HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
One version of Helminth uses a PowerShell script.
Technique: T1059: Command and Scripting Interpreter
The PATH environment variable contains a list of directories.
Technique: T1574: Hijack Execution Flow
ADVSTORESHELL can list connected devices.
Technique: T1120: Peripheral Device Discovery
Remote COM execution is facilitated by Remote Services such as  Distributed Component Object Model .
Technique: T1559: Inter-Process Communication
There exist user and global Registry keys for the Office Test feature:
* HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf
* HKEY_LOCAL_MACHINE\Software\Microsoft\Office test\Special\Perf
Adversaries may add this Registry key and specify a malicious DLL that will be executed whenever an Office application, such as Word or Excel, is started.
Technique: T1137: Office Application Startup
Emissary uses HTTP or HTTPS for C2.
Technique: T1071: Application Layer Protocol
EnvyScout can Base64 encode payloads.
Technique: T1027: Obfuscated Files or Information
Siloscape makes various native API calls.
Technique: T1106: Native API
Network DoS can be performed by exhausting the network bandwidth services rely on.
Technique: T1498: Network Denial of Service
Mandiant initially identified an early variant of the POSHSPY backdoor deployed as PowerShell scripts during an incident response engagement in 2015
Technique: T1546: Event Triggered Execution
Adversaries may search scan databases to gather actionable information.
Technique: T1596: Search Open Technical Databases
Values can be derived from target-specific elements and used to generate a decryption key for an encrypted payload.
Technique: T1480: Execution Guardrails
InvisiMole can gather network share information.
Technique: T1135: Network Share Discovery
The White Company has checked for specific antivirus products on the target’s computer, including Kaspersky, Quick Heal, AVG, BitDefender, Avira, Sophos, Avast!, and ESET.
Technique: T1518: Software Discovery
On Linux and macOS, hijacking dynamic linker variables may grant access to the victim process's memory, system/network resources, and possibly elevated privileges.
Technique: T1574: Hijack Execution Flow
OilRig has used credential dumping tools such as Mimikatz to steal credentials to accounts logged into the compromised system and to Outlook Web Access.
Technique: T1003: OS Credential Dumping
Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means.
Technique: T1598: Phishing for Information
SombRAT can execute enum to enumerate files in storage on a compromised system.
Technique: T1083: File and Directory Discovery
Pteranodon copies itself to the Startup folder to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
Zebrocy decodes its secondary payload and writes it to the victim’s machine.
Technique: T1140: Deobfuscate/Decode Files or Information
Molerats used the public tool BrowserPasswordDump10 to dump passwords saved in browsers on victims.
Technique: T1555: Credentials from Password Stores
In February 2018, several KHRAT associated domains began resolving to the IP address 89.46.222[.]97
Technique: T1016: System Network Configuration Discovery
For example, adversaries may attempt to brute force access to Valid Accounts within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as OS Credential Dumping, Account Discovery, or Password Policy Discovery.
Technique: T1110: Brute Force
SpicyOmelette can identify payment systems, payment gateways, and ATM systems in compromised environments.
Technique: T1018: Remote System Discovery
Kwampirs downloads additional files from C2 servers.
Technique: T1105: Ingress Tool Transfer
Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect.
Technique: T1132: Data Encoding
UNC2452 used HTTP for C2 and data exfiltration.
Technique: T1071: Application Layer Protocol
reg query
Technique: T1012: Query Registry
Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement.
Technique: T1021: Remote Services
Kobalos is triggered by an incoming TCP connection to a legitimate service from a specific source port.
Technique: T1205: Traffic Signaling
BLINDINGCAN can search, read, write, move, and execute files.
Technique: T1083: File and Directory Discovery
Trojan.Karagany can create directories to store plugin output and stage data for exfiltration.
Technique: T1074: Data Staged
China Chopper's server component can list directory contents.
Technique: T1083: File and Directory Discovery
Cardinal RAT can capture screenshots.
Technique: T1113: Screen Capture
Magic Hound has sent malicious URL links through email to victims.
Technique: T1566: Phishing
Epic collects the user name from the victim’s machine.
Technique: T1033: System Owner/User Discovery
WellMess can execute PowerShell scripts received from C2.
Technique: T1059: Command and Scripting Interpreter
Turla surveys a system upon check-in to discover active local network connections using the netstat -an, net use, net file, and net session commands.
Technique: T1049: System Network Connections Discovery
HALFBAKED can obtain screenshots from the victim.
Technique: T1113: Screen Capture
Additionally, a small number of campaigns over this same period also made use of various file-sharing platforms like Dropbox for hosting the malicious documents rather than directly attaching them to the messages themselves.Figure 2: Example malicious Excel documentSimilar to the technique described in our previous blog about Remcos, the contents of the documents have been intentionally made to appear as if they are blurry, with the user being prompted to enable editing to have a clearer view of the contents
Technique: T1204: User Execution
Adversaries can also leverage Dynamic Linker Hijacking to export variables in a shell or set variables programmatically using higher level syntax such Python’s os.environ.
Technique: T1574: Hijack Execution Flow
BlackEnergy gathers a list of installed apps from the uninstall program Registry.
Technique: T1083: File and Directory Discovery
For example, Forfiles, the Program Compatibility Assistant , components of the Windows Subsystem for Linux , as well as other utilities may invoke the execution of programs and commands from a Command and Scripting Interpreter, Run window, or via scripts.
Technique: T1202: Indirect Command Execution
Emotet has been seen exploiting SMB via a vulnerability exploit like EternalBlue  to achieve lateral movement and propagation.
Technique: T1210: Exploitation of Remote Services
TajMahal has the ability to index files from drives, user profiles, and removable drives.
Technique: T1083: File and Directory Discovery
Wizard Spider has used RDP for lateral movement.
Technique: T1021: Remote Services
Writing payloads to shared sections also avoids the use of highly monitored API calls such as WriteProcessMemory and CreateRemoteThread.
Technique: T1055: Process Injection
GrimAgent can use a decryption algorithm for strings based on Rotate on Right  and Rotate on Left  functionality.
Technique: T1140: Deobfuscate/Decode Files or Information
This technique has been observed to both for the dynamic opening of a listening port as well as the initiating of a connection to a listening server on a different system.
Technique: T1205: Traffic Signaling
Dragonfly has used spearphising campaigns to gain access to victims.
Technique: T1566: Phishing
Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services.
Technique: T1552: Unsecured Credentials
Ke3chang malware RoyalDNS has used DNS for C2.
Technique: T1071: Application Layer Protocol
It searches the active process list for the systemd process
Technique: T1057: Process Discovery
Dragonfly 2.0 deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots.
Technique: T1070: Indicator Removal on Host
APT32 has used RTF document that includes an exploit to execute malicious code.
Technique: T1203: Exploitation for Client Execution
GOLD SOUTHFIELD has exploited Oracle WebLogic vulnerabilities for initial compromise.
Technique: T1190: Exploit Public-Facing Application
Gathering this information may reveal opportunities for other forms of reconnaissance , Search Open Websites/Domains, or Active Scanning, establishing operational resources  or Compromise Infrastructure, and/or initial access .
Technique: T1590: Gather Victim Network Information
Fox Kitten has installed TightVNC server and client on compromised servers and endpoints for lateral movement.
Technique: T1021: Remote Services
JPIN can download files and upgrade itself.
Technique: T1105: Ingress Tool Transfer
The script gathers system specific data, such as the domain the system belongs to and the current username, that it constructs in the following format:   <domain>\<username>:pass   The above string is encoded using a custom base64 encoder to strip out non-alphanumeric characters (=, / and +) from the data and replaces them with domain safe values (01, 02 and 03 respectively)
Technique: T1132: Data Encoding
Cobalt Strike can timestomp any files or payloads placed on a target machine to help them blend in.
Technique: T1070: Indicator Removal on Host
WellMess has the ability to use DNS tunneling for C2 communications.
Technique: T1071: Application Layer Protocol
Compromised social media accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos.
Technique: T1586: Compromise Accounts
NETEAGLE allows adversaries to enumerate and modify the infected host's file system.
Technique: T1083: File and Directory Discovery
Whitefly frequently delivers Vcrodat as a malicious DLL that has the same name as DLLs belonging to legitimate software from various security vendors.
Technique: T1036: Masquerading
The AWS command aws iam list-users may be used to obtain a list of users in the current account while aws iam list-roles can obtain IAM roles that have a specified path prefix.
Technique: T1087: Account Discovery
Naikon has convinced victims to open malicious attachments to execute malware.
Technique: T1204: User Execution
Catchamas adds a new service named NetAdapter to establish persistence.
Technique: T1543: Create or Modify System Process
Scan the network environment of the infected machine; checks for availability of specific ports on servers that share the same internal and external subnet mask (i.e 255.255.0.0\16)
Technique: T1046: Network Service Scanning
xCaon has used the GetAdaptersInfo API call to get the victim's MAC address.
Technique: T1016: System Network Configuration Discovery
Astaroth can be loaded through regsvr32.exe.
Technique: T1218: Signed Binary Proxy Execution
This exception invokes the exception handler containing the HTTP communication code, allowing it to run
Technique: T1140: Deobfuscate/Decode Files or Information
APT28 sent spearphishing emails containing malicious Microsoft Office and RAR attachments.
Technique: T1566: Phishing
Ngrok has been used by threat actors to configure servers for data exfiltration.
Technique: T1567: Exfiltration Over Web Service
AppleSeed can gain system level privilege by passing SeDebugPrivilege to the AdjustTokenPrivilege API.
Technique: T1134: Access Token Manipulation
Cobalt Strike can be configured to have commands relayed over a peer-to-peer network of infected hosts.
Technique: T1090: Proxy
Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR.
Technique: T1574: Hijack Execution Flow
Tropic Trooper has used base64 encoding to hide command strings delivered from the C2.
Technique: T1132: Data Encoding
Wizard Spider has used spearphishing attachments to deliver Microsoft documents containing macros or PDFs containing malicious links to download either Emotet, Bokbot, TrickBot, or Bazar.
Technique: T1566: Phishing
The value stored in the Registry key will be executed after a user logs into the computer.
Technique: T1547: Boot or Logon Autostart Execution
Astaroth uses an external software known as NetPass to recover passwords.
Technique: T1555: Credentials from Password Stores
Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection.
Technique: T1040: Network Sniffing
Tonto Team has routed their traffic through an external server in order to obfuscate their location.
Technique: T1090: Proxy
Figure 4 Microsoft Word attempting to download the remote template If the C2 server is active at the time the document is opened, it will successfully retrieve the malicious macro and load it in the same Microsoft Word session
Technique: T1105: Ingress Tool Transfer
KeyBoy uses the Dynamic Data Exchange  protocol to download remote payloads.
Technique: T1559: Inter-Process Communication
Threat Group-3390 has exploited MS17-010 to move laterally to other systems on the network.
Technique: T1210: Exploitation of Remote Services
If a matching entry is found, access to the object is granted.
Technique: T1222: File and Directory Permissions Modification
HOPLIGHT has connected outbound over TCP port 443 with a FakeTLS method.
Technique: T1571: Non-Standard Port
GravityRAT collects the MAC address, computer name, and CPU information.
Technique: T1082: System Information Discovery
SilverTerrier uses FTP for C2 communications.
Technique: T1071: Application Layer Protocol
NETWIRE has used a custom obfuscation algorithm to hide strings including Registry keys, APIs, and DLL names.
Technique: T1027: Obfuscated Files or Information
The Local Security Authority  is the main component responsible for local security policy and user authentication.
Technique: T1547: Boot or Logon Autostart Execution
Dridex has encrypted traffic with RSA.
Technique: T1573: Encrypted Channel
BackdoorDiplomacy has also exploited mis-configured Plesk servers.
Technique: T1190: Exploit Public-Facing Application
Patchwork installed its payload in the startup programs folder as "Baidu Software Update."
Technique: T1036: Masquerading
Penquin can report the IP of the compromised host to attacker controlled infrastructure.
Technique: T1016: System Network Configuration Discovery
Chaes has used VBscript to execute malicious code.
Technique: T1059: Command and Scripting Interpreter
The function invokes sysctl checking the returned value of P_TRACED.
Technique: T1497: Virtualization/Sandbox Evasion
These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Technique: T1552: Unsecured Credentials
The OsInfo function in Komplex collects the current running username.
Technique: T1033: System Owner/User Discovery
HotCroissant has the ability to identify the IP address of the compromised machine.
Technique: T1016: System Network Configuration Discovery
Apple also uses a set of keys and algorithms to encrypt the user’s password, but once the master key is found, an attacker need only iterate over the other values to unlock the final password.
Technique: T1555: Credentials from Password Stores
Stuxnet can propagate via removable media using an autorun.inf file or the CVE-2010-2568 LNK vulnerability.
Technique: T1091: Replication Through Removable Media
Agent Tesla can achieve persistence by modifying Registry key entries.
Technique: T1112: Modify Registry
Users are advised to avoid opening attachments and click links on unsolicited emails
Technique: T1204: User Execution
An adversary may Create Snapshot of one or more volumes in an account, create a new instance, mount the snapshots, and then apply a less restrictive security policy to collect Data from Local System or for Remote Data Staging.
Technique: T1578: Modify Cloud Compute Infrastructure
Blue Mockingbird has used wmic.exe and Windows Registry modifications to set the COR_PROFILER environment variable to execute a malicious DLL whenever a process loads the .NET CLR.
Technique: T1574: Hijack Execution Flow
FYAnti has used ConfuserEx to pack its .NET module.
Technique: T1027: Obfuscated Files or Information
Carberp's bootkit can inject a malicious DLL into the address space of running processes.
Technique: T1055: Process Injection
This technique may also enable Forced Authentication by injecting a SMB/HTTPS  URL and triggering an authentication attempt.
Technique: T1221: Template Injection
Rising Sun can delete files specified by the C2.
Technique: T1070: Indicator Removal on Host
Conti has loaded an encrypted DLL into memory and then executes it.
Technique: T1055: Process Injection
Adversaries may upload tools to support their operations, such as making a tool available to a victim network to enable Ingress Tool Transfer by placing it on an Internet accessible web server.
Technique: T1608: Stage Capabilities
BADNEWS is capable of downloading additional files through C2 channels, including a new version of itself.
Technique: T1105: Ingress Tool Transfer
Cobalt Strike can also use PowerSploit and other scripting frameworks to perform execution.
Technique: T1059: Command and Scripting Interpreter
Seasalt is capable of installing itself as a service.
Technique: T1543: Create or Modify System Process
Ramsay has PE data embedded within JPEG files contained within Word documents.
Technique: T1027: Obfuscated Files or Information
Any user or administrator within the organization  may be able to create rules to automatically move or delete emails.
Technique: T1564: Hide Artifacts
Adversaries can use this information to determine the potential value of databases and discover the requirements to access them.
Technique: T1580: Cloud Infrastructure Discovery
Various utilities and commands may acquire this information, including whoami.
Technique: T1033: System Owner/User Discovery
The default file types copied would include data copied to the drive by SPACESHIP.
Technique: T1025: Data from Removable Media
An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing.
Technique: T1134: Access Token Manipulation
ShimRat communicated over HTTP and HTTPS with C2 servers.
Technique: T1071: Application Layer Protocol
(Source: Dell SecureWorks) Further research revealed additional tools containing the same username (see Figure 21)
Technique: T1033: System Owner/User Discovery
The Windows Control Panel process binary  handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.
Technique: T1218: Signed Binary Proxy Execution
Many cloud service providers offer solutions for online data storage such as Amazon S3, Azure Storage, and Google Cloud Storage.
Technique: T1530: Data from Cloud Storage Object
Lazarus Group has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email.
Technique: T1204: User Execution
The attacker leveraged multiple exploits, targeting both CVE-2014-6332 and CVE-2014-4113
Technique: T1068: Exploitation for Privilege Escalation
Frankenstein has used WMI queries to check if various security applications were running, including VMWare and Virtualbox.
Technique: T1497: Virtualization/Sandbox Evasion
In GCP, gcloud iam service-accounts list and gcloud projects get-iam-policy may be used to obtain a listing of service accounts and users in a project.
Technique: T1087: Account Discovery
KillDisk has attempted to get the access token of a process by calling OpenProcessToken.
Technique: T1134: Access Token Manipulation
Adversaries may also escape via Exploitation for Privilege Escalation, such as exploiting vulnerabilities in global symbolic links in order to access the root directory of a host machine.
Technique: T1611: Escape to Host
NetTraveler reports window names along with keylogger information to provide application context.
Technique: T1010: Application Window Discovery
SHA256 Compiled C2 account POP3S Account SMTPS Accounts   861b6bc1f9.
Technique: T1087: Account Discovery
Bankshot gathers system information, network addresses, disk type, disk free space, and the operation system version.
Technique: T1082: System Information Discovery
By either replacing or adding illegitimate drivers , an adversary can use LSA operations to continuously execute malicious payloads.
Technique: T1547: Boot or Logon Autostart Execution
Leviathan has used steganography to hide stolen data inside other files stored on Github.
Technique: T1027: Obfuscated Files or Information
Rover searches for files on attached removable drives based on a predefined list of file extensions every five seconds.
Technique: T1025: Data from Removable Media
xCaon has communicated with the C2 server by sending POST requests over HTTP.
Technique: T1071: Application Layer Protocol
Adversaries may also be able to escalate privileges from administrator to root as the emond service is executed with root privileges by the Launch Daemon service.
Technique: T1546: Event Triggered Execution
Open interactive python shells with auto-completion on the all-in-memory remote python interpreter
Technique: T1059: Command and Scripting Interpreter
Adversarial may use these commands to make themselves the owner of files and directories or change the mode if current permissions allow it.
Technique: T1222: File and Directory Permissions Modification
In this particular case in 2013, the config file included an unknown plugin set, aside from the usual ‘ddos’ plugin listing
Technique: T1083: File and Directory Discovery
Silence has used compromised credentials to log on to other systems and escalate privileges.
Technique: T1078: Valid Accounts
It can also use Service Control Manager to start new services.
Technique: T1569: System Services
The payload sends system information about the infected computer to the C&C server and downloads additional tools.
Technique: T1082: System Information Discovery
Trojan.Karagany can monitor the titles of open windows to identify specific keywords.
Technique: T1010: Application Window Discovery
The discovery modules used with Duqu can collect information on process details.
Technique: T1057: Process Discovery
Cardinal RAT and its watchdog component are compiled and executed after being delivered to victims as embedded, uncompiled source code.
Technique: T1027: Obfuscated Files or Information
Crutch can exfiltrate files from compromised systems.
Technique: T1005: Data from Local System
Sandworm Team has conducted research against potential victim websites as part of its operational planning.
Technique: T1594: Search Victim-Owned Websites
Adversaries may use such private WHOIS services to obscure information about who owns a purchased domain.
Technique: T1583: Acquire Infrastructure
The initial beacon packet for Misdat contains the operating system version of the victim.
Technique: T1082: System Information Discovery
The victims Data from Cadelle’s C&C servers shows that a large number of Backdoor.Cadelspy infections affected individual users of Iranian internet service providers (ISPs) and hosting services
Technique: T1543: Create or Modify System Process
EvilBunny has used various API calls as part of its checks to see if the malware is running in a sandbox.
Technique: T1106: Native API
Stolen Pencil gathers credentials using Mimikatz and Procdump.
Technique: T1003: OS Credential Dumping
Cobalt Strike can deliver "beacon" payloads for lateral movement by leveraging remote COM execution.
Technique: T1021: Remote Services
AppleSeed can use GetKeyState and GetKeyboardState to capture keystrokes on the victim’s machine.
Technique: T1056: Input Capture
By default, the NTDS file  is located in %SystemRoot%\NTDS\Ntds.dit of a domain controller.
Technique: T1003: OS Credential Dumping
Remsec is capable of listing contents of folders on the victim.
Technique: T1083: File and Directory Discovery
Bad Rabbit has used an executable that installs a modified bootloader to prevent normal boot-up.
Technique: T1495: Firmware Corruption
Valak has the ability to take screenshots on a compromised host.
Technique: T1113: Screen Capture
Sidewinder has used LNK files to download remote files to the victim's network.
Technique: T1105: Ingress Tool Transfer
Reflection attacks often take advantage of protocols with larger responses than requests in order to amplify their traffic, commonly known as a Reflection Amplification attack.
Technique: T1498: Network Denial of Service
APT29 has also used SDelete to remove artifacts from victims.
Technique: T1070: Indicator Removal on Host
Hildegard has disguised itself as a known Linux process.
Technique: T1036: Masquerading
Figure 4 – Backdoored authentication function in SSH server As you can see in Figure 4, this version of Dropbear SSH will authenticate the user if the password passDs5Bu9Te7 was entered
Technique: T1021: Remote Services
AppleSeed can take screenshots on a compromised host by calling a series of APIs.
Technique: T1113: Screen Capture
Suckfly has used stolen certificates to sign its malware.
Technique: T1553: Subvert Trust Controls
APT29 has used compromised identities to access VPNs and remote access tools.
Technique: T1133: External Remote Services
A victim process can be created with native Windows API calls such as CreateProcess, which includes a flag to suspend the processes primary thread.
Technique: T1055: Process Injection
FIN6 also moved laterally to servers in the environment using RDP and configured them as malware “distribution” servers.
Technique: T1021: Remote Services
Example packers are MPRESS and UPX.
Technique: T1027: Obfuscated Files or Information
Dragonfly leveraged Outlook Web Access.
Technique: T1114: Email Collection
Adversaries may also craft malicious web advertisements and purchase ad space on a website through legitimate ad providers.
Technique: T1608: Stage Capabilities
BLUELIGHT can collect a list of anti-virus products installed on a machine.
Technique: T1518: Software Discovery
Kinsing has communicated with C2 over HTTP.
Technique: T1071: Application Layer Protocol
InvisiMole can record sound using input audio devices.
Technique: T1123: Audio Capture
Keydnap puts a space after a false .jpg extension so that execution actually goes through the Terminal.app program.
Technique: T1036: Masquerading
Daserf uses RC4 encryption to obfuscate HTTP traffic.
Technique: T1573: Encrypted Channel
Both are digitally signed by Microsoft.
Technique: T1218: Signed Binary Proxy Execution
OSInfo specifically looks for Domain Admins and power users within the domain.
Technique: T1069: Permission Groups Discovery
Mustang Panda has used InstallUtil.exe to execute a malicious Beacon stager.
Technique: T1218: Signed Binary Proxy Execution
APT28 has performed timestomping on victim files.
Technique: T1070: Indicator Removal on Host
JPIN can inject content into lsass.exe to load a module.
Technique: T1055: Process Injection
Some resources in Prikormka are encrypted with a simple XOR operation or encoded with Base64.
Technique: T1027: Obfuscated Files or Information
This can either be done live in memory during system runtime for immediate effect, or in storage to implement the change on the next boot of the network device.
Technique: T1601: Modify System Image
Tropic Trooper can search for anti-virus software running on the system.
Technique: T1518: Software Discovery
Exaramel for Linux uses RC4 for encrypting the configuration.
Technique: T1027: Obfuscated Files or Information
Bundlore can persist via a LaunchDaemon.
Technique: T1543: Create or Modify System Process
Droppers used by Putter Panda use RC4 or a 16-byte XOR key consisting of the bytes 0xA0 – 0xAF to obfuscate payloads.
Technique: T1027: Obfuscated Files or Information
The ASPXTool version used by Threat Group-3390 has been deployed to accessible servers running Internet Information Services .
Technique: T1505: Server Software Component
APT34 has used certutil to decode base64-encoded files on victims.
Technique: T1140: Deobfuscate/Decode Files or Information
As seen in the above request, the Trojan will generate a URL for its beacon with the following structure:http://<c2 domain>/chk?<hex(Environment.UserName/Environment.MachineName)> The Trojan will issue a request to this URL to check (hence the chk string in the URL) to see if the C2 server has a command for the Trojan to run
Technique: T1071: Application Layer Protocol
KillDisk has a ransomware component that encrypts files with an AES key that is also RSA-1028 encrypted.
Technique: T1486: Data Encrypted for Impact
Here is the code:The goal of this code is to get information from the properties of the document ("Subject", "Company", "Category", "Hyperlink base" and finally "Comments")
Technique: T1140: Deobfuscate/Decode Files or Information
regsvr32.exe
Technique: T1218: Signed Binary Proxy Execution
RTM can check for specific files and directories associated with virtualization and malware analysis.
Technique: T1083: File and Directory Discovery
ChChes can alter the victim's proxy configuration.
Technique: T1562: Impair Defenses
UNC2452 has acquired C2 domains through resellers.
Technique: T1583: Acquire Infrastructure
Malware may be used to inject false credentials into the authentication process on a domain controller with the intent of creating a backdoor used to access any user’s account and/or credentials .
Technique: T1556: Modify Authentication Process
TeamTNT looks for the host machine’s IP address.
Technique: T1016: System Network Configuration Discovery
TAINTEDSCRIBE can execute ProcessList for process discovery.
Technique: T1057: Process Discovery
The KRBTGT password hash may be obtained using OS Credential Dumping and privileged access to a domain controller.
Technique: T1558: Steal or Forge Kerberos Tickets
Operation Wocao has used a custom proxy tool called "Agent" which has support for multiple hops.
Technique: T1090: Proxy
Exaramel for Linux can uninstall its persistence mechanism and delete its configuration file.
Technique: T1070: Indicator Removal on Host
yty uses a keylogger plugin to gather keystrokes.
Technique: T1056: Input Capture
IcedID has utilzed encrypted binaries and base64 encoded strings.
Technique: T1027: Obfuscated Files or Information
OilRig has sent spearphising emails with malicious attachments to potential victims using compromised and/or spoofed email accounts.
Technique: T1566: Phishing
As such, these protocols are classified as Asymmetric Cryptography.
Technique: T1573: Encrypted Channel
They provide support for multiple logon processes and multiple security protocols to the operating system.
Technique: T1547: Boot or Logon Autostart Execution
Ebury can intercept private keys using a trojanized ssh-add function.
Technique: T1556: Modify Authentication Process
TEARDROP files had names that resembled legitimate Window file and directory names.
Technique: T1036: Masquerading
ComRAT has also embedded an XOR encrypted communications module inside the orchestrator module.
Technique: T1027: Obfuscated Files or Information
If this fails, it attempts to add Registry Run keys.
Technique: T1547: Boot or Logon Autostart Execution
When it first starts, BADNEWS crawls the victim's local drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.
Technique: T1005: Data from Local System
Cobalt Strike uses a command-line interface to interact with systems.
Technique: T1059: Command and Scripting Interpreter
SpeakUp encodes C&C communication using Base64.
Technique: T1132: Data Encoding
Outlook stores data locally in offline data files with an extension of .ost.
Technique: T1114: Email Collection
Mouse Pointer Check The Trojan will perform the following WMI query:   Select * from Win32_PointingDevice   The Trojan will check the Caption, Description, HardwareType, InfSection, Manufacturer and Name fields in the results for the string VMware, Virtual, VBox, VM or Oracle
Technique: T1497: Virtualization/Sandbox Evasion
GrimAgent can sleep for 195 - 205 seconds after payload execution and before deleting its task.
Technique: T1497: Virtualization/Sandbox Evasion
APT32 has used malicious links to direct users to web pages designed to harvest credentials.
Technique: T1598: Phishing for Information
Taidoor has collected the MAC address of a compromised host; it can also use GetAdaptersInfo to identify network adapters.
Technique: T1016: System Network Configuration Discovery
Night Dragon has dumped account hashes with Carbanak and cracked them with Cain & Abel.
Technique: T1003: OS Credential Dumping
Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Technique: T1140: Deobfuscate/Decode Files or Information
Proton gathers credentials in files for 1password.
Technique: T1555: Credentials from Password Stores
Volgmer can gather the IP address from the victim's machine.
Technique: T1016: System Network Configuration Discovery
PROMETHIUM has attempted to get users to execute compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.
Technique: T1204: User Execution
DOGCALL is encrypted using single-byte XOR.
Technique: T1027: Obfuscated Files or Information
POWERSTATS can retrieve IP, network adapter configuration information, and domain from compromised hosts.
Technique: T1016: System Network Configuration Discovery
This technique is the execution used in conjunction with Windows Service during service persistence or privilege escalation.
Technique: T1569: System Services
StrongPity can use the HKCU\Software\Microsoft\Windows\CurrentVersion\Run Registry key for persistence.
Technique: T1547: Boot or Logon Autostart Execution
Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign.
Technique: T1036: Masquerading
to make it a hidden file.
Technique: T1564: Hide Artifacts
Bonadan can download an additional module which has a cryptocurrency mining extension.
Technique: T1496: Resource Hijacking
Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats.
Technique: T1565: Data Manipulation
This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts .
Technique: T1555: Credentials from Password Stores
Operation Wocao has used WMI to execute commands.
Technique: T1047: Windows Management Instrumentation
Webshell can gain remote access and execution on target web servers.
Technique: T1505: Server Software Component
Aria-body has the ability to gather TCP and UDP table status listings.
Technique: T1049: System Network Connections Discovery
LiteDuke has the ability to download files.
Technique: T1105: Ingress Tool Transfer
The spoolsv.exe process also runs under SYSTEM level permissions.
Technique: T1547: Boot or Logon Autostart Execution
SDBbot has the ability to access the file system on a compromised host.
Technique: T1005: Data from Local System
They previously used named and hijacked scheduled tasks to also establish persistence.
Technique: T1053: Scheduled Task/Job
APT1 hijacked FQDNs associated with legitimate websites hosted by hop points.
Technique: T1584: Compromise Infrastructure
The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
Technique: T1052: Exfiltration Over Physical Medium
Specifically, we discovered code in the PowerShell script that was a match for code in Magic Unicorn containing the comment “one line shellcode injection with native x86 shellcode”
Technique: T1059: Command and Scripting Interpreter
Aria-body has the ability to enumerate loaded modules for a process.. Get2 has the ability to identify running processes on an infected host.
Technique: T1057: Process Discovery
CloudDuke downloads and executes additional malware from either a Web address or a Microsoft OneDrive account.
Technique: T1105: Ingress Tool Transfer
PlugX also has a module to change service configurations as well as start, control, and delete services.
Technique: T1543: Create or Modify System Process
For all non-removable drives on a victim, USBStealer executes automated collection of certain files for later exfiltration.
Technique: T1119: Automated Collection
Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain.
Technique: T1482: Domain Trust Discovery
Xbash can use regsvr32 for executing scripts.
Technique: T1218: Signed Binary Proxy Execution
ZIRCONIUM has exfiltrated files via the Dropbox API C2.
Technique: T1041: Exfiltration Over C2 Channel
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
Technique: T1210: Exploitation of Remote Services
Javali has been delivered via malicious links embedded in e-mails.
Technique: T1566: Phishing
Once forged, adversaries may use these web cookies to access resources , which may bypass multi-factor and other authentication protection mechanisms.
Technique: T1606: Forge Web Credentials
TDTESS has a command to download and execute an additional file.
Technique: T1105: Ingress Tool Transfer
Drovorub has used XOR encrypted payloads in WebSocket client to server messages.
Technique: T1027: Obfuscated Files or Information
ABK has the ability to decrypt AES encrypted payloads.
Technique: T1140: Deobfuscate/Decode Files or Information
FLASHFLOOD stages data it copies from the local system or removable drives in the "%WINDIR%\$NtUninstallKB885884$\" directory.
Technique: T1074: Data Staged
If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant.
Technique: T1497: Virtualization/Sandbox Evasion
Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code.
Technique: T1212: Exploitation for Credential Access
Mosquito stores configuration values under the Registry key HKCU\Software\Microsoft\dllname and modifies Registry keys under HKCR\CLSID\...\InprocServer32with a path to the launcher.
Technique: T1112: Modify Registry
The EventLog service maintains event logs from various system components and applications.
Technique: T1562: Impair Defenses
Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.
Technique: T1120: Peripheral Device Discovery
GoldenSpy has used HTTP over ports 9005 and 9006 for network traffic, 9002 for C2 requests, 33666 as a WebSocket, and 8090 to download files.
Technique: T1571: Non-Standard Port
Similar to Indicator Blocking, adversaries may unhook or otherwise modify these features added by tools  to avoid detection.
Technique: T1562: Impair Defenses
To ensure its victim will use IE, it will terminate any process in-focus that is Chrome or Firefox, in hopes the victim will believe the browsers are “malfunctioning.” Whenever a victim uses IE and browses to specific Brazilian banks or businesses, the malware will only then begin to log keystrokes
Technique: T1552: Unsecured Credentials
Less than a week after Microsoft issued a patch for CVE-2017-11882 on Nov
Technique: T1203: Exploitation for Client Execution
3PARA RAT command and control commands are encrypted within the HTTP C2 channel using the DES algorithm in CBC mode with a key derived from the MD5 hash of the string HYF54&%9&jkMCXuiS.
Technique: T1573: Encrypted Channel
Adversaries may modify file attributes that signify programs are from untrusted sources to subvert Gatekeeper controls in macOS.
Technique: T1553: Subvert Trust Controls
A version of PlugX loads as shellcode within a .NET Framework project using msbuild.exe, presumably to bypass application control techniques.
Technique: T1127: Trusted Developer Utilities Proxy Execution
Adversaries may steal data by exfiltrating it over an existing command and control channel.
Technique: T1041: Exfiltration Over C2 Channel
gh0st RAT has a keylogger.
Technique: T1056: Input Capture
Hancitor has been delivered via phishing emails with malicious attachments.
Technique: T1566: Phishing
In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services.
Technique: T1598: Phishing for Information
Rifdoor has the ability to identify the username on the compromised host.
Technique: T1033: System Owner/User Discovery
On Windows hosts, PowerShell has two different command history providers: the built-in history and the command history managed by the PSReadLine module.
Technique: T1070: Indicator Removal on Host
InvisiMole can use a .lnk shortcut for the Control Panel to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
Remsec can obtain a list of active connections and open ports.
Technique: T1049: System Network Connections Discovery
FIN10 has established persistence by using S4U tasks as well as the Scheduled Task option in PowerShell Empire.
Technique: T1053: Scheduled Task/Job
LightNeuron gathers the victim computer name using the Win32 API call GetComputerName.
Technique: T1082: System Information Discovery
SpicyOmelette can identify the IP of a compromised system.
Technique: T1016: System Network Configuration Discovery
Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code.
Technique: T1027: Obfuscated Files or Information
The presence of the com.apple.quarantine quarantine flag can be checked with the xattr command xattr -l /path/to/examplefile.
Technique: T1553: Subvert Trust Controls
Information from these sources may reveal opportunities for other forms of reconnaissance  or Search Open Websites/Domains, establishing operational resources  or Obtain Capabilities, and/or initial access  or Exploit Public-Facing Application.
Technique: T1596: Search Open Technical Databases
NTDLL.dll 
Technique: T1129: Shared Modules
This may further enable use of additional techniques for gaining access to systems.
Technique: T1098: Account Manipulation
Depending on the software and nature of the vulnerability, some may be exploited in the browser or require the user to open a file.
Technique: T1203: Exploitation for Client Execution
Moafee has been known to employ binary padding.
Technique: T1027: Obfuscated Files or Information
Adversaries may also abuse MMC to execute malicious .msc files.
Technique: T1218: Signed Binary Proxy Execution
FIN7 has used Kerberoasting for credential access and to enable lateral movement.
Technique: T1558: Steal or Forge Kerberos Tickets
Lokibot downloaded several staged items onto the victim's machine.
Technique: T1105: Ingress Tool Transfer
Adversaries may also attempt to obscure malicious code from analysis by abusing the manner in which rundll32.exe loads DLL function names.
Technique: T1218: Signed Binary Proxy Execution
The DustySky dropper uses Windows Management Instrumentation to extract information about the operating system and whether an anti-virus is active.
Technique: T1047: Windows Management Instrumentation
The tactic also serves to mask malicious C2 and exfiltration traffic and make it appear innocuous
Technique: T1132: Data Encoding
APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access.
Technique: T1190: Exploit Public-Facing Application
Several Lazarus Group malware families use timestomping, including modifying the last write timestamp of a specified Registry key to a random date, as well as copying the timestamp for legitimate .exe files  to its dropped files.
Technique: T1070: Indicator Removal on Host
Turian can establish persistence by adding Registry Run keys.
Technique: T1547: Boot or Logon Autostart Execution
Bonadan has discovered the username of the user running the backdoor.
Technique: T1033: System Owner/User Discovery
NavRAT leverages cmd.exe to perform discovery techniques.
Technique: T1059: Command and Scripting Interpreter
Elise executes ipconfig /all after initial communication is made to the remote server.
Technique: T1016: System Network Configuration Discovery
Rifdoor has encrypted command and control  communications with a stream cipher.
Technique: T1573: Encrypted Channel
YAHOYAH uses HTTP GET requests to download other files that are executed in memory.
Technique: T1105: Ingress Tool Transfer
Ramsay can collect data from removable media and stage it for exfiltration.
Technique: T1025: Data from Removable Media
The libraries can be linked against when compiling, while the utilities require spawning a subshell, or a similar execution mechanism.
Technique: T1560: Archive Collected Data
AppleJeus has also used the open source ADVObfuscation library for its components.
Technique: T1027: Obfuscated Files or Information
InvisiMole gathers the local system time from the victim’s machine.
Technique: T1124: System Time Discovery
Packets produced from these protocols may have many fields and headers in which data can be concealed.
Technique: T1071: Application Layer Protocol
Another example involves pivoting browser traffic from the adversary's browser through the user's browser by setting up a proxy which will redirect web traffic.
Technique: T1185: Browser Session Hijacking
Non-localized resources are placed at the top level directory of an application bundle, while localized resources are placed in the /Resources folder.
Technique: T1564: Hide Artifacts
TrickBot gathers the OS version, machine name, CPU type, amount of RAM available, and UEFI/BIOS firmware information from the victim’s machine.
Technique: T1082: System Information Discovery
NavRAT creates a Registry key to ensure a file gets executed upon reboot in order to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
Each end of the communication channels requires a private key  and the public key of the other entity.
Technique: T1048: Exfiltration Over Alternative Protocol
Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Technique: T1490: Inhibit System Recovery
OnionDuke steals credentials from its victims.
Technique: T1003: OS Credential Dumping
For example, template properties reference a file, serving as a pre-formatted document blueprint, that is fetched when the document is loaded.
Technique: T1221: Template Injection
Examples include dir, tree, ls, find, and locate.
Technique: T1083: File and Directory Discovery
An adversary may obtain root access , then they can scan through memory to find the correct sequence of keys in relatively few tries to decrypt the user’s logon keychain.
Technique: T1555: Credentials from Password Stores
The MirageFox binaries export a function called dll_wWinMain, the name of an export in vsodscpl.dll, a module by McAfee that is loaded by a few of their executables that import and call this function
Technique: T1140: Deobfuscate/Decode Files or Information
SMOKEDHAM has exfiltrated data to its C2 server.
Technique: T1041: Exfiltration Over C2 Channel
TeamTNT has scanned for vulnerabilities in IoT devices and other related resources such as the Docker API.
Technique: T1595: Active Scanning
Stuxnet enumerates user accounts of the domain.
Technique: T1087: Account Discovery
Ebury has verified C2 domain ownership by decrypting the TXT record using an embedded RSA public key.
Technique: T1140: Deobfuscate/Decode Files or Information
APT41 performed password brute-force attacks on the local admin account.
Technique: T1110: Brute Force
Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise.
Technique: T1195: Supply Chain Compromise
Aria-body has the ability to delete files and directories on compromised hosts.
Technique: T1070: Indicator Removal on Host
Smoke Loader scans processes to perform anti-VM checks.
Technique: T1497: Virtualization/Sandbox Evasion
Wizard Spider has identified domain admins through the use of “net group ‘Domain admins’” commands.
Technique: T1087: Account Discovery