HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.
Technique: T1003: OS Credential Dumping
In such cases, the user's web browser is typically targeted for exploitation , but adversaries may also set up websites for non-exploitation behavior such as Application Access Token.
Technique: T1608: Stage Capabilities
Since GPOs can control so many user and machine settings in the AD environment, there are a great number of potential attacks that can stem from this GPO abuse.
Technique: T1484: Domain Policy Modification
Figure 4 x_mode command and new line delimited settings As seen in Figure 4, the settings are stored in variables seen in Table 6, which are used to authenticate to the actor-controlled Google account before uploading and downloading files from Google Drive
Technique: T1102: Web Service
FELIXROOT collects the username from the victim’s machine.
Technique: T1033: System Owner/User Discovery
PowerShower has added a registry key so future powershell.exe instances are spawned with coordinates for a window position off-screen by default.
Technique: T1564: Hide Artifacts
Cobalt Strike can use a number of known techniques to bypass Windows UAC.
Technique: T1548: Abuse Elevation Control Mechanism
Micropsia takes screenshots every 90 seconds by calling the Gdi32.BitBlt API.
Technique: T1113: Screen Capture
NanoCore creates a RunOnce key in the Registry to execute its VBS scripts each time the user logs on to the machine.
Technique: T1547: Boot or Logon Autostart Execution
BendyBear has the ability to determine local time on a compromised host.
Technique: T1124: System Time Discovery
It then calls the subfunction with the argument of 2 to get the string that it will use as the HTTP POST request
Technique: T1071: Application Layer Protocol
This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions.
Technique: T1614: System Location Discovery
The emond service will not launch if there is no file present in the QueueDirectories path /private/var/db/emondClients, specified in the Launch Daemon configuration file at/System/Library/LaunchDaemons/com.apple.emond.plist.
Technique: T1546: Event Triggered Execution
APT29 has used large file sizes to avoid detection.
Technique: T1027: Obfuscated Files or Information
BISCUIT has a command to launch a command shell on the system.
Technique: T1059: Command and Scripting Interpreter
Ursnif has used Systeminfo to gather system information.
Technique: T1082: System Information Discovery
The "SCOUT" variant of NETEAGLE achieves persistence by adding itself to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.
Technique: T1547: Boot or Logon Autostart Execution
Bazar can launch cmd.exe to perform reconnaissance commands.
Technique: T1059: Command and Scripting Interpreter
PowerStallion uses a XOR cipher to encrypt command output written to its OneDrive C2 server.
Technique: T1027: Obfuscated Files or Information
Threat Group-3390 actors use NBTscan to discover vulnerable systems.
Technique: T1016: System Network Configuration Discovery
Denis used the IsDebuggerPresent, OutputDebugString, and SetLastError APIs to avoid debugging.
Technique: T1106: Native API
Brave Prince collects hard drive content and system configuration information.
Technique: T1082: System Information Discovery
FatDuke can decrypt AES encrypted C2 communications.
Technique: T1140: Deobfuscate/Decode Files or Information
Derusbi obfuscates C2 traffic with variable 4-byte XOR keys.
Technique: T1573: Encrypted Channel
CHOPSTICK  includes runtime checks to identify an analysis environment and prevent execution on it.
Technique: T1497: Virtualization/Sandbox Evasion
Once loaded into memory, MESSAGETAP deletes the keyword_parm.txt and parm.txt configuration files from disk.
Technique: T1070: Indicator Removal on Host
The Bazar loader is used to download and execute the Bazar backdoor.
Technique: T1104: Multi-Stage Channels
This tactic uses public web services to host content that contains encoded commands that are decoded by the malware
Technique: T1102: Web Service
Adversaries may attempt to render the system unable to boot by overwriting critical data located in structures such as the master boot record  or partition table.
Technique: T1561: Disk Wipe
In the case of network designs that require NAT to function, this enables the adversary to overcome inherent routing limitations that would normally prevent them from accessing protected systems behind the border device.
Technique: T1599: Network Boundary Bridging
PoetRAT was distributed via malicious Word documents.
Technique: T1566: Phishing
CosmicDuke collects LSA secrets.
Technique: T1003: OS Credential Dumping
Operation Wocao has used domain credentials, including domain admin, for lateral movement and privilege escalation.
Technique: T1078: Valid Accounts
A new child process is created as “ tg ​ yt ​ ut ​ rc ​ ( ID) ​ .e ​ xe - i SM- tgytutrc ”, which is used to encrypt a single file on the drive
Technique: T1486: Data Encrypted for Impact
Obfuscation While the downloader module is not packed, the backdoor is packed with a modified version of UPX
Technique: T1027: Obfuscated Files or Information
This EWM is intended to store data specific to that window and has specific application programming interface  functions to set and get its value.
Technique: T1055: Process Injection
It handles XML formatted project files that define requirements for loading and building various platforms and configurations.
Technique: T1127: Trusted Developer Utilities Proxy Execution
HAFNIUM has obtained IP addresses for publicly-accessible Exchange servers.
Technique: T1590: Gather Victim Network Information
LockerGoga has been observed shutting down infected systems.
Technique: T1529: System Shutdown/Reboot
BRONZE BUTLER has used net user /domain to identify account information.
Technique: T1087: Account Discovery
Sykipot contains keylogging functionality to steal passwords.
Technique: T1056: Input Capture
APT1 gathered a list of running processes on the system using tasklist /v.
Technique: T1057: Process Discovery
APT28 has split archived exfiltration files into chunks smaller than 1MB.
Technique: T1030: Data Transfer Size Limits
FIN7 used SQL scripts to help perform tasks on the victim's machine.
Technique: T1059: Command and Scripting Interpreter
APT39 has used WinRAR and 7-Zip to compress an archive stolen data.
Technique: T1560: Archive Collected Data
Blue Mockingbird has used batch script files to automate execution and deployment of payloads.
Technique: T1059: Command and Scripting Interpreter
The summit is the latest in a line of signs of diplomatic outreach from North Korea, following the Panmunjom Declaration for Peace, Prosperity and Unification of the Korean Peninsula between South Korea and North Korea on April 27, 2018
Technique: T1059: Command and Scripting Interpreter
MuddyWater has used a series of compromised websites that victims connected to randomly to relay information to command and control .
Technique: T1090: Proxy
There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed.
Technique: T1574: Hijack Execution Flow
Higaisa collected the system volume serial number, GUID, and computer name.
Technique: T1082: System Information Discovery
TEARDROP modified the Registry to create a Windows service for itself on a compromised host.
Technique: T1112: Modify Registry
Adversaries may execute their own malicious payloads by hijacking vulnerable file path references.
Technique: T1574: Hijack Execution Flow
JPIN can lower security settings by changing Registry keys.
Technique: T1562: Impair Defenses
Character  Digit   h 0   i 1   j 2   k 3   l 4   m 5   n 6   o 7   p 8   q 9    Table 4 Character substitution used in RogueRobin The Trojan will use future DNS requests to retrieve jobs from the C2 server, which the Trojan will handle as commands
Technique: T1071: Application Layer Protocol
This is the only instance we observed where a hardcoded Google Drive URL was included in RogueRobin, which may suggest that the author may have overlooked this during testing
Technique: T1083: File and Directory Discovery
Silence has used a valid certificate to sign their primary loader Silence.Downloader .
Technique: T1553: Subvert Trust Controls
Metamorfo has a command to delete a Registry key it uses, \Software\Microsoft\Internet Explorer\notes.
Technique: T1070: Indicator Removal on Host
This activity may also be seen shortly after Internal Spearphishing.
Technique: T1204: User Execution
GravityRAT uses HTTP for C2.
Technique: T1071: Application Layer Protocol
A variety of methods exist for compromising social media accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, or by brute forcing credentials .
Technique: T1586: Compromise Accounts
Variants of Anchor can use DNS tunneling to communicate with C2.
Technique: T1071: Application Layer Protocol
Octopus has used HTTP GET and POST requests for C2 communications.
Technique: T1071: Application Layer Protocol
All strings used by the Trojan are encrypted with the XOR algorithm
Technique: T1027: Obfuscated Files or Information
PoetRAT used voStro.exe, a compiled pypykatz , to steal credentials.
Technique: T1003: OS Credential Dumping
By patching the operating system, the adversary can change this command to instead display the original, higher revision number that they replaced through the system downgrade.
Technique: T1601: Modify System Image
Search order hijacking is also a common practice for hijacking DLL loads and is covered in DLL Search Order Hijacking.
Technique: T1574: Hijack Execution Flow
jRAT can capture clipboard data.
Technique: T1115: Clipboard Data
When the shellcode embedded within the malicious EPS is executed, the following three files are dropped:  %PROGRAMDATA%\Microsoft\DeviceSync\VMwareCplLauncher.exe %PROGRAMDATA%\Microsoft\DeviceSync\vmtools.dll %PROGRAMDATA%\Microsoft\DeviceSync\MSBuild.exe  In the list of dropped files, VMwareCplLauncher.exe is a legitimate, signed VMware executable that serves to ultimately deliver the BADNEWS payload
Technique: T1036: Masquerading
APT3 has a tool that can obtain information about the local system.
Technique: T1082: System Information Discovery
BADCALL functions as a proxy server between the victim and C2 server.
Technique: T1090: Proxy
RainyDay can use a file exfiltration tool to collect recently changed files on a compromised host.
Technique: T1005: Data from Local System
Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported.
Technique: T1597: Search Closed Sources
Adversaries may scan IP blocks in order to Gather Victim Network Information, such as which IP addresses are actively in use as well as more detailed information about hosts assigned these addresses.
Technique: T1595: Active Scanning
TajMahal has the ability to identify connected Apple devices.
Technique: T1120: Peripheral Device Discovery
BitPaymer has copied itself to the :bin alternate data stream of a newly created file.
Technique: T1564: Hide Artifacts
If the victim is using PowerShell 3.0 or later, POWERSOURCE writes its decoded payload to an alternate data stream  named kernel32.dll that is saved in %PROGRAMDATA%\Windows\.
Technique: T1564: Hide Artifacts
Egregor has checked for the LogMein event log in an attempt to encrypt files in remote machines.
Technique: T1219: Remote Access Software
Crimson can use a module to perform keylogging on compromised hosts.
Technique: T1056: Input Capture
These tokens are typically stolen from users and used in lieu of login credentials.
Technique: T1550: Use Alternate Authentication Material
Net Crawler uses a list of known credentials gathered through credential dumping to guess passwords to accounts as it spreads throughout a network.
Technique: T1110: Brute Force
The Image File Execution Options Injection debugger method was likely discovered as a potential workaround because it does not require the corresponding accessibility feature binary to be replaced.
Technique: T1546: Event Triggered Execution
ZIRCONIUM has used Python-based implants to interact with compromised hosts.
Technique: T1059: Command and Scripting Interpreter
Dok is packed with an UPX executable packer.
Technique: T1027: Obfuscated Files or Information
Windows systems use a common method to look for required DLLs to load into a program.
Technique: T1574: Hijack Execution Flow
Batch files  also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops.
Technique: T1059: Command and Scripting Interpreter
Perhaps they plan to pair this stealer with another dropper that maintains the WMI anti-AV functionality
Technique: T1047: Windows Management Instrumentation
Chimera has remotely copied tools and malware onto targeted systems.
Technique: T1105: Ingress Tool Transfer
Misdat is capable of providing shell functionality to the attacker to execute commands.
Technique: T1059: Command and Scripting Interpreter
Emotet has been observed dropping browser password grabber modules.
Technique: T1555: Credentials from Password Stores
NETEAGLE can use HTTP to download resources that contain an IP address and port number pair to connect to for C2.
Technique: T1568: Dynamic Resolution
CopyKittens has used PowerShell Empire.
Technique: T1059: Command and Scripting Interpreter
MacSpy stores itself in ~/Library/.DS_Stores/  Calisto uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.
Technique: T1564: Hide Artifacts
GravityRAT uses WMI to check the BIOS and manufacturer information for strings like "VMWare", "Virtual", and "XEN" and another WMI request to get the current temperature of the hardware to determine if it's a virtual machine environment.
Technique: T1497: Virtualization/Sandbox Evasion
Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network.
Technique: T1040: Network Sniffing
VBShower used HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\a-f0-9A-F{8} to maintain persistence.
Technique: T1547: Boot or Logon Autostart Execution
Dridex has collected a list of installed software on the system.
Technique: T1518: Software Discovery
To establish persistence, Truvasys adds a Registry Run key with a value "TaskMgr" in an attempt to masquerade as the legitimate Windows Task Manager.
Technique: T1036: Masquerading
The subdomain 676f6f646c75636b is a hex encoded string which decodes to goodluck
Technique: T1140: Deobfuscate/Decode Files or Information
Adversaries can use open source tools to interact with the ccache files directly or to use the Kerberos framework to call lower-level APIs for extracting the user's TGT or Service Tickets.
Technique: T1558: Steal or Forge Kerberos Tickets
Windigo has distributed Windows malware via drive-by downloads.
Technique: T1189: Drive-by Compromise
Web applications and services  often use session cookies to authenticate and authorize user access.
Technique: T1606: Forge Web Credentials
Aria-body has the ability to identify the hostname, computer name, Windows version, processor speed, machine GUID, and disk information on a compromised host.
Technique: T1082: System Information Discovery
TA505 has used UPX to obscure malicious code.
Technique: T1027: Obfuscated Files or Information
MacSpy captures keystrokes.
Technique: T1056: Input Capture
In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities.
Technique: T1588: Obtain Capabilities
A Patchwork .dll that contains BADNEWS is loaded and executed using DLL side-loading.
Technique: T1574: Hijack Execution Flow
CoinTicker downloads the EggShell mach-o binary using curl, which does not set the quarantine flag.
Technique: T1553: Subvert Trust Controls
The time provider manager, directed by the service control manager, loads and starts time providers listed and enabled under this key at system startup and/or whenever parameters are changed.
Technique: T1547: Boot or Logon Autostart Execution
It has also accessed network diagram files useful for understanding how a host's network was configured.
Technique: T1049: System Network Connections Discovery
build_downer can extract malware from a downloaded JPEG.
Technique: T1027: Obfuscated Files or Information
TeamTNT has deployed privileged containers that mount the filesystem of victim machine.
Technique: T1611: Escape to Host
HotCroissant has the ability to do real time screen viewing on an infected host.
Technique: T1113: Screen Capture
Valak can use a .NET compiled module named exchgrabber to enumerate credentials from the Credential Manager.
Technique: T1555: Credentials from Password Stores
The Poseidon Group's Information Gathering Tool  includes PowerShell components.
Technique: T1059: Command and Scripting Interpreter
SUNBURST checked the domain name of the compromised host to verify it was running in a real environment.
Technique: T1497: Virtualization/Sandbox Evasion
jRAT can list security software, such as by using WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.
Technique: T1518: Software Discovery
Adversaries may abuse this architecture to establish persistence, specifically by registering and enabling a malicious DLL as a time provider.
Technique: T1547: Boot or Logon Autostart Execution
The shareDll32 module then enumerates and identifies systems connected on the same domain using WNetEnumResource and GetComputerNameW
Technique: T1087: Account Discovery
CostaRicto has obtained open source tools to use in their operations.
Technique: T1588: Obtain Capabilities
TA505 has used VBS for code execution.
Technique: T1059: Command and Scripting Interpreter
Cuba loaded the payload into memory using PowerShell.
Technique: T1620: Reflective Code Loading
Bad Rabbit has used rundll32 to launch a malicious DLL as C:Windowsinfpub.dat.
Technique: T1218: Signed Binary Proxy Execution
POWRUNER can download or upload files from its C2 server.
Technique: T1105: Ingress Tool Transfer
Night Dragon sent spearphishing emails containing links to compromised websites where malware was downloaded.
Technique: T1566: Phishing
FIN4 has used Tor to log in to victims' email accounts.
Technique: T1090: Proxy
QakBot can collect system information including the OS version and domain on a compromised host.
Technique: T1082: System Information Discovery
Bandook has a command to delete a file.
Technique: T1070: Indicator Removal on Host
This may include custom or publicly available encoding/compression algorithms  as well as embedding data within protocol headers and fields.
Technique: T1048: Exfiltration Over Alternative Protocol
RobbinHood stops 181 Windows services on the system before beginning the encryption process.
Technique: T1489: Service Stop
UBoatRAT checks for virtualization software such as VMWare, VirtualBox, or QEmu on the compromised machine.
Technique: T1497: Virtualization/Sandbox Evasion
Caterpillar WebShell can obtain a list of the services from a system.
Technique: T1007: System Service Discovery
APT32 enumerated administrative users using the commands net localgroup administrators.
Technique: T1087: Account Discovery
SYSCON has the ability to use FTP in C2 communications.
Technique: T1071: Application Layer Protocol
Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster.
Technique: T1613: Container and Resource Discovery
Higaisa has used VBScript code on the victim's machine.
Technique: T1059: Command and Scripting Interpreter
GoldenSpy's setup file installs initial executables under the folder %WinDir%\System32\PluginManager.
Technique: T1036: Masquerading
TEARDROP checked that HKU\SOFTWARE\Microsoft\CTF existed before decoding its embedded payload.
Technique: T1012: Query Registry
Mosquito can upload and download files to the victim.
Technique: T1105: Ingress Tool Transfer
The most common authentication module is pam_unix.so, which retrieves, sets, and verifies account authentication information in /etc/passwd and /etc/shadow.
Technique: T1556: Modify Authentication Process
The COR_PROFILER can also be used to elevate privileges  if the victim .NET process executes at a higher permission level, as well as to hook and Impair Defenses provided by .NET processes.
Technique: T1574: Hijack Execution Flow
CookieMiner has used Google Chrome's decryption and extraction operations.
Technique: T1140: Deobfuscate/Decode Files or Information
In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser  to ensure it is vulnerable prior to attempting exploitation.
Technique: T1608: Stage Capabilities
Kaspersky Lab products detect the malware used by Poseidon Group with the following detection names: Backdoor.Win32.Nhopro HEUR:Backdoor.Win32.Nhopro.gen HEUR:Hacktool.Win32.Nhopro.gen How many victims have you found? At least 35 victim companies have been identified with primary targets including financial and government institutions, telecommunications, manufacturing, energy and other service utility companies, as well as media and public relations firms
Technique: T1070: Indicator Removal on Host
build_downer has the ability to determine the local time to ensure malware installation only happens during the hours that the infected system is active.
Technique: T1124: System Time Discovery
Kazuar captures images from the webcam.
Technique: T1125: Video Capture
OSX_OCEANLOTUS.D uses Word macros for execution.
Technique: T1059: Command and Scripting Interpreter
PoetRAT has used a .NET tool named dog.exe to exiltrate information over an e-mail account.
Technique: T1048: Exfiltration Over Alternative Protocol
The dropped files are either in the root of the “ProgramData” folder or in a subdirectory
Technique: T1083: File and Directory Discovery
Adversaries disable a network device’s dedicated hardware encryption, which may enable them to leverage weaknesses in software encryption in order to reduce the effort involved in collecting, manipulating, and exfiltrating transmitted data.
Technique: T1600: Weaken Encryption
Operation Wocao has injected code into a selected process, which in turn launches a command as a child process of the original.
Technique: T1055: Process Injection
APT32 also creates a Windows service to establish persistence.
Technique: T1543: Create or Modify System Process
OilRig has used a CHM payload to load and execute another malicious file once delivered to a victim.
Technique: T1218: Signed Binary Proxy Execution
A common example is to build rapport with a target via social media, then send content to a personal webmail service that the target uses on their work computer.
Technique: T1566: Phishing
Windshift has used malware to enumerate active processes.
Technique: T1057: Process Discovery
Example services include websites, email services, DNS, and web-based applications.
Technique: T1499: Endpoint Denial of Service
Carberp's passw.plug plugin can gather account information from multiple instant messaging, email, and social media services, as well as FTP, VNC, and VPN clients.
Technique: T1555: Credentials from Password Stores
AppleSeed can decode its payload prior to execution.
Technique: T1140: Deobfuscate/Decode Files or Information
KGH_SPY can harvest data from mail clients.
Technique: T1114: Email Collection
Adversaries may disable or delete system recovery features to augment the effects of Data Destruction and Data Encrypted for Impact.
Technique: T1490: Inhibit System Recovery
Night Dragon has performed SQL injection attacks of extranet web servers to gain access.
Technique: T1190: Exploit Public-Facing Application
When it first starts, BADNEWS crawls the victim's mapped drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.
Technique: T1039: Data from Network Shared Drive
The CLI and scripting interpreter are accessible through a direct console connection, or through remote means, such as telnet or SSH.
Technique: T1059: Command and Scripting Interpreter
In the second method for changing the operating system in memory, the adversary would make use of the boot loader.
Technique: T1601: Modify System Image
Lucifer can perform a decremental-xor encryption on the initial C2 request before sending it over the wire.
Technique: T1573: Encrypted Channel
Template references injected into a document may enable malicious payloads to be fetched and executed when the document is loaded.
Technique: T1221: Template Injection
Get-NetDomainTrust 
Technique: T1482: Domain Trust Discovery
Silence has used RDP for lateral movement.
Technique: T1021: Remote Services
BadPatch searches for files with specific file extensions.
Technique: T1083: File and Directory Discovery
Users may edit the system’s SSH config file to modify the directives PubkeyAuthentication and RSAAuthentication to the value “yes” to ensure public key and RSA authentication are enabled.
Technique: T1098: Account Manipulation
SUNBURST used Base64 encoding in its C2 traffic.
Technique: T1132: Data Encoding
InvisiMole can launch a remote shell to execute commands.
Technique: T1059: Command and Scripting Interpreter
HotCroissant has encrypted strings with single-byte XOR and base64 encoded RC4.
Technique: T1027: Obfuscated Files or Information
Mustang Panda has used tasklist /v to determine active process information.
Technique: T1057: Process Discovery
SUNBURST also obfuscated collected system information using a FNV-1a + XOR algorithm.
Technique: T1027: Obfuscated Files or Information
It also uses a custom XOR algorithm to obfuscate code.
Technique: T1027: Obfuscated Files or Information
Adversaries can establish persistence by adding a malicious binary path or shell commands to rc.local, rc.common, and other RC scripts specific to the Unix-like distribution.
Technique: T1037: Boot or Logon Initialization Scripts
Doki has resolved the path of a process PID to use as a script argument.
Technique: T1083: File and Directory Discovery
ROKRAT can request to delete files.
Technique: T1070: Indicator Removal on Host
The group has also used torrent file-sharing sites to more indiscriminately disseminate malware to victims.
Technique: T1189: Drive-by Compromise
The executable contains a side-loading weakness which is used to load a portion of the malware.
Technique: T1574: Hijack Execution Flow
OilRig has deleted files associated with their payload after execution.
Technique: T1070: Indicator Removal on Host
In the event it does, Reaver will move this file to ‘%TEMP%\~FJIOW.tmp’ and delete this new file
Technique: T1070: Indicator Removal on Host
On September 24, 2018, we observed an organization targeted by OilRig attempting to download a Zip archive from the following URL: hxxp://193.111.152[.]13/[redacted]-ITsoftwareUpdate.zip This Zip archive contained a file named [redacted]-ITsoftwareUpdate.exe (SHA256: 5f42deb792d8d6f347c58ddbf634a673b3e870ed9977fdd88760e38088cd7336), which is a variant of the OopsIE Trojan we described in detail in a blog we published in September 2018
Technique: T1560: Archive Collected Data
Prikormka contains a keylogger module that collects keystrokes and the titles of foreground windows.
Technique: T1056: Input Capture
Remexi encrypts and adds all gathered browser data into files for upload to C2.
Technique: T1560: Archive Collected Data
InvisiMole can obtain a list of running processes.
Technique: T1057: Process Discovery
Get-MicrophoneAudio
Technique: T1123: Audio Capture
Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.
Technique: T1547: Boot or Logon Autostart Execution
Indicators of Compromise (IoCs)    C&C servers    Ssl[.]arkouthrie[.]com   s3[.]hiahornber[.]com   widget[.]shoreoa[.]com       SHA256   Delivery document (W2KM_OCEANLOTUS.A): 2bb855dc5d845eb5f2466d7186f150c172da737bfd9c7f6bc1804e0b8d20f22a   Dropper (OSX_OCEANLOTUS.D): 4da8365241c6b028a13b82d852c4f0155eb3d902782c6a538ac007a44a7d61b4   Backdoor (OSX_OCEANLOTUS.D): 673ee7a57ba3c5a2384aeb17a66058e59f0a4d0cddc4f01fe32f369f6a845c8f   The post New MacOS Backdoor Linked to OceanLotus Found appeared first on
Technique: T1008: Fallback Channels
WinMM uses HTTP for C2.
Technique: T1071: Application Layer Protocol
Chimera has used the quser command to show currently logged on users.
Technique: T1033: System Owner/User Discovery
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.
Technique: T1505: Server Software Component
DarkComet can access the victim’s webcam to take pictures.
Technique: T1125: Video Capture
Analysis APT34 sent a malicious .rtf file (MD5: a0e6933f4e0497269620f44a083b2ed4) as an attachment in a malicious spear phishing email sent to the victim organization
Technique: T1566: Phishing
WindTail has used icons mimicking MS Office files to mask payloads.
Technique: T1036: Masquerading
Thrip leveraged PowerShell to run commands to download payloads, traverse the compromised networks, and carry out reconnaissance.
Technique: T1059: Command and Scripting Interpreter
Upon exiting, /etc/zlogout and ~/.zlogout are executed.
Technique: T1546: Event Triggered Execution
Before registering new passwords in the Security Accounts Manager , the Local Security Authority  requests validation from each registered filter.
Technique: T1556: Modify Authentication Process
On Windows and Linux, these system processes are referred to as services.
Technique: T1543: Create or Modify System Process
This use of guardrails is distinct from typical Virtualization/Sandbox Evasion.
Technique: T1480: Execution Guardrails
Grandoreiro can use run keys and create link files in the startup folder for persistence.
Technique: T1547: Boot or Logon Autostart Execution
APT32's macOS backdoor hides the clientID file via a chflags function.
Technique: T1564: Hide Artifacts
KillDisk also targets and deletes files with 35 different file extensions.
Technique: T1485: Data Destruction
Adversaries may abuse the ROM Monitor  by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect.
Technique: T1542: Pre-OS Boot
SUNSPOT monitored running processes for instances of MsBuild.exe by hashing the name of each running process and comparing it to the corresponding value 0x53D525.
Technique: T1057: Process Discovery
The malware proceeds to connect to the C2 server at 5.189.145.248 at regular intervals through the use of TCP over port 10500
Technique: T1571: Non-Standard Port
Metamorfo has a function to hijack data from the clipboard by monitoring the contents of the clipboard and replacing the cryptocurrency wallet with the attacker's.
Technique: T1115: Clipboard Data
APT32's macOS backdoor can receive a “delete” command.
Technique: T1070: Indicator Removal on Host
Molerats has sent malicious files via email that tricked users into clicking Enable Content to run an embedded macro and to download malicious archives.
Technique: T1204: User Execution
Volgmer uses a simple XOR cipher to encrypt traffic and files.
Technique: T1573: Encrypted Channel
RGDoor uses HTTP for C2 communications.
Technique: T1071: Application Layer Protocol
Remsec can obtain a list of users.
Technique: T1087: Account Discovery
ThiefQuest uses the CGEventTap functions to perform keylogging.
Technique: T1056: Input Capture
If the quarantine flag is set in macOS 10.15+, Gatekeeper also checks for a notarization ticket and sends a cryptographic hash to Apple's servers to check for validity for all unsigned executables.
Technique: T1553: Subvert Trust Controls
BACKSPACE attempts to avoid detection by checking a first stage command and control server to determine if it should connect to the second stage server, which performs "louder" interactions with the malware.
Technique: T1104: Multi-Stage Channels
Conficker exploited the MS08-067 Windows vulnerability for remote code execution through a crafted RPC request.
Technique: T1210: Exploitation of Remote Services
4H RAT has the capability to create a remote shell.
Technique: T1059: Command and Scripting Interpreter
InvisiMole can capture keystrokes on a compromised host.
Technique: T1056: Input Capture
BackConfig can leverage API functions such as ShellExecuteA and HttpOpenRequestA in the process of downloading and executing files.
Technique: T1106: Native API
The group also searched a compromised DCCC computer for specific terms.
Technique: T1083: File and Directory Discovery
Prior to targeting, adversaries may compromise the infrastructure of other adversaries.
Technique: T1584: Compromise Infrastructure
SombRAT has collected data and files from a compromised host.
Technique: T1005: Data from Local System
This crafted zip archive exploited a WinRAR flaw that makes files in zip archives appear to have a different name and file extension
Technique: T1560: Archive Collected Data
Process Doppelgänging is implemented in 4 steps :
* Transact – Create a TxF transaction using a legitimate executable then overwrite the file with malicious code.
Technique: T1055: Process Injection
KOMPROGO is capable of creating a reverse shell.
Technique: T1059: Command and Scripting Interpreter
Molerats decompresses ZIP files once on the victim machine.
Technique: T1140: Deobfuscate/Decode Files or Information
TA505 has used PowerShell to download and execute malware and reconnaissance scripts.
Technique: T1059: Command and Scripting Interpreter
APT38 installed a port monitoring tool, MAPMAKER, to print the active TCP connections on the local system.
Technique: T1049: System Network Connections Discovery
Gold Dragon uses cmd.exe to execute commands for discovery.
Technique: T1059: Command and Scripting Interpreter
APT28 also executed a .dll for a first stage dropper using rundll32.exe.
Technique: T1218: Signed Binary Proxy Execution
Adversaries may create, acquire, or steal code signing materials to sign their malware or tools.
Technique: T1553: Subvert Trust Controls
menuPass has encrypted files and information before exfiltration.
Technique: T1560: Archive Collected Data
This may lead to Use Alternate Authentication Material, which may bypass multi-factor and other authentication protection mechanisms.
Technique: T1606: Forge Web Credentials
Gorgon Group malware can use cmd.exe to download and execute payloads and to execute commands on the system.
Technique: T1059: Command and Scripting Interpreter
SLOTHFULMEDIA has been created with a hidden attribute to insure it's not visible to the victim.
Technique: T1564: Hide Artifacts
Elderwood has packed malware payloads before delivery to victims.
Technique: T1027: Obfuscated Files or Information
Epic encrypts collected data using a public key framework before sending it over the C2 channel.
Technique: T1560: Archive Collected Data
Calisto uses launchctl to enable screen sharing on the victim’s machine.
Technique: T1569: System Services
Also, after retrieving a C2 IP address and Port Number, NETEAGLE will initiate a TCP connection to this socket.
Technique: T1095: Non-Application Layer Protocol
The executable version of Helminth has a module to log keystrokes.
Technique: T1056: Input Capture
If running as administrator, TDTESS installs itself as a new service named bmwappushservice to establish persistence.
Technique: T1543: Create or Modify System Process
Mosquito deletes files using DeleteFileW API call.
Technique: T1070: Indicator Removal on Host
Instead of purchasing/renting a botnet from a booter/stresser service, adversaries may build their own botnet by compromising numerous third-party systems.
Technique: T1584: Compromise Infrastructure
Programs listed in the load value of the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows run when any user logs on.
Technique: T1547: Boot or Logon Autostart Execution
Remote access tools will call back to the first-stage command and control server for instructions.
Technique: T1104: Multi-Stage Channels
RATANKBA uses HTTP/HTTPS for command and control communication.
Technique: T1071: Application Layer Protocol
This document was a decoy aimed to entice the user to open malicious documents embedded further down the pageThe actor embedded two additional links and the document urged the user to click on these links for more information about New Year's activities in North Korea
Technique: T1204: User Execution
Ursnif has registered itself as a system service in the Registry for automatic execution at system startup.
Technique: T1543: Create or Modify System Process
TYPEFRAME variants can add malicious DLL modules as new services.TYPEFRAME can also delete services from the victim’s machine.
Technique: T1543: Create or Modify System Process
OilRig has used LinkedIn to send spearphishing links.
Technique: T1566: Phishing
Some InnaputRAT variants establish persistence by modifying the Registry key HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Run:%appdata%\NeutralApp\NeutralApp.exe.
Technique: T1547: Boot or Logon Autostart Execution
Once the system is powered on, it may become a target for lateral movement.
Technique: T1205: Traffic Signaling
GOLD SOUTHFIELD has distributed ransomware by backdooring software installers via a strategic web compromise of the site hosting Italian WinRAR.
Technique: T1195: Supply Chain Compromise
The payload (abbad7acd…) is an executable that appears to have been created by a VBScript to Executable tool and further obfuscated with a cryptor
Technique: T1027: Obfuscated Files or Information
EKANS uses encoded strings in its process kill list.
Technique: T1027: Obfuscated Files or Information
Unknown Logger can obtain information about the victim's IP address.
Technique: T1016: System Network Configuration Discovery
Gallmaker used PowerShell to download additional payloads and for execution.
Technique: T1059: Command and Scripting Interpreter
MarkiRAT can capture screenshots that are initially saved as ‘scr.jpg’.
Technique: T1113: Screen Capture
The data contained in disk structures may include the initial executable code for loading an operating system or the location of the file system partitions on disk.
Technique: T1561: Disk Wipe
The sample, in the form of an RTF document, exploited CVE-2016-4117 to download and install a program from a remote C&C server
Technique: T1105: Ingress Tool Transfer
APT28 has used several malicious applications to steal user OAuth access tokens including applications masquerading as "Google Defender" "Google Email Protection," and "Google Scanner" for Gmail users.
Technique: T1528: Steal Application Access Token
Mofang delivered spearphishing emails with malicious documents, PDFs, or Excel files attached.
Technique: T1566: Phishing
This flood relies on raw volume to accomplish the objective, exhausting any of the various resources required by the victim software to provide the service.
Technique: T1499: Endpoint Denial of Service
Regin appears to have functionality to sniff for credentials passed over HTTP, SMTP, and SMB.
Technique: T1040: Network Sniffing
PolyglotDuke can use steganography to hide C2 information in images.
Technique: T1027: Obfuscated Files or Information
Devices such as routers and firewalls can be used to create boundaries between trusted and untrusted networks.
Technique: T1599: Network Boundary Bridging
When preforming PtT, valid Kerberos tickets for Valid Accounts are captured by OS Credential Dumping.
Technique: T1550: Use Alternate Authentication Material
GETMAIL extracts emails from archived Outlook .pst files.
Technique: T1114: Email Collection
FIN7 has consistently utilized legally purchased code signing certificates to sign their CARBANAK payloads
Technique: T1553: Subvert Trust Controls
Emotet has obfuscated macros within malicious documents to hide the URLs hosting the malware,  CMD.exe arguments, and PowerShell scripts.
Technique: T1027: Obfuscated Files or Information
Cobalt Group has compromised legitimate web browser updates to deliver a backdoor.
Technique: T1195: Supply Chain Compromise
APT32 has used PowerShell-based tools, PowerShell one-liners, and shellcode loaders for execution.
Technique: T1059: Command and Scripting Interpreter
The NETWIRE client has been signed by fake and invalid digital certificates.
Technique: T1036: Masquerading
Cryptoistic can retrieve files from the local file system.
Technique: T1005: Data from Local System
Kessel has decrypted the binary's configuration once the main function was launched.
Technique: T1140: Deobfuscate/Decode Files or Information
Stuxnet used MS10-073 and an undisclosed Task Scheduler vulnerability to escalate privileges on local Windows machines.
Technique: T1068: Exploitation for Privilege Escalation
Deep Panda has used -w hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
Technique: T1564: Hide Artifacts
Sandworm Team temporarily disrupted service to Georgian government, non-government, and private sector websites after compromising a Georgian web hosting provider in 2019.
Technique: T1499: Endpoint Denial of Service
Carberp has exploited multiple Windows vulnerabilities  and a .NET Runtime Optimization vulnerability for privilege escalation.
Technique: T1068: Exploitation for Privilege Escalation
Office Visual Basic for Applications  macros  can be inserted into the base template and used to execute code when the respective Office application starts in order to obtain persistence.
Technique: T1137: Office Application Startup
A Lazarus Group malware sample encrypts data using a simple byte based XOR operation prior to exfiltration.
Technique: T1560: Archive Collected Data
To change the operating system, the adversary typically only needs to affect this one file, replacing or modifying it.
Technique: T1601: Modify System Image
Cobalt Strike can use sudo to run a command.
Technique: T1548: Abuse Elevation Control Mechanism
Instead, it immediately issues a query to resolve the following domain, which embeds the session ID value to transmit it to the C2:   <encoded session id>.<same random number between 100000 and 999999>.<c2 domain name>   To transmit the data via the DNS tunneling, the C2 server will respond to the above query with an IPv6 address that contains the number of DNS queries the payload must issue to obtain the entirety of the data from subsequent IPv6 answers
Technique: T1573: Encrypted Channel
PowerDuke has commands to get information about the victim's name, build, version, serial number, and memory usage.
Technique: T1082: System Information Discovery
Bazar can identify the username of the infected user.
Technique: T1033: System Owner/User Discovery
To manage their credentials, users have to use additional credentials to access their keychain.
Technique: T1555: Credentials from Password Stores
BendyBear communicates to a C2 server over port 443 using modified RC4 and XOR-encrypted chunks.
Technique: T1573: Encrypted Channel
Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated.
Technique: T1558: Steal or Forge Kerberos Tickets
Additional information For more information about the attacks and the indicators of compromise, please contact: intelreports@kaspersky.com Alternatively, please visit: https://www.kaspersky.com/enterprise-security/apt-intelligence-reporting To find more information about cybersecurity awareness training for enterprise or government staff, go to Kaspersky Security Awareness
Technique: T1082: System Information Discovery
SLOTHFULMEDIA has sent system information to a C2 server via HTTP and HTTPS POST requests.
Technique: T1041: Exfiltration Over C2 Channel
Adversaries may also use Remote Services such as Distributed Component Object Model to facilitate remote IPC execution.
Technique: T1559: Inter-Process Communication
UNC2452 used account credentials they obtained to attempt access to Group Managed Service Account  passwords.
Technique: T1555: Credentials from Password Stores
APT28 sent spearphishing emails which used a URL-shortener service to masquerade as a legitimate service and to redirect targets to credential harvesting sites.
Technique: T1566: Phishing
KeyBoy can gather extended system information, such as information about the operating system, disks, and memory.
Technique: T1082: System Information Discovery
The last technique that was particularly interesting is the time zone check, as the Trojan will not execute its functional code if the system does not have a specific time zone set
Technique: T1124: System Time Discovery
RogueRobin base64 encodes strings that are sent to the C2 over its DNS tunnel.
Technique: T1132: Data Encoding
WindTail has been incompletely signed with revoked certificates.
Technique: T1036: Masquerading
Adversaries may attempt to get a listing of local system accounts.
Technique: T1087: Account Discovery
Many applications create these hidden files and folders to store information so that it doesn’t clutter up the user’s workspace.
Technique: T1564: Hide Artifacts
Authenticated access may enable unfettered access to hosts and/or resources within single-factor authentication environments.
Technique: T1556: Modify Authentication Process
StrongPity has the ability to hide the console window for its document search module from the user.
Technique: T1564: Hide Artifacts
Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server.
Technique: T1489: Service Stop
This could include filling out profile information, developing social networks, or incorporating photos.
Technique: T1585: Establish Accounts
DarkVishnya used Bash Bunny, Raspberry Pi, netbooks or inexpensive laptops to connect to the company’s local network.
Technique: T1200: Hardware Additions
It specifically enumerates processes for Wireshark and Sysinternals.
Technique: T1057: Process Discovery
The body of the POST request may contain files contained in the cabinet format
Technique: T1083: File and Directory Discovery
APT41 used the net share command as part of network reconnaissance.
Technique: T1135: Network Share Discovery
As part of Credentials from Web Browsers, Internet Explorer and Microsoft Edge website credentials are managed by the Credential Manager and are stored in the Web Credentials locker.
Technique: T1555: Credentials from Password Stores
APT41 used  svchost.exe and Net to execute a system service installed to launch a Cobalt Strike BEACON loader.
Technique: T1569: System Services
Night Dragon has used HTTP for C2.
Technique: T1071: Application Layer Protocol
Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and Visual Basic.
Technique: T1559: Inter-Process Communication
Adversaries may breach or otherwise leverage organizations who have access to intended victims.
Technique: T1199: Trusted Relationship
APT32's backdoor possesses the capability to list files and directories on a machine.
Technique: T1083: File and Directory Discovery
Gallmaker obfuscated shellcode used during execution.
Technique: T1027: Obfuscated Files or Information
Comnie uses HTTP for C2 communication.
Technique: T1071: Application Layer Protocol
njRAT uses Base64 encoding for C2 traffic.
Technique: T1132: Data Encoding
Pony has used several Windows functions for various purposes.
Technique: T1106: Native API
Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol .
Technique: T1021: Remote Services
Cuba has used cmd.exe /c and batch files for execution.
Technique: T1059: Command and Scripting Interpreter
The chinapolicyanalysis.org domain was used as the sender address, as well as the hosting location of the malicious RTF document
Technique: T1016: System Network Configuration Discovery
Ke3chang used a SharePoint enumeration and data dumping tool known as spwebmember.
Technique: T1213: Data from Information Repositories
SUNBURST had commands to enumerate files and directories.
Technique: T1083: File and Directory Discovery
Dragonfly 2.0 moved laterally via RDP.
Technique: T1021: Remote Services
APT33 has sent spearphishing e-mails with archive attachments.
Technique: T1566: Phishing