HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
Machete's collected data is encrypted with AES before exfiltration.
Technique: T1560: Archive Collected Data
BLACKCOFFEE has the capability to delete files.
Technique: T1070: Indicator Removal on Host
Whitefly has used Mimikatz to obtain credentials.
Technique: T1003: OS Credential Dumping
Software packing is a method of compressing or encrypting an executable.
Technique: T1027: Obfuscated Files or Information
PoetRAT sent username, computer name, and the previously generated UUID in reply to a "who" command from C2.
Technique: T1033: System Owner/User Discovery
An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.
Technique: T1071: Application Layer Protocol
BRONZE BUTLER has collected a list of files from the victim and uploaded it to its C2 server, and then created a new list of specific files to steal.
Technique: T1083: File and Directory Discovery
Bad Rabbit drops a file named infpub.datinto the Windows directory and is executed through SCManager and rundll.exe.
Technique: T1569: System Services
Cardinal RAT decodes many of its artifacts and is decrypted  after being downloaded.
Technique: T1140: Deobfuscate/Decode Files or Information
ADVSTORESHELL connects to port 80 of a C2 server using Wininet API.
Technique: T1071: Application Layer Protocol
MiniDuke can can use a named pipe to forward communications from one compromised machine with internet access to other compromised machines.
Technique: T1090: Proxy
Epic has overwritten the function pointer in the extra window memory of Explorer's Shell_TrayWnd in order to execute malicious code in the context of the explorer.exe process.
Technique: T1055: Process Injection
The Komplex C2 channel uses HTTP POST requests.
Technique: T1071: Application Layer Protocol
Machete used the startup folder for persistence.
Technique: T1547: Boot or Logon Autostart Execution
RainyDay can use the Windows Command Shell for execution.
Technique: T1059: Command and Scripting Interpreter
ChChes establishes persistence by adding a Registry Run key.
Technique: T1547: Boot or Logon Autostart Execution
so that it's hidden from users by default.
Technique: T1564: Hide Artifacts
Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell.
Technique: T1218: Signed Binary Proxy Execution
Kinsing has used SSH for lateral movement.
Technique: T1021: Remote Services
attrib +h 
Technique: T1222: File and Directory Permissions Modification
FIN7 used JavaScript scripts to help perform tasks on the victim's machine.
Technique: T1059: Command and Scripting Interpreter
Adversaries may bring a signed vulnerable driver onto a compromised machine so that they can exploit the vulnerability to execute code in kernel mode.
Technique: T1068: Exploitation for Privilege Escalation
Ke3chang actors have been known to copy files to the network shares of other computers to move laterally.
Technique: T1021: Remote Services
Magic Hound stole domain credentials from Microsoft Active Directory Domain Controller and leveraged Mimikatz.
Technique: T1003: OS Credential Dumping
Volgmer queries the system to identify existing services.
Technique: T1007: System Service Discovery
Bandook has been launched by starting iexplore.exe and replacing it with Bandook's payload.
Technique: T1055: Process Injection
Adversaries may purchase domains similar to legitimate domains  during acquisition of infrastructure  to help facilitate Malicious Link.
Technique: T1608: Stage Capabilities
As an example, adversaries with user-level access can execute the df -aH command to obtain currently mounted disks and associated freely available space.
Technique: T1082: System Information Discovery
Bazar has a variant with a packed payload.
Technique: T1027: Obfuscated Files or Information
In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities .
Technique: T1588: Obtain Capabilities
capturing audio 
Technique: T1123: Audio Capture
Nebulae can download files from C2.
Technique: T1105: Ingress Tool Transfer
Mosquito runs tasklist to obtain running processes.
Technique: T1057: Process Discovery
FELIXROOT encrypts collected data with AES and Base64 and then sends it to the C2 server.
Technique: T1560: Archive Collected Data
These AppleEvent messages can be sent independently or easily scripted with AppleScript.
Technique: T1059: Command and Scripting Interpreter
XAgentOSX contains the takeScreenShot  functions to take screenshots using the CGGetActiveDisplayList, CGDisplayCreateImage, and NSImage:initWithCGImage methods.
Technique: T1113: Screen Capture
Ixeshe enumerates the IP address, network proxy settings, and domain name from a victim's system.
Technique: T1016: System Network Configuration Discovery
BoomBox can enumerate the username on a compromised host.
Technique: T1033: System Owner/User Discovery
Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation, such as through the use of virtualization technology.
Technique: T1564: Hide Artifacts
Andariel has conducted spearphishing campaigns that included malicious Word or Excel attachments.
Technique: T1566: Phishing
The configuration data is encrypted with the same algorithm described previously by JPCert but using a different XOR value
Technique: T1027: Obfuscated Files or Information
Operation Wocao has used PowerSploit's Invoke-Kerberoast module to request encrypted service tickets and bruteforce the passwords of Windows service accounts offline.
Technique: T1558: Steal or Forge Kerberos Tickets
CosmicDuke attempts to exploit privilege escalation vulnerabilities CVE-2010-0232 or CVE-2010-4398.
Technique: T1068: Exploitation for Privilege Escalation
Adversaries may obfuscate command and control traffic to make it more difficult to detect.
Technique: T1001: Data Obfuscation
APT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine.
Technique: T1059: Command and Scripting Interpreter
Valak has used packed DLL payloads.
Technique: T1027: Obfuscated Files or Information
NotPetya can use PsExec, which interacts with the ADMIN$ network share to execute commands on remote systems.
Technique: T1021: Remote Services
The specific sandbox checks include:  Using WMI to check BIOS version (SMBIOSBIOSVERSION) for VBOX, bochs, qemu, virtualbox and vm
Technique: T1497: Virtualization/Sandbox Evasion
FIN5 has used legitimate VPN, Citrix, or VNC credentials to maintain access to a victim environment.
Technique: T1133: External Remote Services
Ramsay has masqueraded as a 7zip installer.
Technique: T1036: Masquerading
GoldenSpy's uninstaller has base64-encoded its variables.
Technique: T1027: Obfuscated Files or Information
Some network designs require NAT for the packets to cross the border device.
Technique: T1599: Network Boundary Bridging
Dragonfly 2.0 created accounts disguised as legitimate backup and service accounts as well as an email administration account.
Technique: T1036: Masquerading
Metamorfo requires the user to double-click the executable to run the malicious HTA file or to download a malicious installer.
Technique: T1204: User Execution
MuddyWater has controlled POWERSTATS from behind a proxy network to obfuscate the C2 location.
Technique: T1090: Proxy
REvil can use the Windows command line to delete volume shadow copies and disable recovery.
Technique: T1059: Command and Scripting Interpreter
Silent Librarian has set up auto forwarding rules on compromised e-mail accounts.
Technique: T1114: Email Collection
Remexi uses BITSAdmin to communicate with the C2 server over HTTP.
Technique: T1071: Application Layer Protocol
Mosquito's launcher uses rundll32.exe in a Registry Key value to start the main backdoor capability.
Technique: T1218: Signed Binary Proxy Execution
UNC2452 used WMI event subscriptions for persistence.
Technique: T1546: Event Triggered Execution
Tools such as Systeminfo can be used to gather detailed system information.
Technique: T1082: System Information Discovery
This variation of the technique is often referred to as a "Squiblydoo" attack and has been used in campaigns targeting governments.
Technique: T1218: Signed Binary Proxy Execution
LookBack can retrieve file listings from the victim machine.
Technique: T1083: File and Directory Discovery
Gold Dragon establishes persistence in the Startup folder.
Technique: T1547: Boot or Logon Autostart Execution
Web applications and services  often use session cookies, tokens, or other materials to authenticate and authorize user access.
Technique: T1606: Forge Web Credentials
Patchwork developed a file stealer to search C:\ and collect files with certain extensions.
Technique: T1119: Automated Collection
The final part of the VBA script changes the properties of these two files, setting their attributes to Hidden
Technique: T1564: Hide Artifacts
Is this a Windows-only threat? Which versions of Windows are targeted? Poseidon is particularly focused on the Microsoft Windows operating system family, specifically customizing the infection method for each one so as to gather different information and hide its presence after the initial infection
Technique: T1082: System Information Discovery
zwShell can launch command-line shells.
Technique: T1059: Command and Scripting Interpreter
Chaes stored its instructions in a config file in the Registry.
Technique: T1112: Modify Registry
This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices.
Technique: T1499: Endpoint Denial of Service
Vault was implemented in Windows 7, it contains any sensitive data (like the credentials) of Internet Explorer
Technique: T1003: OS Credential Dumping
Adversaries may also use the Wake-on-LAN feature to turn on powered off systems.
Technique: T1205: Traffic Signaling
Newer variants of BACKSPACE will encode C2 communications with a custom system.
Technique: T1132: Data Encoding
Frankenstein has enumerated hosts, gathering username, machine name, and administrative permissions information.
Technique: T1033: System Owner/User Discovery
Pisloader uses cmd.exe to set the Registry Run key value.
Technique: T1059: Command and Scripting Interpreter
LoJax has modified the Registry key ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’ from ‘autocheck autochk *’ to ‘autocheck autoche *’ in order to execute its payload during Windows startup.
Technique: T1547: Boot or Logon Autostart Execution
Clop can uninstall or disable security products.
Technique: T1562: Impair Defenses
It is common for one-time codes to be sent via out-of-band communications .
Technique: T1111: Two-Factor Authentication Interception
The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes.
Technique: T1003: OS Credential Dumping
OilRig has sent spearphising emails with malicious links to potential victims.
Technique: T1566: Phishing
Ryuk has called GetIpNetTable in attempt to identify all mounted drives and hosts that have Address Resolution Protocol  entries.
Technique: T1016: System Network Configuration Discovery
Patchwork attempted to use RDP to move laterally.
Technique: T1021: Remote Services
RogueRobin uses WMI to check BIOS version for VBOX, bochs, qemu, virtualbox, and vm to check for evidence that the script might be executing within an analysis environment.
Technique: T1497: Virtualization/Sandbox Evasion
RDFSNIFFER has used several Win32 API functions to interact with the victim machine.
Technique: T1106: Native API
Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.
Technique: T1614: System Location Discovery
Machete has scanned and looked for cryptographic keys and certificate file extensions.
Technique: T1552: Unsecured Credentials
Comnie runs the net view command Remsec can ping or traceroute a remote host.
Technique: T1018: Remote System Discovery
it operates over DNS traffic, but can also switch to encrypted channels such as HTTPS or SSL
Technique: T1071: Application Layer Protocol
The group clearly shows a preference for using a simple downloader like Zebrocy as first-stage payloads in these attacks
Technique: T1027: Obfuscated Files or Information
Octopus can collect information on the Windows directory and searches for compressed RAR files on the host.
Technique: T1083: File and Directory Discovery
HALFBAKED can execute PowerShell scripts.
Technique: T1059: Command and Scripting Interpreter
Adversaries may attempt to cause a denial of service  by directly sending a high-volume of network traffic to a target.
Technique: T1498: Network Denial of Service
Additionally, there is a tty_tickets variable that treats each new tty  in isolation.
Technique: T1548: Abuse Elevation Control Mechanism
Many command shell utilities can be used to obtain this information.
Technique: T1083: File and Directory Discovery
Mosquito uses the ipconfig command.
Technique: T1016: System Network Configuration Discovery
This utility is able to execute complicated WQL queries and WMI methods
Technique: T1047: Windows Management Instrumentation
Shamoon decrypts ciphertext using an XOR cipher and a base64-encoded string.
Technique: T1140: Deobfuscate/Decode Files or Information
LiteDuke can query the Registry to check for the presence of HKCU\Software\KasperskyLab.
Technique: T1012: Query Registry
CookieMiner has checked for the presence of "Little Snitch", macOS network monitoring and application firewall software, stopping and exiting if it is found.
Technique: T1562: Impair Defenses
* Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol  and Simple Authentication Security Layer  exchanges.
Technique: T1003: OS Credential Dumping
InvisiMole can register itself for execution and persistence via the Control Panel.
Technique: T1218: Signed Binary Proxy Execution
Malware  Capabilities  WINDSHIELD   Command and control (C2) communications via TCP raw sockets Four configured C2s and six configured ports – randomly-chosen C2/port for communications Registry manipulation Get the current module's file name Gather system information including registry values, user name, computer name, and current code page File system interaction including directory creation, file deletion, reading, and writing files Load additional modules and execute code Terminate processes Anti-disassembly   KOMPROGO   Fully-featured backdoor capable of process, file, and registry management Creating a reverse shell File transfers Running WMI queries Retrieving information about the infected system   SOUNDBITE   C2 communications via DNS Process creation File upload Shell command execution File and directory enumeration/manipulation Window enumeration Registry manipulation System information gathering   PHOREAL   C2 communications via ICMP Reverse shell creation Filesystem manipulation Registry manipulation Process creation File upload   BEACON (Cobalt Strike)   Publicly available payload that can inject and execute arbitrary code into processes Impersonating the security context of users Importing Kerberos tickets Uploading and downloading files Executing shell commands Configured with malleable C2 profiles to blend in with normal network traffic Co-deployment and interoperability with Metasploit framework SMB Named Pipe in-memory backdoor payload that enables peer-to-peer C2 and pivoting over SMB    Table 3: APT32 Malware and Capabilities APT32 operators appear to be well-resourced and supported as they use a large set of domains and IP addresses as command and control infrastructure
Technique: T1041: Exfiltration Over C2 Channel
This shellcode injects the final payload taken from the resource section into the original RegAsm.exe process
Technique: T1055: Process Injection
When each file is encrypted, registry keys are created under HKU\{SID}\Software\Microsoft\ RestartManager \ which are used to track metadata pertaining to the file being encrypted, such as owner, sequence, session and file hash
Technique: T1547: Boot or Logon Autostart Execution
Outlook 2010 and later supports .ost file sizes up to 50GB, while earlier versions of Outlook support up to 20GB.
Technique: T1114: Email Collection
It may also create the Registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ IMJPMIJ8.1{3 characters of Unique Identifier}.
Technique: T1547: Boot or Logon Autostart Execution
RainyDay has the ability to switch between TCP and HTTP for C2 if one method is not working.
Technique: T1008: Fallback Channels
Grandoreiro can modify the binary ACL to prevent security tools from running.
Technique: T1222: File and Directory Permissions Modification
Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Technique: T1135: Network Share Discovery
Tropic Trooper has exfiltrated data using USB storage devices.
Technique: T1052: Exfiltration Over Physical Medium
Zebrocy has exfiltrated data to the designated C2 server using HTTP POST requests.
Technique: T1041: Exfiltration Over C2 Channel
Helminth can download additional files.
Technique: T1105: Ingress Tool Transfer
The database is located in the “/usr/lib/cva-ssys/My_BD” folder (“~/.local/cva-ssys/My_BD”—if the Trojan does not have root privileges)
Technique: T1068: Exploitation for Privilege Escalation
OSX/Shlayer relies on users mounting and executing a malicious DMG file.
Technique: T1204: User Execution
Wizard Spider has used Rubeus, MimiKatz Kerberos module, and the Invoke-Kerberoast cmdlet to steal AES hashes.
Technique: T1558: Steal or Forge Kerberos Tickets
Cloud service providers often provide infrastructure throughout the world in order to improve performance, provide redundancy, and allow customers to meet compliance requirements.
Technique: T1535: Unused/Unsupported Cloud Regions
The macro then extracts the CAB file into %systemroo%\system32, using either wusa.exe or expand.exe (depending on the OS) to again bypass UAC prompts Once the files have been extracted, the Visual Basic macro deletes the CAB file and runs the malicious NTWDBLIB.dll via cliconfg.exe (to gain privileges and bypass UAC protections) Command lines used by the Visual Basic macro:  cmd /c wusa %TEMP%\setup.cab /quiet /extract:%SystemRoot%\System32 && del /f /q %TEMP%\setup.cab && cliconfg.exe cmd /c expand %TEMP%\setup.cab -F:* %SystemRoot%\System32 && del /f /q %TEMP%\setup.cab && cliconfg.exe A combination of NTWDBLIB.dll and cliconfg.exe are used to bypass UAC protections; this is a familiar attack on Windows
Technique: T1548: Abuse Elevation Control Mechanism
Seasalt has a command to download additional files.
Technique: T1105: Ingress Tool Transfer
RDAT has used Windows Video Service as a name for malicious services.
Technique: T1036: Masquerading
SodaMaster has the ability to put itself to "sleep" for a specified time.
Technique: T1497: Virtualization/Sandbox Evasion
PUNCHBUGGY can gather AVs registered in the system.
Technique: T1518: Software Discovery
Bazar can create a task named to appear benign.
Technique: T1036: Masquerading
MuddyWater has used the .NET csc.exe tool to compile executables from downloaded C# code.
Technique: T1027: Obfuscated Files or Information
Carbanak encodes the message body of HTTP traffic with Base64.
Technique: T1132: Data Encoding
GravityRAT collects various information via WMI requests, including CPU information in the Win32_Processor entry .
Technique: T1047: Windows Management Instrumentation
Adversaries may gather credentials that can be used during targeting.
Technique: T1589: Gather Victim Identity Information
dir c:\
Technique: T1083: File and Directory Discovery
InvisiMole also has a built-in command to modify file times.
Technique: T1070: Indicator Removal on Host
Crimson can perform audio surveillance using microphones.
Technique: T1123: Audio Capture
The NETWIRE payload has been injected into benign Microsoft executables via process hollowing.
Technique: T1055: Process Injection
Crimson can check the Registry for the presence of HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\last_edate to determine how long it has been installed on a host.
Technique: T1012: Query Registry
Machete collects the hostname of the target computer.
Technique: T1082: System Information Discovery
For example, mmc wbadmin.msc delete catalog -quiet deletes the backup catalog on the system  Inhibit System Recovery without prompts to the user .
Technique: T1218: Signed Binary Proxy Execution
UNC2452 used cmd.exe to execute commands on remote machines.
Technique: T1059: Command and Scripting Interpreter
Unlike Invalid Code Signature, this activity will result in a valid signature.
Technique: T1553: Subvert Trust Controls
Clop can enumerate all processes on the victim's machine.
Technique: T1057: Process Discovery
GALLIUM used a renamed cmd.exe file to evade detection.
Technique: T1036: Masquerading
ECCENTRICBANDWAGON has encrypted strings with RC4.
Technique: T1027: Obfuscated Files or Information
APT28 has retrieved internal documents from machines inside victim environments, including by using Forfiles to stage documents before exfiltration.
Technique: T1005: Data from Local System
Once patched, an adversary can use the injected password to successfully authenticate as any domain user account .
Technique: T1556: Modify Authentication Process
Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage.
Technique: T1120: Peripheral Device Discovery
Honeybee uses a batch file that modifies Registry keys to launch a DLL into the svchost.exe process.
Technique: T1112: Modify Registry
This type of capability was previously used for the purposes of web censorship where client HTTP traffic was modified to include a reference to JavaScript that generated the DDoS code to overwhelm target web servers.
Technique: T1499: Endpoint Denial of Service
An adversary who finds a program vulnerable to search order hijacking , a program that does not specify the path to an executable may take advantage of this vulnerability by creating a program named after the improperly specified program and placing it within the initiating program's directory.
Technique: T1574: Hijack Execution Flow
One means, originally implemented by Cd00r , is to use the libpcap libraries to sniff for the packets in question.
Technique: T1205: Traffic Signaling
Distributed COM  is transparent middleware that extends the functionality of COM beyond a local computer using remote procedure call  technology.
Technique: T1021: Remote Services
KeyBoy installs a service pointing to a malicious DLL dropped to disk.
Technique: T1543: Create or Modify System Process
Skidmap has monitored critical processes to ensure resiliency.
Technique: T1057: Process Discovery
MURKYTOP has the capability to identify remote hosts on connected networks.
Technique: T1018: Remote System Discovery
Dtrack can retrieve browser history.
Technique: T1217: Browser Bookmark Discovery
Successful execution of the macro within the malicious document results in the installation of APT28’s signature GAMEFISH malware
Technique: T1204: User Execution
It can also identify logical drives for the infected machine.
Technique: T1083: File and Directory Discovery
ROKRAT checks for sandboxing libraries.
Technique: T1497: Virtualization/Sandbox Evasion
Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers.
Technique: T1090: Proxy
Transparent Tribe has used dynamic DNS services to set up C2.
Technique: T1568: Dynamic Resolution
The program calling the API may also load world writable files which can be modified to perform malicious behavior with elevated privileges.
Technique: T1548: Abuse Elevation Control Mechanism
Gatekeeper also monitors an application's usage of dynamic libraries  loaded outside the application folder on any quarantined binary, often using the dlopen function.
Technique: T1553: Subvert Trust Controls
APT3 has used a tool that can obtain info about local and global group users, power users, and administrators.
Technique: T1087: Account Discovery
BBSRAT uses GET and POST requests over HTTP or HTTPS for command and control to obtain commands and send ZLIB compressed data back to the C2 server.
Technique: T1071: Application Layer Protocol
Turla has used fsutil fsinfo drives to list connected drives.
Technique: T1120: Peripheral Device Discovery
OceanSalt has been executed via malicious macros.
Technique: T1059: Command and Scripting Interpreter
Machete renamed task names to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python tasks.
Technique: T1036: Masquerading
BBSRAT uses a custom encryption algorithm on data sent back to the C2 server over HTTP.
Technique: T1573: Encrypted Channel
Valak has been delivered via spearphishing e-mails with password protected ZIP files.
Technique: T1566: Phishing
This build tool encrypts the binary’s strings with a fresh key for each build
Technique: T1027: Obfuscated Files or Information
The string is formatted as “<domain list>|<minimum query size>|<maximum query size>|<hasGarbage>|<sleepPerRequest>|<maximum requests>|<query types>|<hibridMode>|<current query mode>”   ^slp Sets the sleep and jitter values   ^exit Exits the Trojan    Table 5 Commands available within the C# variant of RogueRobin Using Google Drive for C2 A command that was not available in the original PowerShell variant of RogueRobin but is available with the new C# variant is the x_mode
Technique: T1102: Web Service
Administrator privileges are required for time provider registration, though execution will run in context of the Local Service account.
Technique: T1547: Boot or Logon Autostart Execution
Turla surveys a system upon check-in to discover operating system configuration details using the systeminfo and set commands.
Technique: T1082: System Information Discovery
PoetRAT has used a Python tool named Browdec.exe to steal browser credentials.
Technique: T1555: Credentials from Password Stores
This, however, will not delete/flush the ConsoleHost_history.txt file.
Technique: T1070: Indicator Removal on Host
FinFisher clears the system event logs using  OpenEventLog/ClearEventLog APIs .
Technique: T1070: Indicator Removal on Host
The discovery of these resources may inform an adversary’s next steps in the environment, such as how to perform lateral movement and which methods to utilize for execution.
Technique: T1613: Container and Resource Discovery
KGH_SPY has the ability to set a Registry key to run a cmd.exe command.
Technique: T1059: Command and Scripting Interpreter
It appears the same actor developed both the Komplex and XAgentOSX tools, based on similarities within the following project paths found within the tools: Komplex: /Users/kazak/Desktop/Project/komplex XAgent OSX: /Users/kazak/Desktop/Project/XAgentOSX We believe it is possible that Sofacy uses Komplex to download and install the XAgentOSX tool to use its expanded command set on the compromised system
Technique: T1087: Account Discovery
FIN6 has removed files from victim machines.
Technique: T1070: Indicator Removal on Host
IcedID has been delivered via phishing e-mails with malicious attachments.
Technique: T1566: Phishing
RainyDay has named services and scheduled tasks to appear benign including "ChromeCheck" and "googleupdate."
Technique: T1036: Masquerading
Data SPACESHIP copies to the staging area is compressed with zlib.
Technique: T1560: Archive Collected Data
A variation of the the technique, "domainless" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match .
Technique: T1090: Proxy
Trojan.Karagany has used plugins with a self-delete capability.
Technique: T1070: Indicator Removal on Host
Configuration Decryption:  Another small, but same important function in the photo above, is the function for decrypting the data containing the C&C configuration
Technique: T1140: Deobfuscate/Decode Files or Information
SEASHARPEE is a Web shell.
Technique: T1505: Server Software Component
APT33 has used SniffPass to collect credentials by sniffing network traffic.
Technique: T1040: Network Sniffing
Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly or verify the receipt of an email  web bugs/web beacons.
Technique: T1566: Phishing
Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name.
Technique: T1574: Hijack Execution Flow
C:\Windows\System32\sethc.exe 
Technique: T1546: Event Triggered Execution
H1N1 uses a custom packing algorithm.
Technique: T1027: Obfuscated Files or Information
APT28 has collected emails from victim Microsoft Exchange servers.
Technique: T1114: Email Collection
VBShower has the ability to execute VBScript files.
Technique: T1059: Command and Scripting Interpreter
Deep Panda has used the sticky-keys technique to bypass the RDP login screen on remote systems during intrusions.
Technique: T1546: Event Triggered Execution
TeamTNT relies on users to download and execute malicious Docker images.
Technique: T1204: User Execution
Helminth establishes persistence by creating a shortcut.
Technique: T1547: Boot or Logon Autostart Execution
Meanwhile, injection and delivery techniques are undergoing changes in 2018 with reflective loaders and code enhancements
Technique: T1055: Process Injection
Adversaries may also abuse at to break out of restricted environments by using a task to spawn an interactive system shell or to run system commands.
Technique: T1053: Scheduled Task/Job
The group has also used quser.exe to identify existing RDP sessions on a victim.
Technique: T1049: System Network Connections Discovery
Bazar can use a timer to delay execution of core functionality.
Technique: T1497: Virtualization/Sandbox Evasion
ROKRAT retrieves additional malicious payloads from the C2 server.
Technique: T1105: Ingress Tool Transfer
ZIRCONIUM has exfiltrated stolen data to Dropbox.
Technique: T1567: Exfiltration Over Web Service
Adversaries may acquire information about vulnerabilities that can be used during targeting.
Technique: T1588: Obtain Capabilities
Mustang Panda has used netstat -ano to determine network connection information.
Technique: T1049: System Network Connections Discovery
BendyBear can load and execute modules and Windows Application Programming  calls using standard shellcode API hashing.
Technique: T1106: Native API
Operation Wocao has enumerated sessions and users on a remote host, and identified privileged users logged into a targeted system.
Technique: T1033: System Owner/User Discovery
Like many threat groups, TG-3390 conducts strategic web compromises (SWCs), also known as watering hole attacks, on websites associated with the target organization's vertical or demographic to increase the likelihood of finding victims with relevant information
Technique: T1189: Drive-by Compromise
FlawedAmmyy leverages WMI to enumerate anti-virus on the victim.
Technique: T1047: Windows Management Instrumentation
SDBbot has the ability to use RDP to connect to victim's machines.
Technique: T1021: Remote Services
ShadowPad communicates over HTTP to retrieve a string that is decoded into a C2 server URL.
Technique: T1071: Application Layer Protocol
Frankenstein has communicated with a C2 via an encrypted RC4 byte stream and AES-CBC.
Technique: T1573: Encrypted Channel
Okrum's loader can decrypt the backdoor code, embedded within the loader or within a legitimate PNG file.
Technique: T1140: Deobfuscate/Decode Files or Information
InvisiMole can be launched by using DLL search order hijacking in which the wrapper DLL is placed in the same folder as explorer.exe and loaded during startup into the Windows Explorer process instead of the legitimate library.
Technique: T1574: Hijack Execution Flow
RTM has used search order hijacking to force TeamViewer to load a malicious DLL.
Technique: T1574: Hijack Execution Flow
Carbanak searches recursively for Outlook personal storage tables  files within user directories and sends them back to the C2 server.
Technique: T1114: Email Collection
EVILNUM can obtain the username from the victim's machine.
Technique: T1033: System Owner/User Discovery
TRITON was run as trilog.exe, a Py2EXE compiled python script that accepts a single IP address as a flag.
Technique: T1059: Command and Scripting Interpreter
Frankenstein has enumerated hosts via Empire, gathering the username, domain name, machine name, and other system information.
Technique: T1119: Automated Collection
SodaMaster can search a list of running processes.
Technique: T1057: Process Discovery
Aria-body has the ability to collect data from USB devices.
Technique: T1025: Data from Removable Media
WellMail can archive files on the compromised host.
Technique: T1560: Archive Collected Data
Some Volgmer variants also install .dll files as services with names generated by a list of hard-coded strings.
Technique: T1543: Create or Modify System Process
KEYMARBLE has the capability to collect the computer name, language settings, the OS version, CPU information, disk devices, and time elapsed since system start.
Technique: T1082: System Information Discovery
XCSSET adds malicious code to a host's Xcode projects by enumerating CocoaPods target_integrator.rb files under the /Library/Ruby/Gems folder or enumerates all .xcodeproj folders under a given directory.
Technique: T1195: Supply Chain Compromise
APT32 has set up Facebook pages in tandem with fake websites.
Technique: T1585: Establish Accounts
The code will gather the information and format the list using the following HTML to create a table: <table> <tr><td>Type</td><td>Owner</td><td>Permissions</td><td>Created</td><td>Modificated</td><td>Size</td><td>Path</td></tr> <tr><td>[fileType]</td><td>[fileOwnerAccountName]</td><td>[number filePosixPermissions]</td><td>[fileCreationDate]</td><td>[fileModificationDate]</td><td>[fileSize]</td><td>[file path?]</td></tr> … </table>    Table 1 Commands available within XAgent OSX The ‘showBackupIosFolder’ command is rather interesting, as it allows the threat actors to determine if a compromised system was used to backup an IOS device, such as an iPhone or iPad
Technique: T1016: System Network Configuration Discovery
Caterpillar WebShell has a module to gather information from the compromrised asset, including the computer version, computer name, IIS version, and more.
Technique: T1082: System Information Discovery
Felismus collects the victim LAN IP address and sends it to the C2 server.
Technique: T1016: System Network Configuration Discovery
Adversaries may also opt to encrypt and/or obfuscate these alternate channels.
Technique: T1048: Exfiltration Over Alternative Protocol
In order to extend the lifespan of the domains in case one or more are blacklisted, there are twelve different C2 domains that xparis() can be set to
Technique: T1008: Fallback Channels
SDBbot has the ability to use the command shell to execute commands on a compromised host.
Technique: T1059: Command and Scripting Interpreter
Upon authentication attempts, the inserted code will first check to see if the user input is the password.
Technique: T1556: Modify Authentication Process
Leafminer obfuscated scripts that were used on victim machines.
Technique: T1027: Obfuscated Files or Information
NotPetya can use wmic to help propagate itself across a network.
Technique: T1047: Windows Management Instrumentation
All zero-day exploits known, or suspected, to have been used by this group are for vulnerabilities in Internet Explorer and Flash
Technique: T1068: Exploitation for Privilege Escalation
TrickBot injects into the svchost.exe process.
Technique: T1055: Process Injection
Password policies are a way to enforce complex passwords that are difficult to guess or crack through Brute Force.
Technique: T1201: Password Policy Discovery
Felismus has masqueraded as legitimate Adobe Content Management System files.
Technique: T1036: Masquerading
Siloscape checks for Kubernetes node permissions.
Technique: T1069: Permission Groups Discovery
GoldenSpy has exfiltrated host environment information to an external C2 domain via port 9006.
Technique: T1041: Exfiltration Over C2 Channel
Figure 3: ALFA TEaM Shell v2-Fake Mail (Default) Figure 4 shows an example email containing the default values the shell
Technique: T1059: Command and Scripting Interpreter
HELLOKITTY can use WMI to delete volume shadow copies.
Technique: T1047: Windows Management Instrumentation
Lokibot has the ability to copy itself to a hidden file and directory.
Technique: T1564: Hide Artifacts
Proton persists via Launch Agent.
Technique: T1543: Create or Modify System Process
NavRAT then creates a registry key in order to execute this file copy at the next reboot of the system, an initial method of persistence
Technique: T1547: Boot or Logon Autostart Execution
hcdLoader installs itself as a service for persistence.
Technique: T1543: Create or Modify System Process
Bandook contains keylogging capabilities.
Technique: T1056: Input Capture
KeyBoy uses VBS scripts for installing files and performing execution.
Technique: T1059: Command and Scripting Interpreter
The Windows command shell  is the primary command prompt on Windows systems.
Technique: T1059: Command and Scripting Interpreter
Kazuar finds a specified directory, lists the files and metadata about those files.
Technique: T1083: File and Directory Discovery
Additionally, VALUEVAULT will call Windows PowerShell to extract browser history in order to match browser passwords with visited sites.
Technique: T1533: nan
Webshell has the ability to copy files on a compromised host.
Technique: T1005: Data from Local System
HTTPBrowser's code may be obfuscated through structured exception handling and return-oriented programming.
Technique: T1027: Obfuscated Files or Information
Smoke Loader launches a scheduled task.
Technique: T1053: Scheduled Task/Job
A Lazarus Group malware sample performs reflective DLL injection.
Technique: T1055: Process Injection
Exaramel for Windows automatically encrypts files before sending them to the C2 server.
Technique: T1560: Archive Collected Data
Spark has run the whoami command and has a built-in command to identify the user logged in.
Technique: T1033: System Owner/User Discovery
AppleSeed can collect data on a compromised host.
Technique: T1005: Data from Local System
The malware basically provides a remote CMD/PowerShell terminal for the attackers, enabling them to execute any scripts/commands and receive the result via HTTP requests
Technique: T1059: Command and Scripting Interpreter
DarkComet can collect the computer name, RAM used, and operating system version from the victim’s machine.
Technique: T1082: System Information Discovery
The infection could continue to spread via the newly infected file when it is executed by a remote system.
Technique: T1080: Taint Shared Content
T9000 performs checks for various antivirus and security products during installation.
Technique: T1518: Software Discovery
Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.
Technique: T1567: Exfiltration Over Web Service
PoetRAT has used a custom encryption scheme for communication between scripts and pyminifier to obfuscate scripts.
Technique: T1027: Obfuscated Files or Information
Operation Wocao has spawned a new cmd.exe process to execute commands.
Technique: T1059: Command and Scripting Interpreter
Bundlore can install malicious browser extensions that are used to hijack user searches.
Technique: T1176: Browser Extensions
ShimRat has been delivered as a package that includes compressed DLL and shellcode payloads within a .dat file.
Technique: T1027: Obfuscated Files or Information
SLOTHFULMEDIA has enumerated processes by ID, name, or privileges.
Technique: T1057: Process Discovery
FLASHFLOOD achieves persistence by making an entry in the Registry's Run key.
Technique: T1547: Boot or Logon Autostart Execution
PipeMon can switch to an alternate C2 domain when a particular date has been reached.
Technique: T1008: Fallback Channels
Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key.
Technique: T1573: Encrypted Channel
Strider has used a hidden file system that is stored as a file on disk.
Technique: T1564: Hide Artifacts
Adversaries may exploit software vulnerabilities in client applications to execute code.
Technique: T1203: Exploitation for Client Execution
The run command (1) creates the process cmd.exe /c with the command parameters appended and will write the output of the command in hexadecimal format to the file %APPDATA%\tmpCa.vbs
Technique: T1059: Command and Scripting Interpreter
The majority of delivery documents contain a generic lure image requesting the victim enable macros with no additional content, the adversaries seemingly relying solely on lure filenames to entice victims to launch the malicious document
Technique: T1204: User Execution
Ke3chang has used the right-to-left override character in spearphishing attachment names to trick targets into executing .scr and .exe files.
Technique: T1036: Masquerading
Adversaries may compromise third-party DNS servers that can be used during targeting.
Technique: T1584: Compromise Infrastructure
Malicious rules will execute when an adversary sends a specifically crafted email to the user.
Technique: T1137: Office Application Startup
BackdoorDiplomacy has obfuscated tools and malware it uses with VMProtect.
Technique: T1027: Obfuscated Files or Information
Tropic Trooper has used SSL to connect to C2 servers.
Technique: T1573: Encrypted Channel
PoisonIvy creates a backdoor through which remote attackers can upload files.
Technique: T1105: Ingress Tool Transfer
Transport agents will be invoked during a specified stage of email processing and carry out developer defined tasks.
Technique: T1505: Server Software Component
BADCALL collects the network adapter information.
Technique: T1016: System Network Configuration Discovery
Attor's Blowfish key is encrypted with a public RSA key.
Technique: T1573: Encrypted Channel
ComRAT has used encryption and base64 to obfuscate its orchestrator code in the Registry.
Technique: T1027: Obfuscated Files or Information
SNMP can give administrators great insight in their systems, such as, system information, description of hardware, physical location, and software packages.
Technique: T1602: Data from Configuration Repository
Bytes are rotated by four positions and XOR'ed with 0x23.
Technique: T1560: Archive Collected Data
The information discovered may help the adversary conduct SID-History Injection, Pass the Ticket, and Kerberoasting.
Technique: T1482: Domain Trust Discovery
APT32 executed shellcode to collect the username on the victim's machine.
Technique: T1033: System Owner/User Discovery
RATANKBA uses tasklist /svc to display running tasks.
Technique: T1007: System Service Discovery
In newer versions of Windows, the replaced binary needs to be digitally signed for x64 systems, the binary must reside in %systemdir%\, and it must be protected by Windows File or Resource Protection .
Technique: T1546: Event Triggered Execution
Cobalt Strike has the ability to accept a value for HTTP Host Header to enable domain fronting.
Technique: T1090: Proxy
Wingbird exploits CVE-2016-4117 to allow an executable to gain escalated privileges.
Technique: T1068: Exploitation for Privilege Escalation
Adversaries may compromise domain accounts, some with a high level of privileges, through various means such as OS Credential Dumping or password reuse, allowing access to privileged resources of the domain.
Technique: T1078: Valid Accounts
Carbon establishes persistence by creating a service and naming it based off the operating system version running on the current machine.
Technique: T1543: Create or Modify System Process
DarkComet can disable Security Center functions like anti-virus.
Technique: T1562: Impair Defenses
MuddyWater has used VBScript files to execute its POWERSTATS payload, as well as macros.
Technique: T1059: Command and Scripting Interpreter
Fox Kitten has exploited known vulnerabilities in Fortinet, PulseSecure, and Palo Alto VPN appliances.
Technique: T1190: Exploit Public-Facing Application
Egregor has used tools to gather information about users.
Technique: T1033: System Owner/User Discovery
Adversaries may introduce computer accessories, computers, or networking hardware into a system or network that can be used as a vector to gain access.
Technique: T1200: Hardware Additions
ABK has the ability to use cmd to run a Portable Executable  on the compromised host.
Technique: T1059: Command and Scripting Interpreter
When the operating system is patched in storage, this can be achieved in either the resident storage  or via TFTP Boot.
Technique: T1601: Modify System Image
GuLoader has relied upon users clicking on links to malicious documents.
Technique: T1204: User Execution
APT3 leverages valid accounts after gaining credentials for use within the victim domain.
Technique: T1078: Valid Accounts
Typically, a user engages with a file system through applications that allow them to access files and directories, which are an abstraction from their physical location .
Technique: T1564: Hide Artifacts
The encryption key can be found in a file named Policy.vpol, typically located in the same folder as the credentials.
Technique: T1555: Credentials from Password Stores
Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches.
Technique: T1597: Search Closed Sources
Get2 has the ability to run executables with command-line arguments.
Technique: T1059: Command and Scripting Interpreter
Zeus Panda also encrypts all configuration and settings in AES and RC4.
Technique: T1027: Obfuscated Files or Information
Kimsuky has been observed turning off Windows Security Center.
Technique: T1562: Impair Defenses
Linux and macOS implementations of SMB typically use Samba.
Technique: T1021: Remote Services
The LNK file is finally used to identify a third file: a ZIP file
Technique: T1547: Boot or Logon Autostart Execution
EVILNUM can run a remote scriptlet that drops a file and executes it via regsvr32.exe.
Technique: T1218: Signed Binary Proxy Execution
Windows services will have a service name as well as a display name.
Technique: T1036: Masquerading
menuPass has been seen changing malicious files to appear legitimate.
Technique: T1036: Masquerading
ZxShell has a command to clear system event logs.
Technique: T1070: Indicator Removal on Host
Leafminer scanned network services to search for vulnerabilities in the victim system.
Technique: T1046: Network Service Scanning
application shim
Technique: T1546: Event Triggered Execution
There are often remote service gateways that manage connections and credential authentication for these services.
Technique: T1133: External Remote Services
InvisiMole can upload files to the victim's machine for operations.
Technique: T1105: Ingress Tool Transfer
WastedLocker created and established a service that runs until the encryption process is complete.
Technique: T1543: Create or Modify System Process
ROKRAT steals credentials by leveraging the Windows Vault mechanism.
Technique: T1555: Credentials from Password Stores
This suggests that other WMI-based VM detection techniques may also detect certain physical systems if those systems do not support the specific WMI query
Technique: T1047: Windows Management Instrumentation
UNC2452 obtained a list of users and their roles from an Exchange server using Get-ManagementRoleAssignment.
Technique: T1087: Account Discovery
Adversaries may give tasks or services names that are similar or identical to those of legitimate ones.
Technique: T1036: Masquerading
Turla surveys a system upon check-in to discover running services and associated processes using the tasklist /svc command.
Technique: T1007: System Service Discovery