HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
APT37 has used exploits for Flash Player , Word , Internet Explorer , and Microsoft Edge  for execution.
Technique: T1203: Exploitation for Client Execution
Turla has used legitimate web services including Pastebin, Dropbox, and GitHub for C2 communications.
Technique: T1102: Web Service
Adversaries may attempt to take advantage of a weakness in an Internet-facing computer or program using software, data, or commands in order to cause unintended or unanticipated behavior.
Technique: T1190: Exploit Public-Facing Application
Group policy objects  are containers for group policy settings made up of files stored within a predicable network path \<DOMAIN>\SYSVOL\<DOMAIN>\Policies\.
Technique: T1615: Group Policy Discovery
Adversaries may modify Mach-O binary headers to load and execute malicious dylibs every time the binary is executed.
Technique: T1546: Event Triggered Execution
NotPetya contains a modified version of Mimikatz to help gather credentials that are later used for lateral movement.
Technique: T1003: OS Credential Dumping
ELMER uses HTTP for command and control.
Technique: T1071: Application Layer Protocol
BADNEWS installs a registry Run key to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
MS##-### 
Technique: T1210: Exploitation of Remote Services
BBSRAT can list file and directory information.
Technique: T1083: File and Directory Discovery
MarkiRAT can check for the Telegram installation directory by enumerating the files on disk.
Technique: T1518: Software Discovery
Reaver collects system information from the victim, including CPU speed, computer name, volume serial number, ANSI code page, OEM code page identifier for the OS, Microsoft Windows version, and memory information.
Technique: T1082: System Information Discovery
USBStealer searches victim drives for files matching certain extensions  or names.
Technique: T1083: File and Directory Discovery
BackdoorDiplomacy has used web shells to establish an initial foothold and for lateral movement within a victim's system.
Technique: T1505: Server Software Component
SombRAT can execute getinfo to enumerate the computer name and OS version of a compromised system.
Technique: T1082: System Information Discovery
Similar to File and Directory Discovery on a local host, after identifying available storage services  Cloud Infrastructure Discovery adversaries may access the contents/objects stored in cloud infrastructure.
Technique: T1619: Cloud Storage Object Discovery
FinFisher hooks processes by modifying IAT pointers to CreateWindowEx.
Technique: T1056: Input Capture
DOGCALL is capable of capturing screenshots of the victim's machine.
Technique: T1113: Screen Capture
PinchDuke gathers system configuration information.
Technique: T1082: System Information Discovery
WastedLocker can encrypt data and leave a ransom note.
Technique: T1486: Data Encrypted for Impact
DustySky extracts basic information about the operating system.
Technique: T1082: System Information Discovery
Adversaries may try to dump Exchange address lists such as global address lists .
Technique: T1087: Account Discovery
SLOTHFULMEDIA has collected the username from a victim machine.
Technique: T1033: System Owner/User Discovery
ShadowPad has used FTP for C2 communications.
Technique: T1071: Application Layer Protocol
Containers can be deployed by various means, such as via Docker's create and start APIs or via a web application such as the Kubernetes dashboard or Kubeflow.
Technique: T1610: Deploy Container
Lurid can compress data before sending it.
Technique: T1560: Archive Collected Data
ChChes collects the victim's %TEMP% directory path and version of Internet Explorer.
Technique: T1083: File and Directory Discovery
Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment.
Technique: T1563: Remote Service Session Hijacking
Ryuk has called CreateToolhelp32Snapshot to enumerate all running processes.
Technique: T1057: Process Discovery
RTM has initiated connections to external domains using HTTPS.
Technique: T1071: Application Layer Protocol
Hildegard has created a user named “monerodaemon”.
Technique: T1136: Create Account
Cobalt Strike can use Python to perform execution.
Technique: T1059: Command and Scripting Interpreter
In such cases, an adversary may take control of a subdomain to conduct operations with the benefit of the trust associated with that domain.
Technique: T1584: Compromise Infrastructure
Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot.
Technique: T1495: Firmware Corruption
Skidmap is a kernel-mode rootkit used for cryptocurrency mining.
Technique: T1496: Resource Hijacking
UNC2452 named tasks \Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager in order to appear legitimate.
Technique: T1036: Masquerading
Adversaries may extract credentials from memory via Exploitation for Credential Access.
Technique: T1555: Credentials from Password Stores
Adversaries may also obfuscate commands executed from payloads or directly via a Command and Scripting Interpreter.
Technique: T1027: Obfuscated Files or Information
It also uses RSA to encrypt resources.
Technique: T1027: Obfuscated Files or Information
Cobalt Group obfuscated several scriptlets and code used on the victim’s machine, including through use of XOR and RC4.
Technique: T1027: Obfuscated Files or Information
This can be used to limit the number of egress points, or provide access to a host without direct internet access.
Technique: T1090: Proxy
Machete’s downloaded data is decrypted using AES.
Technique: T1140: Deobfuscate/Decode Files or Information
Kivars has the ability to remotely trigger keyboard input and mouse clicks.
Technique: T1021: Remote Services
To clear the audit policy, adversaries may run the following lines: auditpol /clear /y or auditpol /remove /allusers.
Technique: T1562: Impair Defenses
Peppy has the ability to automatically exfiltrate files and keylogs.
Technique: T1020: Automated Exfiltration
Sidewinder has named malicious files rekeywiz.exe to match the name of a legitimate Windows executable.
Technique: T1036: Masquerading
Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff.
Technique: T1593: Search Open Websites/Domains
When, finally, the first stage shellcode receives a special “FF” signal, it then executes the delivered shellcode
Technique: T1059: Command and Scripting Interpreter
Bandook has used PowerShell loaders as part of execution.
Technique: T1059: Command and Scripting Interpreter
MuddyWater has used HTTP for C2 communications.
Technique: T1071: Application Layer Protocol
Large botnets can generate a significant amount of traffic from systems spread across the global internet.
Technique: T1499: Endpoint Denial of Service
Mustang Panda has used a legitimately signed executable to execute a malicious payload within a DLL file.
Technique: T1574: Hijack Execution Flow
More_eggs has used an RC4-based encryption method for its C2 communications.
Technique: T1573: Encrypted Channel
Adversary abuse of RC scripts is especially effective for lightweight Unix-like distributions using the root user as default, such as IoT or embedded systems.
Technique: T1037: Boot or Logon Initialization Scripts
HotCroissant has the ability to retrieve a list of files in a given directory as well as drives and drive types.
Technique: T1083: File and Directory Discovery
Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.
Technique: T1119: Automated Collection
Mustang Panda has stored collected credential files in c:\windows\temp prior to exfiltration.
Technique: T1074: Data Staged
Kinsing has searched bash_history for credentials.
Technique: T1552: Unsecured Credentials
This method typically requires administrative level access to the device.
Technique: T1601: Modify System Image
APT39 has packed tools with UPX, and has repacked a modified version of Mimikatz to thwart anti-virus detection.
Technique: T1027: Obfuscated Files or Information
POWRUNER may collect process information by running tasklist on a victim.
Technique: T1057: Process Discovery
WellMess can identify the IP address and user domain on the target machine.
Technique: T1016: System Network Configuration Discovery
HTTPBrowser has used DNS for command and control.
Technique: T1071: Application Layer Protocol
Targeting may be specific to a desired victim set  or malicious software may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.
Technique: T1195: Supply Chain Compromise
Message 3:    Headers Received: by mailcenter.support   Sender Mercator Institute for China Studies <publications@mericcs.org>   Subject Authoritarian advance Responding to Chinas growing political influence in Europe   Body Content and images included within the e-mail body were a direct copy of the following MERICS report:  https://www.merics.org/sites/default/files/2018-02/GPPi_MERICS_Authoritarian_Advance_2018_1.pdf   Notes The hyperlinked text Click here to download the report within the e-mail body lead to a malicious RTF document located at the URL hxxp://www.mericcs.org/GPPi_MERICS_Authoritarian_Advance_2018_1Q.doc
Technique: T1204: User Execution
SombRAT can use the getprocesslist command to enumerate processes on a compromised host.
Technique: T1057: Process Discovery
Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls.
Technique: T1550: Use Alternate Authentication Material
Caterpillar WebShell has a module to use a port scanner on a system.
Technique: T1046: Network Service Scanning
Proton captures the content of the desktop with the screencapture binary.
Technique: T1113: Screen Capture
Another Lazarus Group malware sample XORs C2 traffic.
Technique: T1573: Encrypted Channel
Cannon can download a payload for execution.
Technique: T1105: Ingress Tool Transfer
TA459 has exploited Microsoft Word vulnerability CVE-2017-0199 for execution.
Technique: T1203: Exploitation for Client Execution
APT29 also created a scheduled task to maintain SUNSPOT persistence when the host booted during the 2020 SolarWinds intrusion.
Technique: T1053: Scheduled Task/Job
WellMess can use junk data in the Base64 string for additional obfuscation.
Technique: T1001: Data Obfuscation
Adversaries may search in different closed databases depending on what information they seek to gather.
Technique: T1597: Search Closed Sources
Adversaries may also delete the ConsoleHost_history.txt file or edit its contents to hide PowerShell commands they have run.
Technique: T1070: Indicator Removal on Host
If installing itself as a service fails, Elise instead writes itself as a file named svchost.exe saved in %APPDATA%\Microsoft\Network.
Technique: T1036: Masquerading
Leafminer infected victims using JavaScript code.
Technique: T1059: Command and Scripting Interpreter
Ke3chang has used Mimikatz to generate Kerberos golden tickets.
Technique: T1558: Steal or Forge Kerberos Tickets
OLE 
Technique: T1559: Inter-Process Communication
The credentials appear to have been stolen via multiple techniques, including using post-exploition password recovery tools such as MimiKatz or its variant ZhuMimiKatz
Technique: T1003: OS Credential Dumping
Adversaries may also seek and target DNS misconfigurations/leaks that reveal information about internal networks.
Technique: T1596: Search Open Technical Databases
JSS Loader can download and execute JavaScript files.
Technique: T1059: Command and Scripting Interpreter
Psylo has commands to enumerate all storage devices and to find all files that start with a particular string.
Technique: T1083: File and Directory Discovery
Additionally, Lazarus Group malware SHARPKNOT disables the Microsoft Windows System Event Notification and Alerter services..  Night Dragon has disabled anti-virus and anti-spyware tools in some instances on the victim’s machines.
Technique: T1562: Impair Defenses
FELIXROOT collects a list of running processes.
Technique: T1057: Process Discovery
Users may be subjected to social engineering to get them to open a file that will lead to code execution.
Technique: T1204: User Execution
Remsec can obtain information about the current user.
Technique: T1033: System Owner/User Discovery
Dragonfly 2.0 dropped and executed SecretsDump to dump password hashes.
Technique: T1003: OS Credential Dumping
POWRUNER may collect information on the victim's anti-virus software.
Technique: T1518: Software Discovery
Malicious Component Object Model  objects may also be registered and loaded in safe mode.
Technique: T1562: Impair Defenses
The message sent to the C2 will be “file is deleted.” if successful or “file is not deleted.” if unsuccessful
Technique: T1070: Indicator Removal on Host
OilRig has used macros to deliver malware such as QUADAGENT and OopsIE.
Technique: T1059: Command and Scripting Interpreter
APT19 used Regsvr32 to bypass application control techniques.
Technique: T1218: Signed Binary Proxy Execution
Machete logs keystrokes from the victim’s machine.
Technique: T1056: Input Capture
Sandworm Team has researched software code to enable supply-chain operations, most notably for the 2017 NotPetya attack.
Technique: T1592: Gather Victim Host Information
Chimera has obtained and used tools such as BloodHound, Cobalt Strike, Mimikatz, and PsExec.
Technique: T1588: Obtain Capabilities
FIN6 has used PowerShell to gain access to merchant's networks, and a Metasploit PowerShell module to download and execute shellcode and to set up a local listener.
Technique: T1059: Command and Scripting Interpreter
A BlackEnergy 2 plug-in uses WMI to gather victim host details.
Technique: T1047: Windows Management Instrumentation
APT41 has used search order hijacking to execute malicious payloads, such as Winnti RAT.
Technique: T1574: Hijack Execution Flow
Available information generally includes name, security group, and additional metadata including sensitive data such as credentials and UserData scripts that may contain additional secrets.
Technique: T1552: Unsecured Credentials
Agent Tesla has the capability to kill any running analysis processes and AV software.
Technique: T1562: Impair Defenses
Control Panel items can be executed directly from the command line, programmatically via an application programming interface  call, or by simply double-clicking the file.
Technique: T1218: Signed Binary Proxy Execution
TG-3390 has used additional web shells containing similarly formatted passwords
Technique: T1505: Server Software Component
Typically, management services over commonly used ports are used when password spraying.
Technique: T1110: Brute Force
HyperStack can connect to the IPC$ share on remote machines.
Technique: T1559: Inter-Process Communication
APT41 used compromised credentials to log on to other systems.
Technique: T1078: Valid Accounts
A Gamaredon Group file stealer can transfer collected files to a hardcoded C2 server.
Technique: T1041: Exfiltration Over C2 Channel
Epic compresses the collected data with bzip2 before sending it to the C2 server.
Technique: T1560: Archive Collected Data
Sandworm Team's plainpwd tool is a modified version of Mimikatz and dumps Windows credentials from system memory.
Technique: T1003: OS Credential Dumping
Lokibot has the ability to discover the computer name and Windows product name/version.
Technique: T1082: System Information Discovery
APT3 has been known to brute force password hashes to be able to leverage plain text credentials.
Technique: T1110: Brute Force
OopsIE checks for information on the CPU fan, temperature, mouse, hard disk, and motherboard as part of its anti-VM checks.
Technique: T1082: System Information Discovery
On occasions, the phishing emails contained links to external domains to download the first stage, and sometimes the first stage was attached to the email itself
Technique: T1566: Phishing
Turian can retrieve system information including OS version, memory usage, local hostname, and system adapter information.
Technique: T1082: System Information Discovery
BackdoorDiplomacy has obtained and used leaked malware, including DoublePulsar, EternalBlue, EternalRocks, and EternalSynergy, in its operations.
Technique: T1588: Obtain Capabilities
RainyDay has the ability to capture screenshots.
Technique: T1113: Screen Capture
Patchwork scanned the “Program Files” directories for a directory with the string “Total Security” .
Technique: T1518: Software Discovery
If the Trojan does not have root privileges to enable its automatic launch, it creates the “~/.config/autostart/dbus-inotifier.desktop” file with the following contents: [Desktop Entry] Type=Application Exec=/home/user/.config/dbus-notifier/dbus-inotifier Name[en_EN]=system service d-bus notifier Name=system service d-bus notifier Comment[en_EN]= Comment= “/home/user/” stands here for the environment variable HOME
Technique: T1033: System Owner/User Discovery
All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks
Technique: T1027: Obfuscated Files or Information
OSX/Shlayer can masquerade as a Flash Player update.
Technique: T1036: Masquerading
Adversaries may use steganography techniques in order to prevent the detection of hidden information.
Technique: T1027: Obfuscated Files or Information
XCSSET searches firewall configuration files located in /Library/Preferences/ and uses csrutil status to determine if System Integrity Protection is enabled.
Technique: T1518: Software Discovery
China Chopper's server component can spider authentication portals.
Technique: T1046: Network Service Scanning
Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Technique: T1055: Process Injection
SideTwist can embed C2 responses in the source code of a fake Flickr webpage.
Technique: T1001: Data Obfuscation
APT32's backdoor has exfiltrated data using the already opened channel with its C&C server.
Technique: T1041: Exfiltration Over C2 Channel
For example, on a Windows system adversaries may attempt to infer the language of a system by querying the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language or parsing the outputs of Windows API functions GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList and GetUserDefaultLangID.
Technique: T1614: System Location Discovery
Adversaries may bridge network boundaries by compromising perimeter network devices.
Technique: T1599: Network Boundary Bridging
Astaroth collects data in a plaintext file named r1.log before exfiltration.
Technique: T1074: Data Staged
The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.
Technique: T1021: Remote Services
OSX_OCEANLOTUS.D uses the command xattr -d com.apple.quarantine to remove the quarantine file attribute used by Gatekeeper and Notarization checks.
Technique: T1553: Subvert Trust Controls
net share
Technique: T1135: Network Share Discovery
Creating processes with a different token may require the credentials of the target user, specific privileges to impersonate that user, or access to the token to be used  or Make and Impersonate Token.
Technique: T1134: Access Token Manipulation
UNC2452 used fsutil to check available free space before executing actions that might create large files on disk.
Technique: T1082: System Information Discovery
BabyShark has downloaded additional files from the C2.
Technique: T1105: Ingress Tool Transfer
Common methods used by adversaries include replacing accessibility feature binaries or pointers/references to these binaries in the Registry.
Technique: T1546: Event Triggered Execution
Ursnif has used HTTP POSTs to exfil gathered information.
Technique: T1041: Exfiltration Over C2 Channel
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.
Technique: T1003: OS Credential Dumping
Clop has checked the keyboard language using the GetKeyboardLayout function to avoid installation on Russian-language or other Commonwealth of Independent States-language machines; it will also check the GetTextCharset function.
Technique: T1614: System Location Discovery
APT28 has staged archives of collected data on a target's Outlook Web Access  server.
Technique: T1074: Data Staged
Figure 1: Configuration file that adds new C2 server and forces the data-stealing backdoor to use it   Figure 2: Configuration file that adds TCP tunnels and records desktop video Command and Control CARBANAK communicates to its C2 servers via pseudo-HTTP or a custom binary protocol
Technique: T1071: Application Layer Protocol
Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user.
Technique: T1548: Abuse Elevation Control Mechanism
Pasam creates a backdoor through which remote attackers can upload files.
Technique: T1105: Ingress Tool Transfer
APT29 has used WinRM via PowerShell to execute command and payloads on remote hosts.
Technique: T1021: Remote Services
JCry has achieved execution by luring users to click on a file that appeared to be an Adobe Flash Player update installer.
Technique: T1204: User Execution
Trojan.Karagany can capture keystrokes on a compromised host.
Technique: T1056: Input Capture
This can be complemented by restricting direct internet access to the company’s internal networks while using proxies to access external resources
Technique: T1090: Proxy
APT34 has used a keylogging tool called KEYPUNCH.
Technique: T1056: Input Capture
If it detects that it is, it will exit.
Technique: T1497: Virtualization/Sandbox Evasion
ThiefQuest uploads files via unencrypted HTTP.
Technique: T1071: Application Layer Protocol
This may be done in a number of ways, including inserting malicious script into web pages or other user controllable web content such as forum posts.
Technique: T1608: Stage Capabilities
The default lifetime of a SAML token is one hour, but the validity period can be specified in the NotOnOrAfter value of the conditions ... element in a token.
Technique: T1606: Forge Web Credentials
Nomadic Octopus as attempted to lure victims into clicking on malicious attachments within spearphishing emails.
Technique: T1204: User Execution
Magic Hound has lured victims into executing malicious files.
Technique: T1204: User Execution
Valak can determine if a compromised host has security products installed.
Technique: T1518: Software Discovery
Adversaries may inject malicious code into processes via thread local storage  callbacks in order to evade process-based defenses as well as possibly elevate privileges.
Technique: T1055: Process Injection
RemoteCMD can execute commands remotely by creating a new service on the remote system .
Technique: T1021: Remote Services
The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx is also available but is not created by default on Windows Vista and newer.
Technique: T1547: Boot or Logon Autostart Execution
With the exception of the ‘Speed’ method previously mentioned, the names of the methods called in this chain appear to be fairly random, as seen in the following list:    ETransaksi.Speed ETransaksi.diomadnfagaghagh ETransaksi.fjcsERIfjfiojsGHIsdifjksi ETransaksi.gsgjIDJIGJIGJIGJIFDOSpl ETransaksi.FJaioefgkaoeK    The last two methods in the chain carry out a majority of the first payload’s functionality
Technique: T1083: File and Directory Discovery
Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly.
Technique: T1185: Browser Session Hijacking
XTunnel is capable of accessing locally stored passwords on victims.
Technique: T1552: Unsecured Credentials
In response to this request, the C2 server responds with a Base64-encoded RSA public key (seen in Figure 12)
Technique: T1132: Data Encoding
Magic Hound has established email accounts using fake personas for spearphishing operations.
Technique: T1585: Establish Accounts
Tropic Trooper used pr and an openly available tool to scan for open ports on target systems.
Technique: T1046: Network Service Scanning
These Honeybee documents did not contain any specific lures, rather variations of a “not compatible” message attempting to convince the user to enable content
Technique: T1204: User Execution
SMOKEDHAM has used whoami commands to identify system owners.
Technique: T1033: System Owner/User Discovery
Taidoor can use GetCurrentProcessId for process discovery.
Technique: T1057: Process Discovery
Bundlore has attempted to get users to execute a malicious .app file that looks like a Flash Player update.
Technique: T1204: User Execution
SLOTHFULMEDIA has taken a screenshot of a victim's desktop, named it "Filter3.jpg", and stored it in the local directory.
Technique: T1113: Screen Capture
RTM can attempt to run the program as admin, then show a fake error message and a legitimate UAC bypass prompt to the user in an attempt to socially engineer the user into escalating privileges.
Technique: T1548: Abuse Elevation Control Mechanism
Gaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, or setting up a command and control channel on the host.
Technique: T1611: Escape to Host
Nerex creates a Registry subkey that registers a new service.
Technique: T1112: Modify Registry
RedLeaves can use HTTP over non-standard ports, such as 995, for C2.
Technique: T1571: Non-Standard Port
PUNCHBUGGY has used PowerShell to decode base64-encoded assembly.
Technique: T1140: Deobfuscate/Decode Files or Information
ShimRat can sleep when instructed to do so by the C2.
Technique: T1029: Scheduled Transfer
Maze operators have used VirtualBox and a Windows 7 virtual machine to run the ransomware; the virtual machine's configuration file mapped the shared network drives of the target company, presumably so Maze can encrypt files on the shared drives as well as the local machine.
Technique: T1564: Hide Artifacts
This can allow an adversary a path to access the cloud or container APIs, exploit container host access via Escape to Host, or take advantage of weak identity and access management policies.
Technique: T1190: Exploit Public-Facing Application
Bazar can attempt to overload sandbox analysis by sending 1550 calls to printf.
Technique: T1497: Virtualization/Sandbox Evasion
None of the known documents contain a lure image or message to instruct the recipient to click the Enable Content button necessary to run the macro, as seen in Figure 1
Technique: T1204: User Execution
OLDBAIT collects credentials from Internet Explorer, Mozilla Firefox, and Eudora.
Technique: T1555: Credentials from Password Stores
Subfolders in this directory categorize logs by their related functions, such as:
* /var/log/messages:: General and system-related messages
* /var/log/secure or /var/log/auth.log: Authentication logs
* /var/log/utmp or /var/log/wtmp: Login records
* /var/log/kern.log: Kernel logs
* /var/log/cron.log: Crond logs
* /var/log/maillog: Mail server logs
* /var/log/httpd/: Web server access and error logs
 Proton removes logs from /var/logs and /Library/logs.
Technique: T1070: Indicator Removal on Host
The "ZJ" variant of BACKSPACE allows "ZJ link" infections with Internet access to relay traffic from "ZJ listen" to a command server.
Technique: T1090: Proxy
When the technique is performed on the running operating system in memory and not on the stored copy, this technique will not survive across reboots.
Technique: T1601: Modify System Image
Peppy can use HTTP to communicate with C2.
Technique: T1071: Application Layer Protocol
MAPIGET steals email still on Exchange servers that has not yet been archived.
Technique: T1114: Email Collection
NavRAT uses tasklist /v to check running processes.
Technique: T1057: Process Discovery
njRAT can capture screenshots of the victim’s machines.
Technique: T1113: Screen Capture
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
Technique: T1189: Drive-by Compromise
Rising Sun used dynamic API resolutions to various Windows APIs by leveraging LoadLibrary and GetProcAddress.
Technique: T1106: Native API
Adversaries may target user email to collect sensitive information.
Technique: T1114: Email Collection
menuPass uses scripts to enumerate IP ranges on the victim network.
Technique: T1018: Remote System Discovery
Epic uses the rem reg query command to obtain values from Registry keys.
Technique: T1012: Query Registry
OilRig used the Plink utility and other tools to create tunnels to C2 servers.
Technique: T1573: Encrypted Channel
ADVSTORESHELL can run Systeminfo to gather information about the victim.
Technique: T1082: System Information Discovery
APT41 attempted to masquerade their files as popular anti-virus software.
Technique: T1036: Masquerading
Sandworm Team used a backdoor which could execute a supplied DLL using rundll32.exe.
Technique: T1218: Signed Binary Proxy Execution
RegDuke can use Dropbox as its C2 server.
Technique: T1102: Web Service
When it is necessary to do this for a large flood of packets, the computational requirements can cause the server to become sluggish and/or unresponsive, due to the work it must do to eliminate the rogue ACK packets.
Technique: T1499: Endpoint Denial of Service
gh0st RAT has added a Registry Run key to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
TAINTEDSCRIBE can download additional modules from its C2 server.
Technique: T1105: Ingress Tool Transfer
Information about networks may also be exposed to adversaries via online or other accessible data sets .
Technique: T1590: Gather Victim Network Information
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options  debuggers.
Technique: T1546: Event Triggered Execution
Attor encrypts collected data with a custom implementation of Blowfish and RSA ciphers.
Technique: T1560: Archive Collected Data
Sandworm Team's CredRaptor tool can collect saved passwords from various internet browsers.
Technique: T1555: Credentials from Password Stores
When documents, applications, or programs are downloaded an extended attribute  called com.apple.quarantine can be set on the file by the application performing the download.
Technique: T1553: Subvert Trust Controls
Code repositories are often accessible via an API .
Technique: T1567: Exfiltration Over Web Service
Cobalt Group has sent malicious Word OLE compound documents to victims.
Technique: T1559: Inter-Process Communication
APT32 used Net to use Windows' hidden network shares to copy their tools to remote machines for execution.
Technique: T1021: Remote Services
Emotet has been delivered by phishing emails containing links.
Technique: T1566: Phishing
EnvyScout has been executed through malicious files attached to e-mails.
Technique: T1204: User Execution
It requires the remote Registry service to be running on the target system.
Technique: T1112: Modify Registry
PLATINUM has transferred files using the Intel® Active Management Technology  Serial-over-LAN  channel.
Technique: T1105: Ingress Tool Transfer
Alternatively, some DGAs employ whole words as the unit by concatenating words together instead of letters .
Technique: T1568: Dynamic Resolution
Zebrocy has a command to delete files and directories.
Technique: T1070: Indicator Removal on Host
AppleScripts do not need to call osascript to execute, however.
Technique: T1059: Command and Scripting Interpreter
Daserf hides collected data in password-protected .rar archives.
Technique: T1560: Archive Collected Data
Mosquito leverages the CreateProcess and LoadLibrary calls to execute files with the .dll and .exe extensions.
Technique: T1106: Native API
Kessel's configuration is hardcoded and RC4 encrypted within the binary.
Technique: T1027: Obfuscated Files or Information
FIN8 has used dsquery and other Active Directory utilities to enumerate hosts; they have also used nltest.exe /dclist to retrieve a list of domain controllers.
Technique: T1018: Remote System Discovery
Brute forcing credentials may take place at various points during a breach.
Technique: T1110: Brute Force
Non-standard data encoding schemes may be based on or related to standard data encoding schemes, such as a modified Base64 encoding for the message body of an HTTP request.
Technique: T1132: Data Encoding
Siloscape is executed after the attacker gains initial access to a Windows container using a known vulnerability.
Technique: T1190: Exploit Public-Facing Application
Finally, Reaver.v2 will execute the ‘~Update.lnk’ file in a new process, thus loading the recently dropped malicious CPL file
Technique: T1547: Boot or Logon Autostart Execution
Malefactors used watering hole attacks to compromise legitimate and trusted websites frequently visited by their targets
Technique: T1189: Drive-by Compromise
4H RAT has the capability to obtain a listing of running processes .
Technique: T1057: Process Discovery
KillDisk overwrites the first sector of the Master Boot Record with “0x00”.
Technique: T1561: Disk Wipe
APT29 has bypassed MFA set on OWA accounts by generating a cookie value from a previously stolen secret key.
Technique: T1606: Forge Web Credentials
Mitigation Security and system/IT administrators must practice due diligence in protecting their websites and web-based applications from threats that can undermine their security, and hijack them to do the bad guys’ bidding—delivering malware to their victims
Technique: T1518: Software Discovery
The “VPN Client” is a legitimate Juniper VPN software bundled with Helminth,  a malware in use by the OilRig threat agnet: JuniperSetupClientInstaller.exe 6a65d762fb548d2dc56cfde4842a4d3c (VirusTotal link) If the victim downloads and installs the file, their computer would get infected, while the legitimate VPN software is installed
Technique: T1036: Masquerading
UNC2452 used WMI for the remote execution of files for lateral movement.
Technique: T1047: Windows Management Instrumentation
Bankshot leverages a known zero-day vulnerability in Adobe Flash to execute the implant into the victims’ machines.
Technique: T1203: Exploitation for Client Execution
Nebulae has the ability to use CreateProcess to execute a process.
Technique: T1106: Native API
Zebrocy identifies network drives when they are added to victim systems.
Technique: T1135: Network Share Discovery
Adversaries may add login items to execute upon user login to gain persistence or escalate privileges.
Technique: T1547: Boot or Logon Autostart Execution
Since macOS Catalina 10.15, kernel extensions have been deprecated on macOS systems.
Technique: T1547: Boot or Logon Autostart Execution
Metamorfo can enumerate all windows on the victim’s machine.
Technique: T1010: Application Window Discovery
Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.
Technique: T1574: Hijack Execution Flow
Depending on how the infrastructure is provisioned, this could provide persistent access if the infrastructure provisioning tool is instructed to always use the latest image.
Technique: T1525: Implant Internal Image
xCaon has used Base64 to encode its C2 traffic.
Technique: T1132: Data Encoding
Second, the threat actors exploit CVE-2017-8570 to achieve code execution via a malicious “scriptlet” file, or .sct file, which is also embedded in the malicious RTF document
Technique: T1203: Exploitation for Client Execution
For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel.
Technique: T1218: Signed Binary Proxy Execution
MuddyWater has exploited the Office vulnerability CVE-2017-0199 for execution.
Technique: T1203: Exploitation for Client Execution
Adversaries may also fragment files across the existing file system structure in non-standard ways.
Technique: T1564: Hide Artifacts
For example, with a cloud-based email service once an OAuth access token is granted to a malicious application, it can potentially gain long-term access to features of the user account if a "refresh" token enabling background access is awarded.
Technique: T1550: Use Alternate Authentication Material
Security tools may make dynamic changes to system components in order to maintain visibility into specific events.
Technique: T1562: Impair Defenses
KGH_SPY can collect information on installed applications.
Technique: T1518: Software Discovery
TA551 has used regsvr32.exe to load malicious DLLs.
Technique: T1218: Signed Binary Proxy Execution
Wizard Spider has gained access to credentials via exported copies of the ntds.dit Active Directory database.
Technique: T1003: OS Credential Dumping
REvil can download a copy of itself from an attacker controlled IP address to the victim machine.
Technique: T1105: Ingress Tool Transfer
These applications are often websites, but can include databases , standard services  or SSH, network device administration and management protocols , and any other applications with Internet accessible open sockets, such as web servers and related services.
Technique: T1190: Exploit Public-Facing Application
When a Windows system attempts to connect to an SMB resource it will automatically attempt to authenticate and send credential information for the current user to the remote system.
Technique: T1187: Forced Authentication
The username appears to be attacker specified and has occurred in 2017 Bankshot samples
Technique: T1033: System Owner/User Discovery
RDFSNIFFER hooks several Win32 API functions to hijack elements of the remote system management user-interface.
Technique: T1056: Input Capture
CoinTicker initially downloads a hidden encoded file.
Technique: T1027: Obfuscated Files or Information
Adversaries may partially or completely overwrite the contents of a storage device rendering the data irrecoverable through the storage interface.
Technique: T1561: Disk Wipe
APT37 uses steganography to send images to users that are embedded with shellcode.
Technique: T1027: Obfuscated Files or Information
Bisonal's dropper creates VBS scripts on the victim’s machine.
Technique: T1059: Command and Scripting Interpreter
Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials.
Technique: T1021: Remote Services
Pseudo-HTTP Protocol Messages for the pseudo-HTTP protocol are delimited with the ‘|’ character
Technique: T1071: Application Layer Protocol
WINDSHIELD can gather the victim user name.
Technique: T1033: System Owner/User Discovery
APT28 has stored captured credential information in a file named pi.log.
Technique: T1074: Data Staged
Hijacking SIP or trust provider components can also enable persistent code execution, since these malicious components may be invoked by any application that performs code signing or signature validation.
Technique: T1553: Subvert Trust Controls
Sykipot may use netstat -ano to display active network connections.
Technique: T1049: System Network Connections Discovery
Hydraq C2 traffic is encrypted using bitwise NOT and XOR operations.
Technique: T1573: Encrypted Channel
FIN7 has used TightVNC to control compromised hosts.
Technique: T1021: Remote Services
Created email accounts can also be used in the acquisition of infrastructure .
Technique: T1585: Establish Accounts
Windows API functions such as GetLocaleInfoW can also be used to determine the locale of the host.
Technique: T1614: System Location Discovery
FYAnti can download additional payloads to a compromised host.
Technique: T1105: Ingress Tool Transfer
RawPOS encodes credit card data it collected from the victim with XOR.
Technique: T1560: Archive Collected Data
Unix shells are the primary command prompt on Linux and macOS systems, though many variations of the Unix shell exist  depending on the specific OS or distribution.
Technique: T1059: Command and Scripting Interpreter
Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Technique: T1105: Ingress Tool Transfer
Gazer can execute a task to download a file.
Technique: T1105: Ingress Tool Transfer
Adversaries may abuse Compiled HTML files  to conceal malicious code.
Technique: T1218: Signed Binary Proxy Execution
This is now a deprecated mechanism in macOS in favor of Launchd.
Technique: T1037: Boot or Logon Initialization Scripts
TeamTNT has deployed XMRig Docker images to mine cryptocurrency.
Technique: T1496: Resource Hijacking
Go2Assist 
Technique: T1219: Remote Access Software
VERMIN saves each collected file with the automatically generated format {0:dd-MM-yyyy}.txt .
Technique: T1119: Automated Collection
Operation Wocao has used stolen credentials to connect to the victim's network via VPN.
Technique: T1133: External Remote Services
A variant of Elise executes dir C:\progra~1 when initially run.
Technique: T1083: File and Directory Discovery
Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.
Technique: T1090: Proxy
The ARP protocol is used to resolve IPv4 addresses to link layer addresses, such as a media access control  address.
Technique: T1557: Adversary-in-the-Middle
With both an inserted card and access to the smart card password, an adversary can connect to a network resource using the infected system to proxy the authentication with the inserted hardware token.
Technique: T1111: Two-Factor Authentication Interception
Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites.
Technique: T1584: Compromise Infrastructure
Windows contains accessibility features that may be launched with a key combination before a user has logged in .
Technique: T1546: Event Triggered Execution
tasklist 
Technique: T1057: Process Discovery
Power Loader overwrites Explorer’s Shell_TrayWnd extra window memory to redirect execution to a NTDLL function that is abused to assemble and execute a return-oriented programming  chain and create a malicious thread within Explorer.exe.
Technique: T1055: Process Injection
These scans can also be performed in various ways, including using native features of network protocols such as ICMP.
Technique: T1595: Active Scanning
Carbon creates several tasks for later execution to continue persistence on the victim’s machine.
Technique: T1053: Scheduled Task/Job
Janicab used a cron job for persistence on Mac devices.
Technique: T1053: Scheduled Task/Job
APT32 established persistence using Registry Run keys, both to execute PowerShell and VBS scripts as well as to execute their backdoor directly.
Technique: T1547: Boot or Logon Autostart Execution
The actors also searched for documents based on a specific date range and attempted to identify all installed software on a victim.
Technique: T1083: File and Directory Discovery
RTM has resolved Pony C2 server IP addresses by either converting Bitcoin blockchain transaction data to specific octets, or accessing IP addresses directly within the Namecoin blockchain.
Technique: T1568: Dynamic Resolution
Babuk can enumerate disk volumes, get disk information, and query service status.
Technique: T1082: System Information Discovery
* User accounts start with a RID of 1,000+.
Technique: T1003: OS Credential Dumping
Bazar can send C2 communications with XOR encryption.
Technique: T1573: Encrypted Channel
An example of this is use of Rundll32 to load a specifically crafted DLL which loads an auto-elevated Component Object Model object and performs a file operation in a protected directory which would typically require elevated access.
Technique: T1548: Abuse Elevation Control Mechanism
FIN6 has used scheduled tasks to establish persistence for various malware it uses, including downloaders known as HARDTACK and SHIPBREAD and FrameworkPOS.
Technique: T1053: Scheduled Task/Job
It can also steal tokens to acquire administrative privileges.
Technique: T1134: Access Token Manipulation
Adversaries have used systemd functionality to establish persistent access to victim systems by creating and/or modifying service unit files that cause systemd to execute malicious commands at system boot.
Technique: T1543: Create or Modify System Process
Adversaries can use the autostart mechanism provided by LSA authentication packages for persistence by placing a reference to a binary in the Windows Registry location HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ with the key value of "Authentication Packages"=&lt;target binary&gt;.
Technique: T1547: Boot or Logon Autostart Execution
QakBot has spread through emails with malicious attachments.
Technique: T1566: Phishing
Similar to debuggers, silent exit monitoring can be enabled through GFlags and/or by directly modifying IFEO and silent process exit Registry values in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\.
Technique: T1546: Event Triggered Execution
Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Technique: T1566: Phishing
The public IP is then POSTed along with OS Version, Internal IP, Machine Name, Domain Name, UserName after being encrypted to the previously chosen URL to register a new victim
Technique: T1016: System Network Configuration Discovery
File is dropped to C:\Users\%USERNAME%\AppData\Roaming\Microsoft Network\microsoft_network\1.0.0.0\microsoft_network.exe
Technique: T1033: System Owner/User Discovery
This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally.
Technique: T1547: Boot or Logon Autostart Execution
Derusbi is capable of logging keystrokes.
Technique: T1056: Input Capture
Web shells are heavily relied on for nearly all stages of the attack lifecycle
Technique: T1505: Server Software Component
Dridex can use multiple layers of proxy servers to hide terminal nodes in its infrastructure.
Technique: T1090: Proxy
PoisonIvy creates a backdoor through which remote attackers can steal system information.
Technique: T1005: Data from Local System
Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle.
Technique: T1588: Obtain Capabilities
RTM can obtain the victim username and permissions.
Technique: T1033: System Owner/User Discovery
Phishing can be targeted, known as spearphishing.
Technique: T1566: Phishing
Bankshot grabs a user token using WTSQueryUserToken and then creates a process by impersonating a logged-on user.
Technique: T1134: Access Token Manipulation
Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution.
Technique: T1574: Hijack Execution Flow
Adversaries may gather email addresses that can be used during targeting.
Technique: T1589: Gather Victim Identity Information
Avaddon has used the Windows Crypto API to generate an AES key.
Technique: T1106: Native API
OilRig has tested malware samples to determine AV detection and subsequently modified the samples to ensure AV evasion.
Technique: T1027: Obfuscated Files or Information
The White Company has performed anti-analysis checks to determine if its malware was in a debugging environment.
Technique: T1497: Virtualization/Sandbox Evasion
Hijacking a COM object requires a change in the Registry to replace a reference to a legitimate system component which may cause that component to not work when executed.
Technique: T1546: Event Triggered Execution
Fysbis has masqueraded as the rsyncd and dbus-inotifier services.
Technique: T1036: Masquerading
SHUTTERSPEED can capture screenshots.
Technique: T1113: Screen Capture
Carbanak performs desktop video recording and captures screenshots of the desktop and sends it to the C2 server.
Technique: T1113: Screen Capture