HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
APT33 has used VBScript to initiate the delivery of payloads.
Technique: T1059: Command and Scripting Interpreter
Frankenstein has enumerated hosts, looking for the system's machine name.
Technique: T1082: System Information Discovery
PowerShower has the ability to encode C2 communications with base64 encoding.
Technique: T1132: Data Encoding
BoxCaon can upload files from a compromised host.
Technique: T1005: Data from Local System
BADFLICK has been distributed via spearphishing campaigns containing malicious Microsoft Word documents.
Technique: T1566: Phishing
Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services.
Technique: T1597: Search Closed Sources
Egregor can enumerate all connected drives.
Technique: T1049: System Network Connections Discovery
A more comprehensive list of known packers is available,  but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses.
Technique: T1027: Obfuscated Files or Information
Adversaries may abuse PowerShell commands and scripts for execution.
Technique: T1059: Command and Scripting Interpreter
LockerGoga has been observed changing account passwords and logging off current users.
Technique: T1531: Account Access Removal
First, the sample is UPX packed
Technique: T1027: Obfuscated Files or Information
Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads.
Technique: T1620: Reflective Code Loading
StrongPity can identify if ESET or BitDefender antivirus are installed before dropping its payload.
Technique: T1518: Software Discovery
Domain accounts can cover user, administrator, and service accounts.
Technique: T1136: Create Account
Valak can determine the Windows version and computer name on a compromised host.
Technique: T1082: System Information Discovery
APT32's backdoor can query the Windows Registry to gather system information.
Technique: T1012: Query Registry
Backdoor.Oldrea collects the current username from the victim.
Technique: T1033: System Owner/User Discovery
The attack involved a spear-phishing email with a subject of “Project Offer” and a malicious Word document (SHA256: d393349a4ad00902e3d415b622cf27987a0170a786ca3a1f991a521bff645318) as an attachment
Technique: T1566: Phishing
Chaes has used Base64 to encode C2 communications.
Technique: T1132: Data Encoding
BendyBear has encrypted payloads using RC4 and XOR.
Technique: T1027: Obfuscated Files or Information
Fysbis has established persistence using a systemd service.
Technique: T1543: Create or Modify System Process
TeamTNT has also encoded files using Base64.
Technique: T1027: Obfuscated Files or Information
Agent Tesla has used ProcessWindowStyle.Hidden to hide windows.
Technique: T1564: Hide Artifacts
To operate and evade standard analysis tools, most of the functions are hashed
Technique: T1027: Obfuscated Files or Information
This API does not validate that the program requesting root privileges comes from a reputable source or has been maliciously modified.
Technique: T1548: Abuse Elevation Control Mechanism
TSCookie has the ability to execute shell commands on the infected host.
Technique: T1059: Command and Scripting Interpreter
In this ongoing campaign, FIN7 is targeting organizations with spear phishing emails containing either a malicious DOCX or RTF file – two versions of the same LNK file and VBScript technique
Technique: T1547: Boot or Logon Autostart Execution
SpeakUp uses cron tasks to ensure persistence.
Technique: T1053: Scheduled Task/Job
If Adobe Flash or Microsoft Silverlight is no longer required, DHS recommends that those applications be removed from systems.The IOCs provided with this alert include IP addresses determined to be part of the HIDDEN COBRA botnet infrastructure, identified as DeltaCharlie
Technique: T1016: System Network Configuration Discovery
The Data field is encrypted using a custom stream cipher.
Technique: T1486: Data Encrypted for Impact
REvil has encrypted C2 communications with the ECIES algorithm.
Technique: T1573: Encrypted Channel
Kasidet has the ability to initiate keylogging and screen captures.
Technique: T1113: Screen Capture
OilRig has used the command-line interface for execution.
Technique: T1059: Command and Scripting Interpreter
Pisloader has commands to list drives on the victim machine and to list file information for a given directory.
Technique: T1083: File and Directory Discovery
The interactive shell uses the ~/.zshrc to configure the user environment.
Technique: T1546: Event Triggered Execution
WannaCry uses attrib +h and icacls .
Technique: T1222: File and Directory Permissions Modification
APT32 has enumerated DC servers using the command net group "Domain Controllers" /domain.
Technique: T1018: Remote System Discovery
Python code can also be compiled into binary executables.
Technique: T1059: Command and Scripting Interpreter
jRAT has been distributed as HTA files with JScript.
Technique: T1059: Command and Scripting Interpreter
RogueRobin checks the running processes for evidence it may be running in a sandbox environment.
Technique: T1057: Process Discovery
Adversaries can also use NETEAGLE to establish an RDP connection with a controller over TCP/7519.
Technique: T1071: Application Layer Protocol
Stuxnet attempts to access network resources with a domain account’s credentials.
Technique: T1078: Valid Accounts
Indrik Spider used Cobalt Strike to carry out credential dumping using ProcDump.
Technique: T1003: OS Credential Dumping
Crimson can set a Registry key to determine how long it has been installed and possibly to indicate the version number.
Technique: T1112: Modify Registry
So, it is possible for poor configurations to allow an adversary to modify executables referenced by current Launch Daemon's plist files.
Technique: T1543: Create or Modify System Process
On macOS this behavior is conceptually the same as on Linux, differing only in how the macOS dynamic libraries  is implemented at a lower level.
Technique: T1574: Hijack Execution Flow
Bad Rabbit’s infpub.dat file uses NTLM login credentials to brute force Windows machines.
Technique: T1110: Brute Force
Nomadic Octopus has used PowerShell for execution.
Technique: T1059: Command and Scripting Interpreter
ROKRAT use HTTPS for all command and control communication methods.
Technique: T1071: Application Layer Protocol
We found a brute-force tool called NLBrute , with configuration files that tell us it had been set up to use an included set of username and passwords to try to break in to machines that have Remote Desktop enabled
Technique: T1110: Brute Force
MechaFlounder has the ability to run commands on a compromised host.
Technique: T1059: Command and Scripting Interpreter
NETWIRE can use crontabs to establish persistence.
Technique: T1053: Scheduled Task/Job
Azorult can download and execute additional files.
Technique: T1105: Ingress Tool Transfer
Adversaries may also compromise existing commands in the operating system to produce false output to mislead defenders.
Technique: T1601: Modify System Image
Frankenstein has enumerated hosts, looking for the public IP address of the system.
Technique: T1016: System Network Configuration Discovery
Adversaries may abuse VNC to perform malicious actions as the logged-on user such as opening documents, downloading files, and running arbitrary commands.
Technique: T1021: Remote Services
And, according to the collected config files, the group upgraded their malware communications from plain text http to encrypted https in October 2013
Technique: T1071: Application Layer Protocol
Its use of a PowerShell payload means that only legitimate system processes are utilized and that the malicious code execution can only be identified through enhanced logging or in memory
Technique: T1546: Event Triggered Execution
Octopus has exfiltrated data to file sharing sites.
Technique: T1567: Exfiltration Over Web Service
Once a user has double-clicked the embedded image, the form executes a VB setup script
Technique: T1204: User Execution
ZeroT gathers the victim's computer name, Windows version, and system language, and then sends it to its C2 server.
Technique: T1082: System Information Discovery
Carbanak has copied legitimate service names to use for malicious services.
Technique: T1036: Masquerading
NETWIRE can inject code into system processes including notepad.exe, svchost.exe, and vbc.exe.
Technique: T1055: Process Injection
HELLOKITTY can enumerate logical drives on a target system.
Technique: T1082: System Information Discovery
Tropic Trooper is capable of enumerating the running processes on the system using pslist.
Technique: T1057: Process Discovery
These credentials may include those needed for Docker API authentication or secrets from Kubernetes cluster components.
Technique: T1552: Unsecured Credentials
Before being appended to image files, HAMMERTOSS commands are encrypted with a key composed of both a hard-coded value and a string contained on that day's tweet.
Technique: T1573: Encrypted Channel
Resource fork content may also be obfuscated/encrypted until execution.
Technique: T1564: Hide Artifacts
TA505 has used .iso files to deploy malicious .lnk files.
Technique: T1553: Subvert Trust Controls
FIN8 has cleared logs during post compromise cleanup activities.
Technique: T1070: Indicator Removal on Host
Examples have been seen in the wild where template injection was used to load malicious code containing an exploit.
Technique: T1221: Template Injection
In addition, multiple APT40 command and control (C2) domains were initially registered by China based domain resellers and had Whois records with Chinese location information, suggesting a China based infrastructure procurement process
Technique: T1102: Web Service
"Are you Happy?" campaign."FreeMilk" campaign."North Korean Human Rights" campaign."Evil New Year 2018" campaign.On January 2nd of 2018, the "Evil New Year 2018" was started
Technique: T1543: Create or Modify System Process
can collect the victim user name.
Technique: T1033: System Owner/User Discovery
HD Creates a file in the Temp path and names it “hd” + PCID then invokes another program module named hd.test1 to identify logical drives
Technique: T1083: File and Directory Discovery
Kobalos can exfiltrate credentials over the network via UDP.
Technique: T1048: Exfiltration Over Alternative Protocol
A Patchwork payload deletes Resiliency Registry keys created by Microsoft Office applications in an apparent effort to trick users into thinking there were no issues during application runs.
Technique: T1112: Modify Registry
APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium, to pack their implants.
Technique: T1027: Obfuscated Files or Information
Higaisa used HTTP and HTTPS to send data back to its C2 server.
Technique: T1071: Application Layer Protocol
After applying this decryption algorithm, we are presented with the following data: h=HOSTNAME-PC&f=mission.ini&c=& The response made by the C2 server uses the same RC4 key for encryption
Technique: T1573: Encrypted Channel
Wizard Spider has used HTTP for network communications.
Technique: T1071: Application Layer Protocol
Tonto Team abuses a legitimate and signed Microsoft executable to launch a malicious DLL.
Technique: T1574: Hijack Execution Flow
Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc.
Technique: T1555: Credentials from Password Stores
master boot record wiper 
Technique: T1561: Disk Wipe
TEMP.Veles has used a VPN to persist in the victim environment.
Technique: T1133: External Remote Services
Adversaries may collect the keychain storage data from a system to acquire credentials.
Technique: T1555: Credentials from Password Stores
appinit_dll
Technique: T1546: Event Triggered Execution
FELIXROOT encrypts strings in the backdoor using a custom XOR algorithm.
Technique: T1027: Obfuscated Files or Information
The group has also used the Plink utility and other tools to create tunnels to C2 servers.
Technique: T1071: Application Layer Protocol
Pillowmint has encrypted stolen credit card information with AES and further encoded it with Base64.
Technique: T1560: Archive Collected Data
at can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account .
Technique: T1053: Scheduled Task/Job
Figure 7: The same de-obfuscated code as Figure 2 The only other script content of the blog-page[.]html is an empty script section
Technique: T1027: Obfuscated Files or Information
Kerrdown can download specific payloads to a compromised host based on OS architecture.
Technique: T1105: Ingress Tool Transfer
One of the tags in these files can be apple.awt.UIElement, which allows for Java applications to prevent the application's icon from appearing in the Dock.
Technique: T1564: Hide Artifacts
FlawedAmmyy has used HTTP for C2.
Technique: T1071: Application Layer Protocol
Netwalker can delete the infected system's Shadow Volumes to prevent recovery.
Technique: T1490: Inhibit System Recovery
KGH_SPY can collect drive information from a compromised host.
Technique: T1082: System Information Discovery
jRAT can list local services.
Technique: T1007: System Service Discovery
By running their own DNS servers, adversaries can have more control over how they administer server-side DNS C2 traffic .
Technique: T1583: Acquire Infrastructure
Transparent Tribe has crafted VBS-based malicious documents.
Technique: T1059: Command and Scripting Interpreter
Most of them manipulate the machine to download and execute different files
Technique: T1105: Ingress Tool Transfer
A thorough explanation of what information is collected can be found in a breakdown by Cofense from late 2018.   The script verifies all parts of the malware have been downloaded.  After downloading the payload, the XSL script checks to make sure every piece of the malware was downloaded.   One of the twelve download commands as detected by the Cybereason platform in same variant of Astaroth.   The twelve downloaded files
Technique: T1105: Ingress Tool Transfer
NotPetya drops PsExec with the filename dllhost.dat.
Technique: T1036: Masquerading
RATANKBA uses the command reg query “HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings”.
Technique: T1012: Query Registry
Use of the RTLO character has been seen in many targeted intrusion attempts and criminal activity.
Technique: T1036: Masquerading
Kimsuky has used Google Chrome browser extensions to infect victims and to steal passwords and cookies.
Technique: T1176: Browser Extensions
An adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence.
Technique: T1053: Scheduled Task/Job
FELIXROOT uses Rundll32 for executing the dropper program.
Technique: T1218: Signed Binary Proxy Execution
Spearphishing via service is a specific variant of spearphishing.
Technique: T1566: Phishing
MuddyWater has used scheduled tasks to establish persistence.
Technique: T1053: Scheduled Task/Job
MuddyWater has attempted to get users to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails.
Technique: T1204: User Execution
Lurid performs XOR encryption.
Technique: T1573: Encrypted Channel
HAWKBALL is a backdoor that communicates to a single hard-coded C2 server using HTTP
Technique: T1071: Application Layer Protocol
Some FinFisher variants incorporate an MBR rootkit.
Technique: T1542: Pre-OS Boot
Dyre has a command to download and executes additional files.
Technique: T1105: Ingress Tool Transfer
AutoFocus customers may learn more from the DarkHydrus tag  IOC Related SHA256 Hashes Payloads cec36e8ed65ac6f250c05b4a17c09f58bb80c19b73169aaf40fa15c8d3a9a6a1 ac7f9c536153780ccbec949f23b86f3d16e3105a5f14bb667df752aa815b0dc4 a547a02eb4fcb8f446da9b50838503de0d46f9bb2fd197c9ff63021243ea6d88 d428d79f58425d831c2ee0a73f04749715e8c4dd30ccd81d92fe17485e6dfcda dd2625388bb2d2b02b6c10d4ee78f68a918b25ddd712a0862bcf92fa64284ffa b2571e3b4afbce56da8faa726b726eb465f2e5e5ed74cf3b172b5dd80460ad81 c8b3d4b6acce6b6655e17255ef7a214651b7fc4e43f9964df24556343393a1a3 ce84b3c7986e6a48ca3171e703e7083e769e9ced1bbdd7edf8f3eab7ce20fd00 99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c Delivery documents d393349a4ad00902e3d415b622cf27987a0170a786ca3a1f991a521bff645318 8063c3f134f4413b793dfc05f035b6480aa1636996e8ac4b94646292a5f87fde 9eac37a5c675cd1750cd50b01fc05085ce0092a19ba97026292a60b11b45bf49 cf9b2b40ac621aaf3241ff570bd7a238f6402102c29e4fbba3c5ce0cb8bc25f9 0a3d5b2a8ed60e0d96d5f0d9d6e00cd6ab882863afbb951f10c395a3d991fbc1 0b1d5e17443f0896c959d22fa15dadcae5ab083a35b3ff6cb48c7f967649ec82 870c8b29be2b596cc2e33045ec48c80251e668abd736cef9c5449df16cf2d3b8 ff0b59f23630f4a854448b82f1f0cd66bc4b1124a3f49f0aecaca28309673cb0 01fd7992aa71f4dca3a3766c438fbabe9aea78ca5812ab75b5371b48bd2625e2 6dcb3492a45a08127f9816a1b9e195de2bb7e0731c4e7168392d0e8068adae7a 47b8ad55b66cdcd78d972d6df5338b2e32c91af0a666531baf1621d2786e7870 776c056096f0e73898723c0807269bc299ae3bbd8e9542f0a1cbba0fd3470cb4 cf7863e023475d695c6f72c471d314b8b1781c6e9087ff4d70118b30205da5f0 e88045931b9d99511ce71cc94f2e3d1159581e5eb26d4e05146749e1620dc678 26e641a9149ff86759c317b57229f59ac48c5968846813cafb3c4e87c774e245 b5cfaac25d87a6e8ebabc918facce491788863f120371c9d00009d78b6a8c350 ad3fd1571277c7ce93dfbd58cee3b3bec84eeaf6bb29a279ecb6a656028f771c Related Domains maccaffe[.]com cisc0[.]net 0utl00k[.]net msdncss[.]com 0ffice[.]com 0ffiice[.]com micrrosoft[.]net anyconnect[.]stream bigip[.]stream  fortiweb[.]download  kaspersky[.]science  microtik[.]stream  owa365[.]bid  symanteclive[.]download  windowsdefender[.]win allexa[.]net kaspersky[.]host hotmai1[.]com 0utlook[.]bid
Technique: T1087: Account Discovery
EVILNUM can achieve persistence through the Registry Run key.
Technique: T1547: Boot or Logon Autostart Execution
Establishing a persona  on social media may require development of additional documentation to make them seem real.
Technique: T1585: Establish Accounts
CookieMiner can download additional scripts from a web server.
Technique: T1105: Ingress Tool Transfer
Adversaries can steal user application access tokens as a means of acquiring credentials to access remote systems and resources.
Technique: T1528: Steal Application Access Token
Fysbis has the ability to search for files.
Technique: T1083: File and Directory Discovery
BOOSTWRITE has been signed by a valid CA.
Technique: T1553: Subvert Trust Controls
With an OAuth access token an adversary can use the user-granted REST API to perform functions such as email searching and contact enumeration.
Technique: T1550: Use Alternate Authentication Material
Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials .
Technique: T1021: Remote Services
A list of all shims currently installed by the default Windows installer  is kept in:
* %WINDIR%\AppPatch\sysmain.sdb and
* hklm\software\microsoft\windows nt\currentversion\appcompatflags\installedsdb
Custom databases are stored in:
* %WINDIR%\AppPatch\custom & %WINDIR%\AppPatch\AppPatch64\Custom and
* hklm\software\microsoft\windows nt\currentversion\appcompatflags\custom
To keep shims secure, Windows designed them to run in user mode so they cannot modify the kernel and you must have administrator privileges to install a shim.
Technique: T1546: Event Triggered Execution
In green, functions from Keychaindump C&C communication Keydnap is using the onion.to Tor2Web proxy over HTTPS to report back to its C&C server
Technique: T1090: Proxy
Threat Group-3390 has embedded malicious code into websites to screen a potential victim's IP address and then exploit their browser if they are of interest.
Technique: T1608: Stage Capabilities
For example, an adversary in a privileged user context  administrator may spawn a new process and assign the parent as a process running as SYSTEM , causing the new process to be elevated via the inherited access token.
Technique: T1134: Access Token Manipulation
Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct Phishing for Information or Phishing.
Technique: T1585: Establish Accounts
APT38 clears Window Event logs and Sysmon logs from the system.
Technique: T1070: Indicator Removal on Host
Zebrocy has the capability to upload dumper tools that extract credentials from web browsers and store them in database files.
Technique: T1555: Credentials from Password Stores
After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software.
Technique: T1205: Traffic Signaling
It will then connect to the system with RegConnectRegistryW and modify the Registry to disable UAC remote restrictions by setting SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy to 1.
Technique: T1112: Modify Registry
Conti can discover files on a local system.
Technique: T1083: File and Directory Discovery
Adversaries may search CDN data to gather actionable information.
Technique: T1596: Search Open Technical Databases
Hancitor has used a macro to check that an ActiveDocument shape object in the lure message is present.
Technique: T1497: Virtualization/Sandbox Evasion
Prikormka contains a module that collects documents with certain extensions from removable media or fixed drives connected via USB.
Technique: T1025: Data from Removable Media
DustySky captures PNG screenshots of the main screen.
Technique: T1113: Screen Capture
OSInfo performs a connection test to discover remote systems in the network Olympic Destroyer uses Windows Management Instrumentation to enumerate all systems in the network.
Technique: T1018: Remote System Discovery
For each executable, ThiefQuest prepends a copy of itself to the beginning of the file.
Technique: T1554: Compromise Client Software Binary
BLUELIGHT has exfiltrated data over its C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
For example, /var/db/sudo's timestamp can be monitored to see if it falls within the timestamp_timeout range.
Technique: T1548: Abuse Elevation Control Mechanism
Bandook is capable of taking an image of and uploading the current desktop.
Technique: T1113: Screen Capture
Adversaries can use a command such as tell application “System Events” to make login item at end with properties /path/to/executable.
Technique: T1547: Boot or Logon Autostart Execution
Mustang Panda has searched the victim system for the InstallUtil.exe program and its version.
Technique: T1518: Software Discovery
In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine  or data storage snapshots through the cloud management dashboard or cloud APIs.
Technique: T1578: Modify Cloud Compute Infrastructure
Ursnif has dropped payload and configuration files to disk.
Technique: T1105: Ingress Tool Transfer
NanoCore can capture audio feeds from the system.
Technique: T1123: Audio Capture
Victim system reconnaissance The code then tries to obtain the victim’s public IP via “https://api.ipify.org/”
Technique: T1016: System Network Configuration Discovery
Two modifications are made to UPX version 3.91:  The magic bytes UPX! in the UPX header are replaced with ASS7, The decompressed code and strings sections are XORed with 0x01
Technique: T1027: Obfuscated Files or Information
BS2005 uses Base64 encoding for communication in the message body of an HTTP request.
Technique: T1132: Data Encoding
watch/?   search/?  find/?    results/? open/?    search/?  close/?   The “ai” value stands for the payload title
Technique: T1083: File and Directory Discovery
The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# or Visual Basic code to be inserted into an XML project file.
Technique: T1127: Trusted Developer Utilities Proxy Execution
KeyBoy exploits the vulnerability CVE-2012-0158 for execution.
Technique: T1203: Exploitation for Client Execution
Frankenstein has used PowerShell to run a series of base64-encoded commands, that acted as a stager and enumerated hosts.
Technique: T1059: Command and Scripting Interpreter
QakBot can send stolen information to C2 nodes including passwords, accounts, and emails.
Technique: T1041: Exfiltration Over C2 Channel
APT34 has a tool called CANDYKING to capture a screenshot of user's desktop.
Technique: T1113: Screen Capture
SQLRat relies on users clicking on an embedded image to execute the scripts.
Technique: T1204: User Execution
If the <flag> field of the message header is greater than one, the XOR key used to encrypt message bodies is iterated in reverse when encrypting and decrypting messages
Technique: T1521: nan
RainyDay has the ability to uninstall itself by deleting its service and files.
Technique: T1070: Indicator Removal on Host
Adversaries may directly leverage compromised email accounts for Phishing for Information or Phishing.
Technique: T1586: Compromise Accounts
Bandook has decoded its PowerShell script.
Technique: T1140: Deobfuscate/Decode Files or Information
Conficker has used a DGA that seeds with the current UTC victim system date to generate domains.
Technique: T1568: Dynamic Resolution
Users can protect themselves from such attacks by disabling Office macros in their settings and also by being more vigilant when enabling macros (especially when prompted) in documents, even if such documents are from seemingly trusted sources
Technique: T1059: Command and Scripting Interpreter
.sdb
Technique: T1546: Event Triggered Execution
Chimera has used netstat -ano | findstr EST to discover network connections.
Technique: T1049: System Network Connections Discovery
BadPatch can download and execute or update malware.
Technique: T1105: Ingress Tool Transfer
POWERSTATS has connected to C2 servers through proxies.
Technique: T1090: Proxy
Darkhotel malware has used a series of checks to determine if it's being analyzed; checks include the length of executable names, if a filename ends with .Md5.exe, and if the program is executed from the root of the C:\ drive, as well as checks for sandbox-related libraries.
Technique: T1497: Virtualization/Sandbox Evasion
Exfiltration Over Alternative Protocol can be done using various common operating system utilities such as Net/SMB or FTP.
Technique: T1048: Exfiltration Over Alternative Protocol
APT39 used custom tools to create SOCK5 and custom protocol proxies between infected hosts.
Technique: T1090: Proxy
The analysis of the tools and techniques used in the Astaroth campaign show how truly effective LOLbins are at evading antivirus products
Technique: T1518: Software Discovery
An example of adversary use of unused AWS regions is to mine cryptocurrency through Resource Hijacking, which can cost organizations substantial amounts of money over time depending on the processing power used.
Technique: T1535: Unused/Unsupported Cloud Regions
Transparent Tribe can hide legitimate directories and replace them with malicious copies of the same name.
Technique: T1564: Hide Artifacts
Revenge RAT uses cmd.exe to execute commands and run scripts on the victim's machine.
Technique: T1059: Command and Scripting Interpreter
This file controls what mode SELinux is in.
Technique: T1518: Software Discovery
MBR + overwrite/wipe
Technique: T1561: Disk Wipe
Egregor has used the Windows API to make detection more difficult.
Technique: T1106: Native API
Before creating a window, graphical Windows-based processes must prescribe to or register a windows class, which stipulate appearance and behavior .
Technique: T1055: Process Injection
Wizard Spider has established persistence via the Registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and a shortcut within the startup folder.
Technique: T1547: Boot or Logon Autostart Execution
Dragonfly 2.0 identified and browsed file servers in the victim network, sometimes , viewing files pertaining to ICS or Supervisory Control and Data Acquisition  systems.
Technique: T1135: Network Share Discovery
Destroy Evidence: Securely deleted logs, as well as deployed and executed disk-wiping malware, to cover tracks and disrupt forensic analysis
Technique: T1070: Indicator Removal on Host
Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Technique: T1012: Query Registry
Mustang Panda has searched the entire target system for DOC, DOCX, PPT, PPTX, XLS, XLSX, and PDF files.
Technique: T1083: File and Directory Discovery
TeamTNT has added batch scripts to the startup folder.
Technique: T1547: Boot or Logon Autostart Execution
Apple’s OSA provides scripting capabilities to control applications, interface with the operating system, and bridge access into the rest of Apple’s internal APIs.
Technique: T1059: Command and Scripting Interpreter
More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.
Technique: T1566: Phishing
Returns the screenshot to the C2 via: <img src=’data:image/jpeg;base64,[base64 of screenshot]’ width=800 height=500 /><br>   111 startTakeScreenShot Creates a thread to take a screenshot at a set interval (default: every 10 seconds)
Technique: T1113: Screen Capture
Lazarus Group has used Themida to pack at least two separate backdoor implants.
Technique: T1027: Obfuscated Files or Information
Some specifics from in-the-wild use include:
* A spearphishing attachment containing a document with a resource that is automatically loaded when the document is opened  Template Injection.
Technique: T1187: Forced Authentication
Adversaries could also edit the target path or entirely replace an existing shortcut so their tools will be executed instead of the intended legitimate program.
Technique: T1547: Boot or Logon Autostart Execution
Indrik Spider has served fake updates via legitimate websites that have been compromised.
Technique: T1584: Compromise Infrastructure
This hash does not allow pass-the-hash style attacks, and instead requires Password Cracking to recover the plaintext password.
Technique: T1003: OS Credential Dumping
The code will gather some information about the system, specifically the local IP address, MAC address, and the external IP address of the system
Technique: T1016: System Network Configuration Discovery
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
Technique: T1082: System Information Discovery
The key differences in this variant:  Two CAB files are encoded into the Word document in text boxes instead of being appended in the DOC file There is one CAB file for an x86 system and another for an x64 system This malware sample uses uacme.exe with dummy.dll to implement the UAC bypass  exe is the program vulnerable to the UAC bypass attack dll runs install.bat to set up the service (same as NTWDBLIB.dll)   exe and dummy.dll may be either 64-bit or 32-bit binaries based on the OS
Technique: T1548: Abuse Elevation Control Mechanism
Fox Kitten has accessed files to gain valid credentials.
Technique: T1552: Unsecured Credentials
The Trojan uses the access token to write the string above to the first file uploaded to Google drive whose filename is <process ID of Trojan>.txt
Technique: T1134: Access Token Manipulation
Responds to the IRC server via PRIVMSG with “Download  Success :FilePath=<path to downloaded file>” or “Download Fail” if unsuccessful
Technique: T1105: Ingress Tool Transfer
RainyDay can use HTTP in C2 communications.
Technique: T1071: Application Layer Protocol
An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable.
Technique: T1574: Hijack Execution Flow
BabyShark has executed the whoami command.
Technique: T1033: System Owner/User Discovery
Emotet has used HTTP over ports such as 20, 22, 7080, and 50000, in addition to using ports commonly associated with HTTP/S.
Technique: T1571: Non-Standard Port
Magic Hound malware has used VBS scripts for execution.
Technique: T1059: Command and Scripting Interpreter
Bazar can identify the installed antivirus engine.
Technique: T1518: Software Discovery
Ramsay has masqueraded as a JPG image file.
Technique: T1036: Masquerading
TA505 has used HTTP to communiate with C2 nodes.
Technique: T1071: Application Layer Protocol
Avaddon deletes backups and shadow copies using native system tools.
Technique: T1490: Inhibit System Recovery
IndigoZebra has acquired open source tools such as NBTscan and Meterpreter for their operations.
Technique: T1588: Obtain Capabilities
httpclient encrypts C2 content with XOR using a single byte, 0x12.
Technique: T1573: Encrypted Channel
Most of the PowerShell commands would call Windows Management Instrumentation (WMI)
Technique: T1047: Windows Management Instrumentation
BlackMould can copy files on a compromised host.
Technique: T1005: Data from Local System
This field contains a URL that the Trojan will use to upload the contents of the <process ID of Trojan>.txt file, which will be structured as <process ID of Trojan>.<C2 domain> where the process ID is encoded with the same character substitution function as seen previously in Table 4
Technique: T1057: Process Discovery
OSInfo discovers shares on the network PlugX has a module to enumerate network shares.
Technique: T1135: Network Share Discovery
Starloader has masqueraded as legitimate software update packages such as Adobe Acrobat Reader and Intel.
Technique: T1036: Masquerading
OceanSalt can encode data with a NOT operation before sending the data to the control server.
Technique: T1132: Data Encoding
Configuration data used by Rising Sun is encrypted using RC4.
Technique: T1027: Obfuscated Files or Information
RogueRobin gathers the IP address and domain from the victim’s machine.
Technique: T1016: System Network Configuration Discovery
It was heavily modified, with almost all original code stripped out aside from its sekurlsa::logonpasswords credential stealing feature
Technique: T1003: OS Credential Dumping
Stuxnet decrypts resources that are loaded into memory and executed.
Technique: T1140: Deobfuscate/Decode Files or Information
Lazarus Group malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, potentially evading SSL traffic inspection/decryption.
Technique: T1001: Data Obfuscation
Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts.
Technique: T1556: Modify Authentication Process
Adversaries may acquire credentials from web browsers by reading files specific to the target browser.
Technique: T1555: Credentials from Password Stores
Carberp has used user mode rootkit techniques to remain hidden on the system.
Technique: T1014: Rootkit
Carbanak can create a Windows account.
Technique: T1136: Create Account
TDTESS provides a reverse shell on the victim.
Technique: T1059: Command and Scripting Interpreter
By running malicious code inside of a virtual instance, adversaries can hide artifacts associated with their behavior from security tools that are unable to monitor activity inside the virtual instance.
Technique: T1564: Hide Artifacts
Adversaries may use SID-History Injection to escalate privileges and bypass access controls.
Technique: T1134: Access Token Manipulation
Access remote objects interactively from the pupy shell and get auto-completion of remote attributes
Technique: T1059: Command and Scripting Interpreter
Most Linux and Linux-based platforms provide a standard set of permission groups  and a standard set of permissions  that are applied to each group.
Technique: T1222: File and Directory Permissions Modification
Malicious AppCert DLLs may also provide persistence by continuously being triggered by API activity.
Technique: T1546: Event Triggered Execution
Adversaries may attempt to get information about running processes on a system.
Technique: T1057: Process Discovery
APT28 has saved files with hidden file attributes.
Technique: T1564: Hide Artifacts
The first 11 bytes of the received buffer are encrypted with the XOR algorithm
Technique: T1027: Obfuscated Files or Information
PoetRAT has used Word documents with VBScripts to execute malicious activities.
Technique: T1059: Command and Scripting Interpreter
MoonWind has a command to return a list of running processes.
Technique: T1057: Process Discovery
GravityRAT steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.
Technique: T1005: Data from Local System
Drovorub can exfiltrate files over C2 infrastructure.
Technique: T1041: Exfiltration Over C2 Channel
Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands.
Technique: T1059: Command and Scripting Interpreter
Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.
Technique: T1560: Archive Collected Data
Spark has used HTTP POST requests to communicate with its C2 server to receive commands.
Technique: T1071: Application Layer Protocol
GoldenSpy's uninstaller can delete registry entries, files and folders, and finally itself once these tasks have been completed.
Technique: T1070: Indicator Removal on Host
The built-in Windows command-line utility Reg may be used for local or remote Registry modification.
Technique: T1112: Modify Registry
Other accessibility features exist that may also be leveraged in a similar fashion: 
* On-Screen Keyboard: C:\Windows\System32\osk.exe
* Magnifier: C:\Windows\System32\Magnify.exe
* Narrator: C:\Windows\System32\Narrator.exe
* Display Switcher: C:\Windows\System32\DisplaySwitch.exe
* App Switcher: C:\Windows\System32\AtBroker.exe APT3 replaces the Sticky Keys binary C:\Windows\System32\sethc.exe for persistence.
Technique: T1546: Event Triggered Execution
HARDRAIN uses cmd.exe to execute netshcommands.
Technique: T1059: Command and Scripting Interpreter
Indrik Spider has used PowerShell Empire for execution of malware.
Technique: T1059: Command and Scripting Interpreter
The group also decrypted received information using the Triple DES algorithm and decompresses it using GZip.
Technique: T1140: Deobfuscate/Decode Files or Information
By default SSSD maintains a copy of the ticket database that can be found in /var/lib/sss/secrets/secrets.ldb as well as the corresponding key located in /var/lib/sss/secrets/.secrets.mkey.
Technique: T1558: Steal or Forge Kerberos Tickets
APT1 has used various open-source tools for privilege escalation purposes.
Technique: T1588: Obtain Capabilities
Adversaries can leverage OAuth authorization by constructing a malicious application designed to be granted access to resources with the target user's OAuth token.
Technique: T1528: Steal Application Access Token
Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation.
Technique: T1547: Boot or Logon Autostart Execution
APT34 has used base64-encoded files that are dropped to victims.
Technique: T1027: Obfuscated Files or Information
Hancitor has been delivered via phishing emails which contained malicious links.
Technique: T1566: Phishing
Dragonfly dropped and executed SecretsDump, a tool that dumps password hashes.
Technique: T1003: OS Credential Dumping
RTM has relied on users opening malicious email attachments, decompressing the attached archive, and double-clicking the executable within.
Technique: T1204: User Execution
CORESHELL can communicate over SMTP and POP3 for C2.
Technique: T1071: Application Layer Protocol
FIN6 has used Metasploit Bind and Reverse TCP stagers.
Technique: T1095: Non-Application Layer Protocol
Zebrocy  has used a method similar to RC4 as well as AES for encryption and hexadecimal for encoding data before exfiltration.
Technique: T1560: Archive Collected Data
Dyre has the ability to identify network settings on a compromised host.
Technique: T1016: System Network Configuration Discovery
63 64 ku64.dll ku32.dll Keylogger & clipboard monitor
Technique: T1056: Input Capture
The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute.
Technique: T1218: Signed Binary Proxy Execution
Permissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure.
Technique: T1578: Modify Cloud Compute Infrastructure
Drive-by content can be staged on adversary controlled infrastructure that has been acquired  or previously compromised .
Technique: T1608: Stage Capabilities
APT33 has used compromised Office 365 accounts in tandem with Ruler in an attempt to gain control of endpoints.
Technique: T1078: Valid Accounts
SSH Hijacking differs from use of SSH because it hijacks an existing SSH session rather than creating a new session using Valid Accounts.
Technique: T1563: Remote Service Session Hijacking
Stealth Falcon malware gathers system information via WMI, including the system directory, build number, serial number, version, manufacturer, model, and total physical memory.
Technique: T1082: System Information Discovery
MuddyWater has disguised malicious executables and used filenames and Registry key names associated with Windows Defender.
Technique: T1036: Masquerading
FALLCHILL collects MAC address and local IP address information from the victim.
Technique: T1016: System Network Configuration Discovery
Wingbird deletes its payload along with the payload's parent process after it finishes copying files.
Technique: T1070: Indicator Removal on Host
A custom XOR cipher or RC4 is used for decryption.
Technique: T1140: Deobfuscate/Decode Files or Information
Note that IP addresses can be reallocated
Technique: T1016: System Network Configuration Discovery
TrickBot uses a custom crypter leveraging Microsoft’s CryptoAPI to encrypt C2 traffic.Newer versions of TrickBot have been known to use `bcrypt` to encrypt and digitally sign responses to their C2 server.
Technique: T1573: Encrypted Channel
Adversaries may also tamper with artifacts deployed and utilized by security tools.
Technique: T1562: Impair Defenses
UNC2452 used netsh to configure firewall rules that limited certain UDP outbound packets.
Technique: T1562: Impair Defenses
NETWIRE can use AES encryption for C2 data transferred.
Technique: T1573: Encrypted Channel
Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials.
Technique: T1110: Brute Force
HDS Deletes the file created by the HD command to reverse the effect
Technique: T1070: Indicator Removal on Host
Denis deploys additional backdoors and hacking tools to the system.
Technique: T1105: Ingress Tool Transfer
APT28 has used a brute-force/password-spray tooling that operated in two modes: in password-spraying mode it conducted approximately four authentication attempts per hour per targeted account over the course of several days or weeks.
Technique: T1110: Brute Force
UNC2452 used AUDITPOL to prevent the collection of audit logs.
Technique: T1562: Impair Defenses
Agent.btz obtains the victim username and saves it to a file.
Technique: T1033: System Owner/User Discovery
SslMM contains a feature to manipulate process privileges and tokens.
Technique: T1134: Access Token Manipulation
Cleaver has used custom tools to facilitate ARP cache poisoning.
Technique: T1557: Adversary-in-the-Middle
InvisiMole has installed legitimate but vulnerable Total Video Player software and wdigest.dll library drivers on compromised hosts to exploit stack overflow and input validation vulnerabilities for code execution.
Technique: T1203: Exploitation for Client Execution
It can also lead to Remote System Discovery and Privilege Escalation by stealing a Domain Admin or higher privileged account session.
Technique: T1563: Remote Service Session Hijacking
Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture video or images.
Technique: T1125: Video Capture
LookBack’s C2 proxy tool sends data to a C2 server over HTTP.
Technique: T1071: Application Layer Protocol
The group has also used a tool that acts as a proxy to allow C2 even if the victim is behind a router.
Technique: T1090: Proxy
Crimson can use a HTTP GET request to download its final payload.
Technique: T1071: Application Layer Protocol
SHOTPUT has a command to obtain a directory listing.
Technique: T1083: File and Directory Discovery
Print processors are DLLs that are loaded by the print spooler service, spoolsv.exe, during boot.
Technique: T1547: Boot or Logon Autostart Execution
Figure 3: CVE-2017-11882 and POWRUNER attack sequence  The malicious .rtf file exploits CVE-2017-11882
Technique: T1203: Exploitation for Client Execution
Several Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation.
Technique: T1573: Encrypted Channel
Gamaredon Group has used an Outlook VBA module on infected systems to send phishing emails with malicious attachments to other employees within the organization.
Technique: T1534: Internal Spearphishing
The payload delivered in these November 2017 attacks using DDE enabled documents was SofacyCarberp, which differs from the Zebrocy downloader delivered in the February 2018 attacks
Technique: T1189: Drive-by Compromise
APT41 used DNS for C2 communications.
Technique: T1071: Application Layer Protocol
Pisloader has a command to collect the victim's IP address.
Technique: T1016: System Network Configuration Discovery
Cobalt Strike can perform browser pivoting and inject into a user's browser to inherit cookies, authenticated HTTP sessions, and client SSL certificates.
Technique: T1185: Browser Session Hijacking
FIN4 has used legitimate credentials to hijack email communications.
Technique: T1078: Valid Accounts
TA505 has sent spearphishing emails containing malicious links.
Technique: T1566: Phishing
TAINTEDSCRIBE can use DriveList to retrieve drive information.
Technique: T1082: System Information Discovery
Bazar can use TLS in C2 communications.
Technique: T1573: Encrypted Channel
Kimsuky has deleted the exfiltrated data on disk after transmission.
Technique: T1070: Indicator Removal on Host
The information this malware collected included the following:The computer nameThe usernameThe execution path of the sampleThe BIOS modelA randomly-generated ID to uniquely identify the systemGroup123 utilized this method to ensure their victim was (a) someone they wanted to target further and (b) someone they could infect further based on the information obtained from the reconnaissance phase
Technique: T1082: System Information Discovery
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.
Technique: T1071: Application Layer Protocol
Calisto uses the zip -r command to compress the data collected on the local system.
Technique: T1560: Archive Collected Data
EvilBunny has created Registry keys for persistence in HKLM|HKCU\…\CurrentVersion\Run.
Technique: T1547: Boot or Logon Autostart Execution
APT37 has collected data from victims' local systems.
Technique: T1005: Data from Local System
Subscriptions consist of three core WMI classes: a Filter, a Consumer, and a FilterToConsumerBinding
Technique: T1047: Windows Management Instrumentation
This may involve downloading a new file via typical protocols used on network devices, such as TFTP, FTP, SCP, or a console connection.
Technique: T1601: Modify System Image
GALLIUM established persistence for PoisonIvy by created a scheduled task.
Technique: T1053: Scheduled Task/Job
Information about victims may be available for purchase from reputable private sources and databases, such as paid subscriptions to feeds of technical/threat intelligence data.
Technique: T1597: Search Closed Sources
APT3 has used PowerShell on victim systems to download and run payloads after exploitation.
Technique: T1059: Command and Scripting Interpreter
Kimsuky has used attempted to lure victims into opening malicious e-mail attachments.
Technique: T1204: User Execution
HyperBro has the ability to download additional files.
Technique: T1105: Ingress Tool Transfer