HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
Siloscape searches for the kubectl binary.
Technique: T1518: Software Discovery
POORAIM can conduct file browsing.
Technique: T1083: File and Directory Discovery
WannaCry uses attrib +h to make some of its files hidden.
Technique: T1564: Hide Artifacts
Windshift has used malware to identify installed software.
Technique: T1518: Software Discovery
Adversaries may collect data related to managed devices from configuration repositories.
Technique: T1602: Data from Configuration Repository
BootComplete starts the AutoStartup service and the AutoStartup service makes sure that MainActivity is always running
Technique: T1543: Create or Modify System Process
Operation Wocao has executed PowerShell commands which were encoded or compressed using Base64, zlib, and XOR.
Technique: T1027: Obfuscated Files or Information
CallMe has the capability to create a reverse shell on victims.
Technique: T1059: Command and Scripting Interpreter
BLINDINGCAN has been signed with code-signing certificates such as CodeRipper.
Technique: T1553: Subvert Trust Controls
HAFNIUM has used the NT AUTHORITY\SYSTEM account to create files on Exchange servers.
Technique: T1078: Valid Accounts
GreyEnergy chooses a service, drops a DLL file, and writes it to that serviceDLL Registry key.
Technique: T1543: Create or Modify System Process
JHUHUGIT is executed using rundll32.exe.
Technique: T1218: Signed Binary Proxy Execution
FeedBack.php validates the sender by User-Agent, saves the data in the “RAR” server directory and stores the metadata in the mssql database for later reference
Technique: T1074: Data Staged
Adversaries may register a malicious transport agent to provide a persistence mechanism in Exchange Server that can be triggered by adversary-specified email events.
Technique: T1505: Server Software Component
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
Technique: T1078: Valid Accounts
Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system.
Technique: T1137: Office Application Startup
Password guessing may or may not take into account the target's policies on password complexity or use policies that may lock accounts out after a number of failed attempts.
Technique: T1110: Brute Force
regsvcs.exe
Technique: T1218: Signed Binary Proxy Execution
Cardinal RAT contains watchdog functionality that ensures its process is always running, else spawns a new instance.
Technique: T1057: Process Discovery
Adversaries may stage collected data in a central location or directory prior to Exfiltration.
Technique: T1074: Data Staged
Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Technique: T1082: System Information Discovery
down_new has the ability to identify the system volume information of a compromised host.
Technique: T1082: System Information Discovery
MuddyWater has used malware that leveraged rundll32.exe in a Registry Run key to execute a .dll.
Technique: T1218: Signed Binary Proxy Execution
Information from these scans may reveal opportunities for other forms of reconnaissance  or Search Open Technical Databases, establishing operational resources  or Obtain Capabilities, and/or initial access .
Technique: T1595: Active Scanning
Kwampirs establishes persistence by adding a new service with the display name "WMI Performance Adapter Extension" in an attempt to masquerade as a legitimate WMI service.
Technique: T1036: Masquerading
Sandworm Team has used PowerShell scripts to run a credential harvesting tool in memory to evade defenses.
Technique: T1059: Command and Scripting Interpreter
Adversaries may abuse inter-process communication  mechanisms for local code or command execution.
Technique: T1559: Inter-Process Communication
POWERSTATS can use VBScript  code for execution.
Technique: T1059: Command and Scripting Interpreter
This is done via adding a path to a script to the HKCU\Environment\UserInitMprLogonScript Registry key.
Technique: T1037: Boot or Logon Initialization Scripts
Machete collects stored credentials from several web browsers.
Technique: T1555: Credentials from Password Stores
Caterpillar WebShell has a command to modify a Registry key.
Technique: T1112: Modify Registry
Some data is also base64-encoded.
Technique: T1027: Obfuscated Files or Information
xCaon has a command to download files to the victim's machine.
Technique: T1105: Ingress Tool Transfer
Hancitor has the ability to download additional files from C2.
Technique: T1105: Ingress Tool Transfer
APT18 actors used the native at Windows task scheduler tool to use scheduled tasks for execution on a victim network.
Technique: T1053: Scheduled Task/Job
Wizard Spider used Base64 encoding to obfuscate an Empire service and PowerShell commands.
Technique: T1027: Obfuscated Files or Information
GreyEnergy has a module to harvest pressed keystrokes.
Technique: T1056: Input Capture
Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS and the default service account in Kubernetes.
Technique: T1078: Valid Accounts
Example resources include specific websites, email services, DNS, and web-based applications.
Technique: T1498: Network Denial of Service
Solutions may help adversary operations blend in with traffic that is seen as normal, such as contact to third-party web services.
Technique: T1583: Acquire Infrastructure
Once logged into the site, an adversary can access sensitive information, read email, or perform actions that the victim account has permissions to perform.
Technique: T1550: Use Alternate Authentication Material
Gamaredon Group has delivered spearphishing emails with malicious attachments to targets.
Technique: T1566: Phishing
Stuxnet attempts to impersonate an anonymous token to enumerate bindings in the service control manager.
Technique: T1134: Access Token Manipulation
Kimsuky has used emails containing Word, Excel and/or HWP  documents in their spearphishing campaigns.
Technique: T1566: Phishing
Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.
Technique: T1574: Hijack Execution Flow
Prikormka creates a directory, %USERPROFILE%\AppData\Local\SKC\, which is used to store collected log files.
Technique: T1074: Data Staged
We suspect the attacker was trying to generate sympathy by reminding the reader that Munchon and the province it is in, Kangwon, were part of a unified province that included South Korea's Gangwon-do prior to the division of Korea in 1945.A second email contained a story about a person called 'Ewing Kim' who was looking for help:The email's attachments are two different HWP documents, both leveraging same vulnerability (CVE-2013-0808)
Technique: T1566: Phishing
This technique may incorporate use of other techniques such as File and Directory Discovery and Lateral Tool Transfer to identify and move files.
Technique: T1119: Automated Collection
Adversaries may abuse Active Setup by creating a key under  HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\ and setting a malicious value for StubPath.
Technique: T1547: Boot or Logon Autostart Execution
Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server.
Technique: T1037: Boot or Logon Initialization Scripts
Rover persists by creating a Registry entry in HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.
Technique: T1547: Boot or Logon Autostart Execution
APT29 has added credentials to OAuth Applications and Service Principals.
Technique: T1098: Account Manipulation
Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.
Technique: T1218: Signed Binary Proxy Execution
TeamTNT has also targeted exposed kubelets for Kubernetes environments.
Technique: T1133: External Remote Services
IndigoZebra sent spearphishing emails containing malicious password-protected RAR attachments.
Technique: T1566: Phishing
Sandworm Team has used backdoors that can delete files used in an attack from an infected system.
Technique: T1070: Indicator Removal on Host
The White Company has the ability to delete its malware entirely from the target system.
Technique: T1070: Indicator Removal on Host
APT19 performed a watering hole attack on forbes.com in 2014 to compromise targets.
Technique: T1189: Drive-by Compromise
This method makes no changes to the Registry as the COM object is not actually registered, only executed.
Technique: T1218: Signed Binary Proxy Execution
A version of KONNI searches for filenames created with a previous version of the malware, suggesting different versions targeted the same victims and the versions may work together.
Technique: T1083: File and Directory Discovery
SMOKEDHAM has created user accounts and added them to local Admin groups.
Technique: T1136: Create Account
This kind of targeted attack is referred to a strategic web compromise or watering hole attack.
Technique: T1189: Drive-by Compromise
Tonto Team has exploited CVE-2019-0803 and MS16-032 to escalate privileges.
Technique: T1068: Exploitation for Privilege Escalation
NanHaiShu executes additional Jscript code on the victim's machine.
Technique: T1059: Command and Scripting Interpreter
Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology.
Technique: T1485: Data Destruction
GravityRAT lists the running processes on the system.
Technique: T1057: Process Discovery
CosmicDuke can use HTTP or HTTPS for command and control to hard-coded C2 servers.
Technique: T1071: Application Layer Protocol
Additionally malware reports itself to its hardcoded command and control servers and established a backdoor connection, so the attacker may have a permanent remote connection
Technique: T1008: Fallback Channels
POWERSTATS can retrieve and execute additional PowerShell payloads from the C2 server.
Technique: T1105: Ingress Tool Transfer
Cannon can obtain a list of processes running on the system.
Technique: T1057: Process Discovery
Although primarily focused on by cyber criminals, these authentication mechanisms have been targeted by advanced actors.
Technique: T1111: Two-Factor Authentication Interception
In spearphishing, a specific individual, company, or industry will be targeted by the adversary.
Technique: T1566: Phishing
WebDAV is an extension of HTTP and will typically operate over TCP ports 80 and 443.
Technique: T1187: Forced Authentication
Revenge RAT collects the CPU information, OS information, and system language.
Technique: T1082: System Information Discovery
Magic Hound has acquired the personal email addresses of some individuals they intend to target.
Technique: T1589: Gather Victim Identity Information
CVE-2017-11882: Microsoft Office Stack Memory Corruption Vulnerability CVE-2017-11882 affects several versions of Microsoft Office and, when exploited, allows a remote user to run arbitrary code in the context of the current user as a result of improperly handling objects in memory
Technique: T1203: Exploitation for Client Execution
Ryuk is a ransomware that uses a combination of public and symmetric-key cryptography to encrypt files on the host computer.
Technique: T1486: Data Encrypted for Impact
Mis-Type uses Base64 encoding for C2 traffic.
Technique: T1132: Data Encoding
PHOREAL communicates via ICMP for C2.
Technique: T1095: Non-Application Layer Protocol
Adversaries may use these scripts to maintain persistence on a single system.
Technique: T1037: Boot or Logon Initialization Scripts
FatDuke can list running processes on the localhost.
Technique: T1057: Process Discovery
Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts.
Technique: T1556: Modify Authentication Process
APT39 has downloaded tools to compromised hosts.
Technique: T1105: Ingress Tool Transfer
PUNCHBUGGY has been observed using a Registry Run key.
Technique: T1547: Boot or Logon Autostart Execution
For simple binary replacement on Windows XP and later as well as and Windows Server 2003/R2 and later, for example, the program  may be replaced with "cmd.exe" .
Technique: T1546: Event Triggered Execution
WellMail can decompress scripts received from C2.
Technique: T1140: Deobfuscate/Decode Files or Information
The datasets included:  Stolen credentials Potential systems to login to using stolen credentials Deployed webshell URLs Backdoor tools Command and control server component of backdoor tools Script to perform DNS hijacking Documents identifying specific individual operators Screenshots of OilRig operational systems  We analyzed each type of dataset other than the documents containing detailed information on alleged OilRig operators and they remain consistent with previously observed OilRig tactics, techniques, and procedures (TTPs)
Technique: T1003: OS Credential Dumping
APT12 has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities  and vulnerabilities in Adobe Reader and Flash .
Technique: T1203: Exploitation for Client Execution
Remsec can add or remove applications or ports on the Windows firewall or disable it entirely.
Technique: T1562: Impair Defenses
Some lure documents used in these attacks are shown below: Decoy documents used in BlackOasis attacks To summarize, we have seen BlackOasis utilizing at least five zero days since June 2015:  CVE-2015-5119 – June 2015 CVE-2016-0984 – June 2015 CVE-2016-4117 – May 2016 CVE-2017-8759 – Sept 2017 CVE-2017-11292 – Oct 2017  Attacks Leveraging CVE-2017-11292 The attack begins with the delivery of an Office document, presumably in this instance via e-mail.  Embedded within the document is an ActiveX object which contains the Flash exploit
Technique: T1203: Exploitation for Client Execution
DropBook is a Python-based backdoor compiled with PyInstaller.
Technique: T1059: Command and Scripting Interpreter
Adversaries may attempt to extract credential material from the Security Account Manager  database either through in-memory techniques or through the Windows Registry where the SAM database is stored.
Technique: T1003: OS Credential Dumping
POWRUNER can use base64 encoded C2 communications.
Technique: T1001: Data Obfuscation
Pysa can stop services and processes.
Technique: T1489: Service Stop
An adversary who has raw access to the boot drive may overwrite this area, diverting execution during startup from the normal boot loader to adversary code.
Technique: T1542: Pre-OS Boot
Andariel has used the netstat -naop tcp command to display TCP connections on a victim's machine.
Technique: T1049: System Network Connections Discovery
Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution.
Technique: T1059: Command and Scripting Interpreter
httpclient opens cmd.exe on the victim.
Technique: T1059: Command and Scripting Interpreter
UNC2452 used a forged duo-sid cookie to bypass MFA set on an email account.
Technique: T1550: Use Alternate Authentication Material
Nidiran can create a new service named msamger , which mimics the legitimate Microsoft database by the same name.
Technique: T1036: Masquerading
Crutch has established persistence with a scheduled task impersonating the Outlook item finder.
Technique: T1036: Masquerading
Derusbi binds to a raw socket on a random source port between 31800 and 31900 for C2.
Technique: T1095: Non-Application Layer Protocol
Dragonfly has placed trojanized installers on legitimate vendor app stores.
Technique: T1195: Supply Chain Compromise
Sys10 collects the local IP address of the victim and sends it to the C2.
Technique: T1016: System Network Configuration Discovery
Bundlore can use AppleScript to inject malicious JavaScript into a browser.
Technique: T1059: Command and Scripting Interpreter
There are two versions of safe mode: Safe Mode and Safe Mode with Networking.
Technique: T1562: Impair Defenses
Traps blocks all of the files currently associated with Gorgon Group    Appendix   Analysis of a targeted attack “1971 Liberation War Freedom Fighters in Pakistan ArmyCustody Database98” The delivery documents used in the targeted attacks are Microsoft Office documents that contain a macro that attempts to compromise the system
Technique: T1566: Phishing
These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms.
Technique: T1059: Command and Scripting Interpreter
Ebury can exfiltrate SSH credentials through custom DNS queries.
Technique: T1041: Exfiltration Over C2 Channel
Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network
Technique: T1087: Account Discovery
Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code.
Technique: T1053: Scheduled Task/Job
The actors have also disabled proxy settings to allow direct communication from victims to the Internet.
Technique: T1562: Impair Defenses
The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and Net.
Technique: T1569: System Services
Brave Prince terminates antimalware processes.
Technique: T1562: Impair Defenses
Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control  or Exfiltration Over Web Service.
Technique: T1584: Compromise Infrastructure
FrameworkPOS can enumerate and exclude selected processes on a compromised host to speed execution of memory scraping.
Technique: T1057: Process Discovery
ZxShell has used rundll32.exe to execute other DLLs and named pipes.
Technique: T1218: Signed Binary Proxy Execution
Repeated requests to those features may be able to exhaust system resources and deny access to the application or the server itself.
Technique: T1499: Endpoint Denial of Service
The White Company has obfuscated their payloads through packing.
Technique: T1027: Obfuscated Files or Information
Tools can be open or closed source, free or commercial.
Technique: T1588: Obtain Capabilities
WEBC2 can open an interactive command shell.
Technique: T1059: Command and Scripting Interpreter
C2 communication is also updated from prior versions, with the following commands now supported by BADNEWS:    Command Description   0 Kill BADNEWS
Technique: T1059: Command and Scripting Interpreter
Leviathan has used VBScript.
Technique: T1059: Command and Scripting Interpreter
One of its file stealers has also persisted by adding a Registry Run key.
Technique: T1547: Boot or Logon Autostart Execution
Micropsia can perform microphone recording.
Technique: T1123: Audio Capture
Lokibot has used process hollowing to inject itself into legitimate Windows process.
Technique: T1055: Process Injection
UNC2452 created tokens using compromised SAML signing certificates.
Technique: T1606: Forge Web Credentials
APT38 leveraged Sysmon to understand the processes, services in the organization.
Technique: T1057: Process Discovery
BBK can extract a malicious Portable Executable  from a photo.
Technique: T1027: Obfuscated Files or Information
It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments.
Technique: T1566: Phishing
Matryoshka is capable of keylogging.
Technique: T1056: Input Capture
FIN5 maintains access to victim environments by using FLIPSIDE to create a proxy for a backup RDP tunnel.
Technique: T1090: Proxy
HAMMERTOSS is known to use PowerShell.
Technique: T1059: Command and Scripting Interpreter
Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.
Technique: T1057: Process Discovery
When the user's system accesses the untrusted resource it will attempt authentication and send information, including the user's hashed credentials, over SMB to the adversary controlled server.
Technique: T1187: Forced Authentication
Octopus encodes C2 communications in Base64.
Technique: T1132: Data Encoding
TeamViewer 
Technique: T1219: Remote Access Software
RATANKBA lists the system’s processes.
Technique: T1057: Process Discovery
CPL files
Technique: T1218: Signed Binary Proxy Execution
Agent Tesla has created hidden folders.
Technique: T1564: Hide Artifacts
Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.
Technique: T1113: Screen Capture
SSL/TLS certificates are designed to instill trust.
Technique: T1587: Develop Capabilities
WindTail can instruct the OS to execute an application without a dock icon or menu.
Technique: T1564: Hide Artifacts
H1N1 contains a command to download and execute a file from a remotely hosted URL using WinINet HTTP requests.
Technique: T1105: Ingress Tool Transfer
ShadowPad has decrypted a binary blob to start execution.
Technique: T1140: Deobfuscate/Decode Files or Information
TeamTNT has searched for security products on infected machines.
Technique: T1518: Software Discovery
Cobalt Strike can identify targets by querying account groups on a domain contoller.
Technique: T1069: Permission Groups Discovery
SDBbot has the ability to use image file execution options for persistence if it detects it is running with admin privileges on a Windows version newer than Windows 7.
Technique: T1546: Event Triggered Execution
Taidoor can use encrypted string blocks for obfuscation.
Technique: T1027: Obfuscated Files or Information
They have also removed malware, tools, or other non-native files used during the intrusion to reduce their footprint or as part of the post-intrusion cleanup process.
Technique: T1070: Indicator Removal on Host
APT29 used dynamic DNS resolution to construct and resolve to randomly-generated subdomains for C2.
Technique: T1568: Dynamic Resolution
Another example is using the Windows copy /b command to reassemble binary fragments into a malicious payload.
Technique: T1140: Deobfuscate/Decode Files or Information
Default accounts are not limited to client machines, rather also include accounts that are preset for equipment such as network devices and computer applications whether they are internal, open source, or commercial.
Technique: T1078: Valid Accounts
BRONZE BUTLER has used net time to check the local time on a target system.
Technique: T1124: System Time Discovery
Kimsuky has a HWP document stealer module which changes the default program association in the registry to open HWP documents.
Technique: T1546: Event Triggered Execution
Adversaries may purchase a subscription to use an existing botnet from a booter/stresser service.
Technique: T1583: Acquire Infrastructure
Botnets have been used in some of the most high-profile DDoS flooding attacks, such as the 2012 series of incidents that targeted major US banks.
Technique: T1498: Network Denial of Service
Others incorporate a seed value as well to make predicting future domains more difficult for defenders.
Technique: T1568: Dynamic Resolution
Bisonal can launch cmd.exe to execute commands on the system.
Technique: T1059: Command and Scripting Interpreter
ObliqueRAT can break large files of interest into smaller chunks to prepare them for exfiltration.
Technique: T1030: Data Transfer Size Limits
APT41 created and modified startup files for persistence.
Technique: T1547: Boot or Logon Autostart Execution
The contents within the releasenotes.txt file (SHA256: bf925f340920111b385078f3785f486fff1096fd0847b993892ff1ee3580fa9d)  contains the following formula that Excel will save to the “A0” cell in the worksheet:  The formula uses a command prompt to run a PowerShell script that attempts to download and execute a second PowerShell script hosted at the URL hxxp://micrrosoft[.]net/winupdate.ps1
Technique: T1546: Event Triggered Execution
HAFNIUM has operated from leased virtual private servers  in the United States.
Technique: T1583: Acquire Infrastructure
P2P ZeuS added junk data to outgoing UDP packets to peer implants.
Technique: T1001: Data Obfuscation
Avenger has the ability to use HTTP in communication with C2.
Technique: T1071: Application Layer Protocol
HALFBAKED can obtain information about the OS, processor, and BIOS.
Technique: T1082: System Information Discovery
Linfo creates a backdoor through which remote attackers can start a remote shell.
Technique: T1059: Command and Scripting Interpreter
S-Type uses Base64 encoding for C2 traffic.
Technique: T1132: Data Encoding
APT32 has used mshta.exe for code execution.
Technique: T1218: Signed Binary Proxy Execution
Stuxnet reduces the integrity level of objects to allow write actions.
Technique: T1562: Impair Defenses
For DoS attacks targeting the hosting system directly, see Endpoint Denial of Service.
Technique: T1498: Network Denial of Service
Molerats used PowerShell implants on target machines.
Technique: T1059: Command and Scripting Interpreter
Threat Group-3390 has used command-line interfaces for execution.
Technique: T1059: Command and Scripting Interpreter
An adversary may take advantage of that build API to build a custom image on the host that includes malware downloaded from their C2 server, and then they then may utilize Deploy Container using that custom image.
Technique: T1612: Build Image on Host
BLUELIGHT can collect IP information from the victim’s machine.
Technique: T1016: System Network Configuration Discovery
Volgmer stores the encoded configuration file in the Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security.
Technique: T1112: Modify Registry
Password policies can be discovered in cloud environments using available APIs such as GetAccountPasswordPolicy in AWS .
Technique: T1201: Password Policy Discovery
ShimRat has used a secondary C2 location if the first was unavailable.
Technique: T1008: Fallback Channels
SUNBURST C2 data attempted to appear as benign XML related to .NET assemblies or as a faux JSON blob.
Technique: T1001: Data Obfuscation
Cobalt Strike can enumerate services on compromised hosts.
Technique: T1007: System Service Discovery
This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior.
Technique: T1562: Impair Defenses
CHOPSTICK can switch to a new C2 channel if the current one is broken.
Technique: T1008: Fallback Channels
More_eggs has used cmd.exe for execution.
Technique: T1059: Command and Scripting Interpreter
Attor has opened the registry and performed query searches.
Technique: T1012: Query Registry
Inception has incorporated at least five different cloud service providers into their C2 infrastructure including CloudMe.
Technique: T1102: Web Service
The times of day that APT33 threat actors were active suggests that they were operating in a time zone close to 04:30 hours ahead of Coordinated Universal Time (UTC)
Technique: T1124: System Time Discovery
In some cases an adversary might modify specific user rights like SeEnableDelegationPrivilege, set in &lt;GPO_PATH&gt;\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf, to achieve a subtle AD backdoor with complete control of the domain because the user account under the adversary's control would then be able to modify GPOs.
Technique: T1484: Domain Policy Modification
Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2.
Technique: T1059: Command and Scripting Interpreter
An adversary may target the systems of those known to conduct vulnerability research .
Technique: T1588: Obtain Capabilities
OnionDuke has the capability to use a Denial of Service module.
Technique: T1499: Endpoint Denial of Service
Reaver continues to collect various information from the victim machine, including the following:  Computer name Volume serial number Microsoft Windows version CPU speed ANSI code page OEM code page identifier for the operating system Physical and virtual memory information  Reaver encrypts this data using an incremental XOR key and uploads it to the configured remote server on the port specified
Technique: T1082: System Information Discovery
POWRUNER may use WMI when collecting information about a victim.
Technique: T1047: Windows Management Instrumentation
Avaddon modifies several registry keys for persistence and UAC bypass.
Technique: T1112: Modify Registry
Adversaries may use the results and responses from these requests to determine if the system is capable of communicating with their C2 servers before attempting to connect to them.
Technique: T1016: System Network Configuration Discovery
Information about network security appliances may include a variety of details, such as the existence and specifics of deployed firewalls, content filters, and proxies/bastion hosts.
Technique: T1590: Gather Victim Network Information
One of Dtrack can hide in replicas of legitimate programs like OllyDbg, 7-Zip, and FileZilla.
Technique: T1036: Masquerading
The Derusbi malware supports timestomping.
Technique: T1070: Indicator Removal on Host
Kazuar gathers information on local groups and members on the victim’s machine.
Technique: T1087: Account Discovery
Honeybee adds collected files to a temp.zip file saved in the %temp% folder, then base64 encodes it and uploads it to control server.
Technique: T1560: Archive Collected Data
PUNCHBUGGY can gather system information such as computer names.
Technique: T1082: System Information Discovery
WastedLocker can delete shadow volumes.
Technique: T1490: Inhibit System Recovery
BACKSPACE is capable of deleting Registry keys, sub-keys, and values on a victim system.
Technique: T1112: Modify Registry
Waterbear can inject decrypted shellcode into the LanmanServer service.
Technique: T1055: Process Injection
NavRAT uses systeminfo on a victim’s machine.
Technique: T1082: System Information Discovery
FIN10 has deployed Meterpreter stagers and SplinterRAT instances in the victim network after moving laterally.
Technique: T1570: Lateral Tool Transfer
Silence attempts to get users to launch malicious attachments delivered via spearphishing emails.
Technique: T1204: User Execution
Pony has used batch scripts to delete itself after execution.
Technique: T1059: Command and Scripting Interpreter
Valak can use the Registry for code updates and to collect credentials.
Technique: T1012: Query Registry
Silent Librarian has searched victim's websites to identify the interests and academic areas of targeted individuals and to scrape source code, branding, and organizational contact information for phishing pages.
Technique: T1594: Search Victim-Owned Websites
Dyre has the ability to identify installed programs on a compromised host.
Technique: T1518: Software Discovery
Adversaries can interact with the DACLs using built-in Windows commands, such as `icacls`, `cacls`, `takeown`, and `attrib`, which can grant adversaries higher permissions on specific files and folders.
Technique: T1222: File and Directory Permissions Modification
An adversary may gain access to an email account for the person listed as the owner of the domain.
Technique: T1584: Compromise Infrastructure
Bazar can collect the time on the compromised host.
Technique: T1124: System Time Discovery
BRONZE BUTLER has placed malware on file shares and given it the same name as legitimate documents on the share.
Technique: T1080: Taint Shared Content
The signature validation process is handled via the WinVerifyTrust application programming interface  function,   which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature.
Technique: T1553: Subvert Trust Controls
Cobalt Strike uses the native Windows Network Enumeration APIs to interrogate and discover targets in a Windows Active Directory network.
Technique: T1018: Remote System Discovery
PROMETHIUM has created new services and modified existing services for persistence.
Technique: T1543: Create or Modify System Process
Indrik Spider has encrypted domain-controlled systems using BitPaymer.
Technique: T1486: Data Encrypted for Impact
*Command_Create&Inject:  This command creates a new process (using a supplied filename as the process name) and then injects malicious code into it
Technique: T1055: Process Injection
MobileOrder has a command to upload information about all running processes to its C2 server.
Technique: T1057: Process Discovery
Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.
Technique: T1573: Encrypted Channel
Misdat network traffic communicates over a raw socket.
Technique: T1095: Non-Application Layer Protocol
Kessel can exfiltrate credentials and other information via HTTP POST request, TCP, and DNS.
Technique: T1048: Exfiltration Over Alternative Protocol
IFEOs can also enable an arbitrary monitor program to be launched when a specified program silently exits  is prematurely terminated by itself or a second, non kernel-mode process.
Technique: T1546: Event Triggered Execution
DCOM can be used as a method of remotely interacting with Windows Management Instrumentation.
Technique: T1021: Remote Services
ComRAT samples have been seen which hijack COM objects for persistence by replacing the path to shell32.dll in registry location HKCU\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32.
Technique: T1546: Event Triggered Execution
For example, the GCP Command Center can be used to view all assets, findings of potential security risks, and to run additional queries, such as finding public IP addresses and open ports.
Technique: T1538: Cloud Service Dashboard
WindTail can invoke Apple APIs contentsOfDirectoryAtPath, pathExtension, and  compare.
Technique: T1106: Native API
This may also reduce the likelihood of being collected for analysis.
Technique: T1027: Obfuscated Files or Information
Sandworm Team has run net use to connect to network shares.
Technique: T1021: Remote Services
Adversaries may exploit software vulnerabilities in an attempt to collect credentials.
Technique: T1212: Exploitation for Credential Access
Dok installs two LaunchAgents to redirect all network traffic with a randomly generated name for each plist file maintaining the format com.random.name.plist.
Technique: T1543: Create or Modify System Process
Ryuk has used Wake-on-Lan to power on turned off systems for lateral movement.
Technique: T1205: Traffic Signaling
A code comparison of hash 12c786c490366727cf7279fc141921d8 with hash 6de6a0df263ecd2d71a92597b2362f2c (from November 28, 2017).  Conclusion We have found what may be an early data-gathering stage for future possible heists from financial organizations in Turkey (and possibly other countries)
Technique: T1550: Use Alternate Authentication Material
Egregor can modify the GPO to evade detection.
Technique: T1484: Domain Policy Modification
Kinsing has attempted to brute force hosts over SSH.
Technique: T1110: Brute Force
EKANS looks for processes from a hard-coded list.
Technique: T1057: Process Discovery
Once malicious forms have been added to the user’s mailbox, they will be loaded when Outlook is started.
Technique: T1137: Office Application Startup
KONNI had a feature to steal data from the clipboard.
Technique: T1115: Clipboard Data
Stolen Pencil victims are prompted to install malicious Google Chrome extensions which gave the threat actor the ability to read data from any website accessed.
Technique: T1176: Browser Extensions
menuPass has resized and added data to the certificate table to enable the signing of modified files with legitimate signatures.
Technique: T1553: Subvert Trust Controls
ZLib mimics the resource version information of legitimate Realtek Semiconductor, Nvidia, or Synaptics modules.
Technique: T1036: Masquerading
LookBack has used VBA macros in Microsoft Word attachments to drop additional files to the host.
Technique: T1059: Command and Scripting Interpreter
Using bash as an example, the default shell for most GNU/Linux systems, adversaries may add commands that launch malicious binaries into the /etc/profile and /etc/profile.d files.
Technique: T1546: Event Triggered Execution
Kimsuky has collected valid email addresses that were subsequently used in spearphishing campaigns.
Technique: T1589: Gather Victim Identity Information
The tool would connect to the SQL SharePoint database and issue a query to dump all data from the database to a temporary file affixed with 'spdata'
Technique: T1003: OS Credential Dumping
OLDBAIT installs itself in %ALLUSERPROFILE%\\Application Data\Microsoft\MediaPlayer\updatewindws.exe; the directory name is missing a space and the file name is missing the letter "o."
Technique: T1036: Masquerading
Sandworm Team has leased servers from resellers instead of leasing infrastructure directly from hosting companies to enable its operations.
Technique: T1583: Acquire Infrastructure
Backdoor.Pirpi also collects information about the target’s local network, including the domain controller and workstations
Technique: T1016: System Network Configuration Discovery
APT41 used legitimate websites for C2 through dead drop resolvers , including GitHub, Pastebin, and Microsoft TechNet.
Technique: T1102: Web Service
Ramsay can use ImprovedReflectiveDLLInjection to deploy components.
Technique: T1055: Process Injection
Adversaries may forge web cookies that can be used to gain access to web applications or Internet services.
Technique: T1606: Forge Web Credentials
These documents contained malicious OLE objects used to drop binaries.This time, however, they contained malicious OLE (Object Link Embedded) objects.Initial analysis confirmed two similarly sized OLE object files within this document which appeared to be the same from an execution point of view.The two dropped binaries were stored and executed in this location during our analysis:C:\Users\ADMINI~1\AppData\Local\Temp\Hwp (2).exeC:\Users\ADMINI~1\AppData\Local\Temp\Hwp (3).exeInitial analysis showed some sloppy cleaning up from Group123, which we used later to determine that separate campaigns were the work of this same actor, as compilation artifacts remained within the binaries:e:\Happy\Work\Source\version 12\T+M\Result\DocPrint.pdbThe second stage of the dropped binaries was used to execute wscript.exe while injecting shellcode into this process
Technique: T1204: User Execution
Ryuk has been observed to query the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language and the value InstallLanguage.
Technique: T1614: System Location Discovery
FinFisher creates a new Windows service with the malicious executable for persistence.
Technique: T1543: Create or Modify System Process
Information about processes can also be extracted from the output of Native API calls such as CreateToolhelp32Snapshot.
Technique: T1057: Process Discovery
When an attempt is made to access a securable object, the system checks the access control entries in the DACL in order.
Technique: T1222: File and Directory Permissions Modification
BBSRAT uses Expand to decompress a CAB file into executable content.
Technique: T1140: Deobfuscate/Decode Files or Information
admin@338 has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails.
Technique: T1204: User Execution
Chaes has used an unsigned, crafted DLL module named hha.dll that was designed to look like a legitimate 32-bit Windows DLL.
Technique: T1036: Masquerading
APT28 has used a UEFI  rootkit known as LoJax.
Technique: T1014: Rootkit
Exploited Vulnerabilities: Frequent exploitation of vulnerabilities in Hangul Word Processor (HWP), as well as Adobe Flash
Technique: T1068: Exploitation for Privilege Escalation
KeyBoy issues the command reg add “HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon” to achieve persistence.
Technique: T1547: Boot or Logon Autostart Execution
Some Bisonal samples encrypt C2 communications with RC4.
Technique: T1573: Encrypted Channel
The structure of each of these outbound DNS requests is as follows: <system ID>-<job ID>-<offset in data><more data flag>-<random length of base64 encoded data between 30 and 42 characters>.<c2 domain> The payload will look for different responses to these outbound queries depending on the type of DNS request that the payload uses to communicate with the C2
Technique: T1573: Encrypted Channel
A dropper used by Putter Panda installs itself into the ASEP Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run with a value named McUpdate.
Technique: T1547: Boot or Logon Autostart Execution
More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns.
Technique: T1598: Phishing for Information
XCSSET then downloads a script and Mach-O file into the Xcode project folder.
Technique: T1195: Supply Chain Compromise
In OS X prior to El Capitan, users with root access can read plaintext keychain passwords of logged-in users because Apple’s keychain implementation allows these credentials to be cached so that users are not repeatedly prompted for passwords.
Technique: T1555: Credentials from Password Stores
GALLIUM dropped additional tools to victims during their operation, including portqry.exe, a renamed cmd.exe file, winrar, and HTRAN.
Technique: T1105: Ingress Tool Transfer
Inception has used a reconnaissance module to identify active processes and other associated loaded modules.
Technique: T1057: Process Discovery
Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.
Technique: T1546: Event Triggered Execution
Then, adversaries may create custom consoles with the “Link to Web Address” snap-in that is linked to the malicious CLSID subkey.
Technique: T1218: Signed Binary Proxy Execution
APT29 obtained information about the configured Exchange virtual directory using Get-WebServicesVirtualDirectory.
Technique: T1083: File and Directory Discovery
Adversaries can modify property list files  to execute their code as part of establishing persistence.
Technique: T1547: Boot or Logon Autostart Execution
The following SSPs can be used to access credentials:
* Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package.
Technique: T1003: OS Credential Dumping
Unknown Logger is capable of recording keystrokes.
Technique: T1056: Input Capture
EvilBunny has exploited CVE-2011-4369, a vulnerability in the PRC component in Adobe Reader.
Technique: T1203: Exploitation for Client Execution
While we can only speculate on the specific reason, it is likely Sofacy packed only the Delphi variants in an attempt to increase evasion as the Delphi variant of Zebrocy is known and has been widely analyzed
Technique: T1027: Obfuscated Files or Information
Traps 4.0 can be configured to protect the processes that are cited as being abused in this blog from loading malicious code
Technique: T1055: Process Injection
Crutch has automatically exfiltrated stolen files to Dropbox.
Technique: T1020: Automated Exfiltration
Metamorfo includes payloads written in JavaScript.
Technique: T1059: Command and Scripting Interpreter
Once it is encrypted using the XOR algorithm, the buffer is encoded with BASE64
Technique: T1027: Obfuscated Files or Information
Chimera has used fsutil, fsinfo drives systeminfo, and vssadmin list shadows for sytesm information including shadow volumes and drive information.
Technique: T1082: System Information Discovery
For example, malware developed that will communicate with Twitter for C2, may require use of Web Services.
Technique: T1587: Develop Capabilities
Sidewinder has used the ActiveXObject utility to create OLE objects to obtain execution through Internet Explorer.
Technique: T1559: Inter-Process Communication
Kimsuky has gathered information about the infected computer.
Technique: T1082: System Information Discovery
APT32 has used Dropbox, Amazon S3, and Google Drive to host malicious downloads.
Technique: T1102: Web Service
Adversaries may search within public scan databases for information about victims that can be used during targeting.
Technique: T1596: Search Open Technical Databases
Adversaries may abuse safe mode to disable endpoint defenses that may not start with a limited boot.
Technique: T1562: Impair Defenses
LiteDuke has the ability to decrypt and decode multiple layers of obfuscation.
Technique: T1140: Deobfuscate/Decode Files or Information
Common subcommands include: launchctl load,launchctl unload, and launchctl start.
Technique: T1569: System Services
Dridex can perform browser attacks via web injects to steal information such as credentials, certificates, and cookies.
Technique: T1185: Browser Session Hijacking
BLACKCOFFEE has also obfuscated its C2 traffic as normal traffic to sites such as Github.
Technique: T1102: Web Service
This provides the principle of least privilege such that users are running in their lowest possible permissions for most of the time and only elevate to other users or permissions as needed, typically by prompting for a password.
Technique: T1548: Abuse Elevation Control Mechanism
Instead of using systeminfo and tasklist commands, the C# variant of Zebrocy uses WMI queries to gather this information
Technique: T1047: Windows Management Instrumentation
Evilnum has sent spearphishing emails containing a link to a zip file hosted on Google Drive.
Technique: T1566: Phishing
Specific examples include use of network layer protocols, such as the Internet Control Message Protocol , transport layer protocols, such as the User Datagram Protocol , session layer protocols, such as Socket Secure , as well as redirected/tunneled protocols, such as Serial over LAN .
Technique: T1095: Non-Application Layer Protocol
SUNBURST had a command to delete files.
Technique: T1070: Indicator Removal on Host
sudo
Technique: T1548: Abuse Elevation Control Mechanism
The Trojan will then use the following regular expression to check the HTTP response to the content upload request for the file identifier value: \”id\”:(.*) The Trojan will use this file identifier value to monitor for changes made to the file by the actor by checking for changes to the modification time of the <process ID of Trojan>.txt file
Technique: T1070: Indicator Removal on Host
The second stage will likely be more fully featured and allow the adversary to interact with the system through a reverse shell and additional RAT features.
Technique: T1104: Multi-Stage Channels
Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.
Technique: T1069: Permission Groups Discovery
Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process.
Technique: T1055: Process Injection
XAgentOSX contains the execFile function to execute a specified file on the system using the NSTask:launch method.
Technique: T1106: Native API
SeaDuke is capable of persisting via a .lnk file stored in the Startup directory.
Technique: T1547: Boot or Logon Autostart Execution
Hashes For a list of all hashes of malware encountered during this campaign, please refer to the following file
Technique: T1083: File and Directory Discovery
Ixeshe uses HTTP for command and control.
Technique: T1071: Application Layer Protocol
In addition to purchasing exploits, adversaries may steal and repurpose exploits from third-party entities .
Technique: T1588: Obtain Capabilities
Lazarus Group has hosted malicious downloads on Github.
Technique: T1583: Acquire Infrastructure
Cobalt Strike has the ability to use Smart Applet attacks to disable the Java SecurityManager sandbox.
Technique: T1562: Impair Defenses
Adversaries may modify Group Policy Objects  to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain.
Technique: T1484: Domain Policy Modification
Cobalt Strike includes a capability to modify the Beacon payload to eliminate known signatures or unpacking methods.
Technique: T1027: Obfuscated Files or Information