HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information.
Technique: T1114: Email Collection
Waterbear can use thread injection to inject shellcode into the process of security software.
Technique: T1055: Process Injection
Msoffice365cdn[.]com resolves to 80.82.79.221, which resides on the same class C network range as the IP resolution of office365-technical[.]info, which resolves to 80.82.79.240
Technique: T1571: Non-Standard Port
SombRAT can execute getinfo  to discover the current time on a compromised host.
Technique: T1124: System Time Discovery
FIN7 used legitimate services like Google Docs, Google Scripts, and Pastebin for C2.
Technique: T1102: Web Service
Windshift has used malware to identify the computer name of a compromised host.
Technique: T1082: System Information Discovery
Since domain configuration settings control many of the interactions within the Active Directory  environment, there are a great number of potential attacks that can stem from this abuse.
Technique: T1484: Domain Policy Modification
EvilGrab has the capability to capture video from a victim machine.
Technique: T1125: Video Capture
Dok installs a root certificate to aid in Adversary-in-the-Middle actions using the command add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /tmp/filename.
Technique: T1553: Subvert Trust Controls
OnionDuke can use a custom decryption algorithm to decrypt strings.
Technique: T1140: Deobfuscate/Decode Files or Information
Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity.
Technique: T1565: Data Manipulation
FIN10 has relied on publicly-available software to gain footholds and establish persistence in victim environments.
Technique: T1588: Obtain Capabilities
BRONZE BUTLER has used schtasks to register a scheduled task to execute malware during lateral movement.
Technique: T1053: Scheduled Task/Job
DownPaper searches and reads the value of the Windows Update Registry Run key.
Technique: T1012: Query Registry
InnaputRAT variants have attempted to appear legitimate by using the file names SafeApp.exe and NeutralApp.exe.
Technique: T1036: Masquerading
TeamTNT has also used a custom user agent HTTP header in shell scripts.
Technique: T1071: Application Layer Protocol
Bandook has used lure documents to convince the user to enable macros.
Technique: T1204: User Execution
FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.
Technique: T1119: Automated Collection
Metamorfo has used MsiExec.exe to automatically execute files.
Technique: T1218: Signed Binary Proxy Execution
LightNeuron has used a malicious Microsoft Exchange transport agent for persistence.
Technique: T1505: Server Software Component
There are various sources of data an adversary could use to infer system language, such as system defaults and keyboard layouts.
Technique: T1614: System Location Discovery
Adversaries may gather information about the victim's networks that can be used during targeting.
Technique: T1590: Gather Victim Network Information
Malware used by Group5 is capable of remotely deleting files from victims.
Technique: T1070: Indicator Removal on Host
Figure 2: De-obfuscated code scheduling the second task to run a script embedded in a blog page The last section of script embedded in 29[.]html then downloads Revenge RAT and injects the binary into the memory of a running process, as seen in Figure 3
Technique: T1055: Process Injection
GoldMax has used HTTPS and HTTP GET requests with custom HTTP cookies for C2.
Technique: T1071: Application Layer Protocol
Vulnerabilities may exist, usually in operating system components and software commonly running at higher permissions, that can be exploited to gain higher levels of access on the system.
Technique: T1068: Exploitation for Privilege Escalation
Lucifer can persist by setting Registry key values HKLM\Software\Microsoft\Windows\CurrentVersion\Run\QQMusic and HKCU\Software\Microsoft\Windows\CurrentVersion\Run\QQMusic.
Technique: T1547: Boot or Logon Autostart Execution
More_eggs's payload has been encrypted with a key that has the hostname and processor family information appended to the end.
Technique: T1027: Obfuscated Files or Information
EVILNUM can harvest cookies and upload them to the C2 server.
Technique: T1539: Steal Web Session Cookie
gh0st RAT is able to open a remote shell to execute commands.
Technique: T1059: Command and Scripting Interpreter
SMOKEDHAM has modified registry keys for persistence, to enable credential caching for credential access, and to facilitate lateral movement via RDP.
Technique: T1112: Modify Registry
Adding new capabilities for the adversary’s purpose include Keylogging, Multi-hop Proxy, and Port Knocking.
Technique: T1601: Modify System Image
Scripting interpreters automate tasks and extend functionality beyond the command set included in the network OS.
Technique: T1059: Command and Scripting Interpreter
Kivars has the ability to initiate keylogging on the infected host.
Technique: T1056: Input Capture
POWERSTATS has detected security tools.
Technique: T1518: Software Discovery
These files typically require root permissions to modify and are executed each time any shell on a system launches.
Technique: T1546: Event Triggered Execution
FELIXROOT adds a shortcut file to the startup folder for persistence.
Technique: T1547: Boot or Logon Autostart Execution
BONDUPDATER uses a DGA to communicate with command and control servers.
Technique: T1568: Dynamic Resolution
However, adversaries may attempt to execute a previous version of PowerShell that does not support SBL with the intent to Impair Defenses while running malicious scripts that may have otherwise been detected.
Technique: T1562: Impair Defenses
Turla has frequently used compromised WordPress sites for C2 infrastructure.
Technique: T1584: Compromise Infrastructure
Chaes has collected system information, including the machine name and OS version.
Technique: T1082: System Information Discovery
They have also used WMI for the remote execution of files for lateral movement.
Technique: T1047: Windows Management Instrumentation
DustySky has used both HTTP and HTTPS for C2.
Technique: T1071: Application Layer Protocol
SombRAT has the ability to use TCP sockets to send data and ICMP to ping the C2 server.
Technique: T1095: Non-Application Layer Protocol
Denis ran multiple system checks, looking for processor and register characteristics, to evade emulation and analysis.
Technique: T1497: Virtualization/Sandbox Evasion
Maze has used the “Wow64RevertWow64FsRedirection” function following attempts to delete the shadow volumes, in order to leave the system in the same state as it was prior to redirection.
Technique: T1070: Indicator Removal on Host
CopyKittens encrypts data with a substitute cipher prior to exfiltration.
Technique: T1560: Archive Collected Data
menuPass has used DLL search order hijacking.
Technique: T1574: Hijack Execution Flow
APT38 has used DYEPACK to manipulate SWIFT messages en route to a printer.
Technique: T1565: Data Manipulation
Gazer can establish persistence through the system screensaver by configuring it to execute the malware.
Technique: T1546: Event Triggered Execution
Astaroth can launch itself via DLL Search Order Hijacking.
Technique: T1574: Hijack Execution Flow
Adversaries may also hide the rule by making use of the Microsoft Messaging API  to modify the rule properties, making it hidden and not visible from Outlook, OWA or most Exchange Administration tools.
Technique: T1114: Email Collection
ZxShell can capture screenshots.
Technique: T1113: Screen Capture
APT32 has infected victims by tricking them into visiting compromised watering hole websites.
Technique: T1189: Drive-by Compromise
Andariel has exploited numerous ActiveX vulnerabilities, including zero-days.
Technique: T1203: Exploitation for Client Execution
The backdoor will load the encrypted configuration file and decrypt it, then use Secure Sockets Layer (SSL) protocol to connect to command-and-control (C&C) servers
Technique: T1140: Deobfuscate/Decode Files or Information
We believe the adversary exploited a recently vulnerability in Microsoft SharePoint tracked by , which is a remote code execution vulnerability used to compromise the server and eventually install a webshell
Technique: T1203: Exploitation for Client Execution
REvil has the ability to identify specific files and directories that are not to be encrypted.
Technique: T1083: File and Directory Discovery
jRAT has command line access.
Technique: T1059: Command and Scripting Interpreter
Kimsuky has disguised services to appear as benign software or related to operating system functions.
Technique: T1036: Masquerading
Windigo has used a script to gather credentials in files left on disk by OpenSSH backdoors.
Technique: T1005: Data from Local System
A defender who is monitoring for large transfers to outside the cloud environment through normal file transfers or over command and control channels may not be watching for data transfers to another account within the same cloud provider.
Technique: T1537: Transfer Data to Cloud Account
Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.
Technique: T1087: Account Discovery
Attor's dispatcher can execute additional plugins by loading the respective DLLs.
Technique: T1129: Shared Modules
Adversaries may use ARP cache poisoning as a means to intercept network traffic.
Technique: T1557: Adversary-in-the-Middle
Wizard Spider has used services.exe to execute scripts and executables during lateral movement within a victim network.
Technique: T1569: System Services
If the payload doesn't work as expected, the adversary can continue normal communications and troubleshoot with the target on how to get it working.
Technique: T1566: Phishing
LightNeuron is controlled via commands that are embedded into PDFs and JPGs using steganographic methods.
Technique: T1001: Data Obfuscation
IOCs Domain supservermgr[.]com URL hxxp://supservermgr[.]com/sys/upd/pageupd.php Zebrocy d697160aecf152a81a89a6b5a7d9e1b8b5e121724038c676157ac72f20364edc cba5ab65a24be52214736bc1a5bc984953a9c15d0a3826d5b15e94036e5497df 25f0d1cbcc53d8cfd6d848e12895ce376fbbfaf279be591774b28f70852a4fd8 115fd8c619fa173622c7a1e84efdf6fed08a25d3ca3095404dcbd5ac3deb1f03 f27836430742c9e014e1b080d89c47e43db299c2e00d0c0801a2830b41b57bc1 5b5e80f63c04402d0b282e95e32155b2f86cf604a6837853ab467111d4ac15e2 dd7e69e14c88972ac173132b90b3f4bfb2d1faec15cca256a256dd3a12b6e75d Koadic abbad7acd50754f096fdc6551e728aa6054dcf8e55946f90a02b17db552471ca User Agents Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; InfoPath.1) Mozilla/5.0 (Windows NT 6.1; WOW64) WinHttp/1.6.3.8 (WinHTTP/5.1) like Gecko Mozilla v5.1 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1 IPs 185.25.51[.]198 185.25.50[.]93 220.158.216[.]127 92.114.92[.]102 86.106.131[.]177  DDE Docs 85da72c7dbf5da543e10f3f806afd4ebf133f27b6af7859aded2c3a6eced2fd5 8cf3bc2bf36342e844e9c8108393562538a9af2a1011c80bb46416c0572c86ff
Technique: T1087: Account Discovery
SpyNote RAT builder The SpyNote Remote Access Trojan (RAT) builder is gaining popularity in the hacking community, so we decided to study its pervasiveness
Technique: T1571: Non-Standard Port
Background From October 2012 to May 2014, FireEye observed APT12 utilizing RIPTIDE, a proxy-aware backdoor that communicates via HTTP to a hard-coded command and control (C2) server
Technique: T1071: Application Layer Protocol
The image and table below illustrate TClient’s encrypted configuration that we decrypted (via Python code):  Figure 10
Technique: T1140: Deobfuscate/Decode Files or Information
Registry entries in HKLM\Software\\Wow6432Node\\\Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are used to manage additional helper programs and functionalities that support Winlogon.
Technique: T1547: Boot or Logon Autostart Execution
BRONZE BUTLER has used Right-to-Left Override to deceive victims into executing several strains of malware.
Technique: T1036: Masquerading
A Patchwork payload was packed with UPX.
Technique: T1027: Obfuscated Files or Information
One of the documents we examined with the filename Rocket attacks on Israel.docx (SHA256: 34bdb5b364..) contained inconsistent creation and last modified timestamps, with the last modified timestamp occurring before the creation timestamp
Technique: T1070: Indicator Removal on Host
The White Company has checked the current date on the victim system.
Technique: T1124: System Time Discovery
An example commonly-used sequence is Microsoft's Authorization Code Grant flow.
Technique: T1528: Steal Application Access Token
MuddyWater has added Registry Run key KCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemTextEncoding to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
The Visual Basic macro performs the following tasks:  Opens a handle to the malicious document to read the encoded CAB file Decodes the CAB file and writes it to the disk at %temp%\setup.cab   Encoded CAB file in the Word document
Technique: T1140: Deobfuscate/Decode Files or Information
Ramsay can schedule tasks via the Windows COM API to maintain persistence.
Technique: T1053: Scheduled Task/Job
Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system.
Technique: T1080: Taint Shared Content
SideTwist can use GetUserNameW, GetComputerNameW, and GetComputerNameExW to gather information.
Technique: T1106: Native API
net user 
Technique: T1087: Account Discovery
A Lazarus Group malware sample encodes data with base64.
Technique: T1132: Data Encoding
Command and control To traverse the firewall, C2 traffic for most TG-3390 tools occurs over ports 53, 80, and 443
Technique: T1571: Non-Standard Port
Shamoon attempts to overwrite operating system files and disk structures with image files.
Technique: T1485: Data Destruction
Cryptoistic can engage in encrypted communications with C2.
Technique: T1573: Encrypted Channel
Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls.
Technique: T1134: Access Token Manipulation
jRAT has been distributed as HTA files with VBScript.
Technique: T1059: Command and Scripting Interpreter
Adversaries may buy, lease, or rent physical servers that can be used during targeting.
Technique: T1583: Acquire Infrastructure
Darkhotel has used a keylogger.
Technique: T1056: Input Capture
Fox Kitten has used protocol tunneling for communication and RDP activity on compromised hosts through the use of open source tools such as Ngrok and custom tool SSHMinion.
Technique: T1572: Protocol Tunneling
Bisonal has a command to gather system information from the victim’s machine.
Technique: T1082: System Information Discovery
Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos.
Technique: T1586: Compromise Accounts
FIN8 has exploited the CVE-2016-0167 local vulnerability.
Technique: T1068: Exploitation for Privilege Escalation
ComRAT has also injected its communications module into the victim's default browser to make C2 connections appear less suspicious as all network connections will be initiated by the browser process.
Technique: T1055: Process Injection
nbtstat 
Technique: T1016: System Network Configuration Discovery
InvisiMole has used TCP to download additional modules.
Technique: T1095: Non-Application Layer Protocol
.cpl
Technique: T1218: Signed Binary Proxy Execution
AppleSeed can delete files from a compromised host after they are exfiltrated.
Technique: T1070: Indicator Removal on Host
PittyTiger attempts to obtain legitimate credentials during operations.
Technique: T1078: Valid Accounts
OSX_OCEANLOTUS.D has used the ioreg command to gather some of this information.
Technique: T1082: System Information Discovery
Access to specific areas of the Registry depends on account permissions, some requiring administrator-level access.
Technique: T1112: Modify Registry
An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.
Technique: T1134: Access Token Manipulation
NavRAT logs the keystrokes on the targeted system.
Technique: T1056: Input Capture
MuddyWater has used web services including OneHub to distribute remote access tools.
Technique: T1102: Web Service
FALLCHILL can collect operating system  version information, processor information, system name, and information about installed disks from the victim.
Technique: T1082: System Information Discovery
The "tDiscoverer" variant of HAMMERTOSS establishes a C2 channel by downloading resources from Web services like Twitter and GitHub.
Technique: T1102: Web Service
SHOTPUT has a command to retrieve information about connected users.
Technique: T1087: Account Discovery
Another common example is mmc gpedit.msc, which will open the Group Policy Editor application window.
Technique: T1218: Signed Binary Proxy Execution
Lazarus Group malware SierraAlfa uses the Windows Management Instrumentation Command-line application wmic to start itself on a target system during lateral movement.
Technique: T1047: Windows Management Instrumentation
Frankenstein has used trojanized documents that retrieve remote templates from an adversary-controlled website.
Technique: T1221: Template Injection
Remsec has a plugin that can perform ARP scanning as well as port scanning.
Technique: T1046: Network Service Scanning
Chimera has used type \\<hostname>\c$\Users\<username>\Favorites\Links\Bookmarks bar\Imported From IE\*citrix* for bookmark discovery.
Technique: T1217: Browser Bookmark Discovery
IIS modules can be written as a DLL that exports RegisterModule, or as a .NET application that interfaces with ASP.NET APIs to access IIS HTTP requests.
Technique: T1505: Server Software Component
Javascript 
Technique: T1059: Command and Scripting Interpreter
CORALDECK searches for specified files.
Technique: T1083: File and Directory Discovery
JSS Loader has the ability to launch scheduled tasks to establish persistence.
Technique: T1053: Scheduled Task/Job
overwrite or delete MBR in same sentence 
Technique: T1561: Disk Wipe
AppleJeus has XOR-encrypted collected system information prior to sending to a C2.
Technique: T1027: Obfuscated Files or Information
OwaAuth web shell command set
Technique: T1505: Server Software Component
Turla has used spearphishing via a link to get users to download and run their malware.
Technique: T1204: User Execution
Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed binaries.
Technique: T1218: Signed Binary Proxy Execution
Portions of these tickets may be encrypted with the RC4 algorithm, meaning the Kerberos 5 TGS-REP etype 23 hash of the service account associated with the SPN is used as the private key and is thus vulnerable to offline Brute Force attacks that may expose plaintext credentials.
Technique: T1558: Steal or Forge Kerberos Tickets
UNC2452 used different compromised credentials for remote access and to move laterally.
Technique: T1078: Valid Accounts
Chimera has staged stolen data locally on compromised hosts.
Technique: T1074: Data Staged
Cuba has the ability to encrypt system data and add the ".cuba" extension to encrypted files.
Technique: T1486: Data Encrypted for Impact
Higaisa used cmd.exe for execution.
Technique: T1059: Command and Scripting Interpreter
Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl.
Technique: T1204: User Execution
Another variation of this technique is to utilize temporary storage attached to the compute instance.
Technique: T1578: Modify Cloud Compute Infrastructure
ThiefQuest installs a launch item using an embedded encrypted launch agent property list template.
Technique: T1543: Create or Modify System Process
Although deprecated, the TxF application programming interface  is still enabled as of Windows 10.
Technique: T1055: Process Injection
BlackEnergy has gathered information about local network connections using netstat.
Technique: T1049: System Network Connections Discovery
Rather than creating and cultivating accounts  Establish Accounts, adversaries may compromise existing accounts.
Technique: T1586: Compromise Accounts
They have also used IP addresses originating from the same country as the victim for their VPN infrastructure.
Technique: T1036: Masquerading
CHOPSTICK encrypts C2 communications with TLS.
Technique: T1573: Encrypted Channel
Melcoz has been distributed through an AutoIt loader script.
Technique: T1059: Command and Scripting Interpreter
The benefit of this is that it allows users to go back to commands they've used before in different sessions.
Technique: T1070: Indicator Removal on Host
Attor can detect whether it is executed in some virtualized or emulated environment by searching for specific artifacts, such as communication with I/O ports and using VM-specific instructions.
Technique: T1497: Virtualization/Sandbox Evasion
Adversaries may modify plist files to automatically run an application when a user logs in.
Technique: T1547: Boot or Logon Autostart Execution
SHARPSTATS has the ability to employ a custom PowerShell script.
Technique: T1059: Command and Scripting Interpreter
Although small, the EWM is large enough to store a 32-bit pointer and is often used to point to a windows procedure.
Technique: T1055: Process Injection
APT3 has a tool that can run DLLs.
Technique: T1218: Signed Binary Proxy Execution
FIN10 has used stolen credentials to connect remotely to victim networks using VPNs protected with only a single factor.
Technique: T1078: Valid Accounts
DOGCALL can capture microphone data from the victim's machine.
Technique: T1123: Audio Capture
Adversaries may use PubPrn to proxy execution of malicious remote files.
Technique: T1216: Signed Script Proxy Execution
APT34 has used the command-line interface for execution.
Technique: T1059: Command and Scripting Interpreter
Credentials are typically accessible after a user provides a master password that unlocks the database.
Technique: T1555: Credentials from Password Stores
UPPERCUT has the capability to collect the current logged on user’s username from a machine.
Technique: T1033: System Owner/User Discovery
Rifdoor has encrypted strings with a single byte XOR algorithm.
Technique: T1027: Obfuscated Files or Information
BoxCaon can execute arbitrary commands and utilize the "ComSpec" environment variable.
Technique: T1059: Command and Scripting Interpreter
The command tab will show previously issued commands, when they were issued, and their status, as seen in Figure 4
Technique: T1059: Command and Scripting Interpreter
Duqu can track key presses with a keylogger module.
Technique: T1056: Input Capture
WindTail can use the open command to execute an application.
Technique: T1059: Command and Scripting Interpreter
On macOS and Linux curl may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.
Technique: T1048: Exfiltration Over Alternative Protocol
PUNCHBUGGY enables remote interaction and can obtain additional code over HTTPS GET and POST requests.
Technique: T1071: Application Layer Protocol
Manipulation may be possible over a network connection or between system processes where there is an opportunity deploy a tool that will intercept and change information.
Technique: T1565: Data Manipulation
If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell  or remote desktop protocol .
Technique: T1021: Remote Services
If the size is 7 bytes or more, the backdoor verifies that the command and control server sent an encoded package
Technique: T1132: Data Encoding
Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
Technique: T1055: Process Injection
CostaRicto employed nmap and pscan to scan target environments.
Technique: T1046: Network Service Scanning
Cadelspy has the ability to compress stolen data into a .cab file.
Technique: T1560: Archive Collected Data
33 Download specified file to %TEMP%\up and execute it in a new process      During C2 communications, BADNEWS will communicate to the C2 previously identified via HTTP
Technique: T1071: Application Layer Protocol
BLINDINGCAN has used HTTPS over port 443 for command and control.
Technique: T1071: Application Layer Protocol
BADNEWS has a command to download an .exe and execute it via CreateProcess API.
Technique: T1106: Native API
The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands.
Technique: T1059: Command and Scripting Interpreter
Zeus Panda checks for running processes on the victim’s machine.
Technique: T1057: Process Discovery
Magic Hound has attempted to lure victims into opening malicious email attachments.
Technique: T1204: User Execution
SpicyOmelette can check for the presence of 29 different antivirus tools.
Technique: T1518: Software Discovery
Execution granted through EWM injection may allow access to both the target process's memory and possibly elevated privileges.
Technique: T1055: Process Injection
BlackTech has used e-mails with malicious documents to lure victims into installing malware.
Technique: T1204: User Execution
APT1 used the commands net start and tasklist to get a listing of the services on the system.
Technique: T1007: System Service Discovery
TA551 has sent spearphishing attachments with password protected ZIP files.
Technique: T1566: Phishing
Remsec is capable of using SMTP for C2.
Technique: T1071: Application Layer Protocol
Adversaries may run the PowerShell command Clear-History to flush the entire command history from a current PowerShell session.
Technique: T1070: Indicator Removal on Host
Ursnif has gathered information about running services.
Technique: T1007: System Service Discovery
Sandworm Team has created VBScripts to run an SSH server.
Technique: T1059: Command and Scripting Interpreter
Revenge RAT uses mshta.exe to run malicious scripts on the system.
Technique: T1218: Signed Binary Proxy Execution
Sandworm Team has also researched third-party websites to help it craft credible spearphishing emails.
Technique: T1593: Search Open Websites/Domains
Agent Tesla can access the victim’s webcam and record video.
Technique: T1125: Video Capture
Emotet has relied upon users clicking on a malicious attachment delivered through spearphishing.
Technique: T1204: User Execution
APT41 used a malware variant called WIDETONE to conduct port scans on specified subnets.
Technique: T1046: Network Service Scanning
UNC2452 set the hostnames of its C2 infrastructure to match legitimate hostnames in the victim environment.
Technique: T1036: Masquerading
An adversary may perform shell escapes or exploit vulnerabilities in an application with the setsuid or setgid bits to get code running in a different user’s context.
Technique: T1548: Abuse Elevation Control Mechanism
Linux Rabbit maintains persistence on an infected machine through rc.local and .bashrc files.
Technique: T1546: Event Triggered Execution
Flame can record audio using any existing hardware recording devices.
Technique: T1123: Audio Capture
DustySky searches for network drives and removable media and duplicates itself onto them.
Technique: T1570: Lateral Tool Transfer
Another JHUHUGIT variant gathers the victim storage volume serial number and the storage device name.
Technique: T1082: System Information Discovery
POWERTON can use WMI for persistence.
Technique: T1546: Event Triggered Execution
After initial compromise, Chaos will download a second stage to establish a more permanent presence on the affected system.
Technique: T1104: Multi-Stage Channels
Dacls can download its payload from a C2 server.
Technique: T1105: Ingress Tool Transfer
The real file extension may be hidden by the operating system in the file browser , as well as in any software configured using or similar to the system’s policies.
Technique: T1036: Masquerading
Information about domains and their properties may include a variety of details, including what domain the victim owns as well as administrative data  and more directly actionable information such as contacts , business addresses, and name servers.
Technique: T1590: Gather Victim Network Information
WastedLocker can identify network adjacent and accessible drives.
Technique: T1135: Network Share Discovery
To perform proper validation, filters must receive plain-text credentials from the LSA.
Technique: T1556: Modify Authentication Process
Naikon uses commands such as netsh advfirewall firewall to discover local firewall settings.
Technique: T1518: Software Discovery
Tropic Trooper has used a copy function to automatically exfiltrate sensitive data from air-gapped systems using USB storage.
Technique: T1020: Automated Exfiltration
Cobalt Group deleted the DLL dropper from the victim’s machine to cover their tracks.
Technique: T1070: Indicator Removal on Host
A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots.
Technique: T1578: Modify Cloud Compute Infrastructure
EnvyScout has used folder icons for malicious files to lure victims into opening them.
Technique: T1036: Masquerading
This technique may be similar to System Firmware but conducted upon other system components/devices that may not have the same capability or level of integrity checking.
Technique: T1542: Pre-OS Boot
hxxp://www.sanjosemaristas[.]com/app/index.php?{A01BA0AD-9BB3-4F38-B76B-A00AD11CBAAA}, providing the current network adapter’s service name GUID
Technique: T1016: System Network Configuration Discovery
LoudMiner can automatically launch at startup if the AutoStart option is enabled in the VBoxVmService configuration file.
Technique: T1547: Boot or Logon Autostart Execution
APT28 has used a Powershell cmdlet to grant the ApplicationImpersonation role to a compromised account.
Technique: T1098: Account Manipulation
Stealth Falcon malware attempts to determine the installed version of .NET by querying the Registry.
Technique: T1012: Query Registry
Sandworm Team has developed malware for its operations, including malicious mobile applications and destructive malware such as NotPetya and Olympic Destroyer.
Technique: T1587: Develop Capabilities
RDAT can also delete itself from the infected system.
Technique: T1070: Indicator Removal on Host
Registry key “SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ” is queried to check the values ConsentPromptBehaviorAdmin and PromptOnSecureDesktop
Technique: T1012: Query Registry
This can be done by either executing a new or modified service.
Technique: T1569: System Services
Bazar has the ability to identify domain administrator accounts.
Technique: T1087: Account Discovery
BUBBLEWRAP can communicate using SOCKS.
Technique: T1095: Non-Application Layer Protocol
Conficker adds keys to the Registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services and various other Registry locations.
Technique: T1112: Modify Registry
APT29 has used the legitimate mailing service Constant Contact to send phishing e-mails.
Technique: T1566: Phishing
KillDisk deletes Application, Security, Setup, and System Windows Event Logs.
Technique: T1070: Indicator Removal on Host
The C2 server will provide the pre-shared key within the response data and will provide the session ID value via the Set-Cookie field within the response, specifically the string after the PHPSESSID parameter of the cookie
Technique: T1573: Encrypted Channel
Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise.
Technique: T1102: Web Service
SUNBURST created VBScripts that were named after existing services or folders to blend into legitimate activities.
Technique: T1036: Masquerading
DWriteCreateFactory() 
Technique: T1129: Shared Modules
The following is a brief list of example information that may hold potential value to an adversary and may also be found on an information repository:
* Policies, procedures, and standards
* Physical / logical network diagrams
* System architecture diagrams
* Technical system documentation
* Testing / development credentials
* Work / project schedules
* Source code snippets
* Links to network shares and other internal resources
Information stored in a repository may vary based on the specific instance or environment.
Technique: T1213: Data from Information Repositories
By default, these unit files are stored in the /etc/systemd/system and /usr/lib/systemd/system directories and have the file extension .service.
Technique: T1543: Create or Modify System Process
APT32 has collected the OS version and computer name from victims.
Technique: T1082: System Information Discovery
APT1 has used the Windows command shell to execute commands.
Technique: T1059: Command and Scripting Interpreter
menuPass has used malicious macros embedded inside Office documents to execute files.
Technique: T1059: Command and Scripting Interpreter
BabyShark has used cmd.exe to execute commands.
Technique: T1059: Command and Scripting Interpreter
KEYMARBLE can execute shell commands using cmd.exe.
Technique: T1059: Command and Scripting Interpreter
Leviathan has conducted internal spearphishing within the victim's environment for lateral movement.
Technique: T1534: Internal Spearphishing
Login items installed using the Service Management Framework leverage launchd, are not visible in the System Preferences, and can only be removed by the application that created them.
Technique: T1547: Boot or Logon Autostart Execution
* ExecStop and ExecStopPost directives cover when a service is stopped or manually by 'systemctl'.
Technique: T1543: Create or Modify System Process
GravityRAT creates a scheduled task to ensure it is re-executed everyday.
Technique: T1053: Scheduled Task/Job
StreamEx has the ability to modify the Registry.
Technique: T1112: Modify Registry
The verb get can be used in a myriad of ways to retrieve information for a machine, however in this case os get /format: is being abused to download payloads from non-local resources with .xsl extensions
Technique: T1082: System Information Discovery
Webshell can use encryption and base64 encoding to hide strings and to enforce access control once deployed.
Technique: T1027: Obfuscated Files or Information
MarkiRAT can download additional files and tools from its C2 server, including through the use of BITSAdmin.
Technique: T1105: Ingress Tool Transfer
CosmicDuke uses scheduled tasks typically named "Watchmon Service" for persistence.
Technique: T1053: Scheduled Task/Job
SynAck payloads are obfuscated prior to compilation to inhibit analysis and/or reverse engineering.
Technique: T1027: Obfuscated Files or Information
Denis will decrypt important strings used for C&C communication.
Technique: T1140: Deobfuscate/Decode Files or Information
Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency .
Technique: T1102: Web Service
Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.
Technique: T1572: Protocol Tunneling
UNC2452 used multiple command-line utilities to enumerate running processes.
Technique: T1057: Process Discovery
ComRAT has used unique per machine passwords to decrypt the orchestrator payload and a hardcoded XOR key to decrypt its communications module.
Technique: T1140: Deobfuscate/Decode Files or Information
JHUHUGIT has used a Registry Run key to establish persistence by executing JavaScript code within the rundll32.exe process.
Technique: T1547: Boot or Logon Autostart Execution
These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.
Technique: T1098: Account Manipulation
The first dropped file, doc.exe, contains the CVE-2014-4113 exploit and then attempts to execute test.exe with the elevated privileges
Technique: T1068: Exploitation for Privilege Escalation
ShimRat can hijack the cryptbase.dll within migwiz.exe to escalate privileges and bypass UAC controls.
Technique: T1574: Hijack Execution Flow
For each user, this file resides at the same location: ~/.bash_history.
Technique: T1552: Unsecured Credentials
APT1 used a batch script to perform a series of discovery techniques and saves it to a text file.
Technique: T1119: Automated Collection
Calisto runs the ifconfig command to obtain the IP address from the victim’s machine.
Technique: T1016: System Network Configuration Discovery
Within MFT entries are file attributes,  such as Extended Attributes  and Data known as Alternate Data Streams  when more than one Data attribute is present, that can be used to store arbitrary data .
Technique: T1564: Hide Artifacts
Attor performs the injection by attaching its code into the APC queue using NtQueueApcThread API.
Technique: T1055: Process Injection
Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise.
Technique: T1567: Exfiltration Over Web Service
Increasing the file size may decrease the effectiveness of certain tools and detection capabilities that are not designed or configured to scan large files.
Technique: T1027: Obfuscated Files or Information
ChChes steals credentials stored inside Internet Explorer.
Technique: T1555: Credentials from Password Stores
Cobalt Strike can use net localgroup to list local groups on a system.
Technique: T1069: Permission Groups Discovery
SideTwist has used HTTP GET and POST requests over port 443 for C2.
Technique: T1071: Application Layer Protocol
HyperBro has used HTTPS for C2 communications.
Technique: T1071: Application Layer Protocol
This allows the adversary to use the proxy credentials for subsequent requests if they enable outbound HTTP access.
Technique: T1552: Unsecured Credentials
Ursnif has also been used to download and execute additional payloads.
Technique: T1105: Ingress Tool Transfer
Metamorfo has a function to kill processes associated with defenses and can prevent certain processes from launching.
Technique: T1562: Impair Defenses
WastedLocker can enumerate removable drives prior to the encryption process.
Technique: T1120: Peripheral Device Discovery
The x_mode command is disabled by default, but when enabled via a command received from the DNS tunneling channel, it allows RogueRobin to receive a unique identifier and to get jobs by using Google Drive API requests
Technique: T1071: Application Layer Protocol
Weak linking enables developers to run an application on multiple macOS versions as new APIs are added.
Technique: T1574: Hijack Execution Flow
Timers can be set to run on a calendar event or after a time span relative to a starting point.
Technique: T1053: Scheduled Task/Job
SUNBURST encrypted C2 traffic using a single-byte-XOR cipher.
Technique: T1573: Encrypted Channel
Compromised access tokens may be used as an initial step in compromising other services.
Technique: T1550: Use Alternate Authentication Material
Common data encoding schemes include ASCII, Unicode, hexadecimal, Base64, and MIME.
Technique: T1132: Data Encoding
Adversaries may include the vulnerable driver with files delivered during Initial Access or download it to a compromised system via Ingress Tool Transfer or Lateral Tool Transfer.
Technique: T1068: Exploitation for Privilege Escalation
More_eggs can obtain information on installed anti-malware programs.
Technique: T1518: Software Discovery
Rancor attempted to get users to click on an embedded macro within a Microsoft Office Excel document to launch their malware.
Technique: T1204: User Execution
RATANKBA uses netstat -ano to search for specific IP address ranges.
Technique: T1049: System Network Connections Discovery
Astaroth has used malicious files including VBS, LNK, and HTML for execution.
Technique: T1204: User Execution
KEYS Deletes the file named by tempPath + “ky” file so as not to upload anything
Technique: T1070: Indicator Removal on Host
This method may also evade detection from security products since the execution is masked under a legitimate process.
Technique: T1574: Hijack Execution Flow
Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.
Technique: T1059: Command and Scripting Interpreter
OilRig has run tasklist on a victim's machine.
Technique: T1057: Process Discovery
KONNI has used Rundll32 to execute its loader for privilege escalation purposes.
Technique: T1218: Signed Binary Proxy Execution
Additionally, HISTCONTROL can be configured to ignore commands that start with a space by simply setting it to "ignorespace".
Technique: T1562: Impair Defenses
Users can interact with ticket storage using kinit, klist, ktutil, and kcc built-in binaries or via Apple's native Kerberos framework.
Technique: T1558: Steal or Forge Kerberos Tickets
Adversaries may choose to do this if they have sufficient access and proximity.
Technique: T1011: Exfiltration Over Other Network Medium
Typically, a user is notified when someone else is trying to steal their session.
Technique: T1563: Remote Service Session Hijacking
PHOREAL is capable of manipulating the Registry.
Technique: T1112: Modify Registry
Rifdoor has created a new registry entry at HKEY_CURRENT_USERS\Software\Microsoft\Windows\CurrentVersion\Run\Graphics with a value of C:\ProgramData\Initech\Initech.exe /run.
Technique: T1547: Boot or Logon Autostart Execution
Fox Kitten has created KeyBase accounts to communicate with ransomware victims.
Technique: T1585: Establish Accounts
StreamEx has the ability to enumerate system information.
Technique: T1082: System Information Discovery
Then, it will launch Dec.exe using PowerShell with the command “ cmd.exe /c powershell - WindowStyle Hidden Start-Process Dec.exe - WindowStyle maximized ”.
Technique: T1546: Event Triggered Execution
Metamorfo has used VMProtect to pack and protect files.
Technique: T1027: Obfuscated Files or Information
Later variants upload the file to a web server via an HTTP post command
Technique: T1071: Application Layer Protocol
VERMIN collects data stored in the clipboard.
Technique: T1115: Clipboard Data
Phishing may also be conducted via third-party services, like social media platforms.
Technique: T1566: Phishing
Adversaries may abuse Microsoft transport agents to establish persistent access to systems.
Technique: T1505: Server Software Component
BoomBox can establish persistence by writing the Registry value MicroNativeCacheSvc to HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
Technique: T1547: Boot or Logon Autostart Execution
MoonWind communicates over ports 80, 443, 53, and 8080 via raw sockets instead of the protocols usually associated with the ports.
Technique: T1571: Non-Standard Port
BRONZE BUTLER used spearphishing emails with malicious Microsoft Word attachments to infect victims.
Technique: T1566: Phishing
Examples include native cmd functions such as DEL, secure deletion tools such as Windows Sysinternals SDelete, or other third-party file deletion tools.
Technique: T1070: Indicator Removal on Host
Metamorfo has a function that can watch the contents of the system clipboard for valid bitcoin addresses, which it then overwrites with the attacker's address.
Technique: T1565: Data Manipulation
Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network.
Technique: T1567: Exfiltration Over Web Service
SMOKEDHAM can capture screenshots of the victim’s desktop.
Technique: T1113: Screen Capture
APT39 has maintained persistence using the startup folder.
Technique: T1547: Boot or Logon Autostart Execution
Kwampirs collects a list of running services with the command tasklist /svc.
Technique: T1007: System Service Discovery
StoneDrill has relied on injecting its payload directly into the process memory of the victim's preferred browser.
Technique: T1055: Process Injection
BlackEnergy has conducted port scans on a host.
Technique: T1046: Network Service Scanning
Adversaries may also use the same icon of the file they are trying to mimic.
Technique: T1036: Masquerading
Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems.
Technique: T1566: Phishing
AppleSeed has used UPX packers for its payload DLL.
Technique: T1027: Obfuscated Files or Information
Pysa has used Python scripts to deploy ransomware.
Technique: T1059: Command and Scripting Interpreter
Emotet has been observed creating new services to maintain persistence.
Technique: T1543: Create or Modify System Process
GRIFFON has used PowerShell to execute the Meterpreter downloader TinyMet.
Technique: T1059: Command and Scripting Interpreter
InvisiMole can use fileless UAC bypass and create an elevated COM object to escalate privileges.
Technique: T1548: Abuse Elevation Control Mechanism
APT3 has a tool that can detect the existence of remote systems.
Technique: T1018: Remote System Discovery
Downdelph uses search order hijacking of the Windows executable sysprep.exe to escalate privileges.
Technique: T1574: Hijack Execution Flow
MobileOrder has a command to upload to its C2 server victim mobile device information, including IMEI, IMSI, SIM card serial number, phone number, Android version, and other information.
Technique: T1082: System Information Discovery
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation.
Technique: T1113: Screen Capture
Sakula encodes C2 traffic with single-byte XOR keys.
Technique: T1573: Encrypted Channel
Machete has used free dynamic DNS domains for C2.
Technique: T1568: Dynamic Resolution
Newer versions create the "MaintenaceSrv" and "hdv_725x" services.
Technique: T1543: Create or Modify System Process
PolyglotDuke can be executed using rundll32.exe.
Technique: T1218: Signed Binary Proxy Execution
DCShadow is a method of manipulating Active Directory  data, including objects and schemas, by registering  and simulating the behavior of a DC.
Technique: T1207: Rogue Domain Controller
PoetRAT used file system monitoring to track modification and enable automatic exfiltration.
Technique: T1119: Automated Collection
The list of possible protocols is extensive.
Technique: T1095: Non-Application Layer Protocol
Figure 2: Excerpt of an APT33 malicious .hta file We assess APT33 used a built-in phishing module within the publicly available ALFA TEaM Shell (aka ALFASHELL) to send hundreds of spear phishing emails to targeted individuals in 2016
Technique: T1566: Phishing
SCREEN Takes a PNG screenshot of the main screen and names the file with timestamps, then uploads it to the C2 server using POST at the path “/FeedBack.php”
Technique: T1113: Screen Capture
Leviathan has used WMI for execution.
Technique: T1047: Windows Management Instrumentation
Egregor has masqueraded the svchost.exe process to exfiltrate data.
Technique: T1036: Masquerading
ZIRCONIUM has used malicious links and web beacons in e-mails for malware download and to track hits to attacker-controlled URL's.
Technique: T1566: Phishing
Execution via PE injection may also evade detection from security products since the execution is masked under a legitimate process.
Technique: T1055: Process Injection
PipeMon loads its modules using reflective loading or custom shellcode.
Technique: T1129: Shared Modules