HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
The purpose of this API is to give application developers an easy way to perform operations with root privileges, such as for application installation or updating.
Technique: T1548: Abuse Elevation Control Mechanism
POWRUNER can execute commands from its C2 server.
Technique: T1059: Command and Scripting Interpreter
Interactive shells (cmd.exe, /bin/bash, etc) can be opened remotely
Technique: T1059: Command and Scripting Interpreter
Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.
Technique: T1136: Create Account
If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process.
Technique: T1574: Hijack Execution Flow
APT32 has also renamed a Cobalt Strike beacon payload to install_flashplayers.exe.
Technique: T1036: Masquerading
Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages .
Technique: T1218: Signed Binary Proxy Execution
Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite.
Technique: T1056: Input Capture
BITS upload functionalities can also be used to perform Exfiltration Over Alternative Protocol.
Technique: T1197: BITS Jobs
Grandoreiro can obtain C2 information from Google Docs.
Technique: T1102: Web Service
Compromised profiles may be leveraged during other phases of the adversary lifecycle, such as during Initial Access .
Technique: T1586: Compromise Accounts
Egregor has used an encoded PowerShell command by a service created by Cobalt Strike for lateral movement.
Technique: T1059: Command and Scripting Interpreter
TrickBot uses brute-force attack against RDP with rdpscanDll module.
Technique: T1110: Brute Force
The discovery modules used with Duqu can collect information on accounts and permissions.
Technique: T1087: Account Discovery
BlackOasis's first stage shellcode contains a NOP sled with alternative instructions that was likely designed to bypass antivirus tools.
Technique: T1027: Obfuscated Files or Information
njRAT has used port 1177 for HTTP C2 communications.
Technique: T1571: Non-Standard Port
NETWIRE can encrypt C2 communications.
Technique: T1573: Encrypted Channel
Gamaredon Group has also used malware to scan for removable drives.
Technique: T1120: Peripheral Device Discovery
This group was observed using tactics such as registering typosquatting domains for security or technology vendors, abusing open-source penetration testing tools, and leveraging novel file types as anti-analysis techniques
Technique: T1518: Software Discovery
By default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager is set to autocheck autochk *.
Technique: T1547: Boot or Logon Autostart Execution
SombRAT has the ability to download and execute additional payloads.
Technique: T1105: Ingress Tool Transfer
QakBot can encrypt and pack malicious payloads.
Technique: T1027: Obfuscated Files or Information
Proton zips up files before exfiltrating them.
Technique: T1560: Archive Collected Data
Lucifer has the ability to identify the username on a compromised host.
Technique: T1033: System Owner/User Discovery
Phishing emails with political themes were used in the majority of the observed attack emails
Technique: T1566: Phishing
HotCroissant has attempted to install a scheduled task named “Java Maintenance64” on startup to establish persistence.
Technique: T1053: Scheduled Task/Job
BRONZE BUTLER has created forged Kerberos Ticket Granting Ticket  and Ticket Granting Service  tickets to maintain administrative access.
Technique: T1550: Use Alternate Authentication Material
Fox Kitten has used Volume Shadow Copy to access credential information from NTDS.
Technique: T1003: OS Credential Dumping
Another implementation could be for an adversary to drop their own portable partition image as a file on top of the standard file system.
Technique: T1564: Hide Artifacts
WMIC is a good tool for managing windows hosts and is widely favored by desktop administrators
Technique: T1047: Windows Management Instrumentation
Doki has searched for the current process’s PID.
Technique: T1057: Process Discovery
This provides the adversary with all the plaintext passwords for users, WiFi, mail, browsers, certificates, secure notes, etc.
Technique: T1555: Credentials from Password Stores
MegaCortex was used to kill endpoint security processes.
Technique: T1562: Impair Defenses
Cuba can discover shared resources using the NetShareEnum API call.
Technique: T1135: Network Share Discovery
CrossRAT is capable of taking screen captures.
Technique: T1113: Screen Capture
Adversaries may buy, lease, or rent infrastructure that can be used during targeting.
Technique: T1583: Acquire Infrastructure
QakBot can identify the system time on a targeted host.
Technique: T1124: System Time Discovery
Patchwork has added the path of its second-stage malware to the startup folder to achieve persistence.
Technique: T1547: Boot or Logon Autostart Execution
Code comparison between the default batch script issued by Poison Frog’s C2 and a batch script received by the Helminth Trojan Webshells The data dump included several different webshells apparently used by OilRig to interact with compromised servers
Technique: T1059: Command and Scripting Interpreter
Orz can execute commands with JavaScript.
Technique: T1059: Command and Scripting Interpreter
TinyZBot can install as a Windows service for persistence.
Technique: T1543: Create or Modify System Process
Then, they are using the process hollowing technique to hide the execution of these tools inside of the original Microsoft vbc.exe (VisualBasic Compiler) process
Technique: T1055: Process Injection
MirageFox can gather the username from the victim’s machine.
Technique: T1033: System Owner/User Discovery
Information about an organization’s business tempo may include a variety of details, including operational hours/days of the week.
Technique: T1591: Gather Victim Org Information
APT32 uses the Invoke-Obfuscation framework to obfuscate their PowerShell and also performs other code obfuscation.
Technique: T1027: Obfuscated Files or Information
P8RAT can download additional payloads to a target system.
Technique: T1105: Ingress Tool Transfer
Machete can download additional files for execution on the victim’s machine.
Technique: T1105: Ingress Tool Transfer
ABK has the ability to download files from C2.
Technique: T1105: Ingress Tool Transfer
Patchwork copied all targeted files to a directory called index that was eventually uploaded to the C&C server.
Technique: T1074: Data Staged
Revenge RAT has the ability to upload and download files.
Technique: T1105: Ingress Tool Transfer
RTM has attempted to lure victims into opening e-mail attachments to execute malicious code.
Technique: T1204: User Execution
Different ways to achieve this exist, including TCP state-exhaustion attacks such as SYN floods and ACK floods.
Technique: T1499: Endpoint Denial of Service
Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures.
Technique: T1552: Unsecured Credentials
Externally-facing websites are a common victim of defacement; often targeted by adversary and hacktivist groups in order to push a political message or spread propaganda.
Technique: T1491: Defacement
The screen capture below shows the decryption function.It then calls the StartAndPatchRegAsm function.This function tries to find the original Microsoft RegAsm executable path
Technique: T1113: Screen Capture
OilRig has used macros to verify if a mouse is connected to a compromised machine.
Technique: T1497: Virtualization/Sandbox Evasion
Metamorfo has side-loaded its malicious DLL file.
Technique: T1574: Hijack Execution Flow
SodaMaster can use "stackstrings" for obfuscation.
Technique: T1027: Obfuscated Files or Information
Files on macOS can also be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app .
Technique: T1564: Hide Artifacts
By running SSH on the server in a compromised network, attackers can come back to the network whenever they want
Technique: T1016: System Network Configuration Discovery
Felismus checks for processes associated with anti-virus vendors.
Technique: T1518: Software Discovery
Get2 has the ability to identify the current username of an infected host.
Technique: T1033: System Owner/User Discovery
Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email.
Technique: T1566: Phishing
MuddyWater has used a Word Template, Normal.dotm, for persistence.
Technique: T1137: Office Application Startup
Several Lazarus Group malware families collect information on the type and version of the victim OS, as well as the victim computer name and CPU information.
Technique: T1082: System Information Discovery
BoomBox has gained execution through user interaction with a malicious file.
Technique: T1204: User Execution
SMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain.
Technique: T1021: Remote Services
The macro contains a PowerShell script to persist in the "Run" registry key, "KCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemTextEncoding".
Technique: T1546: Event Triggered Execution
For user level permissions, adversaries can insert malicious commands into ~/.bash_profile, ~/.bash_login, or ~/.profile which are sourced when a user opens a command-line interface or connects remotely.
Technique: T1546: Event Triggered Execution
This process is sometimes referred to as Bring Your Own Vulnerable Driver .
Technique: T1068: Exploitation for Privilege Escalation
Magic Hound has attempted to lure victims into opening malicious links embedded in emails.
Technique: T1204: User Execution
Operation Wocao has queried the registry to detect recent PuTTY sessions.
Technique: T1012: Query Registry
PlayList.vbs contains the obfuscated codes, which it executes after decrypting the obfuscations.
Technique: T1027: Obfuscated Files or Information
In the example above, the “spp.exe” executable would be added to an auto-run registry key at: SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iexplore Many of the Fetch samples attempted to obfuscate their functionality by encrypting their embedded strings with AES using the same key “agkrhfpdbvhdhrkj”; however, the loader’s main goal involved running the following command:/c powershell -window hidden -EncodedCommand JAAwAG8AOABlACAAPQAgACcAJABmADkAQgAgAD0AIAAnACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsA&lt;snip&gt;The base64 encoded command decodes to the following:$0o8e = '$f9B = ''[DllImport("kernel32.dll")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport("kernel32.dll")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport("msvcrt.dll")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);'';$w = Add-Type -memberDefinition $f9B -Name "Win32" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = &lt;shellcode REDACTED for brevity&gt;;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$rJr=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($rJr.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$rJr,0,0,0);for (;;){Start-sleep 60};';$e = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($0o8e));$DKn = "-enc ";if([IntPtr]::Size -eq 8){$b32 = $env:SystemRoot + "\syswow64\WindowsPowerShell\v1.0\powershell";iex "&amp; $b32 $DKn $e"}else{;iex "&amp; powershell $DKn $e";}The decoded command above builds a buffer that it uses to store shellcode and creates a thread to execute it
Technique: T1546: Event Triggered Execution
Bisonal deletes its dropper and VBS scripts from the victim’s machine.
Technique: T1070: Indicator Removal on Host
DarkComet has a keylogging capability.
Technique: T1056: Input Capture
Gold Dragon collects endpoint information using the systeminfo command.
Technique: T1082: System Information Discovery
APT33 has used a variety of publicly available tools like LaZagne to gather credentials.
Technique: T1003: OS Credential Dumping
Smoke Loader downloads a new version of itself once it has installed.
Technique: T1105: Ingress Tool Transfer
APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit.
Technique: T1047: Windows Management Instrumentation
Siloscape has decrypted the password of the C2 server with a simple byte by byte XOR.
Technique: T1140: Deobfuscate/Decode Files or Information
SUNBURST collected information from a compromised host.
Technique: T1005: Data from Local System
Babuk has the ability to enumerate files on a targeted system.
Technique: T1083: File and Directory Discovery
Unlike DLL Search Order Hijacking, the search order differs depending on the method that is used to execute the program.
Technique: T1574: Hijack Execution Flow
Leafminer used a tool called MailSniper to search through the Exchange server mailboxes for keywords.
Technique: T1114: Email Collection
Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment.
Technique: T1480: Execution Guardrails
APT28 has used CVE-2015-4902 to bypass security features.
Technique: T1211: Exploitation for Defense Evasion
LightNeuron is capable of starting a process using CreateProcess.
Technique: T1106: Native API
Delays may also be based on waiting for specific victim conditions to be met  or employ scheduled Multi-Stage Channels to avoid analysis and scrutiny.
Technique: T1497: Virtualization/Sandbox Evasion
HAFNIUM has downloaded malware and tools--including Nishang and PowerCat--onto a compromised host.
Technique: T1105: Ingress Tool Transfer
Kobalos decrypts strings right after the initial communication, but before the authentication process.
Technique: T1140: Deobfuscate/Decode Files or Information
RogueRobin uses Windows Script Components.
Technique: T1059: Command and Scripting Interpreter
Avaddon has collected information about running processes.
Technique: T1057: Process Discovery
After the database is unlocked, these credentials may be copied to memory.
Technique: T1555: Credentials from Password Stores
Container files downloaded from the Internet will be marked with MOTW but the files within may not inherit the MOTW after the container files are extracted and/or mounted.
Technique: T1553: Subvert Trust Controls
Cobalt Strike can deobfuscate shellcode using a rolling XOR and decrypt metadata from Beacon sessions.
Technique: T1140: Deobfuscate/Decode Files or Information
Adversaries may choose to stage data from a victim network in a centralized location prior to Exfiltration to minimize the number of connections made to their C2 server and better evade detection.
Technique: T1074: Data Staged
Ryuk can remotely create a scheduled task to execute itself on a system.
Technique: T1053: Scheduled Task/Job
Metamorfo has used VBS code on victims’ systems.
Technique: T1059: Command and Scripting Interpreter
SHOTPUT uses netstat to list TCP connection status.
Technique: T1049: System Network Connections Discovery
GALLIUM ensured each payload had a unique hash, including by using different types of packers.
Technique: T1027: Obfuscated Files or Information
Adversaries may copy files laterally between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over SMB to connected network shares or with authenticated connections with SMB/Windows Admin Shares or Remote Desktop Protocol.
Technique: T1570: Lateral Tool Transfer
JCry has used cmd.exe to launch PowerShell.
Technique: T1059: Command and Scripting Interpreter
APT32 executed shellcode to identify the name of the infected host.
Technique: T1082: System Information Discovery
This could be done to blend traffic patterns with normal activity or availability.
Technique: T1029: Scheduled Transfer
RogueRobin enumerates running processes to search for Wireshark and Windows Sysinternals suite.
Technique: T1518: Software Discovery
Adversaries may also compromise shared network directories through binary infections by appending or prepending its code to the healthy binary on the shared network directory.
Technique: T1080: Taint Shared Content
Adversaries may take advantage of this behavior to gain access to user account hashes through forced SMB/WebDAV authentication.
Technique: T1187: Forced Authentication
attachedTemplate.dotm xxx 11/15/18 05:35 11/15/18 05:35 109.248.148[.]42    Table 2 Remote templates downloaded by Dear Joohn delivery documents As seen in Table 1, the delivery documents accessed their respective remote templates from four C2 servers at the following IP addresses:  185.203.118[.]198 145.249.105[.]165 188.241.58[.]170  109.248.148[.]42  These initial C2 IP addresses not only hosted the remote templates that subsequently load the first-stage Zebrocy or Cannon payloads, but the IP addresses also hosted the C2 server for the first-stage payloads themselves
Technique: T1105: Ingress Tool Transfer
KeyBoy uses PowerShell commands to download and execute payloads.
Technique: T1059: Command and Scripting Interpreter
HotCroissant has the ability to upload a file from the command and control  server to the victim machine.
Technique: T1105: Ingress Tool Transfer
Adversaries may also subsequently log off and/or reboot boxes to set malicious changes into place.
Technique: T1531: Account Access Removal
NotPetya searches for files ending with dozens of different file extensions prior to encryption.
Technique: T1083: File and Directory Discovery
Chimera has used net localgroup administrators to identify  accounts with local administrative rights.
Technique: T1069: Permission Groups Discovery
HARDRAIN binds and listens on port 443 with a FakeTLS method.
Technique: T1571: Non-Standard Port
QakBot has spread through emails with malicious links.
Technique: T1566: Phishing
Valak has the ability to identify the domain and the MAC and IP addresses of an infected machine.
Technique: T1016: System Network Configuration Discovery
BitPaymer can set values in the Registry to help in execution.
Technique: T1112: Modify Registry
Elderwood has delivered zero-day exploits and malware to victims by injecting malicious code into specific public Web pages visited by targets within a particular sector.
Technique: T1189: Drive-by Compromise
This file issued a GET request to download a malicious file from: hxxp://94.23.172.164/dupdatechecker.doc
Technique: T1105: Ingress Tool Transfer
Leafminer has obtained and used tools such as LaZagne, Mimikatz, PsExec, and MailSniper.
Technique: T1588: Obtain Capabilities
Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
Technique: T1041: Exfiltration Over C2 Channel
The Microsoft Connection Manager Profile Installer  is a command-line program used to install Connection Manager service profiles.
Technique: T1218: Signed Binary Proxy Execution
The toolset used by the Magic Hound campaign was an assortment of custom tools, as well as open sourced tools available to the general public
Technique: T1518: Software Discovery
Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code.
Technique: T1059: Command and Scripting Interpreter
The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged  profiling DLL to be loaded into each .NET process that loads the Common Language Runtime .
Technique: T1574: Hijack Execution Flow
PowerShower has added a registry key so future powershell.exe instances are spawned off-screen by default, and has removed all registry entries that are left behind during the dropper process.
Technique: T1112: Modify Registry
GeminiDuke uses HTTP and HTTPS for command and control.
Technique: T1071: Application Layer Protocol
After the payload is launched, the shellcode runs the following commands to prevent Microsoft Word from showing a recovery dialog:   Lastly, the shellcode overwrites the malicious file with a decoy document related to the Indian defense forces’ pay scale / matrix (Figure 3), displays it to the user and terminates the exploited instance of Microsoft Word
Technique: T1027: Obfuscated Files or Information
For example, "overpassing the hash" involves using a NTLM password hash to authenticate as a user  Pass the Hash while also using the password hash to create a valid Kerberos ticket.
Technique: T1550: Use Alternate Authentication Material
After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory.
Technique: T1003: OS Credential Dumping
Javali has been delivered as malicious e-mail attachments.
Technique: T1566: Phishing
Hi-Zor uses various XOR techniques to obfuscate its components.
Technique: T1027: Obfuscated Files or Information
PUNCHBUGGY has used PowerShell scripts.
Technique: T1059: Command and Scripting Interpreter
UNC2452 exfiltrated collected data over a simple HTTPS request to a password-protected archive staged on a victim's OWA servers.
Technique: T1048: Exfiltration Over Alternative Protocol
This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Technique: T1070: Indicator Removal on Host
Fox Kitten has used RDP to log in and move laterally in the target environment.
Technique: T1021: Remote Services
BLUELIGHT can use HTTP/S for C2 using the Microsoft Graph API.
Technique: T1071: Application Layer Protocol
Melcoz can use MSI files with embedded VBScript for execution.
Technique: T1218: Signed Binary Proxy Execution
Often this location is the current working directory of the program.
Technique: T1574: Hijack Execution Flow
Daserf can take screenshots.
Technique: T1113: Screen Capture
QUADAGENT used the PowerShell filenames Office365DCOMCheck.ps1 and SystemDiskClean.ps1.
Technique: T1036: Masquerading
Using this information, they can decide to explore further or instruct the compromised computer to download additional malware
Technique: T1105: Ingress Tool Transfer
WIRTE has obtained and used Empire for post-exploitation activities.
Technique: T1588: Obtain Capabilities
It also attempts to issue the following SQL query on the “signons.sqlite” file: “SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins WHERE timePasswordChanged/1000 BETWEEN ? AND ?”   117 ftpUpload Uses FTPManager:uploadFile method and a supplied server name, username and password
Technique: T1033: System Owner/User Discovery
If this object is not found, the macro will exit without downloading additional payloads.
Technique: T1497: Virtualization/Sandbox Evasion
Indrik Spider has stored collected date in a .tmp file.
Technique: T1074: Data Staged
Night Dragon has used compromised VPN accounts to gain access to victim systems.
Technique: T1133: External Remote Services
SQLRat has used PowerShell to create a Meterpreter session.
Technique: T1059: Command and Scripting Interpreter
Astaroth obfuscates its JScript code, and has used an XOR-based algorithm to encrypt payloads twice with different keys.
Technique: T1027: Obfuscated Files or Information
Adversaries can use this to register code to be executed when the shell encounters specific interrupts as a persistence mechanism.
Technique: T1546: Event Triggered Execution
Metamorfo has embedded a "vmdetect.exe" executable to identify virtual machines at the beginning of execution.
Technique: T1497: Virtualization/Sandbox Evasion
Similar to Direct Network Floods, more than one system may be used to conduct the attack, or a botnet may be used.
Technique: T1498: Network Denial of Service
GrimAgent has the ability to set persistence using the Task Scheduler.
Technique: T1053: Scheduled Task/Job
Epic collects the OS version, hardware information, computer name, available system memory status, disk space information, and system and user language settings.
Technique: T1082: System Information Discovery
BONDUPDATER can use DNS and TXT records within its DNS tunneling protocol for command and control.
Technique: T1071: Application Layer Protocol
Given the regional file format used there is a chance that some security software suites may not handle them well, and this may have provided an evasion case for the attacker.The documents sent to the targets were titled "Analysis of "Northern New Year in 2017" and used the official logo of the Korean Ministry of Unification
Technique: T1518: Software Discovery
GreyEnergy has a module to inject a PE binary into a remote process.
Technique: T1055: Process Injection
Methods to acquire this information include port scans and vulnerability scans using tools that are brought onto a system.
Technique: T1046: Network Service Scanning
This excellent whitepaper by William Ballenthin, Matt Graeber and Claudiu Teodorescu contains additional information on WMI offense, defense and forensics
Technique: T1047: Windows Management Instrumentation
Bankshot searches for files on the victim's machine.
Technique: T1083: File and Directory Discovery
Kessel can create a reverse shell between the infected host and a specified system.
Technique: T1059: Command and Scripting Interpreter
Kinsing has used Unix shell scripts to execute commands in the victim environment.
Technique: T1059: Command and Scripting Interpreter
HAFNIUM has used web shells to export mailbox data.
Technique: T1114: Email Collection
A Threat Group-3390 tool can read and decrypt stored Registry values.
Technique: T1012: Query Registry
APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password guessing attacks.
Technique: T1110: Brute Force
Lucifer can use certutil for propagation on Windows hosts within intranets.
Technique: T1570: Lateral Tool Transfer
POORAIM can enumerate processes.
Technique: T1057: Process Discovery
Wizard Spider has used AdFind.exe to collect information about Active Directory groups and accounts.
Technique: T1069: Permission Groups Discovery
A Gamaredon Group file stealer can communicate over HTTP for C2.
Technique: T1071: Application Layer Protocol
Adversaries may modify components of the PAM system to create backdoors.
Technique: T1556: Modify Authentication Process
Gathering this information may reveal opportunities for other forms of reconnaissance , Search Open Websites/Domains, or Phishing for Information, establishing operational resources  or Compromise Infrastructure, and/or initial access .
Technique: T1590: Gather Victim Network Information
We are also highly confident that BlackOasis was also responsible for another zero day exploit (CVE-2017-8759) discovered by FireEye in September 2017.  The FinSpy payload used in the current attacks (CVE-2017-11292) shares the same command and control (C2) server as the payload used with CVE-2017-8759 uncovered by FireEye
Technique: T1203: Exploitation for Client Execution
The group has also used certutil -decode to decode files on the victim’s machine when dropping UPPERCUT.
Technique: T1140: Deobfuscate/Decode Files or Information
The Windows Component Object Model  is a component of the native Windows application programming interface  that enables interaction between software objects, or executable code that implements one or more interfaces.
Technique: T1021: Remote Services
Turian can store copied files in a specific directory prior to exfiltration.
Technique: T1074: Data Staged
In Docker, logs may leak information about the environment, such as the environment’s configuration, which services are available, and what cloud provider the victim may be utilizing.
Technique: T1613: Container and Resource Discovery
Data is exchanged via HTTP POSTs.
Technique: T1071: Application Layer Protocol
Transport agents can be written by application developers and then compiled to .NET assemblies that are subsequently registered with the Exchange server.
Technique: T1505: Server Software Component
Bandook has used .PNG images within a zip file to build the executable.
Technique: T1027: Obfuscated Files or Information
Cobalt Strike can execute a payload on a remote host with PowerShell.
Technique: T1059: Command and Scripting Interpreter
Hildegard has packed ELF files into other binaries.
Technique: T1027: Obfuscated Files or Information
Linux distributions and macOS commonly use key-based authentication to secure the authentication process of SSH sessions for remote management.
Technique: T1098: Account Manipulation
Attacking each layer requires different techniques that take advantage of bottlenecks that are unique to the respective components.
Technique: T1499: Endpoint Denial of Service
Trojan.Karagany can base64 encode and AES-128-CBC encrypt data prior to transmission.
Technique: T1027: Obfuscated Files or Information
The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so.
Technique: T1566: Phishing
Dark Caracal's version of Bandook adds a registry key to HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run for persistence.
Technique: T1547: Boot or Logon Autostart Execution
Dragonfly has compromised targets via strategic web compromise  utilizing a custom exploit kit.
Technique: T1189: Drive-by Compromise
Incidents have been observed where adversaries have created backups of cloud instances and transferred them to separate accounts.
Technique: T1537: Transfer Data to Cloud Account
Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves.
Technique: T1601: Modify System Image
QakBot can Base64 encode system information sent to C2.
Technique: T1132: Data Encoding
Upon execution, Metamorfo has unzipped itself after being downloaded to the system and has performed string decryption.
Technique: T1140: Deobfuscate/Decode Files or Information
Some Backdoor.Oldrea samples use standard Base64 + bzip2, and some use standard Base64 + reverse XOR + RSA-2048 to decrypt data received from C2 servers.
Technique: T1132: Data Encoding
Netwalker can terminate system processes and services, some of which relate to backup software.
Technique: T1489: Service Stop
Silence has used RAdmin, a remote software tool used to remotely control workstations and ATMs.
Technique: T1072: Software Deployment Tools
Threat actors may seek information/indicators gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns.
Technique: T1597: Search Closed Sources
The group has also used PowerShell to perform Timestomping.
Technique: T1059: Command and Scripting Interpreter
Winnti Group looked for a specific process running on infected servers.
Technique: T1057: Process Discovery
ObliqueRAT can check for blocklisted usernames on infected endpoints.
Technique: T1033: System Owner/User Discovery
ShadowPad has encrypted a virtual file system and various files.
Technique: T1027: Obfuscated Files or Information
Many strings in JHUHUGIT are obfuscated with a XOR algorithm.
Technique: T1027: Obfuscated Files or Information
The authentication process is handled by mechanisms, such as the Local Security Authentication Server  process and the Security Accounts Manager  on Windows, pluggable authentication modules  on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials.
Technique: T1556: Modify Authentication Process
Mustang Panda has also stored documents for exfiltration in a hidden folder on USB drives.
Technique: T1074: Data Staged
Modify System Image may include implanted code to the operating system for network devices to provide access for adversaries using a specific password.
Technique: T1556: Modify Authentication Process
OilRig has used sc query on a victim to gather information about services.
Technique: T1007: System Service Discovery
KONNI used PowerShell to download and execute a specific 64-bit version of the malware.
Technique: T1059: Command and Scripting Interpreter
This will cause ConsoleHost_history.txt to stop receiving logs.
Technique: T1562: Impair Defenses
Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as:
* Policies, procedures, and standards
* Physical / logical network diagrams
* System architecture diagrams
* Technical system documentation
* Testing / development credentials
* Work / project schedules
* Source code snippets
* Links to network shares and other internal resources
Technique: T1213: Data from Information Repositories
POORAIM can identify system information, including battery status.
Technique: T1082: System Information Discovery
If the dwell time value for the active mode has been set, but the package has not been received, the dwell time value is incremented by the dwell time value for the active period
Technique: T1124: System Time Discovery
A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page.
Technique: T1137: Office Application Startup
Taidoor uses RC4 to encrypt the message body of HTTP content.
Technique: T1573: Encrypted Channel
Some data encoding systems may also result in data compression, such as gzip.
Technique: T1132: Data Encoding
CookieMiner has loaded coinmining software onto systems to mine for Koto cryptocurrency.
Technique: T1496: Resource Hijacking
Conficker scans for other machines to infect.
Technique: T1046: Network Service Scanning
By default, Word has a Normal.dotm template created that can be modified to include a malicious macro.
Technique: T1137: Office Application Startup
Ursnif has used Tor for C2.
Technique: T1090: Proxy
APT30 has used spearphishing emails with malicious DOC attachments.
Technique: T1566: Phishing
The group has also used a malware variant, HIGHNOON, to enumerate active RDP sessions.
Technique: T1049: System Network Connections Discovery
For example, publicly available scripts such as New-GPOImmediateTask can be leveraged to automate the creation of a malicious Scheduled Task/Job by modifying GPO settings, in this case modifying &lt;GPO_PATH&gt;\Machine\Preferences\ScheduledTasks\ScheduledTasks.xml.
Technique: T1484: Domain Policy Modification
Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement.
Technique: T1078: Valid Accounts
OSX_OCEANLOTUS.D collects processor information, memory information, computer name, hardware UUID, serial number, and operating system version.
Technique: T1082: System Information Discovery
Other malware can list a directory's contents.
Technique: T1083: File and Directory Discovery
Similar to Command and Scripting Interpreter, the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system.
Technique: T1106: Native API
(Source: Dell SecureWorks)   TG-3390 actors have also used the following publicly available tools:  Windows Credential Editor (WCE) — obtains passwords from memory gsecdump — obtains passwords from memory winrar — compresses data for exfiltration nbtscan — scans NetBIOS name servers  Tactics, techniques, and procedures Incident response engagements have given CTU researchers insight into the tactics TG-3390 employs during intrusions
Technique: T1003: OS Credential Dumping
PlugX has a module for enumerating TCP and UDP network connections and associated processes using the netstat command.
Technique: T1049: System Network Connections Discovery
Kerberos tickets on macOS are stored in a standard ccache format, similar to Linux.
Technique: T1558: Steal or Forge Kerberos Tickets
The Syrian Electronic Army  compromised email accounts at the Financial Times  to steal additional account credentials.
Technique: T1534: Internal Spearphishing
Mosquito's installer searches the Registry and system to see if specific antivirus tools are installed on the system.
Technique: T1518: Software Discovery
If the device and/or service is not secured, then it may be vulnerable to interception.
Technique: T1111: Two-Factor Authentication Interception
ThiefQuest creates a hidden file, copies the original target executable to the file, then executes the new hidden file to maintain the appearance of normal behavior.
Technique: T1554: Compromise Client Software Binary
Crutch has used the WinRAR utility to compress and encrypt stolen files.
Technique: T1560: Archive Collected Data
Digital certificates include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct.
Technique: T1608: Stage Capabilities
Link analysis of infrastructure and tools also revealed a potential relationship between Magic Hound and the adversary group called “Rocket Kitten” (AKA Operation Saffron Rose, Ajax Security Team, Operation Woolen-Goldfish) as well as an older attack campaign called Newscasters
Technique: T1518: Software Discovery
Andariel has limited its watering hole attacks to specific IP address ranges.
Technique: T1590: Gather Victim Network Information
Invoke-DCOM 
Technique: T1021: Remote Services
Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel.
Technique: T1011: Exfiltration Over Other Network Medium
QakBot can store its configuration information in a randomly named subkey under HKCU\Software\Microsoft.
Technique: T1112: Modify Registry
Once the password (delivered in the body of the email) is entered, the users are presented with a document that will request users to enable the malicious macro, as shown in Figure 3
Technique: T1204: User Execution
The Instance Metadata API is provided as a convenience to assist in managing applications and is accessible by anyone who can access the instance.
Technique: T1552: Unsecured Credentials
YAHOYAH decrypts downloaded files before execution.
Technique: T1140: Deobfuscate/Decode Files or Information
SUNBURST masqueraded its network traffic as the Orion Improvement Program  protocol.
Technique: T1001: Data Obfuscation
Control Panel items are registered executable  or Control Panel  files, the latter are actually renamed dynamic-link library  files that export a CPlApplet function.
Technique: T1218: Signed Binary Proxy Execution
Adversaries may store malicious data or binaries in file attribute metadata instead of directly in files.
Technique: T1564: Hide Artifacts
The organization managed to discover what scripts were hosted on the server before BE/SandWorm gang deleted them, and unfortunately couldn’t restore them after they were deleted
Technique: T1070: Indicator Removal on Host
Adversaries have been observed conducting network DoS attacks for political purposes and to support other malicious activities, including distraction, hacktivism, and extortion.
Technique: T1498: Network Denial of Service
OSX/Shlayer uses the command sh -c tail -c +1381... to extract bytes at an offset from a specified file.
Technique: T1059: Command and Scripting Interpreter
Micropsia obfuscates the configuration with a custom Base64 and XOR.
Technique: T1027: Obfuscated Files or Information
The 2.0 versions require a dropper to decipher and launch the AES encrypted QUASARRAT payload
Technique: T1027: Obfuscated Files or Information
RDAT has created a service when it is installed on the victim machine.
Technique: T1543: Create or Modify System Process
FatDuke can identify the MAC address on the target computer.
Technique: T1016: System Network Configuration Discovery
Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.
Technique: T1195: Supply Chain Compromise
Ebury has encrypted C2 traffic using the client IP address, then encoded it as a hexadecimal string.
Technique: T1573: Encrypted Channel
WINDSHIELD can gather the victim computer name.
Technique: T1082: System Information Discovery
A variant of ADVSTORESHELL encrypts some C2 with RSA.
Technique: T1573: Encrypted Channel
Additionally, botnets are available for rent or purchase.
Technique: T1583: Acquire Infrastructure
Session cookies can be used to bypasses some multi-factor authentication protocols.
Technique: T1539: Steal Web Session Cookie
For example, auditpol /set /category:”Account Logon” /success:disable /failure:disable turns off auditing for the Account Logon category.
Technique: T1562: Impair Defenses
This effectively routes SOGU malware traffic through the victim’s service provider, which likely indicates a foothold on the service provider’s network
Technique: T1543: Create or Modify System Process
It also downloads additional plugins.
Technique: T1105: Ingress Tool Transfer
BLINDINGCAN has lured victims into executing malicious macros embedded within Microsoft Office documents.
Technique: T1204: User Execution
Adversaries may compromise social media accounts that can be used during targeting.
Technique: T1586: Compromise Accounts
down_new has the ability to download files to the compromised host.
Technique: T1105: Ingress Tool Transfer
Honeybee has batch files that modify the system service COMSysApp to load a malicious DLL.
Technique: T1543: Create or Modify System Process
Analysis of Daserf has shown that it regularly undergoes technical improvements to evade anti-virus detection.
Technique: T1027: Obfuscated Files or Information
Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Technique: T1047: Windows Management Instrumentation
This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.
Technique: T1098: Account Manipulation
The results may also be used to identify routes, redirectors, and proxy servers.
Technique: T1016: System Network Configuration Discovery
GALLIUM used netstat -oan to obtain information about the victim network connections.
Technique: T1049: System Network Connections Discovery
RDAT has used encoded data within subdomains as AES ciphertext to communicate from the host to the C2.
Technique: T1001: Data Obfuscation
This shortcut file points to the path of the previously written ‘Applet.cpl’ file
Technique: T1547: Boot or Logon Autostart Execution
Exaramel for Linux uses crontab for persistence if it does not have root privileges.
Technique: T1053: Scheduled Task/Job
By using compromised infrastructure, adversaries may make it difficult to tie their actions back to them.
Technique: T1584: Compromise Infrastructure
MuddyWater has used a PowerShell backdoor to check for Skype connectivity on the target machine.
Technique: T1518: Software Discovery
Microsoft Management Console, or MMC, is a signed Windows binary and is used in several ways in either its GUI or in a command prompt.
Technique: T1218: Signed Binary Proxy Execution
Zeus Panda hooks processes by leveraging its own IAT hooked functions.
Technique: T1056: Input Capture
Hikit has the ability to create a remote shell and run given commands.
Technique: T1059: Command and Scripting Interpreter
TA505 has used malware to gather credentials from Internet Explorer.
Technique: T1555: Credentials from Password Stores
Okrum uses AES to encrypt network traffic.
Technique: T1573: Encrypted Channel
USBStealer drops itself onto removable media and relies on Autorun to execute the malicious file when a user opens the removable media on another system.
Technique: T1091: Replication Through Removable Media
Deletes existing file
Technique: T1070: Indicator Removal on Host
FELIXROOT creates a .LNK file for persistence.
Technique: T1547: Boot or Logon Autostart Execution
Ke3chang performs account discovery using commands such as net localgroup administrators and net group "REDACTED" /domain on specific permissions groups.
Technique: T1087: Account Discovery
Rising Sun can detect network adapter and IP address information.
Technique: T1016: System Network Configuration Discovery
Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed.
Technique: T1027: Obfuscated Files or Information
APT28 has used Google Drive for C2.
Technique: T1102: Web Service
Kessel can RC4-encrypt credentials before sending to the C2.
Technique: T1560: Archive Collected Data
Grandoreiro can store its configuration in the Registry at HKCU\Software\ under frequently changing names including %USERNAME% and ToolTech-RM.
Technique: T1112: Modify Registry
The public keys of each entity are exchanged before encrypted communications begin.
Technique: T1048: Exfiltration Over Alternative Protocol
Such signaling may also be used to open a closed service port such as telnet, or to trigger module modification of malware implants on the device, adding, removing, or changing malicious capabilities.
Technique: T1205: Traffic Signaling
Domains The RoyalCli backdoor was attempting to communicate to the following domains:  News.memozilla[.]org video.memozilla[.]org  The BS2005 backdoor utilised the following domains for C2:  Run.linodepower[.]com Singa.linodepower[.]com log.autocount[.]org  RoyalDNS backdoor was seen communicating to the domain:  andspurs[.]com  Possible linked APT15 domains include:  Micakiz.wikaba[.]org cavanic9[.]net ridingduck[.]com zipcodeterm[.]com dnsapp[.]info   Published date:  10 March 2018   Written by:  Rob Smallridge
Technique: T1008: Fallback Channels
Adversaries may abuse security support providers  to execute DLLs when the system boots.
Technique: T1547: Boot or Logon Autostart Execution
Ebury has used a DGA to generate a domain name for C2.
Technique: T1568: Dynamic Resolution
HAFNIUM has exfiltrated data to file sharing sites, including MEGA.
Technique: T1567: Exfiltration Over Web Service
Melcoz has been packed with VMProtect and Themida.
Technique: T1027: Obfuscated Files or Information
MuddyWater has used a custom tool for creating reverse shells.
Technique: T1059: Command and Scripting Interpreter
A variant of Emissary appends junk data to the end of its DLL file to create a large file that may exceed the maximum size that anti-virus programs can scan.
Technique: T1027: Obfuscated Files or Information
Molerats used various implants, including those built on .NET, on target machines.
Technique: T1059: Command and Scripting Interpreter
Elevated privileges are required to edit this file though.
Technique: T1548: Abuse Elevation Control Mechanism
Lucifer can check for existing stratum cryptomining information in HKLM\Software\Microsoft\Windows\CurrentVersion\spreadCpuXmr – %stratum info%.
Technique: T1012: Query Registry
FatDuke can turn itself on or off at random intervals.
Technique: T1497: Virtualization/Sandbox Evasion
Gamaredon Group malware can insert malicious macros into documents using a Microsoft.Office.Interop object.
Technique: T1559: Inter-Process Communication
Many libraries exist that can archive data, including Python rarfile , libzip , and zlib .
Technique: T1560: Archive Collected Data
Service configurations can be modified using utilities such as sc.exe and Reg.
Technique: T1543: Create or Modify System Process
GALLIUM collected data from the victim's local system, including password hashes from the SAM hive in the Registry.
Technique: T1005: Data from Local System
Winnti Group used stolen certificates to sign its malware.
Technique: T1553: Subvert Trust Controls
The Ritsol backdoor trojan used by Elderwood can download files onto a compromised host from a remote location.
Technique: T1105: Ingress Tool Transfer