HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
These rules can be abused to impair/delay detection had the email content been immediately seen by a user or defender.
Technique: T1564: Hide Artifacts
Keydnap uses HTTPS for command and control.
Technique: T1071: Application Layer Protocol
Final1stspy obtains victim Microsoft Windows version information and CPU architecture.
Technique: T1082: System Information Discovery
Sandworm Team has collected the username from a compromised host.
Technique: T1033: System Owner/User Discovery
BoxCaon has created a working folder for collected files that it sends to the C2 server.
Technique: T1074: Data Staged
This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications.
Technique: T1568: Dynamic Resolution
Lazarus Group malware TangoDelta attempts to terminate various processes associated with McAfee.
Technique: T1562: Impair Defenses
Sandworm Team conducted technical reconnaissance of the Parliament of Georgia's official internet domain prior to its 2019 attack.
Technique: T1590: Gather Victim Network Information
Some Orz strings are base64 encoded, such as the embedded DLL known as MockDll.
Technique: T1027: Obfuscated Files or Information
(Source: Dell SecureWorks) Over a few days' span, the threat actors install remote access tools on additional systems based upon the results of the network reconnaissance
Technique: T1018: Remote System Discovery
This behavior will likely not result in elevated privileges since the injected process was spawned from  of the injecting process.
Technique: T1055: Process Injection
FALLCHILL can modify file or directory timestamps.
Technique: T1070: Indicator Removal on Host
Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload.
Technique: T1140: Deobfuscate/Decode Files or Information
APT38 has used DYEPACK.FOX to manipulate PDF data as it is accessed to remove traces of fraudulent SWIFT transactions from the data displayed to the end user.
Technique: T1565: Data Manipulation
Packet::getData decrypts the received payload and Converter::outString descrambles the result
Technique: T1140: Deobfuscate/Decode Files or Information
Some Felismus samples use a custom encryption method for C2 traffic that utilizes AES and multiple keys.
Technique: T1573: Encrypted Channel
BLUELIGHT can use different cloud providers for its C2.
Technique: T1102: Web Service
Javali can use large obfuscated libraries to hinder detection and analysis.
Technique: T1027: Obfuscated Files or Information
Ramsay can use Windows API functions such as WriteFile, CloseHandle, and GetCurrentHwProfile during its collection and file storage operations.
Technique: T1106: Native API
The schtasks can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel.
Technique: T1053: Scheduled Task/Job
Additionally, some cryptocurrency mining malware kills off processes for competing malware to ensure it’s not competing for resources.
Technique: T1496: Resource Hijacking
OSInfo queries the registry to look for information about Terminal Services.
Technique: T1012: Query Registry
An APT19 Port 22 malware variant registers itself as a service.
Technique: T1543: Create or Modify System Process
The adversary can then claim that they forgot their password in order to make changes to the domain registration.
Technique: T1584: Compromise Infrastructure
Figure 6 Relational diagram of artifacts  We created a timeline of the activity based off the data we collected, and found that the attack dates were tightly clustered into two waves in mid- to late-October and in mid-November as we see in Figure 7 using the timestamps from Table 3
Technique: T1562: Impair Defenses
LiteDuke can enumerate the account name on a targeted system.
Technique: T1033: System Owner/User Discovery
Figure 4: Downloading second stage Seminar.rtf The downloaded Seminar.rtf contains an embedded binary file that is dropped in %temp% via Equation Editor executable
Technique: T1105: Ingress Tool Transfer
Windshift has used compromised websites to register custom URL schemes on a remote system.
Technique: T1189: Drive-by Compromise
Dragonfly downloaded tools from a remote server after they were inside the victim network.
Technique: T1105: Ingress Tool Transfer
Dtrack packs collected data into a password protected archive.
Technique: T1560: Archive Collected Data
It also extracted command-line arguments and individual arguments from the running MsBuild.exe process to identify the directory path of the Orion software Visual Studio solution.
Technique: T1057: Process Discovery
This activity may be used to collect or relay authentication materials.
Technique: T1557: Adversary-in-the-Middle
TajMahal can set the KeepPrintedJobs attribute for configured printers in SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers to enable document stealing.
Technique: T1112: Modify Registry
KEYMARBLE has a command to search for files on the victim’s machine.
Technique: T1083: File and Directory Discovery
Avaddon bypasses UAC using the CMSTPLUA COM interface.
Technique: T1548: Abuse Elevation Control Mechanism
These files are then transmitted to a threat actor, often over commonly open ports 80 and 443 (HTTP and HTTPS)
Technique: T1571: Non-Standard Port
BoomBox can decrypt AES-encrypted files downloaded from C2.
Technique: T1140: Deobfuscate/Decode Files or Information
Pay2Key can remove its log file from disk.
Technique: T1070: Indicator Removal on Host
DarkHydrus has sent malware that required users to hit the enable button in Microsoft Excel to allow an .iqy file to be downloaded.
Technique: T1204: User Execution
Sidewinder has used base64 encoding and ECDH-P256 encryption for scripts and files.
Technique: T1027: Obfuscated Files or Information
Information about network trusts may also be exposed to adversaries via online or other accessible data sets .
Technique: T1590: Gather Victim Network Information
BADCALL encrypts C2 traffic using an XOR/ADD cipher.
Technique: T1573: Encrypted Channel
Adversaries may manipulate the configuration on the network device specifying use of a malicious TFTP server, which may be used in conjunction with Modify System Image to load a modified image on device startup or reset.
Technique: T1542: Pre-OS Boot
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.
Technique: T1550: Use Alternate Authentication Material
Windows Background Intelligent Transfer Service  is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model .
Technique: T1197: BITS Jobs
AppleJeus has collected the victim host information after infection.
Technique: T1082: System Information Discovery
Its developer used the open source Invoke-Obfuscation tool to obfuscate this PowerShell script, specifically using the COMPRESS technique offered by Invoke-Obfuscation
Technique: T1027: Obfuscated Files or Information
MS\d{2}-\d{3}
Technique: T1210: Exploitation of Remote Services
Molerats has delivered compressed executables within ZIP files to victims.
Technique: T1027: Obfuscated Files or Information
Metamorfo has used cmd.exe /c to execute files.
Technique: T1059: Command and Scripting Interpreter
ZeroT has obfuscated DLLs and functions using dummy API calls inserted between real instructions.
Technique: T1027: Obfuscated Files or Information
Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs.
Technique: T1003: OS Credential Dumping
Zebrocy gets the username from the system.
Technique: T1033: System Owner/User Discovery
Some Orz versions have an embedded DLL known as MockDll that uses Process Hollowing and regsvr32 to execute another payload.
Technique: T1218: Signed Binary Proxy Execution
APT3 has been known to remove indicators of compromise from tools.
Technique: T1027: Obfuscated Files or Information
Skidmap has the ability to download files on an infected host.
Technique: T1105: Ingress Tool Transfer
Cadelspy has the ability to steal information about printers and the documents sent to printers.
Technique: T1120: Peripheral Device Discovery
Proxysvc searches the local system and gathers data.
Technique: T1005: Data from Local System
The author of GravityRAT submitted samples to VirusTotal for testing, showing that the author modified the code to try to hide the DDE object in a different part of the document.
Technique: T1027: Obfuscated Files or Information
Adversaries may attempt to get a listing of accounts on a system or within an environment.
Technique: T1087: Account Discovery
Adversaries may abuse mavinject.exe to inject malicious DLLs into running processes  Dynamic-link Library Injection, allowing for arbitrary code execution .
Technique: T1218: Signed Binary Proxy Execution
BackdoorDiplomacy has executed DLL search order hijacking.
Technique: T1574: Hijack Execution Flow
Depending on the version of Windows, an adversary may take advantage of these features in different ways.
Technique: T1546: Event Triggered Execution
Proxysvc collects the OS version, country name, MAC address, computer name, physical memory statistics, and volume information for all drives on the system.
Technique: T1082: System Information Discovery
Each running process has its own directory, which includes memory mappings.
Technique: T1055: Process Injection
ChChes collects the victim hostname, window resolution, and Microsoft Windows version.
Technique: T1082: System Information Discovery
HELLOKITTY has the ability to enumerate network resources.
Technique: T1135: Network Share Discovery
Adversaries may carry out malicious operations using a virtual instance to avoid detection.
Technique: T1564: Hide Artifacts
Filename SHA256 Description   7za.exe dd6d7af00ef4ca89a319a230cdd094275c3a1d365807fe5b34133324bdaa0229 7-Zip 17.01 beta   hb.exe 3ca3a957c526eaeabcf17b0b2cd345c0fffab549adfdf04470b6983b87f7ec62 Hobocopy   nbt.exe c9d5dc956841e000bfd8762e2f0b48b66c79b79500e894b4efa7fb9ba17e4e9e nbtscan 1.0.35   rx.exe a6a0fbfee08367046d3d26fb4b4cf7779f7fb6eaf7e60e1d9b6bf31c5be5b63e IntelliAdmin Remote Execute v1.0   tardigrade.exe fe1b011fe089969d960d2dce2a61020725a02e15dbc812ee6b6ecc6a98875392 Tardigrade application
Technique: T1036: Masquerading
8 Upload the TPX498.dat file, which contains the list of collected keystrokes
Technique: T1056: Input Capture
ZIRCONIUM has exploited CVE-2017-0005 for local privilege escalation.
Technique: T1068: Exploitation for Privilege Escalation
S-Type may create a .lnk file to itself that is saved in the Start menu folder.
Technique: T1547: Boot or Logon Autostart Execution
These service processes may automatically execute specific binaries as part of their functionality or to perform other actions.
Technique: T1574: Hijack Execution Flow
APT41 used a ransomware called Encryptor RaaS to encrypt files on the targeted systems and provide a ransom note to the user.
Technique: T1486: Data Encrypted for Impact
Clop can kill several processes and services related to backups and security solutions.
Technique: T1489: Service Stop
TINYTYPHON searches through the drive containing the OS, then all drive letters C through to Z, for documents matching certain extensions.
Technique: T1083: File and Directory Discovery
Login items created using a shared file list are visible in System Preferences, can hide the application when it launches, and are executed through LaunchServices, not launchd, to open applications, documents, or URLs without using Finder.
Technique: T1547: Boot or Logon Autostart Execution
Network Security appliances such as NGFW, NGIPS, and Meraki MX can detect malicious activity associated with this threat
Technique: T1518: Software Discovery
They may create a new shortcut as a means of indirection that may use Masquerading to look like a legitimate program.
Technique: T1547: Boot or Logon Autostart Execution
TA505 has used the tool EmailStealer to steal and send lists of e-mail addresses to a remote server.
Technique: T1087: Account Discovery
OilRig has exfiltrated data over FTP separately from its primary C2 channel over DNS.
Technique: T1048: Exfiltration Over Alternative Protocol
KGH_SPY can enumerate files and directories on a compromised host.
Technique: T1083: File and Directory Discovery
LoJax is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems.
Technique: T1014: Rootkit
LoudMiner also added plist files in /Library/LaunchDaemons with KeepAlive set to true, which would restart the process if stopped.
Technique: T1547: Boot or Logon Autostart Execution
HAFNIUM has used ASCII encoding for C2 traffic.
Technique: T1132: Data Encoding
Ke3chang has used keyloggers.
Technique: T1056: Input Capture
RTM can obtain the victim time zone.
Technique: T1124: System Time Discovery
Machete takes photos from the computer’s web camera.
Technique: T1125: Video Capture
Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.
Technique: T1057: Process Discovery
There are examples of antivirus software being targeted by persistent threat groups to avoid detection.
Technique: T1211: Exploitation for Defense Evasion
For example, on the target host use procdump:
* procdump -ma lsass.exe lsass_dump
Locally, mimikatz can be run using:
* sekurlsa::Minidump lsassdump.dmp
* sekurlsa::logonPasswords
Built-in Windows tools such as comsvcs.dll can also be used:
* rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump PID  lsass.dmp full
Windows Security Support Provider  DLLs are loaded into LSSAS process at system start.
Technique: T1003: OS Credential Dumping
Zeus Panda searches for specific directories on the victim’s machine.
Technique: T1083: File and Directory Discovery
LookBack can list running processes.
Technique: T1057: Process Discovery
APT29 has used TCP for C2 communications.
Technique: T1095: Non-Application Layer Protocol
The C2 server response to a beacon sent by a variant of Emissary contains a 36-character GUID value that is used as an encryption key for subsequent network communications.
Technique: T1573: Encrypted Channel
MegaCortex loads injecthelper.dll into a newly created rundll32.exe process.
Technique: T1055: Process Injection
Hildegard was executed through the kubelet API run command and by executing commands on running containers.
Technique: T1609: Container Administration Command
NETWIRE has the ability to steal credentials from web browsers including Internet Explorer, Opera, Yandex, and Chrome.
Technique: T1555: Credentials from Password Stores
Spearphishing attachment is a specific variant of spearphishing.
Technique: T1566: Phishing
Conti has the ability to discover hosts on a target network.
Technique: T1018: Remote System Discovery
YAHOYAH uses HTTP for C2.
Technique: T1071: Application Layer Protocol
DNS information may also be exposed to adversaries via online or other accessible data sets .
Technique: T1590: Gather Victim Network Information
Wizard Spider has used administrative accounts, including Domain Admin, to move laterally within a victim network.
Technique: T1078: Valid Accounts
Stuxnet collects system information including computer and domain names, OS version, and S7P paths.
Technique: T1082: System Information Discovery
ZIRCONIUM has used a tool to steal credentials from installed web browsers including Microsoft Internet Explorer and Google Chrome.
Technique: T1555: Credentials from Password Stores
RawPOS dumps memory from specific processes on a victim system, parses the dumped files, and scrapes them for credit card data.
Technique: T1005: Data from Local System
Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about computers listed in AD.
Technique: T1018: Remote System Discovery
Various Lazarus Group malware modifies the Windows firewall to allow incoming connections or disable it entirely using netsh.
Technique: T1562: Impair Defenses
Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house.
Technique: T1587: Develop Capabilities
Reasons for Defacement include delivering messaging, intimidation, or claiming  credit for an intrusion.
Technique: T1491: Defacement
xCaon has encrypted data sent to the C2 server using a XOR key.
Technique: T1573: Encrypted Channel
BoomBox can encrypt data using AES prior to exfiltration.
Technique: T1027: Obfuscated Files or Information
BADNEWS attempts to hide its payloads using legitimate filenames.
Technique: T1036: Masquerading
ShellTea utilizes a number of techniques to identify if it is running within a virtual environment or is being monitored.
Technique: T1497: Virtualization/Sandbox Evasion
Machete malware used Python’s urllib library to make HTTP requests to the C2 server.
Technique: T1071: Application Layer Protocol
Similarly, GCP's Cloud SDK CLI provides the gcloud compute instances list command to list all Google Compute Engine instances in a project , and Azure's CLI command az vm list lists details of virtual machines.
Technique: T1580: Cloud Infrastructure Discovery
Wizard Spider has used WMI to identify anti-virus products installed on a victim's machine.
Technique: T1518: Software Discovery
Its presence on a compromised system allows a threat actor to spawn a reverse shell, upload or download files, and capture keystrokes
Technique: T1105: Ingress Tool Transfer
It has been observed loading a Linux Kernel Module  and then deleting it from the hard disk as well as overwriting the data with null bytes.
Technique: T1070: Indicator Removal on Host
Sidewinder has used DLL side-loading to drop and execute malicious payloads including the hijacking of the legitimate Windows application file rekeywiz.exe.
Technique: T1574: Hijack Execution Flow
AppleJeus has created a scheduled SYSTEM task that runs when a user logs in.
Technique: T1053: Scheduled Task/Job
FIN8 has used a malicious framework designed to impersonate the lsass.exe/vmtoolsd.exe token.
Technique: T1134: Access Token Manipulation
H1N1 has functionality to copy itself to removable media.
Technique: T1091: Replication Through Removable Media
Example commands that can be used to obtain security software information are netsh, reg query with Reg, dir with cmd, and Tasklist, but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for.
Technique: T1518: Software Discovery
By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making.
Technique: T1565: Data Manipulation
OSX_OCEANLOTUS.D can use HTTP POST and GET requests to send and receive C2 information.
Technique: T1071: Application Layer Protocol
05 27 28 obj32.bin obj32.bin obj64.bin Shellcode template is used by Reinstaller/Injector (rsXX.dll) and AudioRecorder4MetroApp (meXX.dll) for injecting into running processes
Technique: T1055: Process Injection
Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct Phishing for Information or Phishing.
Technique: T1586: Compromise Accounts
Malicious document used by Tropic Trooper PDB Strings as Context Clues The MSI file has two program database (PDB) strings inside: one belonging to the MSI file, and another for the backdoor installer (detected by Trend Micro as TROJ_TCDROP.ZTFB)
Technique: T1140: Deobfuscate/Decode Files or Information
OwaAuth has a command to timestop a file or directory.
Technique: T1070: Indicator Removal on Host
If an initial connectivity check fails, pngdowner attempts to extract proxy details and credentials from Windows Protected Storage and from the IE Credentials Store.
Technique: T1552: Unsecured Credentials
GLOOXMAIL communicates to servers operated by Google using the Jabber/XMPP protocol.
Technique: T1102: Web Service
POORAIM has been delivered through compromised sites acting as watering holes.
Technique: T1189: Drive-by Compromise
APT32 has abused the PasswordChangeNotify to monitor for and capture account password changes.
Technique: T1056: Input Capture
Carbanak lists running processes.
Technique: T1057: Process Discovery
BlackEnergy has run a keylogger plug-in on a victim.
Technique: T1056: Input Capture
FIN6 has obtained and used tools such as Mimikatz, Cobalt Strike, and AdFind.
Technique: T1588: Obtain Capabilities
GoldMax retrieved a list of the system's network interface after execution.
Technique: T1016: System Network Configuration Discovery
SoreFang can download additional payloads from C2.
Technique: T1105: Ingress Tool Transfer
ZIRCONIUM has purchased domains for use in targeted campaigns.
Technique: T1583: Acquire Infrastructure
FIN6 has collected schemas and user accounts from systems running SQL Server.
Technique: T1213: Data from Information Repositories
Industroyer can use supplied user credentials to execute processes and stop services.
Technique: T1078: Valid Accounts
SeaDuke uses HTTP and HTTPS for C2.
Technique: T1071: Application Layer Protocol
XCSSET uses the ssh launchdaemon to elevate privileges, bypass system controls, and enable remote access to the victim.
Technique: T1543: Create or Modify System Process
Stealth Falcon malware gathers passwords from multiple sources, including Internet Explorer, Firefox, and Chrome.
Technique: T1555: Credentials from Password Stores
Sandworm Team also used legitimate M.E.Doc software update check requests for sending and receiving commands and hosted malicious payloads on putdrive.com.
Technique: T1102: Web Service
Chimera has used a Windows version of the Linux touch command to modify the date and time stamp on DLLs.
Technique: T1070: Indicator Removal on Host
MarkiRAT can upload data from the victim's machine to the C2 server.
Technique: T1005: Data from Local System
BackdoorDiplomacy has downloaded additional files and tools onto a compromised host.
Technique: T1105: Ingress Tool Transfer
Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
Technique: T1543: Create or Modify System Process
DarkComet can load any files onto the infected machine to execute.
Technique: T1105: Ingress Tool Transfer
Sharpshooter has sent malicious attachments via emails to targets.
Technique: T1566: Phishing
Gorgon Group has used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
Technique: T1564: Hide Artifacts
Two common accessibility programs are C:\Windows\System32\sethc.exe, launched when the shift key is pressed five times and C:\Windows\System32\utilman.exe, launched when the Windows + U key combination is pressed.
Technique: T1546: Event Triggered Execution
APT32 compromised McAfee ePO to move laterally by distributing malware as a software deployment task.
Technique: T1072: Software Deployment Tools
The full contents of the batch script are given in Appendix C – a.bat
Technique: T1059: Command and Scripting Interpreter
Sidewinder has collected stolen files in a temporary folder in preparation for exfiltration.
Technique: T1074: Data Staged
DarkHydrus used Template Injection to launch an authentication window for users to enter their credentials.
Technique: T1187: Forced Authentication
PLAINTEE uses the ipconfig /all command to gather the victim’s IP address.
Technique: T1016: System Network Configuration Discovery
Adversaries may search for user activity on the host based on variables such as the speed/frequency of mouse movements and clicks  , browser history, cache, bookmarks, or number of files in common directories such as home or the desktop.
Technique: T1497: Virtualization/Sandbox Evasion
Sidewinder has sent e-mails with malicious links often crafted for specific targets.
Technique: T1566: Phishing
Dragonfly 2.0 used batch scripts to enumerate network information, including information about trusts, zones, and the domain.
Technique: T1016: System Network Configuration Discovery
PoetRAT has the ability to list all running processes.
Technique: T1057: Process Discovery
Once the user enables macros, the macro will perform the following actions:  Displays decoy content Checks for the existence of a file at %APPDATA%\wscript.exe If %APPDATA%\wscript.exe does not exist, the macro converts an embedded hex-encoded string into bytes and saves this data to the %APPDATA%\wscript.exe
Technique: T1204: User Execution
TrickBot can identify the user and groups the user belongs to on a compromised host.
Technique: T1033: System Owner/User Discovery
There are also specific applications that store passwords to make it easier for users manage and maintain.
Technique: T1555: Credentials from Password Stores
The usage of LinkedIn to deliver malicious documents,
Technique: T1566: Phishing
SDBbot has the ability to record video on a compromised host.
Technique: T1125: Video Capture
Adversaries may abuse Regsvr32.exe to proxy execution of malicious code.
Technique: T1218: Signed Binary Proxy Execution
DLL side loading is often used to maintain persistence on the compromised system
Technique: T1574: Hijack Execution Flow
Threat Group-3390 malware has used HTTP for C2.
Technique: T1071: Application Layer Protocol
Keep security software up-to-date with the latest definitions  Protection Norton Security, Symantec Endpoint Protection, and other Symantec security products protect users against these threats through the following detections: AV  Backdoor.Cadelspy Backdoor.Remexi Backdoor.Remexi.B  IPS  System Infected: Backdoor.Cadelspy Activity 2 System Infected: Backdoor.Remexi Activity  Indicators of compromise We have also compiled an indicators-of-compromise document containing further details which can be used to help identify the threats if they are present in your environment
Technique: T1518: Software Discovery
APT28 has collected files from various information repositories.
Technique: T1213: Data from Information Repositories
Search order hijacking occurs when an adversary abuses the order in which Windows searches for programs that are not given a path.
Technique: T1574: Hijack Execution Flow
CoinTicker downloads the following hidden files to evade detection and maintain persistence: /private/tmp/.info.enc, /private/tmp/.info.py, /private/tmp/.server.sh, ~/Library/LaunchAgents/.espl.plist, ~/Library/Containers/.random string/random string.
Technique: T1564: Hide Artifacts
Popular open source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency.
Technique: T1195: Supply Chain Compromise
With these permissions, an adversary could potentially browse to any resource on an intranet, such as Sharepoint or webmail, that is accessible through the browser and which the browser has sufficient permissions.
Technique: T1185: Browser Session Hijacking
Adversaries may communicate using the Domain Name System  application layer protocol to avoid detection/network filtering by blending in with existing traffic.
Technique: T1071: Application Layer Protocol
Use of two or multi-factor authentication  is recommended and provides a higher level of security than user names and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms.
Technique: T1111: Two-Factor Authentication Interception
REvil can use Native API for execution and to retrieve active services.
Technique: T1106: Native API
Once a user logs out, the history is flushed to the user’s .bash_history file.
Technique: T1552: Unsecured Credentials
Dragonfly 2.0 used command line for execution.
Technique: T1059: Command and Scripting Interpreter
Netwalker's PowerShell script has been obfuscated with multiple layers including base64 and hexadecimal encoding and XOR-encryption, as well as obfuscated PowerShell functions and variables.
Technique: T1027: Obfuscated Files or Information
ShimRat can use pre-configured HTTP proxies.
Technique: T1090: Proxy
Hi-Zor executes using regsvr32.exe called from the Registry Run Keys / Startup Folder persistence mechanism.
Technique: T1218: Signed Binary Proxy Execution
Cobalt Group has bypassed UAC.
Technique: T1548: Abuse Elevation Control Mechanism
Sowbug has used keylogging tools.
Technique: T1056: Input Capture
Ixeshe collects the username from the victim’s machine.
Technique: T1033: System Owner/User Discovery
Cobalt Strike can explore files on a compromised system.
Technique: T1083: File and Directory Discovery
QakBot can use VBS to download and execute malicious files.
Technique: T1059: Command and Scripting Interpreter
HAWKBALL has encrypted data with XOR before sending it over the C2 channel.
Technique: T1560: Archive Collected Data
Smoke Loader spawns a new copy of c:\windows\syswow64\explorer.exe and then replaces the executable code in memory with malware.
Technique: T1055: Process Injection
After running within the %TEMP% path, Comnie will delete the original file
Technique: T1070: Indicator Removal on Host
Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection.
Technique: T1564: Hide Artifacts
Some 3rd party utilities may be preinstalled, such as `tar` on Linux and macOS or `zip` on Windows systems.
Technique: T1560: Archive Collected Data
Displayed below are these new, xml formatted plugin names “weap_hwi”, “ps”, and “vsnet” in a BlackEnergy configuration file download from a c2 server
Technique: T1105: Ingress Tool Transfer
Dtrack can add a service called WBService to establish persistence.
Technique: T1543: Create or Modify System Process
APIs in these environments, such as the Docker API and Kubernetes APIs, allow a user to remotely manage their container resources and cluster components.
Technique: T1552: Unsecured Credentials
CHOPSTICK has the capability to capture screenshots.
Technique: T1113: Screen Capture
Lokibot has obfuscated strings with base64 encoding.
Technique: T1027: Obfuscated Files or Information
Dragonfly 2.0 copied and installed tools for operations once in the victim environment.
Technique: T1105: Ingress Tool Transfer
Kimsuky has created new services for persistence.
Technique: T1543: Create or Modify System Process
For example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity.
Technique: T1562: Impair Defenses
Linfo creates a backdoor through which remote attackers can retrieve system information.
Technique: T1082: System Information Discovery
IcedCoffee is a fairly basic backdoor which uses WMI to collect a variety of system and user information from the system, which is then encoded with base64, encrypted with RC4 and submitted via HTTP POST to the C2 server
Technique: T1071: Application Layer Protocol
BitPaymer can use icacls /reset and takeown /F to reset a targeted executable's permissions and then take ownership.
Technique: T1222: File and Directory Permissions Modification
A very common usage involves tricking a user into opening what they think is a benign file type but is actually executable code.
Technique: T1036: Masquerading
Operating systems may contain commands to initiate a shutdown/reboot of a machine.
Technique: T1529: System Shutdown/Reboot
Adversaries may modify system firmware to persist on systems.The BIOS  and The Unified Extensible Firmware Interface  or Extensible Firmware Interface  are examples of system firmware that operate as the software interface between the operating system and hardware of a computer.
Technique: T1542: Pre-OS Boot
Bonadan can XOR-encrypt C2 communications.
Technique: T1573: Encrypted Channel
WindowsDefender.ini – The Base64 encoded and obfuscated PowerShell script
Technique: T1027: Obfuscated Files or Information
Seasalt uses cmd.exe to create a reverse shell on the infected endpoint.
Technique: T1059: Command and Scripting Interpreter
njRAT can create, delete, or modify a specified Registry key or value.
Technique: T1112: Modify Registry
Psylo has a command to conduct timestomping by setting a specified file’s timestamps to match those of a system file in the System32 directory.
Technique: T1070: Indicator Removal on Host
Adversaries may also be able to silently create subdomains pointed at malicious servers without tipping off the actual owner of the DNS server.
Technique: T1584: Compromise Infrastructure
Windows shared drive and SMB/Windows Admin Shares connections can be removed when no longer needed.
Technique: T1070: Indicator Removal on Host
To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disks may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.
Technique: T1561: Disk Wipe
WastedLocker's custom cryptor, CryptOne, used an XOR based algorithm to decrypt the payload.
Technique: T1140: Deobfuscate/Decode Files or Information
Aria-body has the ability to download additional payloads from C2.
Technique: T1105: Ingress Tool Transfer
Felismus uses HTTP for C2.
Technique: T1071: Application Layer Protocol
KONNI can download files and execute them on the victim’s machine.
Technique: T1105: Ingress Tool Transfer
Emotet is known to use RSA keys for encrypting C2 traffic.
Technique: T1573: Encrypted Channel
Malicious software can include payloads, droppers, post-compromise tools, backdoors, and a variety of other malicious content.
Technique: T1608: Stage Capabilities
down_new has the ability to use HTTP in C2 communications.
Technique: T1071: Application Layer Protocol
Domains  http://mdzz2019.noip[.]cn:19931 http://mdzz2019.noip[.]cn:3654/  From my analyses, I was able to identify http://mdzz2019.noip[.]cn:19931 as its main C2 url.  This is a dynamic DNS, meaning the actual IP changes quite frequently
Technique: T1071: Application Layer Protocol
Inception lured victims into clicking malicious files for machine reconnaissance and to execute malware.
Technique: T1204: User Execution
InvisiMole can collect data from the system, and can monitor changes in specified directories.
Technique: T1005: Data from Local System
This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.
Technique: T1070: Indicator Removal on Host
Bundlore has disguised a malicious .app file as a Flash Player update.
Technique: T1036: Masquerading
CMSTP.exe can also be abused to Bypass User Account Control and execute arbitrary commands from a malicious INF through an auto-elevated COM interface.
Technique: T1218: Signed Binary Proxy Execution
Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during Spearphishing Link.
Technique: T1608: Stage Capabilities
JSS Loader can download and execute VBScript files.
Technique: T1059: Command and Scripting Interpreter
Turla has used compromised servers as infrastructure.
Technique: T1584: Compromise Infrastructure
XAgentOSX contains the getInstalledAPP function to run ls -la /Applications to gather what applications are installed.
Technique: T1082: System Information Discovery
Cardinal RAT can collect the username from a victim machine.
Technique: T1033: System Owner/User Discovery
Xbash can obtain a webpage hosted on Pastebin to update its C2 domain list.
Technique: T1102: Web Service
Astaroth uses certutil and BITSAdmin to download additional malware.
Technique: T1105: Ingress Tool Transfer
Operation Wocao has gathered a recursive directory listing to find files and directories of interest.
Technique: T1083: File and Directory Discovery
Bisonal can check the system time set on the infected host.
Technique: T1124: System Time Discovery
RogueRobin decodes an embedded executable using base64 and decompresses it.
Technique: T1140: Deobfuscate/Decode Files or Information
Ebury has implemented a fallback mechanism to begin using a DGA when the attacker hasn't connected to the infected system for three days.
Technique: T1008: Fallback Channels
APT29 used account credentials they obtained to attempt access to Group Managed Service Account  passwords.
Technique: T1555: Credentials from Password Stores
Adversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted .
Technique: T1048: Exfiltration Over Alternative Protocol
BoomBox has used HTTP POST requests for C2.
Technique: T1071: Application Layer Protocol
QakBot can make small changes to itself in order to change its checksum and hash value.
Technique: T1027: Obfuscated Files or Information
Leviathan has used stolen code signing certificates to sign malware.
Technique: T1553: Subvert Trust Controls
APT33 has used AES for encryption of command and control traffic.
Technique: T1573: Encrypted Channel
ShadowPad has injected an install module into a newly created process.
Technique: T1055: Process Injection
It is responsible for executing commands in cmd.exe (later down in the functions, not seen in the screenshot, it looks for cmd.exe and executes it using CreateProcessA)
Technique: T1059: Command and Scripting Interpreter
Avenger has the ability to decrypt files downloaded from C2.
Technique: T1140: Deobfuscate/Decode Files or Information
Plist files are formatted in XML and based on Apple's Core Foundation DTD and can be saved in text or binary format.
Technique: T1547: Boot or Logon Autostart Execution
Once malicious home pages have been added to the user’s mailbox, they will be loaded when Outlook is started.
Technique: T1137: Office Application Startup
Seasalt uses HTTP for C2 communications.
Technique: T1071: Application Layer Protocol
An adversary may Create Cloud Instance and stage data in that instance.
Technique: T1074: Data Staged
APT41 deployed a Monero cryptocurrency mining tool in a victim’s environment.
Technique: T1496: Resource Hijacking
Domain fronting involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header.
Technique: T1090: Proxy
Alternatively, a print processor can be registered to the print spooler service by adding the HKLM\SYSTEM\\CurrentControlSet or ControlSet001\Control\Print\Environments\\Windows architecture: e.g., Windows x64\Print Processors\\user defined\Driver Registry key that points to the DLL.
Technique: T1547: Boot or Logon Autostart Execution
MarkiRAT can exfiltrate locally stored data via its C2.
Technique: T1041: Exfiltration Over C2 Channel
Indrik Spider has used batch scripts on victim's machines.
Technique: T1059: Command and Scripting Interpreter
These rules may be created through a local email application, a web interface, or by command-line interface.
Technique: T1114: Email Collection
TA505 has leveraged malicious Word documents that abused DDE.
Technique: T1559: Inter-Process Communication
Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP.
Technique: T1105: Ingress Tool Transfer
Frankenstein has enumerated hosts, looking to obtain a list of all currently running processes.
Technique: T1057: Process Discovery
CopyKittens uses ZPP, a .NET console program, to compress files with ZIP.
Technique: T1560: Archive Collected Data
UPPERCUT has the capability to obtain the time zone information and current timestamp of the victim’s machine.
Technique: T1124: System Time Discovery
Adversaries can avoid the need to upload a tool by having compromised victim machines download the tool directly from a third-party hosting location , including the original hosting site of the tool.
Technique: T1608: Stage Capabilities
Doki has communicated with C2 over HTTPS.
Technique: T1071: Application Layer Protocol
Epic uses the net time command  to get the system time from the machine and collect the current date and time zone information.
Technique: T1124: System Time Discovery
Proton uses an encrypted file to store commands and configuration values.
Technique: T1140: Deobfuscate/Decode Files or Information
APT3 has been known to create or enable accounts, such as support_388945a0.
Technique: T1136: Create Account
SDBbot has the ability to communicate with C2 with TCP over port 443. gh0st RAT has used an encrypted protocol within TCP segments to communicate with the C2.
Technique: T1095: Non-Application Layer Protocol
QUADAGENT uses HTTPS and HTTP for C2 communications.
Technique: T1071: Application Layer Protocol
SombRAT can execute loadfromfile, loadfromstorage, and loadfrommem to inject a DLL  from disk, storage, or memory respectively.
Technique: T1055: Process Injection
NETWIRE can perform keylogging.
Technique: T1056: Input Capture
The screenshot in Figure 8 of the inf method within a Cannon sample (SHA256: 4405cfbf28…) shows the information gathered that is exfiltrated to the C2 via email, specifically with RunningPlace and LogicalDrives header strings:  Figure 8 inf method used by Cannon When comparing the two Cannon variants, we found a method within a Delphi Cannon sample (SHA256: 5a02d4e5f6…) showing the use of Running place and Logical_Drivers as header strings to the system information it is collecting and sending to the C2 via email
Technique: T1071: Application Layer Protocol
The following are the three files:   Defender.sct – The malicious JavaScript based scriptlet file
Technique: T1059: Command and Scripting Interpreter
Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.
Technique: T1059: Command and Scripting Interpreter
The malicious DLL is not a service DLL because it lacks ServiceMain()
Technique: T1543: Create or Modify System Process
Turian can search for specific files and list directories.
Technique: T1083: File and Directory Discovery
This could also enable an adversary to move from a virtualized environment, such as within a virtual machine or container, onto the underlying host.
Technique: T1068: Exploitation for Privilege Escalation
Dark Caracal leveraged a watering hole to serve up malicious code.
Technique: T1189: Drive-by Compromise
Operation Wocao has executed commands through the installed web shell via Tor exit nodes.
Technique: T1090: Proxy
Once a removable media device is inserted back into the first victim, USBStealer collects data from it that was exfiltrated from a second victim.
Technique: T1025: Data from Removable Media
NanoCore can perform keylogging on the victim’s machine.
Technique: T1056: Input Capture
Cuba has a packed payload when delivered.
Technique: T1027: Obfuscated Files or Information
Several types exist:
### Browser-based Exploitation
Web browsers are a common target through Drive-by Compromise and Spearphishing Link.
Technique: T1203: Exploitation for Client Execution
Avenger has the ability to XOR encrypt files to be sent to C2.
Technique: T1027: Obfuscated Files or Information
TrickBot has also used Nt* API functions to perform Process Injection.
Technique: T1106: Native API
EvilGrab has the capability to capture audio from a victim machine.
Technique: T1123: Audio Capture
Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems.
Technique: T1547: Boot or Logon Autostart Execution
BITS enabled execution may also enable persistence by creating long-standing jobs  or invoking an arbitrary program when a job completes or errors .
Technique: T1197: BITS Jobs
SslMM identifies and kills anti-malware processes.
Technique: T1562: Impair Defenses
Babuk can stop specific services related to backups.
Technique: T1489: Service Stop
Adversaries may employ various forms of Masquerading on the file to increase the likelihood that a user will open it.
Technique: T1204: User Execution
Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management .
Technique: T1021: Remote Services
Information about physical locations of a target organization may include a variety of details, including where key resources and infrastructure are housed.
Technique: T1591: Gather Victim Org Information
FIN7 has developed malware for use in operations, including the creation of infected removable media.
Technique: T1587: Develop Capabilities
JHUHUGIT performs code injection injecting its own functions to browser processes.
Technique: T1055: Process Injection
QakBot can use process hollowing to execute its main payload.
Technique: T1055: Process Injection
File starts as mico-audio.exe and installs to C:\Users\%USERNAME%\AppData\Roaming\google-chrome\crome.exe
Technique: T1033: System Owner/User Discovery
Adversaries may use Patch System Image to change the operating system of a network device, implementing their own custom NAT mechanisms to further obscure their activities
Technique: T1599: Network Boundary Bridging
TLS callbacks are normally used by the OS to setup and/or cleanup data used by threads.
Technique: T1055: Process Injection
Mustang Panda has used a customized PlugX variant which could exfiltrate documents from air-gapped networks.
Technique: T1052: Exfiltration Over Physical Medium
Linfo creates a backdoor through which remote attackers can list contents of drives and search for files.
Technique: T1083: File and Directory Discovery
Hildegard was executed through an unsecure kubelet that allowed anonymous access to the victim environment.
Technique: T1133: External Remote Services
RemoteCMD: This tool executes commands on remote computers, similar to the PsExec tool
Technique: T1059: Command and Scripting Interpreter
The MIB is a configuration repository that stores variable information accessible via SNMP in the form of object identifiers .
Technique: T1602: Data from Configuration Repository
Rocke has cleared log files within the /var/log/ folder.
Technique: T1070: Indicator Removal on Host
Sakula calls cmd.exe to run various DLL files via rundll32 and also to perform file cleanup.
Technique: T1059: Command and Scripting Interpreter
Metamorfo can collect screenshots of the victim’s machine.
Technique: T1113: Screen Capture
UPPERCUT can capture desktop screenshots in the PNG format and send them to the C2 server.
Technique: T1113: Screen Capture
PipeMon has used call to LoadLibrary to load its installer.
Technique: T1129: Shared Modules
Servers are likely a high value target for lateral movement exploitation, but endpoint systems may also be at risk if they provide an advantage or access to additional resources.
Technique: T1210: Exploitation of Remote Services
GeminiDuke collects information on network settings and Internet proxy settings from the victim.
Technique: T1016: System Network Configuration Discovery
The KDC is responsible for both authentication and ticket granting.
Technique: T1558: Steal or Forge Kerberos Tickets
OSInfo enumerates the current network connections similar to  net use .
Technique: T1049: System Network Connections Discovery
Carbon encrypts configuration files and tasks for the malware to complete using CAST-128 algorithm.
Technique: T1027: Obfuscated Files or Information
Kwampirs collects network adapter and interface information by using the commands ipconfig /all, arp -a and route print.
Technique: T1016: System Network Configuration Discovery
QakBot has collected usernames and passwords from Firefox and Chrome.
Technique: T1555: Credentials from Password Stores
Dragonfly 2.0 created a directory named "out" in the user's %AppData% folder and copied files to it.
Technique: T1074: Data Staged
GrimAgent can identify the user id on a target machine.
Technique: T1033: System Owner/User Discovery
Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls.
Technique: T1550: Use Alternate Authentication Material
Several Lazarus Group malware families are capable of downloading and executing binaries from its C2 server.
Technique: T1105: Ingress Tool Transfer
ZLib has the ability to enumerate system information.
Technique: T1082: System Information Discovery
ADVSTORESHELL is capable of setting and deleting Registry values.
Technique: T1112: Modify Registry
Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.
Technique: T1574: Hijack Execution Flow