HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
OilRig has used tools to identify if a mouse is connected to a targeted system.
Technique: T1120: Peripheral Device Discovery
MuddyWater has run a tool that steals passwords saved in victim email.
Technique: T1552: Unsecured Credentials
GuLoader has the ability to perform anti-VM and anti-sandbox checks using string hashing, the API call EnumWindows, and checking for Qemu guest agent.
Technique: T1497: Virtualization/Sandbox Evasion
Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.
Technique: T1114: Email Collection
Operation Wocao has used PowerShell to add and delete rules in the Windows firewall.
Technique: T1562: Impair Defenses
Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.
Technique: T1070: Indicator Removal on Host
Netwalker can detect and terminate active security software-related processes on infected systems.
Technique: T1562: Impair Defenses
REvil can save encryption parameters and system information to the Registry.
Technique: T1112: Modify Registry
WIRTE has used HTTP for network communication.
Technique: T1071: Application Layer Protocol
As security controls have improved, DLL side loading has evolved to load a payload stored in a different directory or from a registry value
Technique: T1574: Hijack Execution Flow
SideTwist has the ability to upload files from a compromised host.
Technique: T1005: Data from Local System
Pony has used the Adobe Reader icon for the downloaded file to look more trustworthy.
Technique: T1036: Masquerading
Linfo creates a backdoor through which remote attackers can change C2 servers.
Technique: T1008: Fallback Channels
APT10 spear phishes have been relatively unsophisticated, leveraging .lnk files within archives, files with double extensions (e.g
Technique: T1547: Boot or Logon Autostart Execution
FrameworkPOS can identifiy payment card track data on the victim and copy it to a local file in a subdirectory of C:\Windows\.
Technique: T1074: Data Staged
APT29 has used spearphishing with a link to trick victims into clicking on a link to a zip file containing malicious files.
Technique: T1566: Phishing
Thrip used a cloud-based remote access software called LogMeIn for their attacks.
Technique: T1219: Remote Access Software
Rover automatically collects files from the local system and removable drives based on a predefined list of file extensions on a regular timeframe.
Technique: T1119: Automated Collection
VBScript #1 The dropped script “58d2a83f7778d5.36783181.vbs” acts as a launcher
Technique: T1059: Command and Scripting Interpreter
jRAT can gather victim internal and external IPs.
Technique: T1016: System Network Configuration Discovery
It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.
Technique: T1566: Phishing
Magic Hound malware has obtained the victim username and sent it to the C2 server.
Technique: T1033: System Owner/User Discovery
Pay2Key can stop the MS SQL service at the end of the encryption process to release files locked by the service.
Technique: T1489: Service Stop
Linux systems on Active Directory domains store Kerberos credentials locally in the credential cache file referred to as the "ccache".
Technique: T1558: Steal or Forge Kerberos Tickets
This command would inject an import table entry consisting of the specified DLL into the module at the given base address.
Technique: T1218: Signed Binary Proxy Execution
Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control  infrastructure.
Technique: T1102: Web Service
JPIN can enumerate drives and their types.
Technique: T1083: File and Directory Discovery
The Metasploit reverse HTTP payload was configured to communicate with the command and control (C2) IP address 176.126.85[.]207 with a randomly named resource such as” over TCP port 443.
Technique: T1571: Non-Standard Port
gh0st RAT can download files to the victim’s machine.
Technique: T1105: Ingress Tool Transfer
SLOTHFULMEDIA has the capability to enumerate services.
Technique: T1007: System Service Discovery
Dtrack can collect the victim's computer name, hostname and adapter information to create a unique identifier.
Technique: T1082: System Information Discovery
Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments.
Technique: T1199: Trusted Relationship
APT28 executed CHOPSTICK by using rundll32 commands such as rundll32.exe “C:\Windows\twain_64.dll”.
Technique: T1218: Signed Binary Proxy Execution
Okrum can impersonate a logged-on user's security context using a call to the ImpersonateLoggedOnUser API.
Technique: T1134: Access Token Manipulation
The group has also used tunneling tools to tunnel RDP into the environment.
Technique: T1021: Remote Services
The group has specifically used credentials stolen through a spearphishing email to login to the DCCC network.
Technique: T1078: Valid Accounts
MirageFox is likely loaded via DLL hijacking into a legitimate McAfee binary.
Technique: T1574: Hijack Execution Flow
Binary padding effectively changes the checksum of the file and can also be used to avoid hash-based blocklists and static anti-virus signatures.
Technique: T1027: Obfuscated Files or Information
Dragonfly 2.0 used spearphishing with Microsoft Office attachments to target victims.
Technique: T1566: Phishing
OSInfo has enumerated the local administrators group.
Technique: T1069: Permission Groups Discovery
LoadLibrary 
Technique: T1106: Native API
Pisloader obfuscates files by splitting strings into smaller sub-strings and including "garbage" strings that are never used.
Technique: T1027: Obfuscated Files or Information
Employee names be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures.
Technique: T1589: Gather Victim Identity Information
By chance encounter, victims may directly download/install these backdoored files via User Execution.
Technique: T1608: Stage Capabilities
CosmicDuke copies and exfiltrates the clipboard contents every 30 seconds.
Technique: T1115: Clipboard Data
Locations and format of logs are platform or product-specific, however standard operating system logs are captured as Windows events or Linux/macOS files such as Bash History and /var/log/*.
Technique: T1070: Indicator Removal on Host
Mosquito establishes persistence under the Registry key HKCU\Software\Run auto_update.
Technique: T1547: Boot or Logon Autostart Execution
EnvyScout can collect sensitive NTLM material from a compromised host.
Technique: T1005: Data from Local System
KONNI has used a custom base64 key to encode stolen data before exfiltration.
Technique: T1132: Data Encoding
Adversaries may easily gather email addresses, since they may be readily available and exposed via online or other accessible data sets  or Search Victim-Owned Websites.
Technique: T1589: Gather Victim Identity Information
Lazarus Group delivered RATANKBA to victims via a compromised legitimate website.
Technique: T1189: Drive-by Compromise
Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges from administrator to SYSTEM.
Technique: T1543: Create or Modify System Process
Enumerating the SAM database requires SYSTEM level access.
Technique: T1003: OS Credential Dumping
Since it can be useful for developers to modify default signature enforcement policies during the development and testing of applications, disabling of these features may be possible with elevated permissions.
Technique: T1553: Subvert Trust Controls
Turla has used net group "Domain Admins" /domain to identify domain administrators.
Technique: T1069: Permission Groups Discovery
Secure Shell  is a standard means of remote access on Linux and macOS systems.
Technique: T1563: Remote Service Session Hijacking
NDiskMonitor can obtain a list of all files and directories as well as logical drives.
Technique: T1083: File and Directory Discovery
APT34 can download remote files onto victims.
Technique: T1105: Ingress Tool Transfer
Adversaries may directly access a volume to bypass file access controls and file system monitoring.
Technique: T1006: Direct Volume Access
Unknown Logger is capable of stealing usernames and passwords from browsers on the victim machine.
Technique: T1555: Credentials from Password Stores
Machete has sent data over HTTP if FTP failed, and has also used a fallback server.
Technique: T1008: Fallback Channels
FELIXROOT uses WMI to query the Windows Registry.
Technique: T1047: Windows Management Instrumentation
The Trojan will then read the hexadecimal formatted contents of this file in 1500 byte blocks, sending each 1500 bytes of data from the file to the C2 server via an HTTP GET request to a URL with the following structure:http://<c2 domain>/resp?<hex(Environment.UserName/Environment.MachineName)>AAZ<hex(command prompt output)> The upload command (2) writes data provided by the C2 to a specified file
Technique: T1071: Application Layer Protocol
Adversaries may attempt to get a listing of cloud accounts.
Technique: T1087: Account Discovery
Then it checks to see if it was launched by RUNDLL32.exe along with parameter #1
Technique: T1218: Signed Binary Proxy Execution
SUNBURST strings were compressed and encoded in Base64.
Technique: T1027: Obfuscated Files or Information
After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.
Technique: T1546: Event Triggered Execution
Kazuar can sleep for a specific time and be set to communicate at specific intervals.
Technique: T1029: Scheduled Transfer
Examples may include appending/prepending data with junk characters or writing junk characters between significant characters.
Technique: T1001: Data Obfuscation
SombRAT can use a custom DGA to generate a subdomain for C2.
Technique: T1568: Dynamic Resolution
The servers use a different static key to encrypt replies to the implant.
Technique: T1573: Encrypted Channel
It appears to us that one organization had its entire Active Directory dumped out, making up most of the credentials we found in the data dump
Technique: T1003: OS Credential Dumping
Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server.
Technique: T1074: Data Staged
Cobalt Strike can use RSA asymmetric encryption with PKCS1 padding to encrypt data sent to the C2 server.
Technique: T1573: Encrypted Channel
Adversaries may attempt to get a listing of email addresses and accounts.
Technique: T1087: Account Discovery
The malware queries the value for the flag BeingDebugged from PEB to check whether the process is being debugged. 
Technique: T1518: Software Discovery
All protocols use their standard assigned ports.
Technique: T1071: Application Layer Protocol
Utilities and commands that acquire this information include netstat, "net use," and "net session" with Net.
Technique: T1049: System Network Connections Discovery
Rocke downloaded a file "libprocesshider", which could hide files on the target system.
Technique: T1564: Hide Artifacts
With double-flux additional hosts can act as a proxy to the C2 host, further insulating the true source of the C2 channel.
Technique: T1568: Dynamic Resolution
ShimRat can impersonate Windows services and antivirus products to avoid detection on compromised systems.
Technique: T1036: Masquerading
As seen below, the relational analysis proved to be quite fruitful:  Figure 1 Overview of relationships We rapidly discovered a different set of tools communicating to the exact same C2 servers as those two Word documents, in addition to other tools communicating to other subdomain variations of chrome-up[.]date as seen in the following graphic:  Figure 2 Command and control overlaps From there, we were able to map out a large infrastructure separating out into four categories of tools: downloaders, droppers, loaders, and payloads
Technique: T1518: Software Discovery
LightNeuron has the ability to download and execute additional files.
Technique: T1105: Ingress Tool Transfer
WindTail can be delivered as a compressed, encrypted, and encoded payload.
Technique: T1027: Obfuscated Files or Information
Dragonfly 2.0 has injected SMB URLs into malicious Word spearphishing attachments to initiate Forced Authentication.
Technique: T1221: Template Injection
BRONZE BUTLER malware has used HTTP for C2.
Technique: T1071: Application Layer Protocol
Regsvr32.exe can also be leveraged to register a COM Object used to establish persistence via Component Object Model Hijacking.
Technique: T1218: Signed Binary Proxy Execution
UNC2452 used AdFind to enumerate remote systems.
Technique: T1018: Remote System Discovery
Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls such as logging.
Technique: T1562: Impair Defenses
Gathering this information may reveal opportunities for other forms of reconnaissance  or Search Open Websites/Domains, establishing operational resources  or Compromise Accounts, and/or initial access  or Trusted Relationship.
Technique: T1591: Gather Victim Org Information
Among them, we found variations on the    EternalDarkness SMBv3 exploit (CVE-2020-0796)  , a , the privilege escalation exploit published on the Google Security Github account, and the privilege escalation exploit.
Technique: T1068: Exploitation for Privilege Escalation
Chaes used the CreateFileW API function with read permissions to access downloaded payloads.
Technique: T1106: Native API
MoonWind has a keylogger.
Technique: T1056: Input Capture
Hydraq creates a backdoor through which remote attackers can load and call DLL functions.
Technique: T1129: Shared Modules
FIN5 has used legitimate VPN, RDP, Citrix, or VNC credentials to maintain access to a victim environment.
Technique: T1078: Valid Accounts
In addition to looking for NTDS files on active Domain Controllers, attackers may search for backups that contain the same or similar information.
Technique: T1003: OS Credential Dumping
Lokibot is delivered via a malicious XLS attachment contained within a spearhpishing email.
Technique: T1566: Phishing
Windows implements file and directory ACLs as Discretionary Access Control Lists .
Technique: T1222: File and Directory Permissions Modification
Flame can take regular screenshots when certain applications are open that are sent to the command and control server.
Technique: T1113: Screen Capture
Gamaredon Group has also delivered Microsoft Outlook VBA projects with embedded macros.
Technique: T1059: Command and Scripting Interpreter
ComRAT has used PowerShell to load itself every time a user logs in to the system.
Technique: T1059: Command and Scripting Interpreter
Gorgon Group has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines.
Technique: T1059: Command and Scripting Interpreter
APT32 has lured targets to download a Cobalt Strike beacon by including a malicious link within spearphishing emails.
Technique: T1204: User Execution
GoldenSpy has established persistence by running in the background as an autostart service.
Technique: T1543: Create or Modify System Process
If it does, then malware can execute sudo commands without needing to supply the user's password.
Technique: T1548: Abuse Elevation Control Mechanism
xCaon has uploaded files from victims' machines.
Technique: T1005: Data from Local System
In the case of Astaroth trojan, the .lnk file contains an argument into WMIC.exe to run in non-interactive mode, which forgoes opening a window that the victim could notice, to download the hardcoded url in the .lnk
Technique: T1547: Boot or Logon Autostart Execution
InvisiMole can enumerate windows and child windows on a compromised host.
Technique: T1010: Application Window Discovery
A Destover-like implant used by Lazarus Group can obtain the current system time and send it to the C2 server.
Technique: T1124: System Time Discovery
Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction.
Technique: T1595: Active Scanning
YAHOYAH checks for antimalware solution processes on the system.
Technique: T1518: Software Discovery
REvil can force a reboot in safe mode with networking.
Technique: T1562: Impair Defenses
BADFLICK has uploaded files from victims' machines.
Technique: T1005: Data from Local System
EnvyScout has been distributed via spearphishing as an email attachment.
Technique: T1566: Phishing
HiddenWasp uses an RC4-like algorithm with an already computed PRGA generated key-stream for network communication.
Technique: T1573: Encrypted Channel
The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group.
Technique: T1069: Permission Groups Discovery
NETWIRE has the ability to write collected data to a file created in the ./LOGS directory.
Technique: T1074: Data Staged
Webshell can list PHP server configuration details.
Technique: T1518: Software Discovery
This method is dependent upon the Network Boundary Bridging method in order to allow the adversaries to cross the protected network boundary of the Internet perimeter and into the organization’s WAN.
Technique: T1090: Proxy
References to various COM objects are stored in the Registry.
Technique: T1546: Event Triggered Execution
HTML documents can store large binary objects known as JavaScript Blobs  that can later be constructed into file-like objects.
Technique: T1027: Obfuscated Files or Information
Sandworm Team has used stolen credentials to access administrative accounts within the domain.
Technique: T1078: Valid Accounts
The SSL/TLS protocol suite includes mechanisms for the client and server to agree on an encryption algorithm to use for subsequent secure connections.
Technique: T1499: Endpoint Denial of Service
The group was observed installing Python 2.7 on a victim.
Technique: T1059: Command and Scripting Interpreter
StoneDrill can check for antivirus and antimalware programs.
Technique: T1518: Software Discovery
StoneDrill has used the WMI command-line  utility to run tasks.
Technique: T1047: Windows Management Instrumentation
Pillowmint has been compressed and stored within a registry key.
Technique: T1027: Obfuscated Files or Information
WinExec() 
Technique: T1106: Native API
Chimera has used Windows admin shares to move laterally.
Technique: T1021: Remote Services
PlugX can be configured to use raw TCP or UDP for command and control.
Technique: T1095: Non-Application Layer Protocol
Silence has used Nmap to scan the corporate network, build a network topology, and identify vulnerable hosts.
Technique: T1018: Remote System Discovery
Fox Kitten has searched local system resources to access sensitive documents.
Technique: T1005: Data from Local System
LookBack side loads its communications module as a DLL into the libcurl.dll loader.
Technique: T1574: Hijack Execution Flow
can download and execute a second-stage payload.
Technique: T1105: Ingress Tool Transfer
ObliqueRAT has the ability to check for blocklisted computer names on infected endpoints.
Technique: T1082: System Information Discovery
A malicious password filter would receive these plain-text credentials every time a password request is made.
Technique: T1556: Modify Authentication Process
Aria-body has used TCP in C2 communications.
Technique: T1095: Non-Application Layer Protocol
NETEAGLE will decrypt resources it downloads with HTTP requests by using RC4 with the key "ScoutEagle."
Technique: T1573: Encrypted Channel
BackConfig has the ability to gather the victim's computer name.
Technique: T1082: System Information Discovery
Turian can use VMProtect for obfuscation.
Technique: T1027: Obfuscated Files or Information
NETEAGLE allows adversaries to execute shell commands on the infected host.
Technique: T1059: Command and Scripting Interpreter
Comnie continues to load an embedded bitmap (BMP) file and decrypt data at offset 0x512
Technique: T1140: Deobfuscate/Decode Files or Information
Additional Reading This PowerShell logging blog post contains more information on improving PowerShell visibility in your environment
Technique: T1546: Event Triggered Execution
On Linux systems attackers may launch dialog boxes prompting users for credentials from malicious shell scripts or the command line  Unix Shell.
Technique: T1056: Input Capture
WastedLocker's custom crypter, CryptOne, leveraged the VirtualAlloc API function to help execute the payload.
Technique: T1106: Native API
Several commands are supported by the Honeybee's implant via the command-line interface and there’s also a utility to execute any custom command on an infected endpoint.
Technique: T1059: Command and Scripting Interpreter
Turla used net use commands to connect to lateral systems within a network.
Technique: T1021: Remote Services
Lazarus Group also uses secure file deletion to delete files from the victim.
Technique: T1070: Indicator Removal on Host
Adversaries can also stop traffic from flowing to the appropriate destination, causing denial of service.
Technique: T1557: Adversary-in-the-Middle
The Delphi variant of Cannon does not use legitimate web-based email services for its C2 communications, instead opting to use email accounts at an actor owned domain, ambcomission[.]com
Technique: T1102: Web Service
Lazarus Group has used a VBA Macro to set its file attributes to System and Hidden and has named files with a dot prefix to hide them from the Finder application.
Technique: T1564: Hide Artifacts
Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via Accessibility Features, Boot or Logon Initialization Scripts, Unix Shell Configuration Modification, or tainting/hijacking other instrumental binary/configuration files via Hijack Execution Flow.
Technique: T1222: File and Directory Permissions Modification
Valak can download additional modules and malware capable of using separate C2 channels.
Technique: T1104: Multi-Stage Channels
NETWIRE can downloaded payloads from C2 to the compromised host.
Technique: T1105: Ingress Tool Transfer
On Windows, the built-in klist utility can be used to list and analyze cached Kerberos tickets.
Technique: T1558: Steal or Forge Kerberos Tickets
Filename  vsrss.exe    File Size  446976 bytes    MD5  5c3456d5932544b779fe814133344fdb    SHA1  7ab750afb25457a81c27a98dc6dfd51c27e61b0e    Notes Delphi RAT file that beacons to ebeijingcn.live
Technique: T1036: Masquerading
APT28 has renamed the WinRAR utility to avoid detection.
Technique: T1036: Masquerading
Zebrocy has a command to create a scheduled task for persistence.
Technique: T1053: Scheduled Task/Job
If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process.
Technique: T1574: Hijack Execution Flow
Dragonfly deleted system, security, terminal services, remote services, and audit logs from a victim.
Technique: T1070: Indicator Removal on Host
APT3 has been known to add created accounts to local admin groups to maintain elevated access.
Technique: T1098: Account Manipulation
Adversaries may use port knocking to hide open ports used for persistence or command and control.
Technique: T1205: Traffic Signaling
ARD leverages a blend of protocols, including VNC to send the screen and control buffers and SSH for secure file transfer.
Technique: T1021: Remote Services
One implementation of DNS Calculation is to take the first three octets of an IP address in a DNS response and use those values to calculate the port for command and control traffic.
Technique: T1568: Dynamic Resolution
RainyDay has downloaded as a XOR-encrypted payload.
Technique: T1027: Obfuscated Files or Information
Hi-Zor creates a Registry Run key to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
Security controls can include enforcement mechanisms to ensure that only valid, signed code can be run on an operating system.
Technique: T1553: Subvert Trust Controls
A Lazarus Group custom backdoor implant included a custom PE loader named "Security Package" that was added into the lsass.exe process via registry key.
Technique: T1036: Masquerading
TajMahal has the ability to inject DLLs for malicious plugins into running processes.
Technique: T1055: Process Injection
IcedID has used HTTPS in communications with C2.
Technique: T1071: Application Layer Protocol
This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper.
Technique: T1491: Defacement
The Axiom group is known to have used RDP during operations.
Technique: T1021: Remote Services
These commands are also executed when the loadconfig command is issued
Technique: T1059: Command and Scripting Interpreter
Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs.
Technique: T1574: Hijack Execution Flow
Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse.
Technique: T1218: Signed Binary Proxy Execution
Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.
Technique: T1555: Credentials from Password Stores
TajMahal has the ability to inject the LoadLibrary call template DLL into running processes.
Technique: T1129: Shared Modules
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Technique: T1040: Network Sniffing
Like past attacks, the initial infection vector is a malicious Word document attached to a phishing email that is well-tailored to the targeted business and its day-to-day operations
Technique: T1566: Phishing
TA551 has masked malware DLLs as dat and jpg files.
Technique: T1036: Masquerading
This is typically used in conjunction with attacks to weaken the strength of the cipher in software .
Technique: T1600: Weaken Encryption
TrickBot has attempted to get users to launch malicious documents to deliver its payload.
Technique: T1204: User Execution
Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features.
Technique: T1490: Inhibit System Recovery
They can be used as an alternative to Cron in Linux environments.
Technique: T1053: Scheduled Task/Job
Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing.
Technique: T1608: Stage Capabilities
Adversaries may use the information from Query Registry during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Technique: T1012: Query Registry
It will:  Download and execute the backdoor component Replace the content of the downloader Mach-O executable with a decoy, either using a base64-encoded embedded file or by downloading it from the internet Open a decoy document (described later) Close the Terminal window that just opened  The decoy document replaces the downloader Mach-O file, which means the malicious executable is only present in the ZIP file now
Technique: T1105: Ingress Tool Transfer
In addition, web traffic between a service provider’s customer and a service provider is likely to be viewed as benign by network defenders at the customer, allowing the attacker to exfiltrate data stealthily
Technique: T1543: Create or Modify System Process
In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.
Technique: T1136: Create Account
FinFisher checks its parent process for indications that it is running in a sandbox setup.
Technique: T1057: Process Discovery
Password stealer and NTLM stealer modules in CozyCar harvest stored credentials from the victim, including credentials used as part of Windows NTLM user authentication.
Technique: T1003: OS Credential Dumping
Prikormka adds itself to a Registry Run key with the name guidVGA or guidVSA.
Technique: T1547: Boot or Logon Autostart Execution
RTM has been delivered as archived Windows executable files masquerading as PDF documents.
Technique: T1036: Masquerading
The Github readme page for UACME contains an extensive list of methods that have been discovered and implemented, but may not be a comprehensive list of bypasses.
Technique: T1548: Abuse Elevation Control Mechanism
VNC differs from Remote Desktop Protocol as VNC is screen-sharing software rather than resource-sharing software.
Technique: T1021: Remote Services
Amazon Web Services  Amazon Machine Images , Google Cloud Platform  Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored.
Technique: T1204: User Execution
Okrum's payload is encrypted and embedded within its loader, or within a legitimate PNG file.
Technique: T1027: Obfuscated Files or Information
These often do not require an action by the user for the exploit to be executed.
Technique: T1203: Exploitation for Client Execution
Operation Wocao has used Impacket's smbexec.py as well as accessing the C$ and IPC$ shares to move laterally.
Technique: T1021: Remote Services
BitPaymer has attempted to install itself as a service to maintain persistence.
Technique: T1543: Create or Modify System Process
The wave against the government entity (June 26) also involved a simple PE file attachment (SHA256: d948d5b3702e140ef5b9247d26797b6dcdfe4fdb6f367bb217bc6b5fc79df520) using the filename tafahom.exe
Technique: T1036: Masquerading
TrickBot has been known to use PowerShell to download new payloads, open documents, and upload data to command and control servers.
Technique: T1059: Command and Scripting Interpreter
FruitFly persists via a Launch Agent.
Technique: T1543: Create or Modify System Process
PLAINTEE uses cmd.exe to execute commands on the victim’s machine.
Technique: T1059: Command and Scripting Interpreter
Part of the AS-REP message is signed with the user’s password.
Technique: T1558: Steal or Forge Kerberos Tickets
Adversaries may also add their malicious applications to the list of minimal services that start in safe mode by modifying relevant Registry values  Modify Registry.
Technique: T1562: Impair Defenses
Low confidence generally means that the information's credibility and/or plausibility is questionable, or that the information is too fragmented or poorly corroborated to make solid analytic inferences, or that [there are] significant concerns or problems with the sources
Technique: T1082: System Information Discovery
APT3 has used a tool to dump credentials by injecting itself into lsass.exe and triggering with the argument "dig."
Technique: T1003: OS Credential Dumping
PUNCHBUGGY can download additional files and payloads to compromised hosts.
Technique: T1105: Ingress Tool Transfer
In preparation for its attack against the 2018 Winter Olympics, Sandworm Team conducted online research of partner organizations listed on an official PyeongChang Olympics partnership site.
Technique: T1591: Gather Victim Org Information
Net Crawler uses PsExec to perform remote service manipulation to execute a copy of itself as part of lateral movement.
Technique: T1569: System Services
HAFNIUM has used the Exchange Power Shell module Set-OabVirtualDirectoryPowerShell to export mailbox data.
Technique: T1059: Command and Scripting Interpreter
MoleNet can perform WMI commands on the system.
Technique: T1047: Windows Management Instrumentation
Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system.
Technique: T1137: Office Application Startup
Melcoz has the ability to download additional files to a compromised host.
Technique: T1105: Ingress Tool Transfer
Clop has used built-in API functions such as WNetOpenEnumW, WNetEnumResourceW, WNetCloseEnum, GetProcAddress, and VirtualAlloc.
Technique: T1106: Native API
Shamoon has an operational mode for encrypting data instead of overwriting it.
Technique: T1486: Data Encrypted for Impact
By staging data on one system prior to Exfiltration, adversaries can minimize the number of connections made to their C2 server and better evade detection.
Technique: T1074: Data Staged
The victim's time zone may also be inferred from the current system time or gathered by using w32tm /tz.
Technique: T1124: System Time Discovery
Dtrack has used a decryption routine that is part of an executable physical patch.
Technique: T1140: Deobfuscate/Decode Files or Information
Registration of new windows classes can include a request for up to 40 bytes of EWM to be appended to the allocated memory of each instance of that class.
Technique: T1055: Process Injection
Maze operators have created scheduled tasks masquerading as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update" designed to launch the ransomware.
Technique: T1036: Masquerading
Operation Wocao has encrypted IP addresses used for "Agent" proxy hops with RC4.
Technique: T1001: Data Obfuscation
Operating system's name (i.e., the name of the machine) Operating system's OS architecture Operating system's caption Computer system's domain Computer system's username Computer's public IP address
Technique: T1082: System Information Discovery
Cardinal RAT checks its current working directory upon execution and also contains watchdog functionality that ensures its executable is located in the correct path .
Technique: T1083: File and Directory Discovery
Tropic Trooper has tested if the localhost network is available and other connection capability on an infected system using command scripts.
Technique: T1049: System Network Connections Discovery
Figure 6: Assembly view of Sample 3 root installation related byte arrays As it turns out, the referenced byte mask is applied to the other byte arrays using a rolling double-XOR algorithm to construct malware installation paths, filenames, and descriptions for a Linux root account
Technique: T1573: Encrypted Channel
EvilBunny has used WMI to gather information about the system.
Technique: T1047: Windows Management Instrumentation
POWERSTATS has used PowerShell code with custom string obfuscation  Matryoshka obfuscates API function names using a substitute cipher combined with Base64 encoding.
Technique: T1027: Obfuscated Files or Information
IcedID has used obfuscated VBA string expressions.
Technique: T1059: Command and Scripting Interpreter
That malicious dll then loads encrypted shellcode from the binary, which is decrypted and runs the final BUGJUICE payload
Technique: T1027: Obfuscated Files or Information
RTM strings, network data, configuration, and modules are encrypted with a modified RC4 algorithm.
Technique: T1027: Obfuscated Files or Information
Cardinal RAT can execute commands.
Technique: T1059: Command and Scripting Interpreter
Maze has created a file named "startup_vrun.bat" in the Startup folder of a virtual machine to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
Different protocol channels could also include Web services such as cloud storage.
Technique: T1048: Exfiltration Over Alternative Protocol
Anchor can establish persistence by creating a service.
Technique: T1543: Create or Modify System Process
FatDuke can AES encrypt C2 communications.
Technique: T1573: Encrypted Channel
Astaroth loads its module with the XSL script parameter vShow set to zero, which opens the application with a hidden window.
Technique: T1564: Hide Artifacts
Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor.
Technique: T1550: Use Alternate Authentication Material
Umbreon creates valid local users to provide access to the system.
Technique: T1078: Valid Accounts
Sandworm Team has used Base64 encoding within malware variants.
Technique: T1027: Obfuscated Files or Information
Revenge RAT has a plugin for microphone interception.
Technique: T1123: Audio Capture
Adversaries may abuse control.exe to proxy execution of malicious payloads.
Technique: T1218: Signed Binary Proxy Execution
APT29 used 7-Zip to compress stolen emails into password-protected archives prior to exfiltration.
Technique: T1560: Archive Collected Data
RunningRAT contains code to open and copy data from the clipboard.
Technique: T1115: Clipboard Data
Apple’s securityd utility takes the user’s logon password, encrypts it with PBKDF2, and stores this master key in memory.
Technique: T1555: Credentials from Password Stores
Any potential changes cannot take effect until every registered filter acknowledges validation.
Technique: T1556: Modify Authentication Process
APT39 has used the Smartftp Password Decryptor tool to decrypt FTP passwords.
Technique: T1555: Credentials from Password Stores
A FinFisher variant uses a custom packer.
Technique: T1027: Obfuscated Files or Information
GrimAgent has used Accept-Language to identify hosts in the United Kingdom, United States, France, and Spain.
Technique: T1614: System Location Discovery
When using msxsl.exe adversaries may also give the XML/XSL files an arbitrary file extension.
Technique: T1220: XSL Script Processing
Turla has used shellcode to download Meterpreter after compromising a victim.
Technique: T1105: Ingress Tool Transfer
Cobalt Group used msxsl.exe to bypass AppLocker and to invoke Jscript code from an XSL file.
Technique: T1220: XSL Script Processing
The keylogger then records keystrokes in encrypted files, for example: thumbcache_96.dbx
Technique: T1056: Input Capture
The quarantine flag is an opt-in system and not imposed by macOS.
Technique: T1553: Subvert Trust Controls
jRAT can list network connections.
Technique: T1049: System Network Connections Discovery
Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations.
Technique: T1113: Screen Capture
Fysbis has masqueraded as trusted software rsyncd and dbus-inotifier.
Technique: T1036: Masquerading
Cobalt Strike can inject a variety of payloads into processes dynamically chosen by the adversary.
Technique: T1055: Process Injection
Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private.
Technique: T1573: Encrypted Channel
Rising Sun can detect the username of the infected host.
Technique: T1033: System Owner/User Discovery
Emotet has sent Microsoft Word documents with embedded macros that will invoke scripts to download additional payloads.
Technique: T1059: Command and Scripting Interpreter
POWRUNER may collect domain group information by running net group /domain or a series of other commands on a victim.
Technique: T1069: Permission Groups Discovery
Bad Rabbit has been executed through user installation of an executable disguised as a flash installer.
Technique: T1204: User Execution
Lokibot has utilized multiple techniques to bypass UAC.
Technique: T1548: Abuse Elevation Control Mechanism
MarkiRAT can use the GetKeyboardLayout API to check if a compromised host's keyboard is set to Persian.
Technique: T1614: System Location Discovery
ADVSTORESHELL exfiltrates data over the same channel used for C2.
Technique: T1041: Exfiltration Over C2 Channel
Chimera has collected documents from the victim's SharePoint.
Technique: T1213: Data from Information Repositories
HOPLIGHT has the ability to connect to a remote host in order to upload and download files.
Technique: T1105: Ingress Tool Transfer
Cuba has been disguised as legitimate 360 Total Security Antivirus and OpenVPN programs.
Technique: T1036: Masquerading
Stealth Falcon malware gathers a list of running processes.
Technique: T1057: Process Discovery
An adversary may passively wait for an ARP request to poison the ARP cache of the requesting device.
Technique: T1557: Adversary-in-the-Middle
Cuba logs keystrokes via polling by using GetKeyState and VkKeyScan functions.
Technique: T1056: Input Capture
Tropic Trooper used netview to scan target systems for shared resources.
Technique: T1135: Network Share Discovery
Adversaries have been observed leveraging third-party drivers like RawDisk to directly access disk content.
Technique: T1561: Disk Wipe
Darkhotel has collected the IP address and network adapter information from the victim’s machine.
Technique: T1016: System Network Configuration Discovery
UPPERCUT can download and upload files to and from the victim’s machine.
Technique: T1105: Ingress Tool Transfer
Gold Dragon checks for anti-malware products and processes.
Technique: T1518: Software Discovery
To support complex operations, the XSL standard includes support for embedded scripting in various languages.
Technique: T1220: XSL Script Processing
Carberp has masqueraded as Windows system file names, as well as "chkntfs.exe" and "syscron.exe".
Technique: T1036: Masquerading
Turla has also used net group "Domain Computers" /domain, net group "Domain Controllers" /domain, and net group "Exchange Servers" /domain to enumerate domain computers, including the organization's DC and Exchange Server.
Technique: T1018: Remote System Discovery
Successfully checking the loader will execute the dllhost.exe process and create a hardcode mutex to avoid injecting it into the wrong dllhost.exe, as there can be multiple instances of it depending on the number of programs using the Internet Information Services
Technique: T1055: Process Injection
Linux Rabbit attempts to gain access to the server via SSH.
Technique: T1133: External Remote Services
CostaRicto has set up remote SSH tunneling into the victim's environment from a malicious domain.
Technique: T1572: Protocol Tunneling
APT28 has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263 to escalate privileges.
Technique: T1068: Exploitation for Privilege Escalation
As part of Windows compatibility support for various character sets, rundll32.exe will first check for wide/Unicode then ANSI character-supported functions before loading the specified function .
Technique: T1218: Signed Binary Proxy Execution
Octopus achieved persistence by placing a malicious executable in the startup directory.
Technique: T1547: Boot or Logon Autostart Execution
Even if the arsenal of this actor is diverse, we have identified some patterns, copy-paste code from various public repositories and similarities between the different piece of code
Technique: T1140: Deobfuscate/Decode Files or Information
Fox Kitten has accessed victim security and IT environments and Microsoft Teams to mine valuable information.
Technique: T1213: Data from Information Repositories
NOKKI can gather information on the victim IP address.
Technique: T1016: System Network Configuration Discovery
Crutch can monitor for removable drives being plugged into the compromised machine.
Technique: T1120: Peripheral Device Discovery
Process doppelgänging is a method of executing arbitrary code in the address space of a separate live process.
Technique: T1055: Process Injection
* Volume Shadow Copy
* secretsdump.py
* Using the in-built Windows tool, ntdsutil.exe
* Invoke-NinjaCopy
 Dragonfly 2.0 dropped and executed SecretsDump to dump password hashes.
Technique: T1003: OS Credential Dumping
Gold Dragon uses HTTP for communication to the control servers.
Technique: T1071: Application Layer Protocol
Adversaries may clear the history environment variable  or set the command history size to zero  to prevent logging of commands.
Technique: T1562: Impair Defenses
CORESHELL C2 messages are Base64-encoded.
Technique: T1132: Data Encoding
Windigo has used a Perl script for information gathering.
Technique: T1059: Command and Scripting Interpreter
Kimsuky has packed malware with UPX.
Technique: T1027: Obfuscated Files or Information
Applications use information plist files, Info.plist, to tell the operating system how to handle the application at runtime using structured metadata in the form of keys and values.
Technique: T1547: Boot or Logon Autostart Execution
Malicious GPO modifications can be used to implement many other malicious behaviors such as Scheduled Task/Job, Disable or Modify Tools, Ingress Tool Transfer, Create Account, Service Execution,  and more.
Technique: T1484: Domain Policy Modification
Darkhotel has decrypted strings and imports using RC4 during execution.
Technique: T1140: Deobfuscate/Decode Files or Information
This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control.
Technique: T1205: Traffic Signaling
APT3 has been known to use -WindowStyle Hidden to conceal PowerShell windows.
Technique: T1564: Hide Artifacts
Strings in Attor's components are encrypted with a XOR cipher, using a hardcoded key and the configuration data, log files and plugins are encrypted using a hybrid encryption scheme of Blowfish-OFB combined with RSA.
Technique: T1027: Obfuscated Files or Information
Once the OAuth access token is granted, the application can gain potentially long-term access to features of the user account through Application Access Token.
Technique: T1528: Steal Application Access Token
Depending on the flaw being exploited this may include Exploitation for Defense Evasion.
Technique: T1190: Exploit Public-Facing Application
InstallUtil is digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe and C:\Windows\Microsoft.NET\Framework64\v<version>\InstallUtil.exe.
Technique: T1218: Signed Binary Proxy Execution
MacSpy can steal clipboard contents.
Technique: T1115: Clipboard Data
POWERSTATS can sleep for a given number of seconds.
Technique: T1029: Scheduled Transfer
Molerats has used forged Microsoft code-signing certificates on malware.
Technique: T1553: Subvert Trust Controls
Hydraq creates a backdoor through which remote attackers can check for the existence of files, including its own components, as well as retrieve a list of logical drives.
Technique: T1083: File and Directory Discovery
NOKKI can gather information on drives and the operating system on the victim’s machine.
Technique: T1082: System Information Discovery
The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary.
Technique: T1565: Data Manipulation
Avaddon has decrypted encrypted strings.
Technique: T1140: Deobfuscate/Decode Files or Information
A Volgmer variant is encoded using a simple XOR cipher.
Technique: T1027: Obfuscated Files or Information
SPACESHIP copies staged data to removable drives when they are inserted into the system.
Technique: T1052: Exfiltration Over Physical Medium
If the file in not known/trusted, SmartScreen will prevent the execution and warn the user not to run it.
Technique: T1553: Subvert Trust Controls
Emotet can brute force a local admin password, then use it to facilitate lateral movement.
Technique: T1078: Valid Accounts
Wizard Spider has used a module named NewBCtestnDll64 as a reverse SOCKS proxy.
Technique: T1090: Proxy
If NETEAGLE does not detect a proxy configured on the infected machine, it will send beacons via UDP/6000.
Technique: T1095: Non-Application Layer Protocol
HotCroissant has the ability to hide the window for operations performed on a given file.
Technique: T1564: Hide Artifacts
Carberp can download and execute new plugins from the C2 server.
Technique: T1105: Ingress Tool Transfer