HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
Seasalt has masqueraded as a service called "SaSaut" with a display name of "System Authorization Service" in an apparent attempt to masquerade as a legitimate service.
Technique: T1036: Masquerading
Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.
Technique: T1008: Fallback Channels
Adversaries may attempt to get a listing of open application windows.
Technique: T1010: Application Window Discovery
Carbanak has obtained and used open-source tools such as PsExec and Mimikatz.
Technique: T1588: Obtain Capabilities
APT28 has also used a machine to relay and obscure communications between CHOPSTICK and their server.
Technique: T1090: Proxy
Conti can use compiler-based obfuscation for its code, encrypt DLLs, and hide Windows API calls.
Technique: T1027: Obfuscated Files or Information
In doing so, it will attempt to detect the following Anti-Virus products via various techniques:  Trend Micro Kaspersky Symantec Avira AVG ALYac Ahnlab  Ahnlab and ALYac are the most widely used Anti-Virus solutions in South Korea, and Trend Micro and the rest are also known to be most widely used in Taiwan
Technique: T1518: Software Discovery
Rocke has used Pastebin to check the version of beaconing malware and redirect to another Pastebin hosting updated malware.
Technique: T1102: Web Service
Interestingly, we’ve seen recent samples embedding decoy documents that are screenshots of botnet C&C panels or dumps of credit card numbers
Technique: T1113: Screen Capture
Ramsay can spread itself by infecting other portable executable files on removable drives.
Technique: T1091: Replication Through Removable Media
APT28 registered domains imitating NATO, OSCE security websites, Caucasus information resources and other organizations.
Technique: T1583: Acquire Infrastructure
Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence.
Technique: T1543: Create or Modify System Process
They have also used zero-day exploits.
Technique: T1203: Exploitation for Client Execution
GrimAgent can collect the OS, and build version on a compromised host.
Technique: T1082: System Information Discovery
By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, deciphering, or otherwise analyzing the traffic.
Technique: T1001: Data Obfuscation
OwaAuth has a command to list its directory and logical drives.
Technique: T1083: File and Directory Discovery
AppleJeus has been installed via MSI installer.
Technique: T1218: Signed Binary Proxy Execution
These vulnerabilities were patched last December 28 2015, April 5, 2016, and May 12, 2016, respectively
Technique: T1068: Exploitation for Privilege Escalation
Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment.
Technique: T1518: Software Discovery
Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604.
Technique: T1203: Exploitation for Client Execution
ZxShell has a command to open a file manager and explorer on the system.
Technique: T1083: File and Directory Discovery
Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.
Technique: T1547: Boot or Logon Autostart Execution
Almost any network protocol may be used for flooding.
Technique: T1498: Network Denial of Service
EnvyScout can write files to disk with JavaScript using a modified version of the open-source tool FileSaver.
Technique: T1059: Command and Scripting Interpreter
Later variants of jRAT also incorporated AV evasion methods such as Java bytecode obfuscation via the commercial Allatori obfuscation tool.
Technique: T1027: Obfuscated Files or Information
JScript is the Microsoft implementation of the same scripting standard.
Technique: T1059: Command and Scripting Interpreter
For instance, this Trojan uses the InternetExplorer application object much like the previous OopsIE Trojan and a very similar sequence of requests to obtain commands
Technique: T1059: Command and Scripting Interpreter
Carbanak has used a VBScript named "ggldr" that uses Google Apps Script, Sheets, and Forms services for C2.
Technique: T1102: Web Service
Cadelspy has the ability to capture screenshots and webcam photos.
Technique: T1113: Screen Capture
Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is uploaded to one of its 10 C2 servers.
Technique: T1005: Data from Local System
Machete sends stolen data to the C2 server every 10 minutes.
Technique: T1029: Scheduled Transfer
When a document is found matching one of the extensions in the configuration, TINYTYPHON uploads it to the C2 server.
Technique: T1020: Automated Exfiltration
Crutch can automatically monitor removable drives in a loop and copy interesting files.
Technique: T1119: Automated Collection
In this particular instance, the payload is encoded via base64, which certutil decodes
Technique: T1140: Deobfuscate/Decode Files or Information
To use Google Drive, the x_mode command received from the C2 server via DNS tunneling will be followed by a newline-delimited list of settings needed to interact with the Google Drive account
Technique: T1102: Web Service
RainyDay can enumerate processes on a target system.
Technique: T1057: Process Discovery
Flame identifies security software such as antivirus through the Security module.
Technique: T1518: Software Discovery
DropBook can collect the names of all files and folders in the Program Files directories.
Technique: T1083: File and Directory Discovery
For example, the transport agent may only carry out an action like copying in-transit attachments and saving them for later exfiltration if the recipient email address matches an entry on a list provided by the adversary.
Technique: T1505: Server Software Component
BadPatch collects files from the local system that have the following extensions, then prepares them for exfiltration: .xls, .xlsx, .pdf, .mdb, .rar, .zip, .doc, .docx.
Technique: T1005: Data from Local System
BADNEWS has a command to download an .exe and use process hollowing to inject it into a new process.
Technique: T1055: Process Injection
UBoatRAT can upload and download files to the victim’s machine.
Technique: T1105: Ingress Tool Transfer
The padding used is commonly generated by a function to create junk data and then appended to the end or applied to sections of malware.
Technique: T1027: Obfuscated Files or Information
RDAT has used AES ciphertext to encode C2 communications.
Technique: T1573: Encrypted Channel
Bazar can identify administrator accounts on an infected host.
Technique: T1087: Account Discovery
Magic Hound malware gathers the victim's local IP address, MAC address, and external IP address.
Technique: T1016: System Network Configuration Discovery
APT37 has used a credential stealer known as ZUMKONG that can harvest usernames and passwords stored in browsers.
Technique: T1555: Credentials from Password Stores
Compromised email accounts can also be used in the acquisition of infrastructure .
Technique: T1586: Compromise Accounts
Starloader decrypts and executes shellcode from a file called Stars.jps.
Technique: T1140: Deobfuscate/Decode Files or Information
After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application.
Technique: T1539: Steal Web Session Cookie
Winnti for Linux has the ability to deploy modules directly from command and control  servers, possibly for remote command execution, file exfiltration, and socks5 proxying on the infected host.
Technique: T1105: Ingress Tool Transfer
Maze has stopped SQL services to ensure it can encrypt any database.
Technique: T1489: Service Stop
Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.
Technique: T1553: Subvert Trust Controls
NotPetya can use valid credentials with PsExec or wmic to spread itself to remote systems.
Technique: T1078: Valid Accounts
An APT3 downloader uses the Windows command "cmd.exe" /C whoami to verify that it is running with the elevated privileges of “System.” A Gamaredon Group file stealer can gather the victim's username to send to a C2 server.
Technique: T1033: System Owner/User Discovery
ZxShell can launch a reverse command shell.
Technique: T1059: Command and Scripting Interpreter
PS1 can use an XOR key to decrypt a PowerShell loader and payload binary.
Technique: T1140: Deobfuscate/Decode Files or Information
Kazuar gathers information about network adapters.
Technique: T1016: System Network Configuration Discovery
ServHelper may set up a reverse SSH tunnel to give the attacker access to services running on the victim, such as RDP.
Technique: T1573: Encrypted Channel
Valak can download a module to search for and build a report of harvested credential data.
Technique: T1119: Automated Collection
GreyEnergy digitally signs the malware with a code-signing certificate.
Technique: T1553: Subvert Trust Controls
AppleSeed can call regsvr32.exe for execution.
Technique: T1218: Signed Binary Proxy Execution
menuPass has staged data on remote MSP systems or other victim networks prior to exfiltration.
Technique: T1074: Data Staged
OS Credential Dumping is used to obtain password hashes, this may only get an adversary so far when Pass the Hash is not an option.
Technique: T1110: Brute Force
Adversaries may execute malicious payloads via loading shared modules.
Technique: T1129: Shared Modules
HOMEFRY can perform credential dumping.
Technique: T1003: OS Credential Dumping
Peppy has the ability to execute shell commands.
Technique: T1059: Command and Scripting Interpreter
Gazer uses custom encryption for C2 that uses RSA.
Technique: T1573: Encrypted Channel
FIN6 has renamed the "psexec" service name to "mstdc" to masquerade as a legitimate Windows service.
Technique: T1036: Masquerading
TSCookie can use ICMP to receive information on the destination server.
Technique: T1095: Non-Application Layer Protocol
Okrum's loader can create a new service named NtmsSvc to execute the payload.
Technique: T1569: System Services
Emotet leverages the Admin$ share for lateral movement once the local admin password has been brute forced.
Technique: T1021: Remote Services
Mustang Panda has gathered system information using systeminfo.
Technique: T1082: System Information Discovery
Upon opening the malicious DOC attachment, an additional download is triggered from a stored URL within an embedded OLE Object (seen in Figure 4)
Technique: T1105: Ingress Tool Transfer
Smoke Loader uses a simple one-byte XOR method to obfuscate values in the malware.
Technique: T1027: Obfuscated Files or Information
Information about hosts may also be exposed to adversaries via online or other accessible data sets  or Search Victim-Owned Websites.
Technique: T1592: Gather Victim Host Information
After downloading its main config file, Downdelph downloads multiple payloads from C2 servers.
Technique: T1105: Ingress Tool Transfer
Ebury can automatically exfiltrate gathered SSH credentials.
Technique: T1020: Automated Exfiltration
APT41 used compiled HTML  files for targeting.
Technique: T1218: Signed Binary Proxy Execution
FALLCHILL can search files on a victim.
Technique: T1083: File and Directory Discovery
FIN10 has executed malicious .bat files containing PowerShell commands.
Technique: T1059: Command and Scripting Interpreter
Chaes has collected the username and UID from the infected machine.
Technique: T1033: System Owner/User Discovery
GrimAgent can base64 encode C2 replies.
Technique: T1132: Data Encoding
Service paths  and shortcut paths may also be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks .
Technique: T1574: Hijack Execution Flow
Crimson has the ability to determine the date and time on a compromised host.
Technique: T1124: System Time Discovery
Olympic Destroyer contains a module that tries to obtain stored credentials from web browsers.
Technique: T1555: Credentials from Password Stores
five threads are for forwarding collected data to four cloud services (Box, Dropbox, Pcloud and Yandex). When uploading stolen data to a cloud service
Technique: T1102: Web Service
Sandworm Team has used webshells including P.A.S.
Technique: T1505: Server Software Component
QakBot can RC4 encrypt strings in C2 communication.
Technique: T1573: Encrypted Channel
Thread Execution Hijacking is commonly performed by suspending an existing process then unmapping/hollowing its memory, which can then be replaced with malicious code or the path to a DLL.
Technique: T1055: Process Injection
Much like the previous version of Reaver, Reaver.v3 will query the necessary registry keys to determine the correct startup path to use
Technique: T1012: Query Registry
Malware may be placed on infrastructure that was previously purchased/rented by the adversary  or was otherwise compromised by them .
Technique: T1608: Stage Capabilities
Figure 5 shows Phishery’s output to the command that injects a URL into a file named “good_test.docx”, which it will save the resulting file to “bad_test.docx”
Technique: T1055: Process Injection
Third-party applications and software deployment systems may be in use in the network environment for administration purposes .
Technique: T1072: Software Deployment Tools
Naikon has used WMIC.exe for lateral movement.
Technique: T1047: Windows Management Instrumentation
OilRig has used WMI for execution.
Technique: T1047: Windows Management Instrumentation
Its main functions are:  Brute-force using a pre-defined list of usernames and passwords in an attempt to login to Admin panels
Technique: T1110: Brute Force
The adversary assumes the security context of whichever browser process the proxy is injected into.
Technique: T1185: Browser Session Hijacking
Adversaries may use dynamic resolution for the purpose of Fallback Channels.
Technique: T1568: Dynamic Resolution
APT38 used a backdoor, NESTEGG, that has the capability to download and upload files to and from a victim’s machine.
Technique: T1105: Ingress Tool Transfer
APT33 has created a scheduled task to execute a .vbe file multiple times a day.
Technique: T1053: Scheduled Task/Job
LightNeuron is capable of executing commands via cmd.exe.
Technique: T1059: Command and Scripting Interpreter
Turla has abused local accounts that have the same password across the victim’s network.
Technique: T1078: Valid Accounts
HAMMERTOSS exfiltrates data by uploading it to accounts created by the actors on Web cloud storage providers for the adversaries to retrieve later.
Technique: T1567: Exfiltration Over Web Service
StoneDrill has the capability to discover the system OS, Windows version, architecture and environment.
Technique: T1082: System Information Discovery
Adversaries can use a compromised social media profile to create new, or hijack existing, connections to targets of interest.
Technique: T1586: Compromise Accounts
APT28 has used compromised Office 365 service accounts with Global Administrator privileges to collect email from user inboxes.
Technique: T1078: Valid Accounts
Command ID 17 indexes to a function that collects the system information and sends it to the C2 server.
Technique: T1033: System Owner/User Discovery
It is installed as an ISAPI filter on Exchange servers and shares characteristics with the China Chopper Web shell.
Technique: T1505: Server Software Component
Kimsuky has sent spearphishing emails containing a link to a document that contained malicious macros or took the victim to an actor-controlled domain.
Technique: T1566: Phishing
For example: 
* HKEY_CLASSES_ROOT\txtfile\shell\open\command
* HKEY_CLASSES_ROOT\txtfile\shell\print\command
* HKEY_CLASSES_ROOT\txtfile\shell\printto\command
The values of the keys listed are commands that are executed when the handler opens the file extension.
Technique: T1546: Event Triggered Execution
BUGJUICE is a backdoor that is executed by launching a benign file and then hijacking the search order to load a malicious dll into it
Technique: T1574: Hijack Execution Flow
Mustang Panda has encrypted C2 communications with RC4.
Technique: T1573: Encrypted Channel
Tropic Trooper has been known to side-load DLLs using a valid version of a Windows Address Book and Windows Defender executable with one of their tools.
Technique: T1574: Hijack Execution Flow
Figure 2: Process chain for the first part of the campaign Although the actual VBS script changed from sample to sample, with different levels of obfuscation and different ways of invoking the next stage of process tree, its final purpose remained same: invoking PowerShell to decode the Base64 encoded PowerShell command in the INI file that was dropped earlier by the macro, and executing it
Technique: T1057: Process Discovery
HKCU\Software\Microsoft\Office test\Special\Perf 
Technique: T1137: Office Application Startup
Higaisa discovered system proxy settings and used them if available.
Technique: T1090: Proxy
The script is used to decode and execute the following payloads:Appach01.jpg (renamed: Windows-KB275122-x86.exe) is a Freenki sample.Appach01.jpg (renamed: Windows-KB271854-x86.exe) is a PoohMilk sample.PoohMilk AnalysisThe PoohMilk sample is designed to perform two actions:Create persistence to execute the Freenki sample at the next reboot.Check specific files on the infected machine.The first action is to create a registry key in order to execute the Windows-KB275122-x86.exe file previously downloaded
Technique: T1106: Native API
Penquin can report the file system type and disk space of a compromised host to C2.
Technique: T1082: System Information Discovery
zwShell has used RDP for lateral movement.
Technique: T1021: Remote Services
A total of 64MB of garbage data is appended to this copied file, likely as a way to deter any security products in place that may be scanning files on disk
Technique: T1027: Obfuscated Files or Information
Zebrocy uses HTTP for C2.
Technique: T1071: Application Layer Protocol
The code is obfuscated in order to hide any malicious activity on the remote server
Technique: T1027: Obfuscated Files or Information
Hildegard has used the BOtB tool that can break out of containers.
Technique: T1611: Escape to Host
Kazuar also obfuscates the name of created files/folders/mutexes and encrypts debug messages written to log files using the Rijndael cipher.
Technique: T1027: Obfuscated Files or Information
Previous related research: https://sec0wn.blogspot.com/2018/05/clearing-muddywater-analysis-of-new.html?m=1 https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/ https://blog.malwarebytes.com/threat-analysis/2017/09/elaborate-scripting-fu-used-in-espionage-attack-against-saudi-arabia-government_entity/ https://www.sekoia.fr/blog/falling-on-muddywater/  Decoy images by country Jordan     The Hashemite Kingdom of Jordan, Ministry of Justice (mwjo.doc) DAMAMAX.doc    Turkey     Turkey’s General Directorate of Security Turkey’s Directorate General of Coastal Safety        Turkey’s General Directorate of Security (Onemli Rapor.doc) Turkey’s Ministry of the Interior (Early election.doc)    Saudi Arabia Document signed by the Major General Pilot, commander of the Saudi Royal Air Force     KSA King Saud University (KSU) KSA King Saud University (KSU)    Azerbaijan İnkişaf üçün görüş.doc (meeting for development) Iraq     Iraqi Ministry of Foreign Affairs Government of Iraq, the Treasury of the Council of Ministers    Pakistan     ECP.doc National Assembly of Pakistan.doc        P.Police.doc     Afghanistan President.doc, E-government of Afghanistan Technical details Below is a description of the malware extraction and execution flow, starting from the initial infection vector, running VBA code via a macro and then dropping the PowerShell code that establishes command-center communications, sends victim system information and then receives commands supported by the malware
Technique: T1071: Application Layer Protocol
RGDoor decodes Base64 strings and decrypts strings using a custom XOR algorithm.
Technique: T1140: Deobfuscate/Decode Files or Information
Information reported by vendors may also reveal opportunities other forms of reconnaissance , establishing operational resources  or Obtain Capabilities, and/or initial access  or External Remote Services.
Technique: T1597: Search Closed Sources
SharpStage has a persistence component to write a scheduled task for the payload.
Technique: T1053: Scheduled Task/Job
For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint:
* Policies, procedures, and standards
* Physical / logical network diagrams
* System architecture diagrams
* Technical system documentation
* Testing / development credentials
* Work / project schedules
* Source code snippets
* Links to network shares and other internal resources
 APT28 has collected information from Microsoft SharePoint services within target networks.
Technique: T1213: Data from Information Repositories
PlugX allows the operator to capture screenshots.
Technique: T1113: Screen Capture
Machete has embedded malicious macros within spearphishing attachments to download additional files.
Technique: T1059: Command and Scripting Interpreter
FLASHFLOOD also collects information stored in the Windows Address Book.
Technique: T1005: Data from Local System
USBferry can check for connected USB devices.
Technique: T1120: Peripheral Device Discovery
Adversaries may create self-signed SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic  with Web Protocols or even enabling Adversary-in-the-Middle if added to the root of trust  Install Root Certificate.
Technique: T1587: Develop Capabilities
TajMahal has the ability to manage an automated queue of egress files and commands sent to its C2.
Technique: T1020: Automated Exfiltration
APT32 has used pass the hash for lateral movement.
Technique: T1550: Use Alternate Authentication Material
Hydraq creates a backdoor through which remote attackers can delete files.
Technique: T1070: Indicator Removal on Host
net view 
Technique: T1135: Network Share Discovery
Each module stream has a PerformanceCache that stores a separate compiled version of the VBA source code known as p-code.
Technique: T1564: Hide Artifacts
Rising Sun can enumerate all running processes and process information on an infected machine.
Technique: T1057: Process Discovery
RainyDay can use TCP in C2 communications.
Technique: T1095: Non-Application Layer Protocol
Rundll32.exe is commonly associated with executing DLL payloads .
Technique: T1218: Signed Binary Proxy Execution
rc.local
Technique: T1546: Event Triggered Execution
jRAT can download and execute files.
Technique: T1105: Ingress Tool Transfer
Command & Control  The malware communicates with the Naver email platform in order to communicate with the operator
Technique: T1071: Application Layer Protocol
FinFisher injects itself into various processes depending on whether it is low integrity or high integrity.
Technique: T1055: Process Injection
BlackMould can send commands to C2 in the body of HTTP POST requests.
Technique: T1071: Application Layer Protocol
HAYMAKER is a backdoor that can download and execute additional payloads in the form of modules
Technique: T1105: Ingress Tool Transfer
Poseidon Group searches for administrator accounts on both the local victim machine and the network.
Technique: T1087: Account Discovery
Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed.
Technique: T1110: Brute Force
Shamoon obtains the target's IP address and local network segment.
Technique: T1016: System Network Configuration Discovery
This could include maliciously redirecting  or even disabling host-based sensors, such as Event Tracing for Windows , by tampering settings that control the collection and flow of event telemetry.
Technique: T1562: Impair Defenses
Execution via VDSO hijacking may also evade detection from security products since the execution is masked under a legitimate process.
Technique: T1055: Process Injection
TeamTNT has used shell scripts for execution.
Technique: T1059: Command and Scripting Interpreter
The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals.
Technique: T1546: Event Triggered Execution
After reestablishing access, the adversaries download tools such as gsecudmp and WCE that are staged temporarily on websites that TG-3390 previously compromised but never used
Technique: T1105: Ingress Tool Transfer
Command execution Command execution can create havoc for victim if the malware developer decides to execute commands in the victim’s device
Technique: T1059: Command and Scripting Interpreter
FELIXROOT queries the Registry for specific keys for potential privilege escalation and proxy information.
Technique: T1012: Query Registry
Goopy has the ability to exfiltrate data over the Microsoft Outlook C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
It then downloads and decrypts a PNG file
Technique: T1140: Deobfuscate/Decode Files or Information
SUPERNOVA is a Web shell.
Technique: T1505: Server Software Component
Elise exfiltrates data using cookie values that are Base64-encoded.
Technique: T1132: Data Encoding
23 Take screenshot, temporarily store it as TPX499.dat, and upload it to the C2
Technique: T1113: Screen Capture
GoldMax has used decoy traffic to surround its malicious network traffic to avoid detection.
Technique: T1001: Data Obfuscation
The NETWIRE binary has been executed via PowerShell script.
Technique: T1059: Command and Scripting Interpreter
Disturbing or offensive images may be used as a part of Internal Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages.
Technique: T1491: Defacement
By generating the decryption keys from target-specific environmental values, environmental keying can make sandbox detection, anti-virus detection, crowdsourcing of information, and reverse engineering difficult.
Technique: T1480: Execution Guardrails
Agent Tesla has used the Rijndael symmetric encryption algorithm to encrypt strings.
Technique: T1027: Obfuscated Files or Information
PipeMon can inject its modules into various processes using reflective DLL loading.
Technique: T1055: Process Injection
Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing malicious attachments.
Technique: T1566: Phishing
A module in Prikormka collects information on available printers and disk drives.
Technique: T1120: Peripheral Device Discovery
Similar to Code Signing, adversaries may abuse this architecture to subvert trust controls and bypass security policies that allow only legitimately signed code to execute on a system.
Technique: T1553: Subvert Trust Controls
Rifdoor has been distributed in e-mails with malicious Excel or Word documents.
Technique: T1566: Phishing
Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest.
Technique: T1189: Drive-by Compromise
Machete stores zipped files with profile data from installed web browsers.
Technique: T1560: Archive Collected Data
OnionDuke uses Twitter as a backup C2.
Technique: T1102: Web Service
RTM can obtain a list of smart card readers attached to the victim.
Technique: T1120: Peripheral Device Discovery
HALFBAKED can delete a specified file.
Technique: T1070: Indicator Removal on Host
Threat actors can query nameservers for a target organization directly, or search through centralized repositories of logged DNS query responses .
Technique: T1596: Search Open Technical Databases
Some Brave Prince variants have used South  Korea's Daum email service to exfiltrate information, and later variants have posted the data to a web server via an HTTP post command.
Technique: T1048: Exfiltration Over Alternative Protocol
WhiskeyBravo can be used to overwrite the first 4.9MB of physical drives.
Technique: T1561: Disk Wipe
Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe.
Technique: T1055: Process Injection
RemoteCMD copies a file over to the remote system before execution.
Technique: T1105: Ingress Tool Transfer
Kwampirs collects registered owner details by using the commands systeminfo and net config workstation.
Technique: T1033: System Owner/User Discovery
LoudMiner used an MSI installer to install the virtualization software.
Technique: T1218: Signed Binary Proxy Execution
USBStealer mimics a legitimate Russian program called USB Disk Security.
Technique: T1036: Masquerading
The configuration and strings are encrypted using 3DES and Base64 encoding
Technique: T1027: Obfuscated Files or Information
Adversaries may use email rules to hide inbound emails in a compromised user's mailbox.
Technique: T1564: Hide Artifacts
QakBot can run nltest /domain_trusts /all_trusts for domain trust discovery.
Technique: T1482: Domain Trust Discovery
Cannon can take a screenshot of the desktop.
Technique: T1113: Screen Capture
Industroyer used Tor nodes for C2.
Technique: T1090: Proxy
FIN7 has used SSH to move laterally through victim environments.
Technique: T1021: Remote Services
Downdelph bypasses UAC to escalate privileges by using a custom “RedirectEXE” shim database.
Technique: T1548: Abuse Elevation Control Mechanism
TrickBot has been known to reach a command and control server via one of nine proxy IP addresses.
Technique: T1090: Proxy
Olympic Destroyer attempts to copy itself to remote machines on the network.
Technique: T1570: Lateral Tool Transfer
These PowerShell scripts are final stage payloads – they include a downloader with domain generation algorithm (DGA) functionality and the backdoor component, which connect to the C2 server to receive commands and perform additional malicious activities.  hUpdateCheckers.ps1 (POWRUNER) The backdoor component, POWRUNER, is a PowerShell script that sends and receives commands to and from the C2 server
Technique: T1546: Event Triggered Execution
Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel.
Technique: T1048: Exfiltration Over Alternative Protocol
FIN7 has created a scheduled task named “AdobeFlashSync” to establish persistence.
Technique: T1036: Masquerading
DarkComet can open an active screen of the victim’s machine and take control of the mouse and keyboard.
Technique: T1021: Remote Services
Threat actors can use online resources and lookup tools to harvest information about content servers within a CDN.
Technique: T1596: Search Open Technical Databases
ROKRAT has the ability to gather a list of files and directories on the infected system.
Technique: T1083: File and Directory Discovery
PROMETHIUM has named services to appear legitimate.
Technique: T1036: Masquerading
It is unknown what these domains may have been used for but based on the similarity of domain spoofing and sharing an IP, they are likely part of the adversary infrastructure
Technique: T1016: System Network Configuration Discovery
Volatile Cedar can deploy additional tools.
Technique: T1105: Ingress Tool Transfer
Bazar has the ability to use an alternative C2 server if the primary server fails.
Technique: T1008: Fallback Channels
Upon execution, this Trojan checks to see if it was configured with “BINDERON” to determine if it should extract an embedded payload from a resource named “B”, save it to %TEMP%\%BIND1%, and create a new process with the embedded payload
Technique: T1055: Process Injection
Magic Hound has acquired mobile phone numbers of potential targets, possibly for mobile malware or additional phishing operations.
Technique: T1589: Gather Victim Identity Information
PowerShower has sent HTTP GET and POST requests to C2 servers to send information and receive instructions.
Technique: T1071: Application Layer Protocol
XCSSET uses a hidden folder named .xcassets and .git to embed itself in Xcode.
Technique: T1564: Hide Artifacts
Ramsay can collect data from network drives and stage it for exfiltration.
Technique: T1039: Data from Network Shared Drive
The Cobalt Strike System Profiler can discover applications through the browser and identify the version of Java the target has.
Technique: T1518: Software Discovery
Cobalt Strike can exploit vulnerabilities such as MS14-058.
Technique: T1068: Exploitation for Privilege Escalation
Network Downloader The Network Downloader functionality allows the actor to quickly upload user files from remote victim systems
Technique: T1105: Ingress Tool Transfer
In some cases where an adversary has access to a system that is in the authentication path between systems or when automated scans that use credentials attempt to authenticate to an adversary controlled system, the NTLMv2 hashes can be intercepted and relayed to access and execute code against a target system.
Technique: T1557: Adversary-in-the-Middle
Native API functions  may be directed invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries.
Technique: T1106: Native API
XTunnel is capable of probing the network for open ports.
Technique: T1046: Network Service Scanning
APT39 has used malware to delete files after they are deployed on a compromised host.
Technique: T1070: Indicator Removal on Host
They should also take the following steps to harden both web applications and the servers hosting them to reduce the risk of network intrusion via this vector.Use and configure available firewalls to block attacks.Take steps to secure Windows systems, such as installing and configuring Microsoft’s Enhanced Mitigation Experience Toolkit (EMET) and Microsoft AppLocker.Monitor and remove any unauthorized code present in any www directories.Disable, discontinue, or disallow the use of Internet Control Message Protocol (ICMP) and Simple Network Management Protocol (SNMP) as much as possible.Remove unnecessary HTTP verbs from web servers
Technique: T1505: Server Software Component
GreyEnergy encrypts its configuration files with AES-256 and also encrypts its strings.
Technique: T1027: Obfuscated Files or Information
Cuba can enumerate processes running on a victim's machine.
Technique: T1057: Process Discovery
Denis obfuscates its code and encrypts the API names.
Technique: T1027: Obfuscated Files or Information
Cryptoistic can use TCP in communications with C2.
Technique: T1095: Non-Application Layer Protocol
This allows the adversary to gain information without making any API requests.
Technique: T1538: Cloud Service Dashboard
APT37 identifies the victim username.
Technique: T1033: System Owner/User Discovery
Pillowmint can iterate through running processes every six seconds collecting a list of processes to capture from later.
Technique: T1057: Process Discovery
Bisonal has encoded binary data with Base64.
Technique: T1132: Data Encoding
Pysa can perform OS credential dumping using Mimikatz.
Technique: T1003: OS Credential Dumping
xCaon has added persistence via the Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load which causes the malware to run each time any user logs in.
Technique: T1547: Boot or Logon Autostart Execution
APT38 has used a custom secure delete function to make deleted files unrecoverable.
Technique: T1485: Data Destruction
A variation on this behavior takes advantage of differences in functionality across cloud regions.
Technique: T1535: Unused/Unsupported Cloud Regions
FIN8 has used Registry keys to detect and avoid executing in potential sandboxes.
Technique: T1518: Software Discovery
PipeMon's first stage has been executed by a call to CreateProcess with the decryption password in an argument.
Technique: T1106: Native API
A Helminth VBScript receives a batch script to execute a set of commands in a command prompt.
Technique: T1119: Automated Collection
Magic Hound malware has a function to determine whether the C2 server wishes to execute the newly dropped file in a hidden window.
Technique: T1564: Hide Artifacts
Depending on the configuration of the environment, an adversary may be able to enumerate more information via the graphical dashboard than an API.
Technique: T1538: Cloud Service Dashboard
For example, at the end of 2016 CTU researchers observed the threat actors using native system functionality to disable logging processes and delete logs within a network
Technique: T1070: Indicator Removal on Host
OSX_OCEANLOTUS.D has the ability to upload files from a compromised host.
Technique: T1005: Data from Local System
There does appear to be function names however, including PeekMessageA, which has been previously observed in other keylogging malware
Technique: T1056: Input Capture
Instructions within guide.txt explaining how to carry out DNS hijacking attack In one part of guide.txt, an example target appears to be provided, with a corresponding adversary IP (185.162.235[.]106) for the legitimate domain to be redirected to
Technique: T1016: System Network Configuration Discovery
Lazarus Group malware has conducted C2 over HTTP and HTTPS.
Technique: T1071: Application Layer Protocol
From these reports, we know that the group uses an abundance of tools and tactics, ranging across zero-day exploits targeting common applications such as Java or Microsoft Office, heavy use of spear-phishing attacks, compromising legitimate websites to stage watering-hole attacks, and targeting over a variety of operating systems – Windows, OSX, Linux, even mobile iOS
Technique: T1189: Drive-by Compromise
Elise performs timestomping of a CAB file it creates.
Technique: T1070: Indicator Removal on Host
Smoke Loader adds a Registry Run key for persistence and adds a script in the Startup folder to deploy the payload.
Technique: T1547: Boot or Logon Autostart Execution
Lazarus Group malware uses cmd.exe to execute commands on victims.
Technique: T1059: Command and Scripting Interpreter
Adversaries may gather information in an attempt to calculate the geographical location of a victim host.
Technique: T1614: System Location Discovery
MoonWind installs itself as a new service with automatic startup to establish persistence.
Technique: T1543: Create or Modify System Process
Resulting script on the compromised government websites Users were redirected to https://google-updata[.]tk:443/hook.js, a BEeF instance, and https://windows-updata[.]tk:443/scanv1.8/i/?1, an empty ScanBox instance that answered a small piece of JavaScript code
Technique: T1571: Non-Standard Port
KONNI can collect the IP address from the victim’s machine.
Technique: T1016: System Network Configuration Discovery
VMware DLL Check The Trojan checks to see if the files vmGuestLib.dll or vmbusres.dll exist in the system directory
Technique: T1497: Virtualization/Sandbox Evasion
Some malware that has been used by Axiom also uses steganography to hide communication in PNG image files.
Technique: T1001: Data Obfuscation
Network devices such as routers and firewalls that connect multiple networks together may implement NAT during the process of passing packets between networks.
Technique: T1599: Network Boundary Bridging
FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities.
Technique: T1059: Command and Scripting Interpreter
To disguise the source of malicious traffic, adversaries may chain together multiple proxies.
Technique: T1090: Proxy
PipeMon modules are stored encrypted on disk.
Technique: T1027: Obfuscated Files or Information
InvisiMole can enumerate Registry values, keys, and data.
Technique: T1012: Query Registry
Blue Mockingbird has gained initial access by exploiting CVE-2019-18935, a vulnerability within Telerik UI for ASP.NET AJAX.
Technique: T1190: Exploit Public-Facing Application
BACKSPACE will attempt to establish a C2 channel, then will examine open windows to identify a pop-up from the firewall software and will simulate a mouse-click to allow the connection to proceed.
Technique: T1562: Impair Defenses
A possible explanation for this is that the document was copied to another system with an incorrectly set system time, then saved with the incorrect time
Technique: T1124: System Time Discovery
When the Trojan runs as an executable within the “DsvHelper” folder, the Trojan will create a shortcut (.lnk file) and save the shortcut to the ‘DsvHelper’ folder
Technique: T1547: Boot or Logon Autostart Execution
jRAT can capture microphone recordings.
Technique: T1123: Audio Capture
From an infrastructure point of view there is no overlap between the two sets of activity, the only overlap is the use of the unique tool “DNSMessenger”  When these points are considered together in conjunction with the significant difference in targeting they make a strong case for classifying this activity as distinct from FIN7 activity
Technique: T1562: Impair Defenses
FlawedAmmyy will attempt to detect anti-virus products during the initial infection.
Technique: T1518: Software Discovery
Bazar can decrypt downloaded payloads.
Technique: T1140: Deobfuscate/Decode Files or Information
JSS Loader has been executed through malicious attachments contained in spearphishing emails.
Technique: T1204: User Execution
- There were two interesting sub-classes found inside Main Activity: Receiver and Sender
Technique: T1562: Impair Defenses
Ke3chang performs service discovery using net start commands.
Technique: T1007: System Service Discovery
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
Technique: T1547: Boot or Logon Autostart Execution
Bazar has been downloaded via Windows BITS functionality.
Technique: T1197: BITS Jobs
Windows allows programs to have direct access to logical volumes.
Technique: T1006: Direct Volume Access
HAFNIUM has exploited CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065  to compromise on-premises versions of Microsoft Exchange Server, enabling access to email accounts and installation of additional malware.
Technique: T1203: Exploitation for Client Execution
Persistence is maintained through a Run registry key
Technique: T1547: Boot or Logon Autostart Execution
As such, Valid Accounts used by the other party for access to internal network systems may be compromised and used.
Technique: T1199: Trusted Relationship
Net is an example utility that can be used to remove network share connections with the net use \\system\share /delete command.
Technique: T1070: Indicator Removal on Host
Bazar can retrieve information from the infected machine.
Technique: T1005: Data from Local System
APT40 has been observed consolidating files acquired from victim networks and using the archival tool rar.exe to compress and encrypt the data before exfiltration
Technique: T1560: Archive Collected Data
In on-premises Exchange and Exchange Online, theGet-GlobalAddressList PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.
Technique: T1087: Account Discovery
One example of these samples is given below: SHA256:6500636c29eba70efd3eb3be1d094dfda4ec6cca52ace23d50e98e6b63308fdb The file is a self-extracting RAR, which is a common delivery mechanism for PlugX particularly when the eventual payload will be sideloaded by a legitimate executable
Technique: T1036: Masquerading
POSHSPY uses PowerShell to execute various commands, one to execute its payload.
Technique: T1059: Command and Scripting Interpreter
Pysa has used brute force attempts against a central management console, as well as some Active Directory accounts.
Technique: T1110: Brute Force
RunningRAT captures keystrokes and sends them back to the C2 server.
Technique: T1056: Input Capture
Bisonal uses rundll32.exe to execute as part of the Registry Run key it adds: HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Run\”vert” = “rundll32.exe c:\windows\temp\pvcu.dll , Qszdez”.
Technique: T1218: Signed Binary Proxy Execution
APT18 uses DNS for C2 communications.
Technique: T1071: Application Layer Protocol
A process scope COR_PROFILER can also be created in-memory without modifying the Registry.
Technique: T1574: Hijack Execution Flow
Epic gathers a list of all user accounts, privilege classes, and time of last logon.
Technique: T1087: Account Discovery
Inspecting the class C network for 185.162.235.0/24 shows us that another IP on the same network resolves to an OilRig domain, msoffice-cdn[.]com which we identified in August 2017
Technique: T1016: System Network Configuration Discovery
Adversaries may use Valid Accounts to interact with remote machines by taking advantage of Distributed Component Object Model .
Technique: T1021: Remote Services
BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background  without interrupting other networked applications.
Technique: T1197: BITS Jobs
There have also been similar examples of extensions being used for command & control.
Technique: T1176: Browser Extensions
Smoke Loader injects into the Internet Explorer process.
Technique: T1055: Process Injection
It can continue tagging documents to collect with follow up scans.
Technique: T1119: Automated Collection
Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.
Technique: T1610: Deploy Container
By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making.
Technique: T1565: Data Manipulation
Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting.
Technique: T1608: Stage Capabilities
Adversaries may also abuse Windows APIs such as CredEnumerateA to list credentials managed by the Credential Manager.
Technique: T1555: Credentials from Password Stores
ZeroT has used HTTP for C2.
Technique: T1071: Application Layer Protocol
UBoatRAT can list running processes on the system.
Technique: T1057: Process Discovery
text=  from=  ai= ags=  oe= aq= btnG=  oprnd=  ai= utm=  channel=  The page address in the domain of the command and control server is chosen randomly from the list
Technique: T1016: System Network Configuration Discovery
SHARPSTATS has the ability to identify the IP address, machine name, and OS of the compromised host.
Technique: T1082: System Information Discovery
The return traffic may occur in a variety of ways, depending on the Web service being utilized.
Technique: T1102: Web Service
FIN7 has signed Carbanak payloads with legally purchased code signing certificates.
Technique: T1553: Subvert Trust Controls
FELIXROOT downloads and uploads files to and from the victim’s machine.
Technique: T1105: Ingress Tool Transfer
Such control can allow for redirection of an organization's traffic, facilitating Collection and Credential Access efforts for the adversary.
Technique: T1584: Compromise Infrastructure
Dipsind uses HTTP for C2.
Technique: T1071: Application Layer Protocol
MuddyWater has used malware that can capture screenshots of the victim’s machine.
Technique: T1113: Screen Capture
Leviathan has used external remote services such as virtual private networks  to gain initial access.
Technique: T1133: External Remote Services
KONNI can collect the username from the victim’s machine.
Technique: T1033: System Owner/User Discovery
The ccache file may also be converted into a Windows format using tools such as Kekeo.
Technique: T1558: Steal or Forge Kerberos Tickets
By pointing to a maliciously-crafted DLL with an exported function that always returns TRUE , an adversary can successfully validate any file  using that SIP  .
Technique: T1553: Subvert Trust Controls
Kimsuky has gathered credentials using Mimikatz and ProcDump.
Technique: T1003: OS Credential Dumping
yty contains junk code in its binary, likely to confuse malware analysts.
Technique: T1027: Obfuscated Files or Information
APT32 used WMI to deploy their tools on remote machines and to gather information about the Outlook process.
Technique: T1047: Windows Management Instrumentation
Safe mode starts up the Windows operating system with a limited set of drivers and services.
Technique: T1562: Impair Defenses