HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
When using the Create Account technique with a userID under 500  and enabling this property , an adversary can conceal user accounts.
Technique: T1564: Hide Artifacts
Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data.
Technique: T1207: Rogue Domain Controller
Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory  domains, and local/external IP addresses.
Technique: T1480: Execution Guardrails
Cuba can download files from its C2 server.
Technique: T1105: Ingress Tool Transfer
Honeybee removes batch files to reduce fingerprint on the system as well as deletes the CAB file that gets encoded upon infection.
Technique: T1070: Indicator Removal on Host
BRONZE BUTLER has used a tool to capture screenshots.
Technique: T1113: Screen Capture
Egregor can perform a  long sleep  to evade detection.
Technique: T1497: Virtualization/Sandbox Evasion
The communication and exfiltration of data was detected in a real-world scenario using the Cybereason platform
Technique: T1132: Data Encoding
Instead of purchasing a Server or Virtual Private Server, adversaries may compromise third-party servers in support of operations.
Technique: T1584: Compromise Infrastructure
Time providers are implemented as dynamic-link libraries  that are registered in the subkeys of  HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders\.
Technique: T1547: Boot or Logon Autostart Execution
We are unable to confirm if all of these stolen credentials are indeed valid sets of credentials, but based upon previously observed activity, timestamping, and known behaviors, it is highly probable that these credentials were or may still be valid
Technique: T1003: OS Credential Dumping
Andariel has used tasklist to enumerate processes and find a specific string.
Technique: T1057: Process Discovery
UNC2452 staged data and files in password-protected archives on a victim's OWA server.
Technique: T1074: Data Staged
Carbon has used RSA encryption for C2 communications.
Technique: T1573: Encrypted Channel
Sowbug extracted Word documents from a file server on a victim network.
Technique: T1039: Data from Network Shared Drive
Leviathan has collected compromised credentials to use for targeting efforts.
Technique: T1589: Gather Victim Identity Information
APT41 has obtained and used tools such as Mimikatz, pwdump, PowerSploit, and Windows Credential Editor.
Technique: T1588: Obtain Capabilities
Tonto Team has relied on user interaction to open their spearphishing attachments.
Technique: T1204: User Execution
APT28 has used CVE-2015-1701 to access the SYSTEM token and copy it into the current process as part of privilege escalation.
Technique: T1134: Access Token Manipulation
Adversaries have been seen targeting Gmail, Microsoft Outlook, and Yahoo Mail users.
Technique: T1528: Steal Application Access Token
Windshift has sent spearphishing emails with links to harvest credentials and deliver malware.
Technique: T1566: Phishing
The locations:  For root user  path: /Library/CoreMediaIO/Plug-Ins/FCP-DAL/iOSScreenCapture.plugin/Contents/Resources/ processname: screenassistantd  For regular user  path: ~/Library/Spelling/ processname: spellagentd Subsequently, it implements the Loader::installLoader method, reading the hardcoded 64-bit Mach-O executable (magic value 0xFEEDFACF), and writing to the previously determined path and file
Technique: T1564: Hide Artifacts
Goopy has the ability to delete emails used for C2 once the content has been copied.
Technique: T1070: Indicator Removal on Host
Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised network infrastructure.
Technique: T1020: Automated Exfiltration
Leviathan has compromised email accounts to conduct social engineering attacks.
Technique: T1586: Compromise Accounts
Operation Wocao has archived collected files with WinRAR, prior to exfiltration.
Technique: T1560: Archive Collected Data
Bandook has a command to list files on a system.
Technique: T1083: File and Directory Discovery
P8RAT can check for specific processes associated with virtual environments.
Technique: T1057: Process Discovery
To obtain a job, the Trojan builds a subdomain that has the following structure and issues a DNS query to the C2 server: c<unique identifier><job identifier padded with ‘0’ to make three digits><sequence number>c The generated subdomain is then subjected to a number-to-character substitution function that is the inverse of the Table 4, which effectively converts all the digits in the subdomain into characters
Technique: T1082: System Information Discovery
TeamTNT has created local privileged users on victim machines.
Technique: T1136: Create Account
Adversaries may use macOS logon scripts automatically executed at logon initialization to establish persistence.
Technique: T1037: Boot or Logon Initialization Scripts
BLINDINGCAN has loaded and executed DLLs in memory during runtime on a victim machine.
Technique: T1129: Shared Modules
Misconfiguration by end users is a common problem.
Technique: T1530: Data from Cloud Storage Object
Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using rundll32.exe.
Technique: T1218: Signed Binary Proxy Execution
GoldMax has set an execution trigger date and time, stored as an ASCII Unix/Epoch time value.
Technique: T1497: Virtualization/Sandbox Evasion
SamSam has been seen deleting its own files and payloads to make analysis of the attack more difficult.
Technique: T1070: Indicator Removal on Host
Proton uses a keylogger to capture keystrokes.
Technique: T1056: Input Capture
The ptrace system call enables a debugging process to observe and control another process , including changing memory and register values.
Technique: T1055: Process Injection
Bad Rabbit has masqueraded as a Flash Player installer through the executable file install_flash_player.exe.
Technique: T1036: Masquerading
MURKYTOP has the capability to retrieve information about shares on remote hosts.
Technique: T1135: Network Share Discovery
FatDuke can get user agent strings for the default browser from HKCU\Software\Classes\http\shell\open\command.
Technique: T1012: Query Registry
Turla has used malware obtained after compromising other threat actors, such as OilRig.
Technique: T1588: Obtain Capabilities
Some versions of DEATHRANSOM have performed language ID and keyboard layout checks; if either of these matched Russian, Kazakh, Belarusian, Ukrainian or Tatar DEATHRANSOM would exit.
Technique: T1614: System Location Discovery
Blue Mockingbird has used frp, ssf, and Venom to establish SOCKS proxy connections.
Technique: T1090: Proxy
(Source: SecureWorks) Reentry attempt After BRONZE UNION was evicted from a compromised environment, which involved blocking the group's known infrastructure, CTU researchers observed the group attempting to reconnect to its OWA web shells and a backup web shell it had deployed during the intrusion
Technique: T1505: Server Software Component
Many of the Fetch samples we analyzed attempted to obfuscate their functionality by encrypting their embedded strings using AES
Technique: T1027: Obfuscated Files or Information
Adversaries can set environment variables via the command line using the export command, setenv function, or putenv function.
Technique: T1574: Hijack Execution Flow
APT32 has used COM scriptlets to download Cobalt Strike beacons.
Technique: T1059: Command and Scripting Interpreter
OSX_OCEANLOTUS.D has a command to download and execute a file on the victim’s machine.
Technique: T1105: Ingress Tool Transfer
The file names may vary from one version of the malware to another
Technique: T1083: File and Directory Discovery
Ptrace system call injection can also be done with PTRACE_POKETEXT/PTRACE_POKEDATA, which copy data to a specific address in the target processes’ memory .
Technique: T1055: Process Injection
LookBack can kill processes and delete services.
Technique: T1489: Service Stop
Elise executes systeminfo after initial communication is made to the remote server.
Technique: T1082: System Information Discovery
If the C2 server is not active at this time, the download will fail and the victim will not receive a prompt to Enable Content as no macro is downloaded
Technique: T1105: Ingress Tool Transfer
Rocke exploited Apache Struts, Oracle WebLogic , and Adobe ColdFusion  vulnerabilities to deliver malware.
Technique: T1190: Exploit Public-Facing Application
The script is signed by Microsoft and is commonly executed through the Windows Command Shell via Cscript.exe.
Technique: T1216: Signed Script Proxy Execution
A flood of ACK packets are sent to the target.
Technique: T1499: Endpoint Denial of Service
GravityRAT can obtain the date and time of a system.
Technique: T1124: System Time Discovery
Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting.
Technique: T1608: Stage Capabilities
POSHSPY uses a DGA to derive command and control URLs from a word list.
Technique: T1568: Dynamic Resolution
ZLib creates Registry keys to allow itself to run as various services.
Technique: T1543: Create or Modify System Process
ObliqueRAT has the ability to recursively enumerate files on an infected endpoint.
Technique: T1083: File and Directory Discovery
APT41 compromised an online billing/payment service using VPN access between a third-party service provider and the targeted payment service.
Technique: T1133: External Remote Services
Grandoreiro can steal the victim's cookies to use for duplicating the active session from another device.
Technique: T1539: Steal Web Session Cookie
Dok prompts the user for credentials.
Technique: T1056: Input Capture
Windows User Account Control  allows a program to elevate its privileges  to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.
Technique: T1548: Abuse Elevation Control Mechanism
HOPLIGHT has modified the firewall using netsh.
Technique: T1562: Impair Defenses
In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Technique: T1486: Data Encrypted for Impact
ThiefQuest uses a function named is_debugging to perform anti-debugging logic.
Technique: T1497: Virtualization/Sandbox Evasion
The attack involved the new HAWKBALL backdoor being delivered via well-known Microsoft Office vulnerabilities CVE-2017-11882 and CVE-2018-0802.
Technique: T1203: Exploitation for Client Execution
Msiexec.exe can also execute DLLs.
Technique: T1218: Signed Binary Proxy Execution
Grandoreiro can detect VMWare via its I/O port and Virtual PC via the vpcext instruction.
Technique: T1497: Virtualization/Sandbox Evasion
Night Dragon is known to use software packing in its tools.
Technique: T1027: Obfuscated Files or Information
Lucifer can infect victims by brute forcing SMB.
Technique: T1021: Remote Services
It also securely removes itself after collecting and exfiltrating data.
Technique: T1070: Indicator Removal on Host
We were able to brute force the actor-provided key using the inverse arithmetic operations using the embedded salt and embedded ciphertext, so we were able to extract the embedded webshells with ease
Technique: T1110: Brute Force
Ke3chang backdoor RoyalDNS established persistence through adding a service called Nwsapagent.
Technique: T1543: Create or Modify System Process
GreyEnergy uses cmd.exe to execute itself in-memory.
Technique: T1059: Command and Scripting Interpreter
InvisiMole has attempted to disguise itself by registering under a seemingly legitimate service name.
Technique: T1036: Masquerading
Adversaries may scan victim IP blocks to gather information that can be used during targeting.
Technique: T1595: Active Scanning
This technique can also execute local/remote scripts and, similar to its Regsvr32/ "Squiblydoo" counterpart, leverages a trusted, built-in Windows tool.
Technique: T1220: XSL Script Processing
APT29 has used multiple command-line utilities to enumerate running processes.
Technique: T1057: Process Discovery
HotCroissant has used the open source UPX executable packer.
Technique: T1027: Obfuscated Files or Information
Ryuk has used a combination of symmetric  and asymmetric  encryption to encrypt files.
Technique: T1486: Data Encrypted for Impact
Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads.
Technique: T1218: Signed Binary Proxy Execution
POWERSTATS uses character replacement, PowerShell environment variables, and XOR encoding to obfuscate code.
Technique: T1027: Obfuscated Files or Information
HotCroissant has the ability to retrieve a list of services on the infected host.
Technique: T1007: System Service Discovery
SDBbot has the ability to inject a downloaded DLL into a newly created rundll32.exe process.
Technique: T1055: Process Injection
Threat Group-3390 has staged tools, including gsecdump and WCE, on previously compromised websites.
Technique: T1608: Stage Capabilities
TeamTNT has used masscan to search for open Docker API ports.
Technique: T1046: Network Service Scanning
Adversaries may configure services to execute at startup in order to persist on a system.
Technique: T1543: Create or Modify System Process
Regsvr32.exe can also be used to specifically bypass application control using functionality to load COM scriptlets to execute DLLs under user permissions.
Technique: T1218: Signed Binary Proxy Execution
Once registered, a rogue DC may be able to inject and replicate changes into AD infrastructure for any domain object, including credentials and keys.
Technique: T1207: Rogue Domain Controller
Cloned certificate chains will carry many of the same metadata characteristics of the source and can be used to sign malicious code that may then bypass signature validation tools  used to block execution and/or uncover artifacts of Persistence.
Technique: T1553: Subvert Trust Controls
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
Technique: T1546: Event Triggered Execution
Unlike Upload Malware, this technique focuses on adversaries implanting an image in a registry within a victim’s environment.
Technique: T1525: Implant Internal Image
Patchwork collected the victim computer name, OS version, and architecture type and sent the information to its C2 server.
Technique: T1082: System Information Discovery
OSX_OCEANLOTUS.D uses PowerShell scripts.
Technique: T1059: Command and Scripting Interpreter
Wizard Spider has acquired credentials from the SAM/SECURITY registry hives.
Technique: T1003: OS Credential Dumping
Adversaries may install malicious components to extend and abuse server applications.
Technique: T1505: Server Software Component
Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs.
Technique: T1553: Subvert Trust Controls
build_downer has the ability to download files from C2 to the infected host.
Technique: T1105: Ingress Tool Transfer
FIN6 has used the Stealer One credential stealer to target e-mail and file transfer utilities including FTP.
Technique: T1555: Credentials from Password Stores
Tools such as MailSniper can be used to automate searches for specific keywords.
Technique: T1114: Email Collection
Matryoshka uses rundll32.exe in a Registry Run key value for execution as part of its persistence mechanism.
Technique: T1218: Signed Binary Proxy Execution
Azorult can collect the time zone information from the system.
Technique: T1124: System Time Discovery
Doki has used Ngrok to establish C2 and exfiltrate data.
Technique: T1041: Exfiltration Over C2 Channel
PoetRAT has exfiltrated data over the C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
Turla RPC backdoors have used cmd.exe to execute commands.
Technique: T1059: Command and Scripting Interpreter
REvil can query the Registry to get random file extensions to append to encrypted files.
Technique: T1012: Query Registry
Chimera has utilized multiple commands to identify data of interest in file and directory listings.
Technique: T1083: File and Directory Discovery
As with legitimate development efforts, different skill sets may be required for developing capabilities.
Technique: T1587: Develop Capabilities
Kazuar adds a .lnk file to the Windows startup folder.
Technique: T1547: Boot or Logon Autostart Execution
DarkComet can disable Security Center functions like the Windows Firewall.
Technique: T1562: Impair Defenses
Shared templates may also be stored and pulled from remote locations.
Technique: T1137: Office Application Startup
FIN6 has collected and exfiltrated payment card data from compromised systems.
Technique: T1005: Data from Local System
Astaroth collects the timestamp from the infected machine.
Technique: T1124: System Time Discovery
XAgent uses HTTP requests to communicate with its C2 servers, which allows the threat actor to interact with the compromised system
Technique: T1071: Application Layer Protocol
Adversaries may create an account to maintain access to victim systems.
Technique: T1136: Create Account
A build tool is likely being used by these attackers that allows the operator to configure details such as C2 addresses, C2 encryption keys, and a campaign code
Technique: T1573: Encrypted Channel
FruitFly saves itself with a leading "."
Technique: T1564: Hide Artifacts
Waterbear can use API hooks on "GetExtendedTcpTable" to retrieve a table containing a list of TCP endpoints available to the application.
Technique: T1049: System Network Connections Discovery
Third-party entities can include technology companies that specialize in exploit development, criminal marketplaces , or from individuals.
Technique: T1588: Obtain Capabilities
Figure 3: Script code embedded in 29[.]html used to download and run Revenge RAT The script shown in Figure 4 is almost identical to the one used by the script contents of 29[.]html (in Figure 3), the only difference being the absence of a sleep command and the usage of the “forfiles” utility
Technique: T1059: Command and Scripting Interpreter
Industroyer has used a Trojanized version of the Windows Notepad application for an additional backdoor persistence mechanism.
Technique: T1554: Compromise Client Software Binary
Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.
Technique: T1197: BITS Jobs
DownPaper communicates to its C2 server over HTTP.
Technique: T1071: Application Layer Protocol
As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way.
Technique: T1598: Phishing for Information
GravityRAT supports file encryption .
Technique: T1027: Obfuscated Files or Information
Chaes has been delivered by sending victims a phishing email containing a malicious .docx file.
Technique: T1566: Phishing
StrongPity has named services to appear legitimate.
Technique: T1036: Masquerading
Dok uses AppleScript to install a login Item by sending Apple events to the System Events process.
Technique: T1547: Boot or Logon Autostart Execution
SIDs are used by Windows security in both security descriptors and access tokens.
Technique: T1134: Access Token Manipulation
SideTwist can collect the computer name of a targeted system.
Technique: T1082: System Information Discovery
Adversaries may manipulate accounts to maintain access to victim systems.
Technique: T1098: Account Manipulation
ZxShell can delete files from the system.
Technique: T1070: Indicator Removal on Host
Each of the emails had a password protected RAR archive attached named credential.rar
Technique: T1560: Archive Collected Data
PoetRAT used TLS to encrypt command and control  communications.
Technique: T1573: Encrypted Channel
Adversaries can direct BACKSPACE to upload files to the C2 Server.
Technique: T1041: Exfiltration Over C2 Channel
MirageFox has the capability to execute commands using cmd.exe.
Technique: T1059: Command and Scripting Interpreter
POWRUNER can use DNS for C2 communications.
Technique: T1071: Application Layer Protocol
Wizard Spider has used scheduled tasks establish persistence for TrickBot and other malware.
Technique: T1053: Scheduled Task/Job
To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports.
Technique: T1205: Traffic Signaling
Lazarus Group malware RomeoDelta archives specified directories in .zip format, encrypts the .zip file, and uploads it to its C2 server.
Technique: T1560: Archive Collected Data
Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.
Technique: T1092: Communication Through Removable Media
The discovery modules used with Duqu can collect information on network connections.
Technique: T1049: System Network Connections Discovery
Kivars has the ability to capture screenshots on the infected host.
Technique: T1113: Screen Capture
Threat Group-3390 has used a variety of Web shells.
Technique: T1505: Server Software Component
OSX_OCEANLOTUS.D deletes the app bundle and dropper after execution.
Technique: T1070: Indicator Removal on Host
QakBot has the ability to capture web session cookies.
Technique: T1539: Steal Web Session Cookie
Bundlore has also used base64 and RC4 with a hardcoded key to deobfuscate data.
Technique: T1140: Deobfuscate/Decode Files or Information
During a file analysis of PLAINTEE in WildFire, we observed the attackers download and execute a plugin during the runtime for that sample
Technique: T1105: Ingress Tool Transfer
Filters are implemented as DLLs containing a method to validate potential passwords against password policies.
Technique: T1556: Modify Authentication Process
Rather than finding/modifying exploits from online or purchasing them from exploit vendors, an adversary may develop their own exploits.
Technique: T1587: Develop Capabilities
Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive.
Technique: T1496: Resource Hijacking
Malware can also be staged on web services, such as GitHub or Pastebin.
Technique: T1608: Stage Capabilities
InvisiMole can deliver trojanized versions of software and documents, relying on user execution.
Technique: T1204: User Execution
APT32 used the netstat -anpo tcp command to display TCP connections on the victim's machine.
Technique: T1049: System Network Connections Discovery
APT29 used netsh to configure firewall rules that limited certain UDP outbound packets.
Technique: T1562: Impair Defenses
This type of Network DoS takes advantage of a third-party server intermediary that hosts and will respond to a given spoofed source IP address.
Technique: T1498: Network Denial of Service
Sakula uses DLL side-loading, typically using a digitally signed sample of Kaspersky Anti-Virus  6.0 for Windows Workstations or McAfee's Outlook Scan About Box to load malicious DLL files.
Technique: T1574: Hijack Execution Flow
Cobalt Strike can perform port scans from an infected host.
Technique: T1046: Network Service Scanning
TDTESS creates then deletes log files during installation of itself as a service.
Technique: T1070: Indicator Removal on Host
Patchwork embedded a malicious macro in a Word document and lured the victim to click on an icon to execute the malware.
Technique: T1204: User Execution
Adversaries may delete their commands from these logs by manually clearing the history  or deleting the bash history file rm ~/.bash_history.
Technique: T1070: Indicator Removal on Host
HOPLIGHT has multiple proxy options that mask traffic between the malware and the remote operators.
Technique: T1090: Proxy
ZIRCONIUM targeted presidential campaign staffers with credential phishing e-mails.
Technique: T1598: Phishing for Information
Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions.
Technique: T1548: Abuse Elevation Control Mechanism
Adversaries may hook into Windows application programming interface  functions to collect user credentials.
Technique: T1056: Input Capture
Spark has used a splash screen to check whether an user actively clicks on the screen before running malicious code.
Technique: T1497: Virtualization/Sandbox Evasion
This indicates that a human operative was executing commands on a command line style interface, rather than an automated or GUI process
Technique: T1059: Command and Scripting Interpreter
Windshift has used links embedded in e-mails to lure victims into executing malicious code.
Technique: T1204: User Execution
POWRUNER may query the Registry by running reg query on a victim.
Technique: T1012: Query Registry
njRAT has modified the Windows firewall to allow itself to communicate through the firewall.
Technique: T1562: Impair Defenses
Adversaries can register malicious password filters to harvest credentials from local computers and/or entire domains.
Technique: T1556: Modify Authentication Process
T9000 searches removable storage devices for files with a pre-defined list of file extensions .
Technique: T1119: Automated Collection
Dragonfly 2.0 accessed email accounts using Outlook Web Access.
Technique: T1114: Email Collection
One of the group's backdoors can also query the Windows Registry to gather system information, and another macOS backdoor performs a fingerprint of the machine on its first connection to the C&C server.
Technique: T1082: System Information Discovery
The Komplex payload is stored in a hidden directory at /Users/Shared/.local/kextd.
Technique: T1564: Hide Artifacts
The same situation applies to authentication by key pair – the server contains a pre-defined constant public key and it allows authentication only if a particular private key is used
Technique: T1056: Input Capture
menuPass has used Ntdsutil to dump credentials.
Technique: T1003: OS Credential Dumping
APT38 has used a custom MBR wiper named BOOTWRECK, which will initiate a system reboot after wiping the victim's MBR.
Technique: T1529: System Shutdown/Reboot
APT41 used RDP for lateral movement.
Technique: T1021: Remote Services
Adversaries may search content delivery network  data about victims that can be used during targeting.
Technique: T1596: Search Open Technical Databases
A user visits a website that is used to host the adversary controlled content.
Technique: T1189: Drive-by Compromise
Operation Wocao has discovered the local disks attached to the system and their hardware information including manufacturer and model, as well as the OS versions of systems connected to a targeted network.
Technique: T1082: System Information Discovery
XCSSET uses AppleScript to check the host's language and location with the command user locale of .
Technique: T1614: System Location Discovery
OnDrawClipboard
Technique: T1115: Clipboard Data
Dragonfly 2.0 modified the Registry to hide create user accounts.
Technique: T1564: Hide Artifacts
Leafminer used Microsoft’s Sysinternals tools to gather detailed information about remote systems.
Technique: T1018: Remote System Discovery
The network configuration is a file containing parameters that determine the operation of the device.
Technique: T1602: Data from Configuration Repository
Adversaries may modify the key size used and other encryption parameters using specialized commands in a Network Device CLI introduced to the system through Modify System Image to change the configuration of the device.
Technique: T1600: Weaken Encryption
Cadelspy has the ability to identify open windows on the compromised host.
Technique: T1010: Application Window Discovery
TSCookie has encrypted network communications with RC4.
Technique: T1573: Encrypted Channel
UNC2452 was able to get SUNBURST signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle.
Technique: T1553: Subvert Trust Controls
A handle to an existing victim process is first created with native Windows API calls such as OpenThread.
Technique: T1055: Process Injection
JCry has encrypted files and demanded Bitcoin to decrypt those files.
Technique: T1486: Data Encrypted for Impact
Duqu can be configured to have commands relayed over a peer-to-peer network of infected hosts if some of the hosts do not have Internet access.
Technique: T1090: Proxy
BRONZE BUTLER downloader code has included "0" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection.
Technique: T1027: Obfuscated Files or Information
CARROTBAT has the ability to delete downloaded files from a compromised host.
Technique: T1070: Indicator Removal on Host
Suckfly the victim's internal network for hosts with ports 8080, 5900, and 40 open.
Technique: T1046: Network Service Scanning
HAWKBALL has methods to check if the process the malware uses is being debugged.
Technique: T1497: Virtualization/Sandbox Evasion
Size Expansion of Configuration Information PlugX is designed to run based on its configuration information stored in itself
Technique: T1082: System Information Discovery
Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners.
Technique: T1596: Search Open Technical Databases
SSL/TLS certificates are files that can be installed on servers to enable secure communications between systems.
Technique: T1608: Stage Capabilities
Ursnif has used a peer-to-peer  network for C2.
Technique: T1090: Proxy
Additional custom tools likely exist as well.
Technique: T1003: OS Credential Dumping
The domain names differed but the script adheres to the same logic (including the logic function).” The DNSMessenger malware is an obfuscated and customized version of the popular DNS_TXT_PWNAGE.ps1 script available on GitHub and is also referred to by FireEye as POWERSOURCE
Technique: T1027: Obfuscated Files or Information
Transparent Tribe has sent spearphishing e-mails with attachments to deliver malicious payloads.
Technique: T1566: Phishing
This poses a greater risk of unauthorized disclosure and may help facilitate data manipulation, Credential Access, or Collection efforts.
Technique: T1600: Weaken Encryption
TeamTNT has searched for system version and architecture information.
Technique: T1082: System Information Discovery
Dacls can scan directories on a compromised host.
Technique: T1083: File and Directory Discovery
BackConfig can download and execute additional payloads on a compromised host.
Technique: T1105: Ingress Tool Transfer
Maze has checked the language of the infected system using the "GetUSerDefaultUILanguage" function.
Technique: T1082: System Information Discovery
SUNBURST collected the registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid from compromised hosts.
Technique: T1012: Query Registry
An APT19 HTTP malware variant used Base64 to encode communications to the C2 server.
Technique: T1132: Data Encoding
Responses from the Pisloader C2 server are base32-encoded.
Technique: T1132: Data Encoding
WindTail has the ability to automatically exfiltrate files using the macOS built-in utility /usr/bin/curl.
Technique: T1048: Exfiltration Over Alternative Protocol
Threat Group-3390 actors have split RAR files for exfiltration into parts.
Technique: T1030: Data Transfer Size Limits
The SMOKEDHAM source code is embedded in the dropper as an encrypted string.
Technique: T1027: Obfuscated Files or Information
Lazarus Group malware attempts to connect to Windows shares for lateral movement by using a generated list of usernames, which center around permutations of the username Administrator, and weak passwords.
Technique: T1110: Brute Force
APT28 installed a Delphi backdoor that used a custom algorithm for C2 communications.
Technique: T1573: Encrypted Channel
KEYMARBLE uses a customized XOR algorithm to encrypt C2 communications.
Technique: T1573: Encrypted Channel
Conti can enumerate remote open SMB network shares using NetShareEnum.
Technique: T1135: Network Share Discovery
Operation Wocao has collected a list of installed software on the infected system.
Technique: T1518: Software Discovery
ShimRat has registered two registry keys for shim databases.
Technique: T1112: Modify Registry
QakBot can enumerate a list of installed programs.
Technique: T1518: Software Discovery
Rocke has installed an "init.d" startup script to maintain persistence.
Technique: T1037: Boot or Logon Initialization Scripts
EvilBunny's dropper has checked the number of processes and the length and strings of its own file name to identify if the malware is in a sandbox environment.
Technique: T1497: Virtualization/Sandbox Evasion
Security can be limited on browser app stores so it may not be difficult for malicious extensions to defeat automated scanners.
Technique: T1176: Browser Extensions
Drovorub can use a port forwarding rule on its agent module to relay network traffic through the client module to a remote host on the same network.
Technique: T1090: Proxy
Wizard Spider has also used AdFind and nltest/dclist to enumerate domain computers, including the domain controller.
Technique: T1018: Remote System Discovery
APT29 has developed malware variants written in Python.
Technique: T1059: Command and Scripting Interpreter
Cobalt Strike can produce a sessions report from compromised hosts.
Technique: T1049: System Network Connections Discovery
Adversaries may also seek and target CDN misconfigurations that leak sensitive information not intended to be hosted and/or do not have the same protection mechanisms  as the content hosted on the organization’s website.
Technique: T1596: Search Open Technical Databases
BLUELIGHT has encoded data into a binary blob using XOR.
Technique: T1560: Archive Collected Data
WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs.
Technique: T1546: Event Triggered Execution
RunningRAT adds itself to the Registry key Software\Microsoft\Windows\CurrentVersion\Run to establish persistence upon reboot.
Technique: T1547: Boot or Logon Autostart Execution
Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.
Technique: T1055: Process Injection
ISMInjector is obfuscated with the off-the-shelf SmartAssembly .NET obfuscator created by red-gate.com.
Technique: T1027: Obfuscated Files or Information
XCSSET loads a system level launchdaemon using the launchctl load -w command from /System/Librarby/LaunchDaemons/ssh.plist.
Technique: T1569: System Services
Information about an organization may also be exposed to adversaries via online or other accessible data sets  or Search Victim-Owned Websites.
Technique: T1591: Gather Victim Org Information
While logged in, this command history is tracked in a file pointed to by the environment variable HISTFILE.
Technique: T1070: Indicator Removal on Host
After escalating privileges, MegaCortex calls TerminateProcess, CreateRemoteThread, and other Win32 APIs.
Technique: T1106: Native API
HAWKBALL can collect the user name of the system.
Technique: T1033: System Owner/User Discovery
* Modifying the Dll and FuncName Registry values in HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{SIP_GUID} that point to the DLL providing a SIP’s CryptSIPDllVerifyIndirectData function, which validates a file’s computed hash against the signed hash value.
Technique: T1553: Subvert Trust Controls
Hooking involves redirecting calls to these functions and can be implemented via:
* **Hooks procedures**, which intercept and execute designated code in response to events such as messages, keystrokes, and mouse inputs.
Technique: T1056: Input Capture
Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor.
Technique: T1550: Use Alternate Authentication Material
APT29 used fsutil to check available free space before executing actions that might create large files on disk.
Technique: T1082: System Information Discovery
Sakula contains UAC bypass code for both 32- and 64-bit systems.
Technique: T1548: Abuse Elevation Control Mechanism
In March, we came across an email with a malware attachment that used the Gamaredon group’s tactics.
Technique: T1204: User Execution
Astaroth uses WMIC to execute payloads.
Technique: T1047: Windows Management Instrumentation
The policy of the domain also includes configuration settings that may apply between domains in a multi-domain/forest environment.
Technique: T1484: Domain Policy Modification
BONDUPDATER persists using a scheduled task that executes every minute.
Technique: T1053: Scheduled Task/Job
SombRAT can encrypt strings with XOR-based routines and use a custom AES storage format for plugins, configuration, C2 domains, and harvested data.
Technique: T1027: Obfuscated Files or Information
Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery , Lambda Functions, Azure AD, etc.
Technique: T1526: Cloud Service Discovery
Cracked hashes may enable Persistence, Privilege Escalation, and Lateral Movement via access to Valid Accounts.
Technique: T1558: Steal or Forge Kerberos Tickets
Users must specifically change settings to have these files viewable.
Technique: T1564: Hide Artifacts
This behavior is related to Bypass User Account Control.
Technique: T1574: Hijack Execution Flow
Each web shell instance is configured to contain SP, Key, and Log variables
Technique: T1505: Server Software Component
At this point the process can be suspended then written to, realigned to the injected code, and resumed via SuspendThread , VirtualAllocEx, WriteProcessMemory, SetThreadContext, then ResumeThread respectively.
Technique: T1055: Process Injection
ShimRat has hijacked the cryptbase.dll within migwiz.exe to escalate privileges.
Technique: T1548: Abuse Elevation Control Mechanism
A vulnerability is a weakness in computer hardware or software that can, potentially, be exploited by an adversary to cause unintended or unanticipated behavior to occur.
Technique: T1588: Obtain Capabilities
One of these domains, facebook-apps[.]com, was identified in one of the malware samples associated with this IP address
Technique: T1016: System Network Configuration Discovery
ZeroT has encrypted its payload with RC4.
Technique: T1027: Obfuscated Files or Information
Fox Kitten has used WizTree to obtain network files and directory listings.
Technique: T1083: File and Directory Discovery
Large botnets can generate a significant amount of traffic from systems spread across the global Internet.
Technique: T1498: Network Denial of Service
Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application.
Technique: T1505: Server Software Component
Emotet has relied upon users clicking on a malicious link delivered through spearphishing.
Technique: T1204: User Execution
GuLoader has been spread in phishing campaigns using malicious web links.
Technique: T1566: Phishing
Version 2 Rather than using the host ID as the key, this version uses a random XOR key between 32 and 64 bytes in length that is generated for each session
Technique: T1573: Encrypted Channel
NativeZone can check for the presence of KM.EkeyAlmaz1C.dll and will halt execution unless it is in the same directory as the rest of the malware's components.
Technique: T1480: Execution Guardrails
APT41 has encrypted payloads using the Data Protection API , which relies on keys tied to specific user accounts on specific machines.
Technique: T1480: Execution Guardrails
ShimRat has installed a Windows service to maintain persistence on victim machines.
Technique: T1543: Create or Modify System Process
jRAT can capture passwords from common chat applications such as MSN Messenger, AOL, Instant Messenger, and and Google Talk.
Technique: T1552: Unsecured Credentials
Adversaries may abuse various implementations of JavaScript for execution.
Technique: T1059: Command and Scripting Interpreter
Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking.
Technique: T1003: OS Credential Dumping
TA505 has used lures to get users to enable content in malicious attachments and execute malicious files contained in archives.
Technique: T1204: User Execution
Modifying or disabling a system firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed.
Technique: T1562: Impair Defenses
ObliqueRAT has the ability to extract data from removable devices connected to the endpoint.
Technique: T1025: Data from Removable Media
AppleSeed can use a second channel for C2 when the primary channel is in upload mode.
Technique: T1008: Fallback Channels
Pysa can perform network reconnaissance using the Advanced IP Scanner tool.
Technique: T1016: System Network Configuration Discovery
PlugX has used DLL side-loading to evade anti-virus.
Technique: T1574: Hijack Execution Flow
Ryuk has constructed legitimate appearing installation folder paths by calling GetWindowsDirectoryW and then inserting a null byte at the fourth character of the path.
Technique: T1036: Masquerading
Lokibot has the ability to discover the domain name of the infected host.
Technique: T1016: System Network Configuration Discovery
EvilBunny has executed C2 commands directly via HTTP.
Technique: T1071: Application Layer Protocol
An adversary may compress and/or encrypt data that is collected prior to exfiltration.
Technique: T1560: Archive Collected Data
APT39 has used Mimikatz, Windows Credential Editor and ProcDump to dump credentials.
Technique: T1003: OS Credential Dumping
This can be done remotely or locally and with active or disconnected sessions.
Technique: T1563: Remote Service Session Hijacking
A Threat Group-3390 tool can encrypt payloads using XOR.
Technique: T1027: Obfuscated Files or Information
BoomBox can enumerate the hostname, domain, and IP of a compromised host.
Technique: T1082: System Information Discovery
The malware then appends a script extension (php, bml, or cgi) with a random number of random parameters or a file extension from the following list with no parameters: gif, jpg, png, htm, html, php
Technique: T1083: File and Directory Discovery
This shortcut file calls the built-in ‘control.exe’ utility to in turn load the previously dropped malicious CPL file of ‘winhelp.cpl’
Technique: T1547: Boot or Logon Autostart Execution
Systemd is the default initialization  system on many Linux distributions starting with Debian 8, Ubuntu 15.04, CentOS 7, RHEL 7, Fedora 15, and replaces legacy init systems including SysVinit and Upstart while remaining backwards compatible with the aforementioned init systems.
Technique: T1543: Create or Modify System Process
Another variation, known as a SSL renegotiation attack, takes advantage of a protocol feature in SSL/TLS.
Technique: T1499: Endpoint Denial of Service
Rising Sun can enumerate the compilation timestamp of Windows executable files.
Technique: T1083: File and Directory Discovery
DEATHRANSOM can download files to a compromised host.
Technique: T1105: Ingress Tool Transfer
Bonadan can create bind and reverse shells on the infected system.
Technique: T1059: Command and Scripting Interpreter
When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task .
Technique: T1056: Input Capture
Darkhotel has used malware that repeatedly checks the mouse cursor position to determine if a real user is on the system.
Technique: T1497: Virtualization/Sandbox Evasion
Similar to Obfuscated Files or Information, adversaries may use environmental keying to help protect their TTPs and evade detection.
Technique: T1480: Execution Guardrails
Maze has disrupted systems by encrypting files on targeted machines, claiming to decrypt files if a ransom payment is made.
Technique: T1486: Data Encrypted for Impact
Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.
Technique: T1140: Deobfuscate/Decode Files or Information
Adversaries may leverage Spearphishing Attachment or Spearphishing Link as part of internal spearphishing to deliver a payload or redirect to an external site to capture credentials through Input Capture on sites that mimic email login interfaces.
Technique: T1534: Internal Spearphishing
Adversaries may conduct File and Directory Permissions Modification or Modify Registry in support of subverting these controls.
Technique: T1553: Subvert Trust Controls
APT41 executed file /bin/pwd in activity exploiting CVE-2019-19781 against Citrix devices.
Technique: T1059: Command and Scripting Interpreter
GrimAgent can set persistence with a Registry run key.
Technique: T1547: Boot or Logon Autostart Execution
There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well.
Technique: T1070: Indicator Removal on Host
Stuxnet used WMI with an explorer.exe token to execute on a remote share.
Technique: T1047: Windows Management Instrumentation
QakBot has stored stolen emails and other data into new folders prior to exfiltration.
Technique: T1074: Data Staged
It is believed that a patch management system for an anti-virus product commonly installed among targeted companies was used to distribute the Wiper malware.
Technique: T1072: Software Deployment Tools
Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
Technique: T1078: Valid Accounts
SideTwist has the ability to download additional files.
Technique: T1105: Ingress Tool Transfer
CLIs typically contain various permission levels required for different commands.
Technique: T1059: Command and Scripting Interpreter
StoneDrill has obfuscated its module with an alphabet-based table or XOR encryption.
Technique: T1027: Obfuscated Files or Information
Adversaries can use resource forks to hide malicious data that may otherwise be stored directly in files.
Technique: T1564: Hide Artifacts
Azorult can delete files from victim machines.
Technique: T1070: Indicator Removal on Host
Emissary has the capability to execute the command ipconfig /all.
Technique: T1016: System Network Configuration Discovery
The final antidebugging technique involves GetTickCount performance counters, which are placed within the main sections of code to detect any delay a debugger adds during runtime
Technique: T1140: Deobfuscate/Decode Files or Information
Figure 8: Network communication to download the Pause.ps1 payload Zyklon Delivery In all these techniques, the same domain is used to download the next level payload (Pause.ps1), which is another PowerShell script that is Base64 encoded (as seen in Figure 8)
Technique: T1105: Ingress Tool Transfer
“win32_remote“,”win64_remote64“,”ollydbg“,”ProcessHacker“,”tcpview“,”autoruns“,”autorunsc“,”filemon“,”procmon“,”regmon“,”procexp“,”idaq“,”idaq64“,”ImmunityDebugger“,”Wireshark“,”dumpcap“,”HookExplorer“,”ImportREC“,”PETools“,”LordPE“,”dumpcap“,”SysInspector“,”proc_analyzer“,”sysAnalyzer“,”sniff_hit“,”windbg“,”joeboxcontrol“,”joeboxserver“  Blacklisted process names in the malware In some cases, it calculates the checksum of each running process name, and if it matches any hard-coded checksums, it causes a BSOD via the ntdll.dll “NtRaiseHardError” function
Technique: T1057: Process Discovery
The IRC variant of MPK has a command set (Table 2) that makes this an effective backdoor Trojan, specifically allowing the actors to steal credentials from the targeted system via keylogging, to navigate and interact with the file system, to run arbitrary commands, and to download and execute additional tools on the system
Technique: T1105: Ingress Tool Transfer
BadPatch captures screenshots in .jpg format and then exfiltrates them.
Technique: T1113: Screen Capture
Shamoon has used HTTP for C2.
Technique: T1071: Application Layer Protocol
DarkComet can list active processes running on the victim’s machine.
Technique: T1057: Process Discovery
Timestomping is a technique that modifies the timestamps of a file , often to mimic files that are in the same folder.
Technique: T1070: Indicator Removal on Host