /node:<ip> process call create "cmd /c copy c:\Users\<username>\<path>\backup.pst c:\windows\temp\backup.pst" copy "i:\<path>\<username>\My Documents\<filename>.pst"
copy.
Technique: T1114: Email Collection
These files allow system administrators to map and start custom services at startup for different run levels.
Technique: T1037: Boot or Logon Initialization Scripts
Wingbird uses services.exe to register a new autostart service named "Audit Service" using a copy of the local lsass.exe file.
Technique: T1569: System Services
The Information Gathering Tool (IGT) tool is coded in Delphi and includes powershell and SQL components across a dozen different drops
Technique: T1546: Event Triggered Execution
Smoke Loader adds a Visual Basic script in the Startup folder to deploy the payload.
Technique: T1059: Command and Scripting Interpreter
FIN4 has used spearphishing emails  containing malicious links.
Technique: T1566: Phishing
Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.
Technique: T1195: Supply Chain Compromise
Mustang Panda has delivered spearphishing links to their target.
Technique: T1566: Phishing
Remsec is capable of using HTTP and HTTPS for C2.
Technique: T1071: Application Layer Protocol
TEMP.Veles has created staging folders in directories that were infrequently used by legitimate users or processes.
Technique: T1074: Data Staged
Pillowmint has been decompressed by included shellcode prior to being launched.
Technique: T1140: Deobfuscate/Decode Files or Information
Some SeaDuke samples have a module to use pass the ticket with Kerberos for authentication.
Technique: T1550: Use Alternate Authentication Material
Hildegard has modified /etc/ld.so.preload to overwrite readdir and readdir64.
Technique: T1014: Rootkit
FatDuke has used several C2 servers per targeted organization.
Technique: T1008: Fallback Channels
Adversaries may compromise third-party infrastructure that can be used during targeting.
Technique: T1584: Compromise Infrastructure
A 2016 Novetta report detailed the work of security vendors attempting to unveil tools and infrastructure related to the 2014 destructive attack against Sony Pictures Entertainment
Technique: T1518: Software Discovery
Additionally, backdoor files are encrypted using DES as a stream cipher.
Technique: T1027: Obfuscated Files or Information
Cloud providers offer methods such as APIs and commands issued through CLIs to serve information about infrastructure.
Technique: T1580: Cloud Infrastructure Discovery
Included in the directories were a combination of files leveraged in targeted attacks mentioned above against nation states
Technique: T1083: File and Directory Discovery
Cardinal RAT is downloaded using HTTP over port 443.
Technique: T1071: Application Layer Protocol
Pteranodon identifies files matching certain file extension and copies them to subdirectories it created.
Technique: T1083: File and Directory Discovery
PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.
Technique: T1059: Command and Scripting Interpreter
Information about victim domains and their properties may also be exposed to adversaries via online or other accessible data sets .
Technique: T1590: Gather Victim Network Information
Patchwork payloads download additional files from the C2 server.
Technique: T1105: Ingress Tool Transfer
UNC2452 downloaded additional tools, such as TEARDROP malware and Cobalt Strike, to the compromised host following initial compromise.
Technique: T1105: Ingress Tool Transfer
APT29 has used compromised certificates issued by Mimecast to authenticate to Mimecast customer systems.
Technique: T1199: Trusted Relationship
Turla has used net user to enumerate local accounts on the system.
Technique: T1087: Account Discovery
Rover has functionality to remove Registry Run key persistence as a cleanup procedure.
Technique: T1112: Modify Registry
FIVEHANDS can use an embedded NTRU public key to encrypt data for ransom.
Technique: T1486: Data Encrypted for Impact
TrickBot module "Trickboot" can write or erase the UEFI/BIOS firmware of a compromised device.
Technique: T1495: Firmware Corruption
The stylecs.aspx webshell provides fairly significant functionality, as its developer wrote this webshell in JScript that ultimately runs any supplied JScript code provided to it within the HTTP request..
Technique: T1505: Server Software Component
A IP and/or port number calculation can be used to bypass egress filtering on a C2 channel.
Technique: T1568: Dynamic Resolution
Unknown Logger is capable of spreading to USB devices.
Technique: T1091: Replication Through Removable Media
FIN8 has used scheduled tasks to maintain RDP backdoors.
Technique: T1053: Scheduled Task/Job
FIN6 has used a script to iterate through a list of compromised PoS systems, copy and remove data to a log file, and to bind to events from the submit payment button.
Technique: T1119: Automated Collection
There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens.
Technique: T1134: Access Token Manipulation
Adversaries may craft or modify CLR assemblies that are linked to stored procedures since these CLR assemblies can be made to execute arbitrary commands.
Technique: T1505: Server Software Component
Windshift has sent spearphishing emails with attachment to harvest credentials and deliver malware.
Technique: T1566: Phishing
The shellcode decodes and decompresses another DLL, which is an updated variant of UPPERCUT
Technique: T1140: Deobfuscate/Decode Files or Information
Some variants of FakeM use RC4 to encrypt C2 traffic.
Technique: T1573: Encrypted Channel
17-3 Function names To target specific victims, Astaroth is locale aware; any attempts to run the malware without locale spoofing will result in failed downloads and the inability to run the .dll files
Technique: T1083: File and Directory Discovery
Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest.
Technique: T1608: Stage Capabilities
Adversaries may search in different social media sites depending on what information they seek to gather.
Technique: T1593: Search Open Websites/Domains
TAINTEDSCRIBE can copy itself into the current user’s Startup folder as “Narrator.exe” for persistence.
Technique: T1547: Boot or Logon Autostart Execution
Cobalt Strike can use Window admin shares  for lateral movement.
Technique: T1021: Remote Services
In some of the worst cases for distributed DoS , so many systems are used to generate the flood that each one only needs to send out a small amount of traffic to produce enough volume to saturate the target network.
Technique: T1498: Network Denial of Service
MiniDuke can use control flow flattening to obscure code.
Technique: T1027: Obfuscated Files or Information
Ursnif has used encoded data in HTTP URLs for C2.
Technique: T1132: Data Encoding
RARSTONE uses SSL to encrypt its communication with its C2 server.
Technique: T1095: Non-Application Layer Protocol
SDBbot has the ability to use port forwarding to establish a proxy between a target host and C2.
Technique: T1090: Proxy
In one instance, menuPass added PlugX as a service with a display name of "Corel Writing Tools Utility."
Technique: T1036: Masquerading
Xbash can execute malicious VBScript payloads on the victim’s machine.
Technique: T1059: Command and Scripting Interpreter
Reaver deletes the original dropped file from the victim.
Technique: T1070: Indicator Removal on Host
HOMEFRY uses a command-line interface.
Technique: T1059: Command and Scripting Interpreter
TRITON disguised itself as the legitimate Triconex Trilog application.
Technique: T1036: Masquerading
Cleaver has created customized tools and payloads for functions including ARP poisoning, encryption, credential dumping, ASP.NET shells, web backdoors, process enumeration, WMI querying, HTTP and SMB communications, network interface sniffing, and keystroke logging.
Technique: T1587: Develop Capabilities
KeyBoy can determine the public or WAN IP address for the system.
Technique: T1016: System Network Configuration Discovery
Downgrading the system image to an older versions may allow an adversary to evade defenses by enabling behaviors such as Weaken Encryption.
Technique: T1601: Modify System Image
P8RAT can send randomly-generated data as part of its C2 communication.
Technique: T1001: Data Obfuscation
TeamTNT has modified the permissions on binaries with chattr.
Technique: T1222: File and Directory Permissions Modification
ServHelper contains modules that will use schtasks to carry out malicious operations.
Technique: T1053: Scheduled Task/Job
Similar to Process Injection, this value can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.
Technique: T1546: Event Triggered Execution
To change the operating system in storage, the adversary will typically use the standard procedures available to device operators.
Technique: T1601: Modify System Image
These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary  or was otherwise compromised by them .
Technique: T1608: Stage Capabilities
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
Technique: T1543: Create or Modify System Process
Remexi collects text from the clipboard.
Technique: T1115: Clipboard Data
StrongPity has encrypted C2 traffic using SSL/TLS.
Technique: T1573: Encrypted Channel
Data exfiltration is done by Okrum using the already opened channel with the C2 server.
Technique: T1041: Exfiltration Over C2 Channel
DarkVishnya used PowerShell to create shellcode loaders.
Technique: T1059: Command and Scripting Interpreter
fprii.net 185.130.212.254 Domain used for spear phish sender e-mail address and to host malicious documents
Technique: T1016: System Network Configuration Discovery
Kessel has collected the system architecture, OS version, and MAC address information.
Technique: T1082: System Information Discovery
JHUHUGIT has registered itself as a scheduled task to run each time the current user logs in.
Technique: T1053: Scheduled Task/Job
Hildegard has used shell scripts for execution.
Technique: T1059: Command and Scripting Interpreter
After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software.
Technique: T1205: Traffic Signaling
In addition to these tools, we believe OilRig attackers obtained credentials through, bruteforcing, SQL injections, and using traditional credential harvesting toolkits as we discussed in the Striking Oil blog published in September 2017
Technique: T1003: OS Credential Dumping
Octopus has been disguised as legitimate programs, such as Java and Telegram Messenger.
Technique: T1036: Masquerading
Agent Tesla can collect the IP address of the victim machine and spawn instances of netsh.exe to enumerate wireless settings.
Technique: T1016: System Network Configuration Discovery
Attor's has a plugin that captures screenshots of the target applications.
Technique: T1113: Screen Capture
GoldMax can download and execute additional files.
Technique: T1105: Ingress Tool Transfer
APT28 has exfiltrated archives of collected data previously staged on a target's OWA server via HTTPS.
Technique: T1048: Exfiltration Over Alternative Protocol
Adversaries may gather information about the victim's DNS that can be used during targeting.
Technique: T1590: Gather Victim Network Information
Olympic Destroyer will attempt to enumerate mapped network shares to later attempt to wipe all files on those shares.
Technique: T1135: Network Share Discovery
WellMail can use hard coded client and certificate authority certificates to communicate with C2 over mutual TLS.
Technique: T1573: Encrypted Channel
Operation Wocao has used the Xserver backdoor to exfiltrate data.
Technique: T1041: Exfiltration Over C2 Channel
Can be packed into a single .py file and run without any dependencies other than the python standard library on all OSes
Technique: T1027: Obfuscated Files or Information
Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content  filetypes.
Technique: T1593: Search Open Websites/Domains
Conti can spread via SMB and encrypts files on different hosts, potentially compromising an entire network.
Technique: T1021: Remote Services
Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Technique: T1567: Exfiltration Over Web Service
njRAT can be configured to spread via removable drives.
Technique: T1091: Replication Through Removable Media
SUNBURST delivered different payloads, including TEARDROP in at least one instance.
Technique: T1105: Ingress Tool Transfer
This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened.
Technique: T1137: Office Application Startup
QakBot can identify remote systems through the net view command.
Technique: T1018: Remote System Discovery
TeamTNT has used open-source tools such as Weave Scope to target exposed Docker API ports and gain initial access to victim environments.
Technique: T1133: External Remote Services
T9000 encrypts collected data using a single byte XOR key.
Technique: T1560: Archive Collected Data
NETWIRE creates a Registry start-up entry to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
QakBot can use GetProcAddress to help delete malicious strings from memory.
Technique: T1106: Native API
Exaramel has a command to download a file from a remote server to execute.
Technique: T1105: Ingress Tool Transfer
In addition, if an adversary places a program called "net.com" in the same directory as "net.exe", then cmd.exe /C net user will execute "net.com" instead of "net.exe" due to the order of executable extensions defined under PATHEXT.
Technique: T1574: Hijack Execution Flow
JHUHUGIT obtains a list of running processes on the victim.
Technique: T1057: Process Discovery
StrongPity can compress and encrypt archived files into multiple .sft files with a repeated xor encryption scheme.
Technique: T1560: Archive Collected Data
HISTCONTROL
Technique: T1562: Impair Defenses
Tonto Team has used the ShowLocalGroupDetails command to identify administrator, user, and guest accounts on a compromised host.
Technique: T1069: Permission Groups Discovery
APT39 has used post-exploitation tools including RemCom and the Non-sucking Service Manager  to execute processes.
Technique: T1569: System Services
Deobfuscated, we can see it is the HawkEye Keylogger — Reborn v9, Version=9.0.1.6
Technique: T1056: Input Capture
Hikit performs XOR encryption.
Technique: T1573: Encrypted Channel
RTM can search for specific strings within browser tabs using a Dynamic Data Exchange mechanism.
Technique: T1559: Inter-Process Communication
APT40 strongly favors web shells for maintaining presence, especially publicly available tools
Technique: T1505: Server Software Component
FatDuke can enumerate directories on target machines.
Technique: T1083: File and Directory Discovery
PoetRAT has added a registry key in the <RUN> hive for persistence.
Technique: T1547: Boot or Logon Autostart Execution
Kerrdown has the ability to determine if the compromised host is running a 32 or 64 bit OS architecture.
Technique: T1082: System Information Discovery
For example, AWS provides a DescribeInstances API within the Amazon EC2 API that can return information about one or more instances within an account, the ListBuckets API that returns a list of all buckets owned by the authenticated sender of the request, or the GetPublicAccessBlock API to retrieve access block configuration for a bucket .
Technique: T1580: Cloud Infrastructure Discovery
Reaver installs itself as a new service.
Technique: T1543: Create or Modify System Process
ZIRCONIUM has used malicious links in e-mails to lure victims into downloading malware.
Technique: T1204: User Execution
To wipe disk content, adversaries may acquire direct access to the hard drive in order to overwrite arbitrarily sized portions of disk with random data.
Technique: T1561: Disk Wipe
VERMIN uses HTTP for C2 communications.
Technique: T1071: Application Layer Protocol
Bad Rabbit has attempted to bypass UAC and gain elevated administrative privileges.
Technique: T1548: Abuse Elevation Control Mechanism
LightNeuron exfiltrates data over its email C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
Cobalt Strike can spawn processes with alternate PPIDs.
Technique: T1134: Access Token Manipulation
REvil can launch an instance of itself with administrative rights using runas.
Technique: T1134: Access Token Manipulation
Naid creates Registry entries that store information about a created service and point to a malicious DLL dropped to disk.
Technique: T1112: Modify Registry
Wingbird drops a malicious file  alongside a copy of lsass.exe, which is used to register a service that loads sspisrv.dll as a driver.
Technique: T1547: Boot or Logon Autostart Execution
Ursnif has used a DGA to generate domain names for C2.
Technique: T1568: Dynamic Resolution
TEMP.Veles routinely deleted tools, logs, and other files after they were finished with them.
Technique: T1070: Indicator Removal on Host
Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.
Technique: T1090: Proxy
Pteranodon can use HTTP for C2.
Technique: T1071: Application Layer Protocol
Stuxnet calls LoadLibrary then executes exports from a DLL.
Technique: T1129: Shared Modules
Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms.
Technique: T1027: Obfuscated Files or Information
SMOKEDHAM has added created user accounts to local Admin groups.
Technique: T1098: Account Manipulation
Ajax Security Team has used various social media channels to spearphish victims.
Technique: T1566: Phishing
TYPEFRAME can delete files off the system.
Technique: T1070: Indicator Removal on Host
For example, they stated DROPSHOT uses more advanced anti-emulation techniques, utilizes external scripts for self-deletion, and uses memory injection versus external drivers for deployment
Technique: T1059: Command and Scripting Interpreter
Zebrocy scans the system and automatically collects files with the following extensions: .doc, .docx, ,.xls, .xlsx, .pdf, .pptx, .rar, .zip, .jpg, .jpeg, .bmp, .tiff, .kum, .tlg, .sbx, .cr, .hse, .hsf, and .lhz.
Technique: T1119: Automated Collection
Grandoreiro can use SSL in C2 communication.
Technique: T1573: Encrypted Channel
The malware sends an HTTP GET request to its C2 IP address using HTTP over port 443
Technique: T1071: Application Layer Protocol
Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.
Technique: T1114: Email Collection
Turian can download additional files and tools from its C2.
Technique: T1105: Ingress Tool Transfer
RemoteCMD can execute commands remotely by creating a new service on the remote system.
Technique: T1569: System Services
Various Remsec .exe files mimic legitimate file names used by Microsoft, Symantec, Kaspersky, Hewlett-Packard, and VMWare.
Technique: T1036: Masquerading
Proxysvc lists processes running on the system.
Technique: T1057: Process Discovery
ZLib has the ability to execute shell commands.
Technique: T1059: Command and Scripting Interpreter
Fox Kitten has used Amazon Web Services to host C2.
Technique: T1102: Web Service
SOUNDBITE communicates via DNS for C2.
Technique: T1071: Application Layer Protocol
FIN6 has used WMI to automate the remote execution of PowerShell scripts.
Technique: T1047: Windows Management Instrumentation
The group also adds its second stage payload to the startup programs as “Net Monitor."
Technique: T1036: Masquerading
Azorult can collect the machine information, system architecture, the OS version, computer name, Windows product name, the number of CPU cores, video card information, and the system language.
Technique: T1082: System Information Discovery
NETWIRE can use TCP in C2 communications.
Technique: T1095: Non-Application Layer Protocol
APT38 has used the Windows API to execute code within a victim's system.
Technique: T1106: Native API
Zebrocy uses SMTP and POP3 for C2.
Technique: T1071: Application Layer Protocol
ABK has the ability to use HTTP in communications with C2.
Technique: T1071: Application Layer Protocol
Using this information an adversary can target accounts with permissions to a given object or leverage accounts they have already compromised to access the object.
Technique: T1069: Permission Groups Discovery
Transparent Tribe can mimic legitimate Windows directories by using the same icons and names.
Technique: T1036: Masquerading
TeamTNT uses a payload that removes itself after running.
Technique: T1070: Indicator Removal on Host
Operation Wocao's proxy implementation "Agent" can upgrade the socket in use to a TLS socket.
Technique: T1573: Encrypted Channel
Ursnif has collected files from victim machines, including certificates and cookies.
Technique: T1005: Data from Local System
The code comparison specifically shows the HighShell code including a salt variable containing di2zag7wZHTK9YR0NGq, which is not present within the TwoFace code on the left
Technique: T1140: Deobfuscate/Decode Files or Information
DDKONG decodes an embedded configuration using XOR.
Technique: T1140: Deobfuscate/Decode Files or Information
If the C2 server is discovered or shut down, the threat actors can update the encoded IP address on TechNet to maintain control of the victims’ machines.
Technique: T1104: Multi-Stage Channels
Many utilities exist that can archive data, including 7-Zip, WinRAR, and WinZip.
Technique: T1560: Archive Collected Data
APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443.
Technique: T1562: Impair Defenses
IcedID has the ability to identify Workgroup membership.
Technique: T1069: Permission Groups Discovery
MURKYTOP has the capability to retrieve information about the OS.
Technique: T1082: System Information Discovery
Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files.
Technique: T1125: Video Capture
The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages.
Technique: T1003: OS Credential Dumping
Sandworm Team had gathered user, IP address, and server data related to RDP sessions on a compromised host.
Technique: T1049: System Network Connections Discovery
Turla has used HTTP and HTTPS for C2 communications.
Technique: T1071: Application Layer Protocol
An adversary may place a program called "net.exe" within the same directory as example.exe, "net.exe" will be run instead of the Windows system utility net.
Technique: T1574: Hijack Execution Flow
APT37 has used Python scripts to execute payloads.
Technique: T1059: Command and Scripting Interpreter
ACK floods leverage the stateful nature of the TCP protocol.
Technique: T1499: Endpoint Denial of Service
Avenger has the ability to browse files in directories such as Program Files and the Desktop.
Technique: T1083: File and Directory Discovery
Adversaries may exploit a system or application vulnerability to bypass security features.
Technique: T1211: Exploitation for Defense Evasion
Conti can enumerate routine network connections from a compromised host.
Technique: T1049: System Network Connections Discovery
SoreFang can gain access by exploiting a Sangfor SSL VPN vulnerability that allows for the placement and delivery of malicious update binaries.
Technique: T1190: Exploit Public-Facing Application
HAFNIUM gathered the fully qualified domain names  for targeted Exchange servers in the victim's environment.
Technique: T1590: Gather Victim Network Information
This information can help adversaries determine which domain accounts exist to aid in follow-on behavior.
Technique: T1087: Account Discovery
Adversaries may also query for specific readings from these devices.
Technique: T1497: Virtualization/Sandbox Evasion
APT3 has a tool that can enumerate the permissions associated with Windows groups.
Technique: T1069: Permission Groups Discovery
Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information  Spearphishing Service.
Technique: T1593: Search Open Websites/Domains
Orz can execute shell commands.
Technique: T1059: Command and Scripting Interpreter
Since these payloads are text-based, it is also very common for adversaries to obfuscate their content as part of Obfuscated Files or Information.
Technique: T1059: Command and Scripting Interpreter
Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.
Technique: T1059: Command and Scripting Interpreter
APT33 has used HTTP over TCP ports 808 and 880 for command and control.
Technique: T1571: Non-Standard Port
BLINDINGCAN has been delivered by phishing emails containing malicious Microsoft Office documents.
Technique: T1566: Phishing
POWRUNER may collect network configuration data by running ipconfig /all on a victim.
Technique: T1016: System Network Configuration Discovery
EvilBunny has used EnumProcesses to identify how many process are running in the environment.
Technique: T1057: Process Discovery
Evidence also supports the hypothesis that there is a encryption plugin for victim files (see below)
Technique: T1027: Obfuscated Files or Information
They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket.
Technique: T1213: Data from Information Repositories
CosmicDuke collects Windows account hashes.
Technique: T1003: OS Credential Dumping
Though a malicious transport agent may be invoked for all emails passing through the Exchange transport pipeline, the agent can be configured to only carry out specific tasks in response to adversary defined criteria.
Technique: T1505: Server Software Component
The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.
Technique: T1140: Deobfuscate/Decode Files or Information
SslMM has a hard-coded primary and backup C2 string.
Technique: T1008: Fallback Channels
FELIXROOT deletes the Registry key HKCU\Software\Classes\Applications\rundll32.exe\shell\open.
Technique: T1112: Modify Registry
QUADAGENT modifies an HKCU Registry key to store a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications.
Technique: T1112: Modify Registry
Metamorfo has performed process name checks and has monitored applications.
Technique: T1057: Process Discovery
Okrum establishes persistence by creating a .lnk shortcut to itself in the Startup folder.
Technique: T1547: Boot or Logon Autostart Execution
Windshift has used icons mimicking MS Office files to mask malicious executables.
Technique: T1036: Masquerading
This strangeness was related to values listed in newer BlackEnergy configuration files
Technique: T1027: Obfuscated Files or Information
Operation Wocao has created services on remote systems for execution purposes.
Technique: T1569: System Services
Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel.
Technique: T1102: Web Service
Windshift has used e-mail attachments to lure victims into executing malicious code.
Technique: T1204: User Execution
Aside from the command line, scripts can be executed in numerous ways including Mail rules, Calendar.app alarms, and Automator workflows.
Technique: T1059: Command and Scripting Interpreter
Final1stspy obfuscates strings with base64 encoding.
Technique: T1027: Obfuscated Files or Information
Adversaries may create a cloud account to maintain access to victim systems.
Technique: T1136: Create Account
The URIs used in the HTTP requests are randomly generated
Technique: T1071: Application Layer Protocol
Use of servers allows an adversary to stage, launch, and execute an operation.
Technique: T1583: Acquire Infrastructure
Malware used by Ke3chang can run commands on the command-line interface.
Technique: T1059: Command and Scripting Interpreter
Adversaries may also utilize this technique to perform SID-History Injection and/or manipulate AD objects  to establish backdoors for Persistence.
Technique: T1207: Rogue Domain Controller
The backdoor's infrequent beaconing, traffic obfuscation, extensive encryption and use of geographically local, legitimate websites for command and control (C2) make identification of its network traffic difficult
Technique: T1521: nan
Upon execution, the initialized file downloads multiple malicious payloads from remote servers
Technique: T1105: Ingress Tool Transfer
Wizard Spider has obtained and used publicly-available post-exploitation frameworks and tools like Metasploit, Empire, Mimikatz.
Technique: T1588: Obtain Capabilities
Cobalt Strike includes a capability to modify the "beacon" payload to eliminate known signatures or unpacking methods.
Technique: T1027: Obfuscated Files or Information
RedLeaves can receive and execute commands with cmd.exe.
Technique: T1059: Command and Scripting Interpreter
Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.
Technique: T1592: Gather Victim Host Information
This document exploited a newer vulnerability, CVE-2017-0199
Technique: T1203: Exploitation for Client Execution
Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response.
Technique: T1102: Web Service
EKANS stops database, data backup solution, antivirus, and ICS-related processes.
Technique: T1489: Service Stop
Implant directory contained in the malicious Flash file
Technique: T1083: File and Directory Discovery
Similarly, website defacement may also be used as setup, or a precursor, for future attacks such as Drive-by Compromise.
Technique: T1491: Defacement
OSX_OCEANLOTUS.D has disguised its app bundle by adding special characters to the filename and using the icon for legitimate Word documents.
Technique: T1036: Masquerading
In containerized environments, this may include an exposed Docker API, Kubernetes API server, kubelet, or web application such as the Kubernetes dashboard.
Technique: T1133: External Remote Services
An adversary may use cron in Linux or Unix environments to execute programs at system startup or on a scheduled basis for persistence.
Technique: T1053: Scheduled Task/Job
Sys10 collects the group name of the logged-in user and sends it to the C2.
Technique: T1069: Permission Groups Discovery
admin@338 actors used the following commands following exploitation of a machine with LOWBALL malware to enumerate user accounts: net user >> %temp%\download net user /domain >> %temp%\download APT1 used the commands net localgroup,net user, and net group to find accounts on the system.
Technique: T1087: Account Discovery
Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.
Technique: T1087: Account Discovery
Volgmer checks the system for certain Registry keys.
Technique: T1012: Query Registry
PlugX can be configured to use DNS for command and control.
Technique: T1071: Application Layer Protocol
If the DC responds without errors, the account does not require preauthentication and the AS-REP message will already contain the encrypted data.
Technique: T1558: Steal or Forge Kerberos Tickets
Wizard Spider has used Window Remote Management to move laterally through a victim network.
Technique: T1021: Remote Services
Shamoon attempts to disable UAC remote restrictions by modifying the Registry.
Technique: T1548: Abuse Elevation Control Mechanism
ZIRCONIUM has used the msiexec.exe command-line utility to download and execute malicious MSI files.
Technique: T1218: Signed Binary Proxy Execution
Prior to a phish for information  or a phish to gain initial access to a system , an adversary must set up the resources for a link target for the spearphishing link.
Technique: T1608: Stage Capabilities
A variant of HOPLIGHT hooks lsass.exe, and lsass.exe then checks the Registry for the data value 'rdpproto' under the key SYSTEM\CurrentControlSet\Control\Lsa Name.
Technique: T1012: Query Registry
PLEAD has the ability to execute shell commands on the compromised host.
Technique: T1059: Command and Scripting Interpreter
Client software enables users to access services provided by a server.
Technique: T1554: Compromise Client Software Binary
Capturing token input  may provide temporary access  replay the one-time passcode until the next value rollover as well as possibly enabling adversaries to reliably predict future authentication values .
Technique: T1111: Two-Factor Authentication Interception
Figure 3 Hardware ID used by XAgent to uniquely identify compromised hosts When generating the URLs within the HTTP POST and GET requests, XAgent sets one HTTP parameter using a specific data structure that contains this agent_id value
Technique: T1071: Application Layer Protocol
REvil can inject itself into running processes on a compromised host.
Technique: T1055: Process Injection
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Technique: T1115: Clipboard Data
Epic uses the tasklist /v command to obtain a list of processes.
Technique: T1057: Process Discovery
TeamTNT has obtained domains to host their payloads.
Technique: T1583: Acquire Infrastructure
PinchDuke steals credentials from compromised hosts.
Technique: T1555: Credentials from Password Stores
Lastly, if the HTTP request is not successful, the downloader will fallback to using DNS tunneling to establish communications
Technique: T1071: Application Layer Protocol
PinchDuke transfers files from the compromised host via HTTP or HTTPS to a C2 server.
Technique: T1071: Application Layer Protocol
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager 
Technique: T1546: Event Triggered Execution
The .zip archive attached to the email contains a Windows shortcut (.lnk) file with the Microsoft Internet Explorer logo
Technique: T1547: Boot or Logon Autostart Execution
Lokibot has used cmd /c commands embedded within batch scripts.
Technique: T1059: Command and Scripting Interpreter
ProLock can use vssadmin.exe to remove volume shadow copies.
Technique: T1490: Inhibit System Recovery
Figure 3: FIN7 phishing lure persistence mechanisms Examining Attacker Shortcut Files In many cases, attacker-created LNK files can reveal valuable information about the attacker’s development environment
Technique: T1547: Boot or Logon Autostart Execution
GRIFFON has used sctasks for persistence.
Technique: T1053: Scheduled Task/Job
Transparent Tribe has directed users to open URLs hosting malicious content.
Technique: T1204: User Execution
In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task.
Technique: T1053: Scheduled Task/Job
An APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.
Technique: T1140: Deobfuscate/Decode Files or Information
ComRAT has been programmed to sleep outside local business hours .
Technique: T1029: Scheduled Transfer
Agent Tesla can log keystrokes on the victim’s machine.
Technique: T1056: Input Capture
Various Windows utilities may be used to execute commands, possibly without invoking cmd.
Technique: T1202: Indirect Command Execution
Another difference in the network traffic generated from the malware is that the encoded proxy information has been added in the URL query values during the C2 communication
Technique: T1132: Data Encoding
Whitefly has named the malicious DLL the same name as DLLs belonging to legitimate software from various security vendors.
Technique: T1036: Masquerading
It may be possible to bypass those security mechanisms by renaming the utility prior to utilization .
Technique: T1036: Masquerading
A backdoor used by APT29 created a Tor hidden service to forward traffic from the Tor client to local ports 3389 , 139 , and 445  enabling full remote access from outside the network.
Technique: T1090: Proxy
Tracked Commands During observation of the described above “router-PC” CnC we tracked the following commands delivered in the config file before the server went offline
Technique: T1059: Command and Scripting Interpreter
FIN7 has collected files and other sensitive information from a compromised network.
Technique: T1005: Data from Local System
SpicyOmelette can enumerate running software on a targeted system.
Technique: T1518: Software Discovery
Conficker adds Registry Run keys to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
ZxShell has a feature to perform SYN flood attack on a host.
Technique: T1499: Endpoint Denial of Service
Suckfly used a signed credential-dumping tool to obtain victim account credentials.
Technique: T1003: OS Credential Dumping
Ramsay can stage data prior to exfiltration in %APPDATA%\Microsoft\UserSetting and %APPDATA%\Microsoft\UserSetting\MediaCache.
Technique: T1074: Data Staged
KOMPROGO is capable of retrieving information about the infected system.
Technique: T1082: System Information Discovery
Deep Panda has updated and modified its malware, resulting in different hash values that evade detection.
Technique: T1027: Obfuscated Files or Information
Reaver collects the victim's IP address.
Technique: T1016: System Network Configuration Discovery
Adversaries may also send a gratuitous ARP reply that maliciously announces the ownership of a particular IP address to all the devices in the local network segment.
Technique: T1557: Adversary-in-the-Middle
Tropic Trooper has lured victims into executing malware via malicious e-mail attachments.
Technique: T1204: User Execution
Kazuar can overwrite files with random data before deleting them.
Technique: T1485: Data Destruction
A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network.
Technique: T1505: Server Software Component
Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs.
Technique: T1574: Hijack Execution Flow
net use 
Technique: T1049: System Network Connections Discovery
MoleNet can collect information about the about the system.
Technique: T1082: System Information Discovery
QakBot can identify peripheral devices on targeted systems.
Technique: T1120: Peripheral Device Discovery
FELIXROOT opens a remote shell to execute commands on the infected system.
Technique: T1059: Command and Scripting Interpreter
Rundll32.exe can also be used to execute Control Panel Item files  through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser.
Technique: T1218: Signed Binary Proxy Execution
RATANKBA gathers information about the OS architecture, OS name, and OS version/Service pack.
Technique: T1082: System Information Discovery
GoldMax has used scheduled tasks to maintain persistence.
Technique: T1053: Scheduled Task/Job
Sidewinder has sent e-mails with malicious links to credential harvesting websites.
Technique: T1598: Phishing for Information
An APT19 HTTP malware variant decrypts strings using single-byte XOR keys.
Technique: T1140: Deobfuscate/Decode Files or Information
To execute operating system commands through SQL syntax the adversary may have to enable additional functionality, such as xp_cmdshell for MSSQL Server.
Technique: T1505: Server Software Component
Okrum's backdoor deletes files after they have been successfully uploaded to C2 servers.
Technique: T1070: Indicator Removal on Host
Dark Caracal has obfuscated strings in Bandook by base64 encoding, and then encrypting them.
Technique: T1027: Obfuscated Files or Information
After encrypting C2 data, BADNEWS converts it into a hexadecimal representation and then encodes it into base64.
Technique: T1132: Data Encoding
TINYTYPHON installs itself under Registry Run key to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
RTM has also been delivered to targets as various archive files including ZIP, 7-ZIP, and RAR.
Technique: T1027: Obfuscated Files or Information
In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to login as that user.
Technique: T1021: Remote Services
This may enable malicious activity such as modifying, replacing, or deleting specific files or directories.
Technique: T1222: File and Directory Permissions Modification
BISCUIT has a command to gather the username from the system.
Technique: T1033: System Owner/User Discovery
Chaes has a module to perform any API hooking it desires.
Technique: T1056: Input Capture
MegaCortex can enable SeDebugPrivilege and adjust token privileges.
Technique: T1134: Access Token Manipulation
A variety of methods exist for compromising accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, or by brute forcing credentials .
Technique: T1586: Compromise Accounts
Ryuk has called kill.bat for stopping services, disabling services and killing processes.
Technique: T1489: Service Stop
FIVEHANDS can enumerate network shares and mounted drives on a network.
Technique: T1135: Network Share Discovery
Volgmer can download remote files and additional payloads to the victim's machine.
Technique: T1105: Ingress Tool Transfer
PLATINUM has leveraged a zero-day vulnerability to escalate privileges.
Technique: T1068: Exploitation for Privilege Escalation
Adversaries may use tainted shared content to move laterally.
Technique: T1080: Taint Shared Content
Adversaries may use bootkits to persist on systems.
Technique: T1542: Pre-OS Boot
TeamTNT has established persistence through the creation of a cryptocurrency mining system service.
Technique: T1543: Create or Modify System Process
APT39 has used tools for capturing keystrokes.
Technique: T1056: Input Capture
Frankenstein has run a command script to set up persistence as a scheduled task named "WinUpdate", as well as other encoded commands from the command-line.
Technique: T1059: Command and Scripting Interpreter
The cron utility is a time-based job scheduler for Unix-like operating systems.
Technique: T1053: Scheduled Task/Job
Kimsuky has modified Registry settings for default file associations to enable the opening of malicious documents.
Technique: T1112: Modify Registry
LiteDuke has the ability to discover the proxy configuration of Firefox and/or Opera.
Technique: T1016: System Network Configuration Discovery
An adversary could use VNC to remotely control and monitor a system to collect data and information to pivot to other systems within the network.
Technique: T1021: Remote Services
APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google.
Technique: T1053: Scheduled Task/Job
Dragonfly has performed screen captures of victims.
Technique: T1113: Screen Capture
However, the second extension is the true file type that determines how the file is opened and executed.
Technique: T1036: Masquerading
Memory protections may prevent writing executable code to a process via Ptrace System Calls.
Technique: T1055: Process Injection
Naikon has used administrator credentials for lateral movement in compromised networks.
Technique: T1078: Valid Accounts
The startup folder path for the current user is C:\Users\\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.
Technique: T1547: Boot or Logon Autostart Execution
Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts , Get-ADDefaultDomainPasswordPolicy, chage -l <username>, cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies  .
Technique: T1201: Password Policy Discovery
BRONZE BUTLER has used tools to enumerate software installed on an infected host.
Technique: T1518: Software Discovery
After copying itself to a DLL file, a variant of Elise calls the DLL file using rundll32.exe.
Technique: T1218: Signed Binary Proxy Execution
After execution, the malware will use the Dropbox API to make an HTTP GET request using HTTPS over TCP port 443 for the files:  MD5  Filename  d76261ba3b624933a6ebb5dd73758db4  WmiApCom  79b68cdd0044edd4fbf8067b22878644  WmiApCom.bat   The “WmiApCom.bat” file is simply used to start “WmiApCom”, which happens to be the exact same file as the one dropped by the malicious Word documents
Technique: T1059: Command and Scripting Interpreter
For connections that occur internally within an enclave , commonly used protocols are SMB, SSH, or RDP.
Technique: T1071: Application Layer Protocol
Kinsing has used chmod to modify permissions on key files for use.
Technique: T1222: File and Directory Permissions Modification
Turla has used a AMSI bypass, which patches the in-memory amsi.dll, in PowerShell scripts to bypass Windows antimalware products.
Technique: T1562: Impair Defenses
Reaver creates a shortcut file and saves it in a Startup folder to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
EVILNUM can upload files over the C2 channel from the infected host.
Technique: T1041: Exfiltration Over C2 Channel