HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
Machete has a feature to copy files from every drive onto a removable drive in a hidden folder.
Technique: T1052: Exfiltration Over Physical Medium
GrimAgent can identify the country code on a compromised host.
Technique: T1614: System Location Discovery
GPOs are containers for group policy settings made up of files stored within a predicable network path \\&lt;DOMAIN&gt;\SYSVOL\&lt;DOMAIN&gt;\Policies\.
Technique: T1484: Domain Policy Modification
menuPass has used key loggers to steal usernames and passwords.
Technique: T1056: Input Capture
Calisto adds permissions and remote logins to all users.
Technique: T1098: Account Manipulation
Patchwork has used BITS jobs to download malicious payloads.
Technique: T1197: BITS Jobs
This functionality could also be built into remote access tools.
Technique: T1119: Automated Collection
RATANKBA looking for specific IP ranges Our analysis of samples of the hack tool (HKTL_NBTSCAN.GA and HKTL_NBTSCAN.GB) indicate it as a command-line program that scans IP networks for NetBIOS information such as IP address, NetBIOS computer name, logged-in username, and MAC address—with some of the information coming from the initial RATAKNBA installation
Technique: T1016: System Network Configuration Discovery
Linux Rabbit brute forces SSH passwords in order to attempt to gain access and install its malware onto the server.
Technique: T1110: Brute Force
PowerShower sets up persistence with a Registry run key.
Technique: T1547: Boot or Logon Autostart Execution
These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions.
Technique: T1127: Trusted Developer Utilities Proxy Execution
NanoCore can open a remote command-line interface and execute commands.
Technique: T1059: Command and Scripting Interpreter
Wizard Spider has established persistence using Userinit by adding the Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.
Technique: T1547: Boot or Logon Autostart Execution
Remexi searches for files on the system.
Technique: T1083: File and Directory Discovery
* Reading raw keystroke data from the hardware buffer.
Technique: T1056: Input Capture
It does this by creating the following Registry keys: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs – %APPDATA%\Intel\ResN32.dll and HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs – 0x1.
Technique: T1546: Event Triggered Execution
Adversaries may abuse mavinject.exe to proxy execution of malicious code.
Technique: T1218: Signed Binary Proxy Execution
Code for new functionality can be included in these messages.
Technique: T1205: Traffic Signaling
The Get-MsolRole PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts .
Technique: T1069: Permission Groups Discovery
Regsvr32.exe is also a Microsoft signed binary.
Technique: T1218: Signed Binary Proxy Execution
Unlike Code Signing, this activity will not result in a valid signature.
Technique: T1036: Masquerading
Skidmap has the ability to add the public key of its handlers to the authorized_keys file to maintain persistence on an infected host.
Technique: T1098: Account Manipulation
Wizard Spider has accessed victim networks by using stolen credentials to access the corporate VPN infrastructure.
Technique: T1133: External Remote Services
Delivery document The delivery document contains a macro that downloads an executable from a remote server
Technique: T1105: Ingress Tool Transfer
FIN7 spear phishing campaigns have included malicious Word documents with DDE execution.
Technique: T1559: Inter-Process Communication
In Windows, Applications can access clipboard data by using the Windows API.
Technique: T1115: Clipboard Data
CMSTP.exe accepts an installation information file  as a parameter and installs a service profile leveraged for remote access connections.
Technique: T1218: Signed Binary Proxy Execution
PUNCHBUGGY can establish using a AppCertDLLs Registry key.
Technique: T1546: Event Triggered Execution
HAWKBALL has encrypted the payload with an XOR-based algorithm.
Technique: T1027: Obfuscated Files or Information
FLASHFLOOD will scan the My Recent Documents, Desktop, Temporary Internet Files, and TEMP directories.
Technique: T1005: Data from Local System
Patchwork removed certain files and replaced them so they could not be retrieved.
Technique: T1070: Indicator Removal on Host
Stuxnet used xp_cmdshell to store and execute SQL code.
Technique: T1505: Server Software Component
This type of prompt can be used to collect credentials via various languages such as AppleScript and PowerShell.
Technique: T1056: Input Capture
Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords.
Technique: T1110: Brute Force
jRAT has the capability to take screenshots of the victim’s machine.
Technique: T1113: Screen Capture
Sandworm Team's BCS-server tool can create an internal proxy server to redirect traffic from the adversary-controlled C2 to internal servers which may not be connected to the internet, but are interconnected locally.
Technique: T1090: Proxy
FakeM C2 traffic attempts to evade detection by resembling data generated by legitimate messenger applications, such as MSN and Yahoo!
Technique: T1001: Data Obfuscation
They also targeted Yahoo users with applications masquerading as "Delivery Service" and "McAfee Email Protection".
Technique: T1528: Steal Application Access Token
KARAE can use public cloud-based storage providers for command and control.
Technique: T1102: Web Service
Taidoor has downloaded additional files onto a compromised host.
Technique: T1105: Ingress Tool Transfer
There is a property value in /Library/Preferences/com.apple.loginwindow called Hide500Users that prevents users with userIDs 500 and lower from appearing at the login screen.
Technique: T1564: Hide Artifacts
Unpacks the code in memory via process hollowing
Technique: T1055: Process Injection
TG-3390 attempts to reenter the environment by identifying accounts that do not require two-factor authentication for remote access solutions, and then brute forcing usernames and passwords
Technique: T1110: Brute Force
Crimson has the ability to execute commands with the COMSPEC environment variable.
Technique: T1059: Command and Scripting Interpreter
menuPass has used esentutl to change file extensions to their true type that were masquerading as .txt files.
Technique: T1036: Masquerading
Micropsia creates a command-line shell using cmd.exe.
Technique: T1059: Command and Scripting Interpreter
POWERSTATS can retrieve screenshots from compromised hosts.
Technique: T1113: Screen Capture
Adversaries can create social media accounts that can be used to build a persona to further operations.
Technique: T1585: Establish Accounts
Honeybee launches a DLL file that gets executed as a service using svchost.exe Ke3chang has used a tool known as RemoteExec  to remotely execute batch scripts and binaries.
Technique: T1569: System Services
Astaroth logs keystrokes from the victim's machine.
Technique: T1056: Input Capture
ObliqueRAT can copy specific files, webcam captures, and screenshots to local directories.
Technique: T1074: Data Staged
Penquin can remove strings from binaries.
Technique: T1027: Obfuscated Files or Information
Bankshot gathers domain and account names/information through process monitoring.
Technique: T1087: Account Discovery
Turla surveys a system upon check-in to discover network configuration details using the arp -a, nbtstat -n, net config, ipconfig /all, and route commands, as well as NBTscan.
Technique: T1016: System Network Configuration Discovery
To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares..
Technique: T1485: Data Destruction
Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.
Technique: T1071: Application Layer Protocol
MuddyWater has used one C2 to obtain enumeration scripts and monitor web logs, but a different C2 to send data back.
Technique: T1104: Multi-Stage Channels
infoClient is reponsible for collecting OS info, submitting this info to its C&C servers (the servers are malicious in nature), and receiving additional C&C communication information
Technique: T1082: System Information Discovery
A benign rule might, for example, automatically move an email to a particular folder in Outlook if it contains specific words from a specific sender.
Technique: T1137: Office Application Startup
ELMER is capable of performing directory listings.
Technique: T1083: File and Directory Discovery
FLASHFLOOD searches for interesting files  on removable media and copies them to a staging area.
Technique: T1025: Data from Removable Media
A JPIN variant downloads the backdoor payload via the BITS service.
Technique: T1197: BITS Jobs
Kimsuky has used pass the hash for authentication to remote access software used in C2.
Technique: T1550: Use Alternate Authentication Material
GoldenSpy's installer has delayed installation of GoldenSpy for two hours after it reaches a victim system.
Technique: T1497: Virtualization/Sandbox Evasion
TA505 has used JavaScript for code execution.
Technique: T1059: Command and Scripting Interpreter
For example, the FailureCommand key may be changed so that the service is executed in an elevated context anytime the service fails or is intentionally corrupted.
Technique: T1574: Hijack Execution Flow
APT37 has used an audio capturing utility known as SOUNDWAVE that captures microphone input.
Technique: T1123: Audio Capture
Adversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future.. Keydnap adds the setuid flag to a binary so it can easily elevate in the future.
Technique: T1548: Abuse Elevation Control Mechanism
APT33 has used valid accounts for initial access and privilege escalation.
Technique: T1078: Valid Accounts
hides any strings related to its own indicators of compromise.
Technique: T1027: Obfuscated Files or Information
Gather domain and account names based on all running processes  Gathering account information from running processes
Technique: T1057: Process Discovery
POWERSTATS has created a scheduled task named "MicrosoftEdge" to establish persistence.
Technique: T1036: Masquerading
What does it mean for everyone and how to defend against such attacks, including zero-day exploits? For CVE-2017-11292 and other similar vulnerabilities, one can use the killbit for Flash within their organizations to disable it in any applications that respect it.  Unfortunately, doing this system-wide is not easily done, as Flash objects can be loaded in applications that potentially do not follow the killbit
Technique: T1203: Exploitation for Client Execution
Revenge RAT is a simple and freely available Remote Access Trojan that automatically gathers system information before allowing threat actors to remotely access system components such as webcams, microphones, and various other utilities
Technique: T1082: System Information Discovery
NOKKI uses Base64 encoding for strings.
Technique: T1027: Obfuscated Files or Information
The webshell will save the archives locally to the server in the C:\Users\Public\Libraries\Recorded\Files folder, each with a filename with the following structure: [IP address]_c$_Users_[username]__[Desktop-Documents-Downloads]_[year]-[month]-[day]-[hours]-[minutes]-[seconds].7z It is likely that the threat actors use this functionality to rapidly check for new files created by users on the network
Technique: T1033: System Owner/User Discovery
In one version of the malware, the code checks if the “ProgramData” folder has folders or files with the keywords “Kasper“, “Panda“, or “ESET“
Technique: T1083: File and Directory Discovery
Octopus can collect the host IP address from the victim’s machine.
Technique: T1016: System Network Configuration Discovery
Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems.
Technique: T1566: Phishing
Evilnum can deploy additional components or tools as needed.
Technique: T1105: Ingress Tool Transfer
Adversaries can set the DYLD_INSERT_LIBRARIES environment variable to point to malicious libraries containing names of legitimate libraries or functions requested by a victim program.
Technique: T1574: Hijack Execution Flow
Adversaries may abuse double extensions to attempt to conceal dangerous file types of payloads.
Technique: T1036: Masquerading
Specific common information repositories include web-based platforms such as Sharepoint and Confluence, specific services such as Code Repositories, IaaS databases, enterprise databases, and other storage infrastructure such as SQL Server.
Technique: T1213: Data from Information Repositories
Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.
Technique: T1547: Boot or Logon Autostart Execution
Gorgon Group malware can attempt to disable security features in Microsoft Office and Windows Defender using the taskkill command.
Technique: T1562: Impair Defenses
There are several examples of malware targeting cookies from web browsers on the local system.
Technique: T1539: Steal Web Session Cookie
menuPass has collected various files from the compromised computers.
Technique: T1005: Data from Local System
NanoCore uses VBS files.
Technique: T1059: Command and Scripting Interpreter
For the adversary to poison the ARP cache, their reply must be faster than the one made by the legitimate IP address owner.
Technique: T1557: Adversary-in-the-Middle
With CLR integration enabled, application developers can write stored procedures using any .NET framework language .
Technique: T1505: Server Software Component
Lucifer can identify the process that owns remote connections.
Technique: T1057: Process Discovery
StoneDrill has been observed deleting the temporary files once they fulfill their task.
Technique: T1070: Indicator Removal on Host
Credential Lockers store credentials in encrypted .vcrd files, located under %Systemdrive%\Users\\Username\AppData\Local\Microsoft\\Vault/Credentials\.
Technique: T1555: Credentials from Password Stores
Attachment types have included .rtf, .doc, .xls, archives containing LNK files, and password protected archives containing .exe and .scr executables.
Technique: T1566: Phishing
POWERSTATS can retrieve OS name/architecture and computer/domain name information from compromised hosts.
Technique: T1082: System Information Discovery
HiddenWasp downloads a tar compressed archive from a download server to the system.
Technique: T1105: Ingress Tool Transfer
BoomBox can search for specific files and directories on a machine.
Technique: T1083: File and Directory Discovery
Brave Prince gathers information about the Registry.
Technique: T1012: Query Registry
DarkVishnya has obtained and used tools such as Impacket, Winexe, and PsExec.
Technique: T1588: Obtain Capabilities
QUADAGENT uses VBScripts.
Technique: T1059: Command and Scripting Interpreter
RDFSNIFFER has the capability of deleting local files.
Technique: T1070: Indicator Removal on Host
Carberp has attempted to disable security software by creating a suspended process for the security software and injecting code to delete antivirus core files when the process is resumed.
Technique: T1562: Impair Defenses
Honeybee used batch scripting.
Technique: T1059: Command and Scripting Interpreter
Silence has used environment variable string substitution for obfuscation.
Technique: T1027: Obfuscated Files or Information
Adversaries may forge credential materials that can be used to gain access to web applications or Internet services.
Technique: T1606: Forge Web Credentials
NotPetya uses wevtutil to clear the Windows event logs.
Technique: T1070: Indicator Removal on Host
In macOS, every user account has a userID associated with it.
Technique: T1564: Hide Artifacts
Blue Mockingbird has executed custom-compiled XMRIG miner DLLs by configuring them to execute via the "wercplsupport" service.
Technique: T1569: System Services
BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.
Technique: T1203: Exploitation for Client Execution
Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.
Technique: T1098: Account Manipulation
APT41 attempted to remove evidence of some of its activity by deleting Bash histories.
Technique: T1070: Indicator Removal on Host
To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.
Technique: T1036: Masquerading
Upon user logon, the plist is called for execution and the malicious dylib is executed within the process space.
Technique: T1547: Boot or Logon Autostart Execution
APT29 has obtained and used a variety of tools including Mimikatz, SDelete, Tor, meek, and Cobalt Strike.
Technique: T1588: Obtain Capabilities
KARAE can upload and download files, including second-stage malware.
Technique: T1105: Ingress Tool Transfer
Machete’s collected files are exfiltrated automatically to remote servers.
Technique: T1020: Automated Exfiltration
Oftentimes, a customer will only use a subset of the available regions and may not actively monitor other regions.
Technique: T1535: Unused/Unsupported Cloud Regions
NanHaiShu can download additional files from URLs.
Technique: T1105: Ingress Tool Transfer
Snapshot of code we used to decrypt TClient’s configuration   Figure 11
Technique: T1140: Deobfuscate/Decode Files or Information
In the case of network infrastructure, particularly routers, it is possible for an adversary to leverage multiple compromised devices to create a multi-hop proxy chain within the Wide-Area Network  of the enterprise.
Technique: T1090: Proxy
Malicious usage of Regsvr32.exe may avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of allowlists or false positives from Windows using regsvr32.exe for normal operations.
Technique: T1218: Signed Binary Proxy Execution
PLATINUM has attempted to get users to open malicious files by sending spearphishing emails with attachments to victims.
Technique: T1204: User Execution
APT28 exploited a Windows SMB Remote Code Execution Vulnerability to conduct lateral movement.
Technique: T1210: Exploitation of Remote Services
APT29 added Registry Run keys to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
SpeakUp encodes its second-stage payload with Base64.
Technique: T1027: Obfuscated Files or Information
APT39 leveraged spearphishing emails with malicious attachments to initially compromise victims.
Technique: T1566: Phishing
Orz can overwrite Registry settings to reduce its visibility on the victim.
Technique: T1070: Indicator Removal on Host
Mustang Panda's custom ORat tool uses a WMI event consumer to maintain persistence.
Technique: T1546: Event Triggered Execution
Attor can download additional plugins, updates and other files.
Technique: T1105: Ingress Tool Transfer
Darkhotel has also stolen certificates and signed backdoors and downloaders with them.
Technique: T1553: Subvert Trust Controls
This functionality is used by Windows features such as User Account Control  to correctly set the PPID after a requested elevated process is spawned by SYSTEM  rather than the current user context.
Technique: T1134: Access Token Manipulation
launchctl
Technique: T1569: System Services
Adversaries may use this functionality as a way to execute arbitrary payloads on a victim system.
Technique: T1129: Shared Modules
POWRUNER may collect local group information by running net localgroup administrators or a series of other commands on a victim.
Technique: T1069: Permission Groups Discovery
Gamaredon Group has used GitHub repositories for downloaders which will be obtained by the group's .NET executable on the compromised system.
Technique: T1102: Web Service
APT41 sent spearphishing emails with attachments such as compiled HTML  files to initially compromise their victims.
Technique: T1566: Phishing
Orz can gather the victim OS version and whether it is 64 or 32 bit.
Technique: T1082: System Information Discovery
Chaes has used cmd to execute tasks on the system.
Technique: T1059: Command and Scripting Interpreter
Admin tools such as TeamViewer have been used by several groups targeting institutions in countries of interest to the Russian state and criminal campaigns.
Technique: T1219: Remote Access Software
ZIRCONIUM has used the AES256 algorithm with a SHA1 derived key to decrypt exploit code.
Technique: T1140: Deobfuscate/Decode Files or Information
Attor monitors the free disk space on the system.
Technique: T1082: System Information Discovery
Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.
Technique: T1056: Input Capture
PLEAD has the ability to list processes on the compromised host.
Technique: T1057: Process Discovery
Derusbi is capable of performing audio captures.
Technique: T1123: Audio Capture
Scripts can be run from the command-line via osascript /path/to/script or osascript -e "script here".
Technique: T1059: Command and Scripting Interpreter
The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise.
Technique: T1199: Trusted Relationship
Bazar has been spread via emails with embedded malicious links.
Technique: T1566: Phishing
Carbon uses HTTP to send data to the C2 server.
Technique: T1048: Exfiltration Over Alternative Protocol
Kazuar adds a sub-key under several Registry run keys.
Technique: T1547: Boot or Logon Autostart Execution
yty uses the net view command for discovery.
Technique: T1018: Remote System Discovery
Office add-ins can be used to add functionality to Office programs.
Technique: T1137: Office Application Startup
Through DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications as well as other Windows objects that contain insecure methods.
Technique: T1021: Remote Services
Adversaries can use scripts or manually run the commands launchctl load -w "%s/Library/LaunchAgents/%s" or /bin/launchctl load to execute Launch Agents or Launch Daemons.
Technique: T1569: System Services
Agent.btz collects the network adapter’s IP and MAC address as well as IP addresses of the network adapter’s default gateway, primary/secondary WINS, DHCP, and DNS servers, and saves them into a log file.
Technique: T1016: System Network Configuration Discovery
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications.
Technique: T1564: Hide Artifacts
APT1 has sent spearphishing emails containing hyperlinks to malicious files.
Technique: T1566: Phishing
APT29 has compromised domains to use for C2.
Technique: T1584: Compromise Infrastructure
Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Technique: T1057: Process Discovery
Spark has exfiltrated data over the C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
GravityRAT uses the netstat command to find open ports on the victim’s machine.
Technique: T1049: System Network Connections Discovery
While adversaries typically require root privileges to create/modify service unit files in the /etc/systemd/system and /usr/lib/systemd/system directories, low privilege users can create/modify service unit files in directories such as ~/.config/systemd/user/ to achieve user-level persistence.
Technique: T1543: Create or Modify System Process
Common file types, such as text files  and image files  are typically used as the first extension to appear benign.
Technique: T1036: Masquerading
In later versions of Windows , PubPrn.vbs has been updated to prevent proxying execution from a remote site.
Technique: T1216: Signed Script Proxy Execution
email client, Outlook, and Windows Credential Store.
Technique: T1552: Unsecured Credentials
Tropic Trooper has used multiple Windows APIs including HttpInitialize, HttpCreateHttpHandle, and HttpAddUrl.
Technique: T1106: Native API
Rocke's miner, "TermsHost.exe", evaded defenses by injecting itself into Windows processes, including Notepad.exe.
Technique: T1055: Process Injection
Unlike Credential API Hooking, this focuses solely on API functions intended for processing keystroke data.
Technique: T1056: Input Capture
NanHaiShu launches a script to delete their original decoy file to cover tracks.
Technique: T1070: Indicator Removal on Host
HTTPBrowser has used HTTP and HTTPS for command and control.
Technique: T1071: Application Layer Protocol
BADFLICK has captured victim computer name, memory space, and CPU details.
Technique: T1082: System Information Discovery
SHARPSTATS has the ability to identify the current date and time on the compromised host.
Technique: T1124: System Time Discovery
The adversary could then restart the device to implement the change immediately or they could wait until the next time the system restarts.
Technique: T1601: Modify System Image
CORALDECK has created password-protected RAR, WinImage, and zip archives to be exfiltrated.
Technique: T1560: Archive Collected Data
PoisonIvy creates a Registry subkey that registers a new system device.
Technique: T1112: Modify Registry
Attor has a plugin that collects data stored in the Windows clipboard by using the OpenClipboard and GetClipboardData APIs.
Technique: T1115: Clipboard Data
Astaroth exfiltrates collected information from its r1.log file to the external C2 server.
Technique: T1041: Exfiltration Over C2 Channel
TajMahal has the ability to identify hardware information, the computer name, and OS information on an infected host.
Technique: T1082: System Information Discovery
NETWIRE can discover processes on compromised hosts.
Technique: T1057: Process Discovery
itwm= ags= oe= aq= btnG= oprnd= itwm= utm= channel= The XAgent OSX Trojan generates a system specific value that it refers to as an “agent_id”, which is a unique identifier for each compromised host
Technique: T1082: System Information Discovery
Emotet has been observed encrypting the data it collects before sending it to the C2 server.
Technique: T1560: Archive Collected Data
Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.
Technique: T1020: Automated Exfiltration
The BlackEnergy component KillDisk is capable of deleting Windows Event Logs.
Technique: T1070: Indicator Removal on Host
MuddyWater has performed credential dumping with LaZagne and other tools, including by dumping passwords saved in victim email.
Technique: T1555: Credentials from Password Stores
These trust objects may include accounts, credentials, and other authentication material applied to servers, tokens, and domains.
Technique: T1484: Domain Policy Modification
SodaMaster can enumerate the host name and OS version on a target system.
Technique: T1082: System Information Discovery
CARROTBAT has the ability to execute command line arguments on a compromised host.
Technique: T1059: Command and Scripting Interpreter
APT28 has used spearphishing to compromise credentials.
Technique: T1598: Phishing for Information
SNUGRIDE is a backdoor that communicates with its C2 server through HTTP requests
Technique: T1071: Application Layer Protocol
They are loaded and unloaded through kextload and kextunload commands.
Technique: T1547: Boot or Logon Autostart Execution
regasm.exe 
Technique: T1218: Signed Binary Proxy Execution
Carbanak malware installs itself as a service to provide persistence and SYSTEM privileges.
Technique: T1543: Create or Modify System Process
MURKYTOP has the capability to delete local files.
Technique: T1070: Indicator Removal on Host
EVILNUM has a function called "DeleteLeftovers" to remove certain artifacts of the attack.
Technique: T1070: Indicator Removal on Host
DustySky collects information about running processes from victims.
Technique: T1057: Process Discovery
OopsIE exfiltrates command output and collected files to its C2 server in 1500-byte blocks.
Technique: T1030: Data Transfer Size Limits
TeamTNT has established tmate sessions for C2 communications.
Technique: T1219: Remote Access Software
Windows password filters are password policy enforcement mechanisms for both domain and local accounts.
Technique: T1556: Modify Authentication Process
Adversaries may attempt to establish persistence by inserting commands into scripts automatically executed by shells.
Technique: T1546: Event Triggered Execution
BLUELIGHT can enumerate files and collect associated metadata.
Technique: T1083: File and Directory Discovery
Lazarus Group malware SierraAlfa sends data to one of the hard-coded C2 servers chosen at random, and if the transmission fails, chooses a new C2 server to attempt the transmission again.
Technique: T1008: Fallback Channels
Zebrocy has used URL/Percent Encoding on data exfiltrated via HTTP POST requests.
Technique: T1132: Data Encoding
Metamorfo has communicated with hosts over raw TCP on port 9999.
Technique: T1571: Non-Standard Port
The  crontab file contains the schedule of cron entries to be run and the specified times for execution.
Technique: T1053: Scheduled Task/Job
InvisiMole has been configured with several servers available for alternate C2 communications.
Technique: T1008: Fallback Channels
APT28 has downloaded additional files, including by using a first-stage downloader to contact the C2 server to obtain the second-stage implant.
Technique: T1105: Ingress Tool Transfer
Chimera has collected credentials for the target organization from previous breaches for use in brute force attacks.
Technique: T1589: Gather Victim Identity Information
A Silver Ticket can be obtained for services that use Kerberos as an authentication mechanism and are used to generate tickets to access that particular resource and the system that hosts the resource .
Technique: T1550: Use Alternate Authentication Material
APT16 has compromised otherwise legitimate sites as staging servers for second-stage payloads.
Technique: T1584: Compromise Infrastructure
Further collaboration between FireEye as a Service (FaaS), Mandiant and FireEye iSIGHT intelligence uncovered additional victims worldwide, a new suite of tools and novel techniques
Technique: T1543: Create or Modify System Process
Operation Wocao has edited variable names within the Impacket suite to avoid automated detection.
Technique: T1027: Obfuscated Files or Information
APT32 used NTFS alternate data streams to hide their payloads.
Technique: T1564: Hide Artifacts
Executables tagged with the MOTW will be processed by Windows Defender SmartScreen that compares files with an allowlist of well-known executables.
Technique: T1553: Subvert Trust Controls
For example, if domain-x and domain-y are customers of the same CDN, it is possible to place domain-x in the TLS header and domain-y in the HTTP header.
Technique: T1090: Proxy
SYNful Knock can be sent instructions via special packets to change its functionality.
Technique: T1205: Traffic Signaling
Psylo uses HTTPS for C2.
Technique: T1071: Application Layer Protocol
PoetRAT has the ability to gather information about the compromised host.
Technique: T1082: System Information Discovery
Attackers using Comnie are leveraging malicious macros that initially hide decoy documents and shows them when the victim enables macros
Technique: T1059: Command and Scripting Interpreter
Hikit uses certmgr.exe -add GlobalSign.cer -c -s -r localMachine Root and certmgr.exe -add GlobalSign.cer -c -s -r localMachineTrustedPublisher to install a self-generated certificate to the local trust store as a root CA and Trusted Publisher.
Technique: T1553: Subvert Trust Controls
Proc memory injection involves enumerating the memory of a process via the /proc filesystem  then crafting a return-oriented programming  payload with available gadgets/instructions.
Technique: T1055: Process Injection
Explosive has commonly set file and path attributes to hidden.
Technique: T1564: Hide Artifacts
Dridex contains a backconnect module for tunneling network traffic through a victim's computer.
Technique: T1090: Proxy
InnaputRAT enumerates directories and obtains file attributes on a system.
Technique: T1083: File and Directory Discovery
Reaver encrypts collected data with an incremental XOR key prior to exfiltration.
Technique: T1560: Archive Collected Data
Bazar can establish persistence by writing shortcuts to the Windows Startup folder.
Technique: T1547: Boot or Logon Autostart Execution
Information from these sources may reveal opportunities for other forms of reconnaissance  or Phishing for Information, establishing operational resources  or Obtain Capabilities, and/or initial access  or Trusted Relationship.
Technique: T1596: Search Open Technical Databases
Operation Wocao has collected a list of open connections on the infected system using netstat and checks whether it has an internet connection.
Technique: T1049: System Network Connections Discovery
Drovorub has used a kernel module rootkit to hide processes, files, executables, and network artifacts from user space view.
Technique: T1014: Rootkit
CostaBricks can implement a custom-built virtual machine mechanism to obfuscate its code.
Technique: T1027: Obfuscated Files or Information
ComRAT can load a PE file from memory or the file system and execute it with CreateProcessW.
Technique: T1106: Native API
These are in-line with the targeting of the victims witnessed by the attackers using Conmie
Technique: T1059: Command and Scripting Interpreter
Tonto Team has used keylogging tools in their operations.
Technique: T1056: Input Capture
The recovered encrypted data may be vulnerable to offline Password Cracking attacks similarly to Kerberoasting and expose plaintext credentials.
Technique: T1558: Steal or Forge Kerberos Tickets
This custom onion routing network will transport the encrypted C2 traffic through the compromised population, allowing adversaries to communicate with any device within the onion routing network.
Technique: T1090: Proxy
ProLock can encrypt files on a compromised host with RC6, and encrypts the key with RSA-1024.
Technique: T1486: Data Encrypted for Impact
BadPatch has a keylogging capability.
Technique: T1056: Input Capture
Adversaries may use SNMP queries to collect MIB content directly from SNMP-managed devices in order to collect network information that allows the adversary to build network maps and facilitate future targeted exploitation.
Technique: T1602: Data from Configuration Repository
Get2 has the ability to identify the computer name and Windows version of an infected host.
Technique: T1082: System Information Discovery
Drovorub can use kernel modules to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
EvilBunny has deleted the initial dropper after running through the environment checks.
Technique: T1070: Indicator Removal on Host
ECCENTRICBANDWAGON can capture and store keystrokes.
Technique: T1056: Input Capture
They extend the functionality of the kernel without the need to reboot the system.
Technique: T1547: Boot or Logon Autostart Execution
HotCroissant has the ability to stop services on the infected host.
Technique: T1489: Service Stop
Access through trusted third party relationship exploits an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.
Technique: T1199: Trusted Relationship
A typical example of this is environments where internal networks make use of non-Internet routable addresses.
Technique: T1599: Network Boundary Bridging
RTM encrypts C2 traffic with a custom RC4 variant.
Technique: T1573: Encrypted Channel
APT28 used weaponized Microsoft Word documents abusing the remote template function to retrieve a malicious macro.
Technique: T1221: Template Injection
Turla surveys a system upon check-in to discover the system time by using the net time command.
Technique: T1124: System Time Discovery
Carbon uses the netstat -r and netstat -an commands.
Technique: T1049: System Network Connections Discovery
Trojan.Karagany can steal data and credentials from browsers.
Technique: T1555: Credentials from Password Stores
USBferry can copy its installer to attached USB storage devices.
Technique: T1091: Replication Through Removable Media
Figure 2: Zyklon attack flow Infection Techniques CVE-2017-8759 This vulnerability was discovered by FireEye in September 2017, and it is a vulnerability we have observed being exploited in the wild
Technique: T1203: Exploitation for Client Execution
APT32 successfully gained remote access by using pass the ticket.
Technique: T1550: Use Alternate Authentication Material
Bandook has modules that are capable of capturing video from a victim's webcam.
Technique: T1125: Video Capture
InvisiMole can use winapiexec tool for indirect execution of  ShellExecuteW and CreateProcessA.
Technique: T1106: Native API
KEYMARBLE has a command to create Registry entries for storing data under HKEY_CURRENT_USER\SOFTWARE\Microsoft\WABE\DataPath.
Technique: T1112: Modify Registry
ZxShell supports functionality for VNC sessions.
Technique: T1021: Remote Services
SHARPSTATS has the ability to upload and download files.
Technique: T1105: Ingress Tool Transfer
Wiarp creates a backdoor through which remote attackers can download files.
Technique: T1105: Ingress Tool Transfer
Kasidet can execute commands using cmd.exe.
Technique: T1059: Command and Scripting Interpreter
At face value, this current variant of OopsIE has a vast majority of its strings obfuscated, which can be deobfuscated by splitting the strings using the hyphen as a delimiter, treating each split value as an integer, subtracting one from each integer and converting each into a character
Technique: T1027: Obfuscated Files or Information
Screenshots The data dump includes several screenshots of resources that the leaker alleged was related to the OilRig group
Technique: T1113: Screen Capture
APT3 has a tool that exfiltrates data over the C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
FInally , the newest sample uses dynamic API lookups to attempt to make static disassembly harder to understand.
Technique: T1106: Native API
TrickBot downloads several additional files and saves them to the victim's machine.
Technique: T1105: Ingress Tool Transfer
APT33 has used a variety of publicly available tools like LaZagne, Mimikatz, and ProcDump to dump credentials.
Technique: T1003: OS Credential Dumping
Files have been encrypted with their own AES key and given a file extension of .RYK.
Technique: T1486: Data Encrypted for Impact
The POSHSPY backdoor is designed to download and execute additional PowerShell code and Windows binaries
Technique: T1105: Ingress Tool Transfer
POWERSTATS can use JavaScript code for execution.
Technique: T1059: Command and Scripting Interpreter
APT33 has utilized PowerShell to download files from the C2 server and run various scripts.
Technique: T1059: Command and Scripting Interpreter
Revenge RAT used blogpost.com as its primary command and control server during a campaign.
Technique: T1102: Web Service
An RTF, an MSI file, a .NET Wrapper and two stages of Shellcode walk into a bar… Our journey begins with an RTF file named “New Salary Structure 2017.doc”, which exploits CVE-2017-0199
Technique: T1203: Exploitation for Client Execution
StreamEx uses rundll32 to call an exported function.
Technique: T1218: Signed Binary Proxy Execution
Sidewinder has sent e-mails with malicious attachments that lead victims to credential harvesting websites.
Technique: T1598: Phishing for Information
Higaisa used ipconfig to gather network configuration information.
Technique: T1016: System Network Configuration Discovery
APT29 has written malware variants in Visual Basic.
Technique: T1059: Command and Scripting Interpreter
APT28 has delivered JHUHUGIT and Koadic by executing PowerShell commands through DDE in Word documents.
Technique: T1559: Inter-Process Communication
EVILNUM has used a one-way communication method via GitLab and Digital Point to perform C2.
Technique: T1102: Web Service
InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute System.ComponentModel.RunInstaller.
Technique: T1218: Signed Binary Proxy Execution
FatDuke has the ability to create a process.
Technique: T1543: Create or Modify System Process
PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services.
Technique: T1556: Modify Authentication Process
Get-NetForestTrust 
Technique: T1482: Domain Trust Discovery
Stuxnet used copies of .lnk shortcuts to propagate through removable media.
Technique: T1547: Boot or Logon Autostart Execution
Bandook can download files to the system.
Technique: T1105: Ingress Tool Transfer
One variant of BlackEnergy creates a new service using either a hard-coded or randomly generated name.
Technique: T1543: Create or Modify System Process
FIN6 used another set of compromised credentials with membership to additional groups in the domain to RDP to other hosts
Technique: T1021: Remote Services
As of OSX 10.10, OSA only supports two languages, JXA and AppleScript.
Technique: T1059: Command and Scripting Interpreter
Attor's dispatcher disguises itself as a legitimate task , the task name and description appear legitimate.
Technique: T1036: Masquerading
Bazar can use various APIs to allocate memory and facilitate code execution/injection.
Technique: T1106: Native API
Silver tickets are more limited in scope in than golden tickets in that they only enable adversaries to access a particular resource  and the system that hosts the resource; however, unlike golden tickets, adversaries with the ability to forge silver tickets are able to create TGS tickets without interacting with the Key Distribution Center , potentially making detection more difficult.
Technique: T1558: Steal or Forge Kerberos Tickets
Bazar can use HTTP and HTTPS over ports 80 and 443 in C2 communications.
Technique: T1071: Application Layer Protocol
Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by Password Cracking Kerberos messages.
Technique: T1558: Steal or Forge Kerberos Tickets
Trojan.Karagany can perform reconnaissance commands on a victim machine via a cmd.exe process.
Technique: T1059: Command and Scripting Interpreter
Command Description   !Dir Lists the contents of a specified directory   !Drives Enumerates the storage drives attached to the system and their respective type
Technique: T1083: File and Directory Discovery
Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility.
Technique: T1218: Signed Binary Proxy Execution
Kerrdown has been distributed via e-mails containing a malicious link.
Technique: T1566: Phishing
Otherwise, it runs a search for the “/bin/rsyncd” string within the files found in the /etc/ folder
Technique: T1083: File and Directory Discovery
APT34 has used valid administrator credentials to assist in lateral movement.
Technique: T1078: Valid Accounts
An adversary may create a snapshot or data backup within a cloud account to evade defenses.
Technique: T1578: Modify Cloud Compute Infrastructure
Each .timer file must have a corresponding .service file with the same name, e.g., example.timer and example.service.
Technique: T1053: Scheduled Task/Job
* Staging web resources for a link target to be used with spearphishing.
Technique: T1608: Stage Capabilities
SpeakUp uses the ifconfig -a command.
Technique: T1016: System Network Configuration Discovery
Older documents used by Patchwork focused on the CVE-2017-0261 vulnerability, however in late January 2018 when, paradoxically, newer documents abandoned this vulnerability to attack the older CVE-2015-2545 vulnerability
Technique: T1203: Exploitation for Client Execution
PoisonIvy stages collected data in a text file.
Technique: T1074: Data Staged
ShadowPad has sent data back to C2 every 8 hours.
Technique: T1029: Scheduled Transfer
In this instance a spear phishing email was used containing a lure designed to socially engineer and entice the victim to executing a malicious attachment
Technique: T1566: Phishing
Misdat saves itself as a file named msdtc.exe, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.
Technique: T1036: Masquerading
Ursnif has used HTTPS for C2.
Technique: T1071: Application Layer Protocol
20 New processes The malicious svchost constantly queries ieframe.dll, as well as IWebBrowser2 Interface using CLSID dc30c1661-cdaf-11D0-8A3E-00c04fc9e26e, both key components to interact with Internet Explorer
Technique: T1055: Process Injection
LoJax has modified the Registry key ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’ from ‘autocheck autochk *’ to ‘autocheck autoche *’.
Technique: T1112: Modify Registry
Access to Registry keys is controlled through access control lists and user permissions.
Technique: T1574: Hijack Execution Flow
Adversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection.
Technique: T1499: Endpoint Denial of Service
REvil can obtain the token from the user that launched the explorer.exe process to avoid affecting the desktop of the SYSTEM user.
Technique: T1134: Access Token Manipulation
HiddenWasp adds itself to the LD_PRELOAD path and sets a series of environment variables.
Technique: T1055: Process Injection
APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.
Technique: T1036: Masquerading
netstat 
Technique: T1049: System Network Connections Discovery
Leafminer used several tools for retrieving login and password information, including LaZagne and Mimikatz.
Technique: T1003: OS Credential Dumping
RegDuke can extract and execute PowerShell scripts from C2 communications.
Technique: T1059: Command and Scripting Interpreter
Dragonfly 2.0 used spearphishing with PDF attachments containing malicious links that redirected to credential harvesting websites.
Technique: T1566: Phishing
LightNeuron can be configured to automatically collect files under a specified directory.
Technique: T1119: Automated Collection
Remsec can dump the SAM database.
Technique: T1003: OS Credential Dumping
Honeybee performs data exfiltration is accomplished through the following command-line command: from <COMPUTER-NAME> .txt.
Technique: T1020: Automated Exfiltration
JPIN can obtain the victim user name.
Technique: T1033: System Owner/User Discovery
Reflectively loaded payloads may be compiled binaries, anonymous files , or just snubs of fileless executable code .
Technique: T1620: Reflective Code Loading
In order to decode this data, Comnie first decodes it using base64 with the following non-standard alphabet (note that it is simply the original alphabet in reverse): /+9876543210zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA   The resulting data is then parsed and decrypted using RC4
Technique: T1140: Deobfuscate/Decode Files or Information
Some Felismus samples use a custom method for C2 traffic that utilizes Base64.
Technique: T1132: Data Encoding
FIN6 has used has used Metasploit’s named-pipe impersonation technique to escalate privileges.
Technique: T1134: Access Token Manipulation
Adversaries may use hidden users to mask the presence of user accounts they create or modify.
Technique: T1564: Hide Artifacts