HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
njRAT has used AutoIt to compile the payload and main script into a single executable after delivery.
Technique: T1027: Obfuscated Files or Information
To maintain backwards compatibility some systems, such as Ubuntu, will execute the RC scripts if they exist with the correct file permissions.
Technique: T1037: Boot or Logon Initialization Scripts
VBScript 
Technique: T1059: Command and Scripting Interpreter
The generation of web cookies often requires secret values, such as passwords, Private Keys, or other cryptographic seed values.
Technique: T1606: Forge Web Credentials
Darkhotel has sent spearphishing emails with malicious RAR and .LNK attachments.
Technique: T1566: Phishing
Hidden Content The primary command and control location used in this campaign is hosted on a blog on blogspot[.]com, which enables the threat actors to hide their malicious content behind a legitimate service
Technique: T1102: Web Service
VNC is a platform-independent desktop sharing system that uses the RFB  protocol to enable users to remotely control another computer’s display by relaying the screen, mouse, and keyboard inputs over the network.
Technique: T1021: Remote Services
Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.
Technique: T1110: Brute Force
Wizard Spider has used the icacls command to modify access control to backup servers, providing them with full control of all the system folders.
Technique: T1222: File and Directory Permissions Modification
Hancitor has used PowerShell to execute commands.
Technique: T1059: Command and Scripting Interpreter
Next, the script triggered a PowerShell stager
Technique: T1546: Event Triggered Execution
Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens.
Technique: T1114: Email Collection
Adversaries may use several methods to accomplish Virtualization/Sandbox Evasion such as checking for security monitoring tools  or other system artifacts associated with analysis or virtualization.
Technique: T1497: Virtualization/Sandbox Evasion
APT38 has used DYEPACK to create, delete, and alter records in databases used for SWIFT transactions.
Technique: T1565: Data Manipulation
On Windows, there are a variety of features in scripting languages in Windows, such as PowerShell, Jscript, and Visual Basic to make windows hidden.
Technique: T1564: Hide Artifacts
BISCUIT uses SSL for encrypting C2 communications.
Technique: T1573: Encrypted Channel
APT34 has used net.exe in a script with net accounts /domain to find the password policy of a domain.
Technique: T1201: Password Policy Discovery
Silence has leveraged the Windows API, including using CreateProcess or ShellExecute, to perform a variety of tasks.
Technique: T1106: Native API
Additionally, on that same url, http://mdzz2019.noip[.]cn:3654/ is used to distribute more versions of this Gh0stRAT sample, along with a .zip file containing ASPXSpy, a web shell
Technique: T1505: Server Software Component
menuPass has used tcping.exe, similar to Ping, to probe port status on systems of interest.
Technique: T1046: Network Service Scanning
Mustang Panda has delivered initial payloads hidden using archives and encoding measures.
Technique: T1027: Obfuscated Files or Information
TeamTNT has uploaded backdoored Docker images to Docker Hub.
Technique: T1608: Stage Capabilities
Sakula has the capability to download files.
Technique: T1105: Ingress Tool Transfer
* Load – Create a shared section of memory and load the malicious executable.
Technique: T1055: Process Injection
Bandook has used the ShellExecuteW function call.
Technique: T1106: Native API
In the first, the adversary would make use of native debug commands in the original, unaltered running operating system that allow them to directly modify the relevant memory addresses containing the running operating system.
Technique: T1601: Modify System Image
Bad Rabbit enumerates open SMB shares on internal victim networks.
Technique: T1135: Network Share Discovery
InvisiMole can create hidden system directories.
Technique: T1564: Hide Artifacts
who -a and w can be used to show which users are currently logged in, similar to "net session".
Technique: T1049: System Network Connections Discovery
Because each OS has a maximum number of concurrent TCP connections that it will allow, this can quickly exhaust the ability of the system to receive new requests for TCP connections, thus preventing access to any TCP service provided by the server.
Technique: T1499: Endpoint Denial of Service
However, there are instances where programs need to be executed in an elevated context to function properly, but the user running them doesn’t need the elevated privileges.
Technique: T1548: Abuse Elevation Control Mechanism
The Duqu command and control protocol's data stream can be encrypted with AES-CBC.
Technique: T1573: Encrypted Channel
Information about client configurations may include a variety of details and settings, including operating system/version, virtualization, architecture , language, and/or time zone.
Technique: T1592: Gather Victim Host Information
Okrum can establish persistence by creating a .lnk shortcut to itself in the Startup folder.
Technique: T1547: Boot or Logon Autostart Execution
FruitFly looks for specific files and file types.
Technique: T1083: File and Directory Discovery
Ryuk has attempted to adjust its token privileges to have the SeDebugPrivilege.
Technique: T1134: Access Token Manipulation
EvilGrab has the capability to capture screenshots.
Technique: T1113: Screen Capture
Chimera has used custom DLLs for continuous retrieval of data from memory.
Technique: T1119: Automated Collection
Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.
Technique: T1069: Permission Groups Discovery
Domain names are the human readable names used to represent one or more IP addresses.
Technique: T1583: Acquire Infrastructure
Bundlore has used Python scripts to execute payloads.
Technique: T1059: Command and Scripting Interpreter
Silence has used ProxyBot, which allows the attacker to redirect traffic from the current node to the backconnect server via Sock4\Socks5.
Technique: T1090: Proxy
Proxysvc registers itself as a service on the victim’s machine to run as a standalone process.
Technique: T1569: System Services
TA551 has used encoded ASCII text for initial C2 communications.
Technique: T1132: Data Encoding
Sibot has downloaded a DLL to the C:\windows\system32\drivers\ folder and renamed it with a .sys extension.
Technique: T1036: Masquerading
Leviathan has archived victim's data prior to exfiltration.
Technique: T1560: Archive Collected Data
Adversaries may inject malicious code into processes via the asynchronous procedure call  queue in order to evade process-based defenses as well as possibly elevate privileges.
Technique: T1055: Process Injection
Volgmer installs a copy of itself in a randomly selected service, then overwrites the ServiceDLL entry in the service's Registry entry.
Technique: T1543: Create or Modify System Process
DarkComet has the option to compress its payload using UPX or MPRESS.
Technique: T1027: Obfuscated Files or Information
In one instance, APT29 created a Filter named BfeOnServiceStartTypeChange (Figure 1), which they configured to execute every Monday, Tuesday, Thursday, Friday, and Saturday at 11:33 am local time.     Figure 1: “BfeOnServiceStartTypeChange” WMI Query Language (WQL) filter condition The BfeOnServiceStartTypeChange Filter was bound to the CommandLineEventConsumer WindowsParentalControlsMigration
Technique: T1047: Windows Management Instrumentation
Astaroth has used malicious VBS e-mail attachments for execution.
Technique: T1059: Command and Scripting Interpreter
OopsIE uses the SmartAssembly obfuscator to pack an embedded .Net Framework assembly used for C2.
Technique: T1027: Obfuscated Files or Information
BLINDINGCAN has been packed with the UPX packer.
Technique: T1027: Obfuscated Files or Information
Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign.
Technique: T1480: Execution Guardrails
Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc.
Technique: T1552: Unsecured Credentials
Duqu creates a new service that loads a malicious driver when the system starts.
Technique: T1543: Create or Modify System Process
A 256-bit AES session key is generated and used to encrypt both message headers and bodies separately
Technique: T1521: nan
Ryuk can use anti-disassembly and code transformation obfuscation techniques.
Technique: T1027: Obfuscated Files or Information
Launchctl interfaces with launchd, the service management framework for macOS.
Technique: T1569: System Services
Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may improperly handle these files.
Technique: T1036: Masquerading
RGDoor establishes persistence on webservers as an IIS module.
Technique: T1505: Server Software Component
The following shows the specific IP addresses or strings used by the C2 to transmit a success or cancel message depending on the type of DNS query used for C2 communications:    DNS Type Successful Cancel   A,AC 1.1.1.\d+ 1.2.9.\d+   AAAA 2a00:: 2200::   CNAME,MX,TXT,SRV,SOA ok cancel    After providing system specific information, the payload will Interact with the C2 server to obtain commands, which the payload refers to as jobs
Technique: T1071: Application Layer Protocol
Threat Group-3390 malware is also obfuscated using Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.
Technique: T1027: Obfuscated Files or Information
Adversaries may generate these credential materials in order to gain access to web resources.
Technique: T1606: Forge Web Credentials
Magic Hound has compromised personal email accounts through the use of legitimate credentials and gathered additional victim information.
Technique: T1586: Compromise Accounts
The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity.
Technique: T1588: Obtain Capabilities
FIN6 actors have compressed data from remote systems and moved it to another staging system before exfiltration.
Technique: T1074: Data Staged
Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy.
Technique: T1090: Proxy
Sibot has used a legitimate compromised website to download DLLs to the victim's machine.
Technique: T1102: Web Service
Some of the information may help adversaries to further their operation within a network.
Technique: T1012: Query Registry
Alternatively, the adversary may send an AS-REQ message for each user.
Technique: T1558: Steal or Forge Kerberos Tickets
An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in various nodes within a cluster.
Technique: T1053: Scheduled Task/Job
Ke3chang malware RoyalCli and BS2005 have communicated over HTTP with the C2 server through Internet Explorer  by using the COM interface IWebBrowser2.
Technique: T1071: Application Layer Protocol
TrickBot module shareDll/mshareDll discovers network shares via the WNetOpenEnumA API.
Technique: T1135: Network Share Discovery
Mapping of TG-3390's interactions with web shells during an intrusion responded to by CTU researchers
Technique: T1505: Server Software Component
OilRig has used net.exe in a script with net accounts /domain to find the password policy of a domain.
Technique: T1201: Password Policy Discovery
Bxaki obfuscated function
Technique: T1027: Obfuscated Files or Information
Ebury has installed a self-signed RPM package mimicking the original system package on RPM based systems.
Technique: T1553: Subvert Trust Controls
Following the successful injection of SUNBURST, SUNSPOT deleted a temporary file it created named InventoryManager.bk after restoring the original SolarWinds Orion source code to the software library.
Technique: T1070: Indicator Removal on Host
Cardinal RAT can act as a reverse proxy.
Technique: T1090: Proxy
Olympic Destroyer contains a module that tries to obtain credentials from LSASS, similar to Mimikatz.
Technique: T1003: OS Credential Dumping
APT33 has used base64 to encode command and control traffic.
Technique: T1132: Data Encoding
Operation Wocao can proxy traffic through multiple infected systems.
Technique: T1090: Proxy
BitPaymer has set the run key HKCU\Software\Microsoft\Windows\CurrentVersion\Run for persistence.
Technique: T1547: Boot or Logon Autostart Execution
LoudMiner is typically bundled with pirated copies of Virtual Studio Technology  for Windows and macOS.
Technique: T1189: Drive-by Compromise
QakBot can identify the installed antivirus product on a targeted system.
Technique: T1518: Software Discovery
Filename  Part-II.doc    File Size  10156713 bytes    MD5  e32668e569362c96cc56db368b7e821e    SHA1  dadc493abbe3e21610539e1d5a42f523626a6132    Notes Malicious RTF document that exploits CVE-2017-8570 and drops QuasarRAT file mico-audio.exe
Technique: T1036: Masquerading
Machete has delivered spearphishing emails that contain a zipped file with malicious contents.
Technique: T1566: Phishing
A JHUHUGIT variant takes screenshots by simulating the user pressing the "Take Screenshot" key , accessing the screenshot saved in the clipboard, and converting it to a JPG image.
Technique: T1113: Screen Capture
Azorult can recursively search for files in folders and collects files from the desktop with certain extensions.
Technique: T1083: File and Directory Discovery
Carbon can collect the IP address of the victims and other computers on the network using the commands: ipconfig -all nbtstat -n, and nbtstat -s. NanoCore gathers the IP address from the victim’s machine.
Technique: T1016: System Network Configuration Discovery
OSX/Shlayer can base64-decode and AES-decrypt downloaded payloads.
Technique: T1140: Deobfuscate/Decode Files or Information
Duqu will inject itself into different processes to evade detection.
Technique: T1055: Process Injection
An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed.
Technique: T1562: Impair Defenses
ComRAT has injected its orchestrator DLL into explorer.exe.
Technique: T1055: Process Injection
TA459 has used PowerShell for execution of a payload.
Technique: T1059: Command and Scripting Interpreter
Higaisa used malicious e-mail attachments to lure victims into executing LNK files.
Technique: T1204: User Execution
Drovorub can transfer files from the victim machine.
Technique: T1005: Data from Local System
For operations incorporating social engineering, the utilization of an online persona may be important.
Technique: T1586: Compromise Accounts
Javali has used the MSI installer to download and execute malicious payloads.
Technique: T1218: Signed Binary Proxy Execution
DropBook has checked for the presence of Arabic language in the infected machine's settings.
Technique: T1082: System Information Discovery
Adversaries may gain execution by inserting malicious dylibs with the name of the missing dylib in the identified path.
Technique: T1574: Hijack Execution Flow
Calisto collects Keychain storage data and copies those passwords/tokens to a file.
Technique: T1555: Credentials from Password Stores
BLINDINGCAN has used AES and XOR to decrypt its DLLs.
Technique: T1140: Deobfuscate/Decode Files or Information
Malicious Control Panel items can be delivered via Phishing campaigns or executed as part of multi-stage malware.
Technique: T1218: Signed Binary Proxy Execution
Kessel has trojanized the <sode>ssh_login and user-auth_pubkey functions to steal plaintext credentials.
Technique: T1556: Modify Authentication Process
These persistence mechanisms can work within Outlook or be used through Office 365.
Technique: T1137: Office Application Startup
If you compare the HTTP GET request from the RIPTIDE samples (Figure 1) to the HTTP GET request from the HIGHTIDE samples (Figure 3) you can see the malware author changed the following items:  User Agent Format and structure of the HTTP Uniform Resource Identifier (URI)   Figure 3: HIGHTIDE GET Request Example Similar to RIPTIDE campaigns, APT12 infects target systems with HIGHTIDE using a Microsoft Word (.doc) document that exploits CVE-2012-0158
Technique: T1071: Application Layer Protocol
Inception has obtained and used open-source tools such as LaZagne.
Technique: T1588: Obtain Capabilities
SEASHARPEE can timestomp files on victims using a Web shell.
Technique: T1070: Indicator Removal on Host
Lazarus Group has used malware like WhiskeyAlfa to overwrite the first 64MB of every drive with a mix of static and random buffers.
Technique: T1561: Disk Wipe
Typically, management services over commonly used ports are used when stuffing credentials.
Technique: T1110: Brute Force
Doki has used a script that gathers information from a hardcoded list of IP addresses and uploads to an Ngrok URL.
Technique: T1020: Automated Exfiltration
JPIN can obtain network information, including DNS, IP, and proxies.
Technique: T1016: System Network Configuration Discovery
If the Performance key is not already present and if an adversary-controlled user has the Create Subkey permission, adversaries may create the Performance key in the service’s Registry tree to point to a malicious DLL.
Technique: T1574: Hijack Execution Flow
It named Meterpreter as a WAV file type, probably in the hope that this would not raise suspicions
Technique: T1036: Masquerading
VERMIN can get a list of the processes and running tasks on the system.
Technique: T1057: Process Discovery
Emotet has been observed leveraging a module that can scrape email addresses from Outlook.
Technique: T1087: Account Discovery
Remsec has a package that collects documents from any inserted USB sticks.
Technique: T1025: Data from Removable Media
These changes will be isolated and only visible within the context of the transaction.
Technique: T1055: Process Injection
DarkVishnya used network sniffing to obtain login data.
Technique: T1040: Network Sniffing
Techniques to systematically guess the passwords used to compute hashes are available, or the adversary may use a pre-computed rainbow table to crack hashes.
Technique: T1110: Brute Force
Kimsuky has used FTP to download additional malware to the target machine.
Technique: T1071: Application Layer Protocol
The BONDUPDATER script, which was named based on the hard-coded string “B007”, uses a custom DGA algorithm to generate subdomains for communication with the C2 server
Technique: T1573: Encrypted Channel
Threat Group-3390 actors obtain legitimate credentials using a variety of methods and use them to further lateral movement on victim networks.
Technique: T1078: Valid Accounts
Comnie encrypts command and control communications with RC4.
Technique: T1573: Encrypted Channel
VERMIN gathers the username from the victim’s machine.
Technique: T1033: System Owner/User Discovery
Stealth Falcon malware communicates with its C2 server via HTTPS.
Technique: T1071: Application Layer Protocol
Agent Tesla has exploited Office vulnerabilities such as CVE-2017-11882 and CVE-2017-8570 for execution during delivery.
Technique: T1203: Exploitation for Client Execution
APT32 has disguised a Cobalt Strike beacon as a Flash Installer.
Technique: T1036: Masquerading
For example, a compromised login page may log provided user credentials before logging the user in to the service.
Technique: T1056: Input Capture
Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing a link to malicious content hosted on an uncommon Web server.
Technique: T1566: Phishing
Turla has used spearphishing emails to deliver BrainTest as a malicious attachment.
Technique: T1566: Phishing
Stuxnet checks for specific operating systems on 32-bit machines, Registry keys, and dates for vulnerabilities, and will exit execution if the values are not met.
Technique: T1480: Execution Guardrails
TAINTEDSCRIBE has used FileReadZipSend to compress a file and send to C2.
Technique: T1560: Archive Collected Data
The dropped executable (MD5: 78734CD268E5C9AB4184E1BBE21A6EB9) contains the compressed FELIXROOT dropper component in the Portable Executable (PE) binary overlay section
Technique: T1070: Indicator Removal on Host
APT28 has cleared event logs, including by using the commands wevtutil cl System and wevtutil cl Security.
Technique: T1070: Indicator Removal on Host
BitPaymer can import a hard-coded RSA 1024-bit public key, generate a 128-bit RC4 key for each file, and encrypt the file in place, appending .locked to the filename.
Technique: T1486: Data Encrypted for Impact
PoetRAT has the ability to copy files and download/upload files into C2 channels using FTP and HTTPS.
Technique: T1105: Ingress Tool Transfer
COM and execution in same sentence 
Technique: T1021: Remote Services
BISCUIT can capture keystrokes.
Technique: T1056: Input Capture
Adversaries may put in place resources that are referenced by a link that can be used during targeting.
Technique: T1608: Stage Capabilities
SslMM sends information to its hard-coded C2, including OS version, service pack information, processor speed, system name, and OS install date.
Technique: T1082: System Information Discovery
Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Technique: T1011: Exfiltration Over Other Network Medium
DustySky has two hard-coded domains for C2 servers; if the first does not respond, it will try the second.
Technique: T1008: Fallback Channels
Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.
Technique: T1531: Account Access Removal
BendyBear has used a custom RC4 and XOR encrypted protocol over port 443 for C2.
Technique: T1571: Non-Standard Port
AppleJeus can install itself as a service.
Technique: T1543: Create or Modify System Process
SpeakUp uses the whoami command.
Technique: T1033: System Owner/User Discovery
TrickBot can obtain passwords stored in files from several applications such as Outlook, Filezilla, OpenSSH, OpenVPN and WinSCP.
Technique: T1552: Unsecured Credentials
Asymmetric encryption algorithms are those that use different keys on each end of the channel.
Technique: T1048: Exfiltration Over Alternative Protocol
APT37 has signed its malware with an invalid digital certificates listed as “Tencent Technology  Company Limited.” Windshift has used revoked certificates to sign malware.
Technique: T1036: Masquerading
Clop can use msiexec.exe to disable security tools on the system.
Technique: T1218: Signed Binary Proxy Execution
Magic Hound malware is capable of keylogging.
Technique: T1056: Input Capture
FIN7 has used malicious links to lure victims into downloading malware.
Technique: T1204: User Execution
Conficker resets system restore points and deletes backup files.
Technique: T1490: Inhibit System Recovery
MarkiRAT can capture all keystrokes on a compromised host.
Technique: T1056: Input Capture
Helminth can use HTTP for C2.
Technique: T1071: Application Layer Protocol
TinyZBot supports execution from the command-line.
Technique: T1059: Command and Scripting Interpreter
Ursnif has copied itself to and infected files in network drives for propagation.
Technique: T1080: Taint Shared Content
captures keystrokes.
Technique: T1056: Input Capture
Agent Tesla has dropped RegAsm.exe onto systems for performing malicious activity.
Technique: T1218: Signed Binary Proxy Execution
POWRUNER may collect information about the system by running hostname and systeminfo on a victim.
Technique: T1082: System Information Discovery
StoneDrill has a disk wiper module that targets files other than those in the Windows directory.
Technique: T1485: Data Destruction
Cobalt Strike's execute-assembly command can run a .NET executable within the memory of a sacrificial process by loading the CLR.
Technique: T1620: Reflective Code Loading
build_downer has the ability to detect if the infected host is running an anti-virus process.
Technique: T1518: Software Discovery
The skills needed may be located in-house, or may need to be contracted out.
Technique: T1587: Develop Capabilities
MuddyWater decoded base64-encoded PowerShell commands using a VBS file.
Technique: T1140: Deobfuscate/Decode Files or Information
Machete has created scheduled tasks to maintain Machete's persistence.
Technique: T1053: Scheduled Task/Job
InvisiMole can collect jpeg files from connected MTP devices.
Technique: T1025: Data from Removable Media
A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d.
Technique: T1546: Event Triggered Execution
Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.
Technique: T1587: Develop Capabilities
/user <parameters>: Executes downloaded file with parameters specified using CreateProcessAsUser cmd /c <command>: Executes command on infected endpoint   Conclusion  The actor behind Honeybee has been operating with new implants since at least November 2017 with the first known version of NTWDBLIB installer
Technique: T1059: Command and Scripting Interpreter
PlugX can use the Windows API function CreateProcess to execute another process.
Technique: T1106: Native API
TRITON encoded the two inject.bin and imain.bin payloads.
Technique: T1027: Obfuscated Files or Information
User Unix Shells execute several configuration scripts at different points throughout the session based on events.
Technique: T1546: Event Triggered Execution
SynAck enumerates all running processes.
Technique: T1057: Process Discovery
ComRAT can use SSL/TLS encryption for its HTTP-based C2 channel.
Technique: T1573: Encrypted Channel
SLOWDRIFT uses cloud based services for C2.
Technique: T1102: Web Service
This document was alleged to have been written by the Ministry of Reunification as demonstrated by the logo in the top left.Similar to the "Golden Time" campaign, this document exploits an EPS vulnerability in order to download and execute shellcode located on a compromised website:hxxp://60chicken[.]co[.]kr/wysiwyg/PEG_temp/logo1.pngThe fake image usage is a common pattern for this group
Technique: T1105: Ingress Tool Transfer
Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.
Technique: T1036: Masquerading
By compromising DNS servers, adversaries can alter DNS records.
Technique: T1584: Compromise Infrastructure
Chimera has used time /t and net time \\ip/hostname for system time discovery.
Technique: T1124: System Time Discovery
Threat Group-1314 actors used a victim's endpoint management platform, Altiris, for lateral movement.
Technique: T1072: Software Deployment Tools
Files and folders that start with a period, ‘.’, are by default hidden from being viewed in the Finder application and standard command-line utilities like “ls”.
Technique: T1564: Hide Artifacts
FIN5 uses SDelete to clean up the environment and attempt to prevent detection.
Technique: T1070: Indicator Removal on Host
The "Uploader" variant of HAMMERTOSS visits a hard-coded server over HTTP/S to download the images HAMMERTOSS uses to receive commands.
Technique: T1071: Application Layer Protocol
P.A.S.
Technique: T1059: Command and Scripting Interpreter
OSX/Shlayer can use bash scripts to check the macOS version, download payloads, and extract bytes from files.
Technique: T1059: Command and Scripting Interpreter
Link shortening services can also be employed.
Technique: T1608: Stage Capabilities
EVILNUM has changed the creation date of files.
Technique: T1070: Indicator Removal on Host
Dragonfly 2.0 queried the Registry to identify victim information.
Technique: T1012: Query Registry
Malware used by Group5 is capable of capturing keystrokes.
Technique: T1056: Input Capture
AuditCred can inject code from files to other running processes.
Technique: T1055: Process Injection
SideTwist has the ability to search for specific files.
Technique: T1083: File and Directory Discovery
FLIPSIDE uses RDP to tunnel traffic from a victim environment.
Technique: T1572: Protocol Tunneling
Many benign tasks and services exist that have commonly associated names.
Technique: T1036: Masquerading
StreamEx has the ability to remotely execute commands.
Technique: T1059: Command and Scripting Interpreter
Adversaries may abuse scripting or built-in command line interpreters  on network devices to execute malicious command and payloads.
Technique: T1059: Command and Scripting Interpreter
Tropic Trooper has encrypted configuration files.
Technique: T1027: Obfuscated Files or Information
BONDUPDATER can read batch commands in a file sent from its C2 server and execute them with cmd.exe.
Technique: T1059: Command and Scripting Interpreter
Pisloader has a command to collect victim system information, including the system name and OS version.
Technique: T1082: System Information Discovery
MuddyWater uses various techniques to bypass UAC.
Technique: T1548: Abuse Elevation Control Mechanism
Conficker downloads an HTTP server to the infected machine.
Technique: T1105: Ingress Tool Transfer
jRAT can query and kill system processes.
Technique: T1057: Process Discovery
Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.
Technique: T1046: Network Service Scanning
Hydraq creates a backdoor through which remote attackers can download files and additional malware components.
Technique: T1105: Ingress Tool Transfer
Whitefly has consistently used a technique known as search order hijacking to run Vcrodat.
Technique: T1574: Hijack Execution Flow
USBStealer has several commands to delete files associated with the malware from the victim.
Technique: T1070: Indicator Removal on Host
Grandoreiro has used compromised websites and Google Ads to bait victims into downloading its installer.
Technique: T1189: Drive-by Compromise
WinMM collects the system name, OS version including service pack, and system install date and sends the information to the C2 server.
Technique: T1082: System Information Discovery
Adversaries may hijack domains and/or subdomains that can be used during targeting.
Technique: T1584: Compromise Infrastructure
For the print processor to be correctly installed, it must be located in the system print-processor directory that can be found with the GetPrintProcessorDirectory API call.
Technique: T1547: Boot or Logon Autostart Execution
Adversaries may gather employee names that can be used during targeting.
Technique: T1589: Gather Victim Identity Information
If running in a Windows environment, Kazuar saves a DLL to disk that is injected into the explorer.exe process to execute the payload.
Technique: T1055: Process Injection
Okrum can collect network information, including the host IP address, DNS, and proxy information.
Technique: T1016: System Network Configuration Discovery
UNC2452 collected emails from specific individuals, such as executives and IT staff, using New-MailboxExportRequest followed by Get-MailboxExportRequest.
Technique: T1114: Email Collection
Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain .
Technique: T1583: Acquire Infrastructure
Clop can make modifications to Registry keys.
Technique: T1112: Modify Registry
Inception has used PowerShell to execute malicious commands and payloads.
Technique: T1059: Command and Scripting Interpreter
Cardinal RAT contains watchdog functionality that periodically ensures HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load is set to point to its executable.
Technique: T1012: Query Registry
BabyShark has executed the tasklist command.
Technique: T1057: Process Discovery
Adversaries may search in different online sites depending on what information they seek to gather.
Technique: T1593: Search Open Websites/Domains
Frankenstein has established persistence through a scheduled task using the command:  /Create /F /SC DAILY /ST 09:00 /TN WinUpdate /TR , named "WinUpdate".
Technique: T1053: Scheduled Task/Job
Magic Hound has used personalized spearphishing attachments.
Technique: T1566: Phishing
UPPERCUT has the capability to gather the system’s hostname and OS version.
Technique: T1082: System Information Discovery
TinyZBot contains screen capture functionality.
Technique: T1113: Screen Capture
BITS tasks are self-contained in the BITS job database, without new files or registry modifications, and often permitted by host firewalls.
Technique: T1197: BITS Jobs
build_downer has added itself to the Registry Run key as "NVIDIA" to appear legitimate.
Technique: T1036: Masquerading
Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version.
Technique: T1189: Drive-by Compromise
Kimsuky has set auto-forward rules on victim's e-mail accounts.
Technique: T1114: Email Collection
Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials.
Technique: T1593: Search Open Websites/Domains
Examples of such abuse include modifying GPOs to push a malicious Scheduled Task to computers throughout the domain environment or modifying domain trusts to include an adversary controlled domain where they can control access tokens that will subsequently be accepted by victim domain resources.
Technique: T1484: Domain Policy Modification
An adversary can use WMI to interact with local and remote systems and use it as a means to execute various behaviors, such as gathering information for Discovery as well as remote Execution of files as part of Lateral Movement.
Technique: T1047: Windows Management Instrumentation
BRONZE BUTLER has used various tools  to perform credential dumping.
Technique: T1003: OS Credential Dumping
When the Launch Daemon is executed, the program inherits administrative permissions.
Technique: T1543: Create or Modify System Process
Specifically, the following GitHub repositories appear to be controlled by the MuddyWater threat actor(s):  [unknown SHA256]  Downloads payload from: hxxps://raw.githubusercontent[.]com/F0R3X/BrowserFontArabic/master/ArabicBrowserFont.exe   [unknown SHA256]  Downloads payload from: hxxps://raw.githubusercontent[.]com/F0R3X/BrowserFontArabic/master/FontArabic.exe     9b5e36bb7518a9e333c31d09b589102f89e3425571dd434820ab3c437dc4e0d9 (and several others)  Downloads payload from: hxxps://raw.githubusercontent[.]com/ReactDeveloper2017/react/master/src/test/test.js    Interestingly, both profiles were populated with forked repositories to give them an air of legitimacy as shown in figure 2
Technique: T1027: Obfuscated Files or Information
Adversaries may use startup items automatically executed at boot initialization to establish persistence.
Technique: T1037: Boot or Logon Initialization Scripts
Ecipekac has the ability to decrypt fileless loader modules.
Technique: T1140: Deobfuscate/Decode Files or Information
Captured hashes are used with PtH to authenticate as that user.
Technique: T1550: Use Alternate Authentication Material
These appeared to be hosted on either Linode or Google Cloud, with a preference for using the ASN AS63949
Technique: T1102: Web Service
APT19 used PowerShell commands to execute payloads.
Technique: T1059: Command and Scripting Interpreter
HyperBro can list all services and their configurations.
Technique: T1007: System Service Discovery
Egregor has been decrypted before execution.
Technique: T1140: Deobfuscate/Decode Files or Information
QakBot can use a variety of commands, including esentutl.exe to steal sensitive data from Internet Explorer and Microsoft Edge, to acquire information that is subsequently exfiltrated.
Technique: T1005: Data from Local System
It uses the Dropbox API with a hardcoded bearer access token and has the ability to download, upload, and execute files
Technique: T1105: Ingress Tool Transfer
KONNI has duplicated the token of a high integrity process to spawn an instance of cmd.exe under an impersonated user.
Technique: T1134: Access Token Manipulation
Higaisa’s shellcode attempted to find the process ID of the current process.
Technique: T1057: Process Discovery
For macOS, the sharing -l command lists all shared points used for smb services.
Technique: T1135: Network Share Discovery
Kinsing has searched for private keys.
Technique: T1552: Unsecured Credentials
With a sufficient level of access, the net user /add command can be used to create a local account.
Technique: T1136: Create Account
SynAck gathers user names from infected hosts.
Technique: T1033: System Owner/User Discovery
Cloud service providers offer APIs allowing users to enumerate objects stored within cloud storage.
Technique: T1619: Cloud Storage Object Discovery
Sidewinder has used malware to collect information on network interfaces, including the MAC address.
Technique: T1016: System Network Configuration Discovery
BRONZE UNION appears to use a combination of self-registered IP addresses and commercial VPN services in its command and control (C2) and operational infrastructure
Technique: T1102: Web Service
REvil has the capability to destroy files and folders.
Technique: T1485: Data Destruction
RogueRobin uses various WMI queries to check if the sample is running in a sandbox.
Technique: T1047: Windows Management Instrumentation
Adversaries can abuse these components to execute malware, such as remote access tools, to maintain persistence through system reboots.
Technique: T1547: Boot or Logon Autostart Execution
Caterpillar WebShell can gather the IP address from the victim's machine using the IP config command.
Technique: T1016: System Network Configuration Discovery
All the strings and settings were encrypted and obfuscated
Technique: T1027: Obfuscated Files or Information
Rocke has used shell scripts which download mining executables and saves them with the filename "java".
Technique: T1036: Masquerading
Kivars has the ability to uninstall malware from the infected host.
Technique: T1070: Indicator Removal on Host
RTM can add a certificate to the Windows store.
Technique: T1553: Subvert Trust Controls
Operation Wocao has used a script to collect information about the infected system.
Technique: T1119: Automated Collection
H1N1 bypasses user access control by using a DLL hijacking vulnerability in the Windows Update Standalone Installer .
Technique: T1548: Abuse Elevation Control Mechanism
OilRig has used compromised credentials to access other systems on a victim network.
Technique: T1078: Valid Accounts
Kimsuky has used browser extensions including Google Chrome to steal passwords and cookies from browsers.
Technique: T1555: Credentials from Password Stores
PUNCHTRACK scrapes memory for properly formatted payment card data.
Technique: T1005: Data from Local System
AuditCred can utilize proxy for communications.
Technique: T1090: Proxy
HAWKBALL has sent system information and files over the C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
This hidden information can be used for command and control of compromised systems.
Technique: T1001: Data Obfuscation
Execution via EWM injection may also evade detection from security products since the execution is masked under a legitimate process.
Technique: T1055: Process Injection
The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access , domain or enterprise administrator to bypass access controls set within the enterprise.
Technique: T1078: Valid Accounts
SilverTerrier uses SMTP for C2 communications.
Technique: T1071: Application Layer Protocol
Sakula also has the capability to invoke a reverse shell.
Technique: T1059: Command and Scripting Interpreter
For example, JavaScript Blobs can be abused to dynamically generate malicious files in the victim machine and may be dropped to disk by abusing JavaScript functions such as msSaveBlob.
Technique: T1027: Obfuscated Files or Information
Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Technique: T1112: Modify Registry
SoreFang can enumerate domain accounts via net.exe user /domain.
Technique: T1087: Account Discovery
Andariel has hidden malicious executables within PNG files.
Technique: T1027: Obfuscated Files or Information
NETWIRE has been spread via e-mail campaigns utilizing malicious attachments.
Technique: T1566: Phishing
Derusbi is capable of creating a remote Bash shell and executing commands.
Technique: T1059: Command and Scripting Interpreter
Machete detects the insertion of new devices by listening for the WM_DEVICECHANGE window message.
Technique: T1120: Peripheral Device Discovery
Lucifer has used UPX packed binaries.
Technique: T1027: Obfuscated Files or Information
A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
Technique: T1564: Hide Artifacts
Gazer stores configuration items in alternate data streams  if the Registry is not accessible.
Technique: T1564: Hide Artifacts
Umbreon provides additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet.
Technique: T1205: Traffic Signaling
Turla has used net user /domain to enumerate domain accounts.
Technique: T1087: Account Discovery
Kazuar uses cmd.exe to execute commands on the victim’s machine.
Technique: T1059: Command and Scripting Interpreter
QakBot can use netstat to enumerate current network connections.
Technique: T1049: System Network Connections Discovery
Operation Wocao has used Mimikatz to dump certificates and private keys from the Windows certificate store.
Technique: T1552: Unsecured Credentials
Remexi gathers and exfiltrates keystrokes from the machine.
Technique: T1056: Input Capture
Since mavinject.exe is digitally signed by Microsoft, proxying execution via this method may evade detection by security products because the execution is masked under a legitimate process.
Technique: T1218: Signed Binary Proxy Execution
BOOTRASH has used unallocated disk space between partitions for a hidden file system that stores components of the Nemesis bootkit.
Technique: T1564: Hide Artifacts
Popular open source projects that are used as dependencies in many applications may be targeted as a means to add malicious code to users of the dependency.
Technique: T1195: Supply Chain Compromise
Some private keys require a password or passphrase for operation, so an adversary may also use Input Capture for keylogging or attempt to Brute Force the passphrase off-line.
Technique: T1552: Unsecured Credentials
It has historically leveraged legitimate third-party websites to host the malware’s command and control (C2) information, acting as “dead drops”
Technique: T1102: Web Service
TAINTEDSCRIBE can enable Windows CLI access and execute files.
Technique: T1059: Command and Scripting Interpreter
APT29 used forged SAML tokens that allowed the actors to impersonate users and bypass MFA, enabling APT29 to access enterprise cloud applications and services.
Technique: T1550: Use Alternate Authentication Material
Cookies are often valid for an extended period of time, even if the web application is not actively used.
Technique: T1539: Steal Web Session Cookie
Stuxnet propagates to available network shares.
Technique: T1021: Remote Services
KGH_SPY can collect credentials from WINSCP.
Technique: T1555: Credentials from Password Stores
Leviathan has established domains that impersonate legitimate entities to use for targeting efforts.
Technique: T1583: Acquire Infrastructure
Normal users may want to hide users when there are many users accounts on a given system or want to keep an account hidden from the other users on the system.
Technique: T1564: Hide Artifacts
This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks.
Technique: T1564: Hide Artifacts
The login shell then configures the user environment with ~/.zprofile and ~/.zlogin.
Technique: T1546: Event Triggered Execution
In this campaign the KopiLuwak backdoor was encoded and delivered in a Windows shortcut (.lnk) file
Technique: T1547: Boot or Logon Autostart Execution
If and only if the DC is able to successfully decrypt the timestamp with the hash of the user’s password, it will then send an Authentication Server Response  message that contains the Ticket Granting Ticket  to the user.
Technique: T1558: Steal or Forge Kerberos Tickets
Adversaries may attempt to discover information about the services enabled throughout the environment.
Technique: T1526: Cloud Service Discovery
Honeybee drops a Word file containing a Base64-encoded file in it that is read, decoded, and dropped to the disk by the macro.
Technique: T1140: Deobfuscate/Decode Files or Information
Darkhotel has used AES-256 and 3DES for C2 communications.
Technique: T1573: Encrypted Channel
Because some programs do not call other programs using the full path, adversaries may place their own file in the directory where the calling program is located, causing the operating system to launch their malicious software at the request of the calling program.
Technique: T1574: Hijack Execution Flow
Metamorfo has hidden its GUI using the ShowWindow WINAPI call.
Technique: T1564: Hide Artifacts
Emotet has been observed leveraging a module that scrapes email data from Outlook.
Technique: T1114: Email Collection
GALLIUM used the Windows command shell to execute commands.
Technique: T1059: Command and Scripting Interpreter
Patchwork used JavaScript code and .SCT files on victim machines.
Technique: T1059: Command and Scripting Interpreter
With System permissions and using Terminal Services Console, `c:\windows\system32\tscon.exe session number to be stolen`, an adversary can hijack a session without the need for credentials or prompts to the user.
Technique: T1563: Remote Service Session Hijacking
Adversaries may target LSASS drivers to obtain persistence.
Technique: T1547: Boot or Logon Autostart Execution
Rover searches for files on local drives based on a predefined list of file extensions.
Technique: T1005: Data from Local System
Malicious modifications to NAT may enable an adversary to bypass restrictions on traffic routing that otherwise separate trusted and untrusted networks.
Technique: T1599: Network Boundary Bridging
Normally an application is run in the current user’s context, regardless of which user or group owns the application.
Technique: T1548: Abuse Elevation Control Mechanism
BBSRAT has been seen loaded into msiexec.exe through process hollowing to hide its execution.
Technique: T1055: Process Injection
It also deletes Windows Event Logs : Application, Security, Setup, System
Technique: T1070: Indicator Removal on Host
A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as a way to pivot into an authenticated intranet.
Technique: T1185: Browser Session Hijacking
Avenger has the ability to identify the host volume ID and the OS architecture on a compromised host.
Technique: T1082: System Information Discovery
KEYMARBLE has the capability to delete files off the victim’s machine.
Technique: T1070: Indicator Removal on Host
Hydraq creates a backdoor through which remote attackers can adjust token privileges.
Technique: T1134: Access Token Manipulation
The malicious macros were all designed to use Windows PowerShell to download a shellcode-based payload from a remote server
Technique: T1546: Event Triggered Execution
CookieMiner has installed multiple new Launch Agents in order to maintain persistence for cryptocurrency mining software.
Technique: T1543: Create or Modify System Process
Dark Caracal spearphished victims via Facebook and Whatsapp.
Technique: T1566: Phishing