HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
Since it is signed and native on Windows systems, msiexec.exe can be used to bypass application control solutions that do not account for its potential abuse.
Technique: T1218: Signed Binary Proxy Execution
A print processor can be installed through the AddPrintProcessor API call with an account that has SeLoadDriverPrivilege enabled.
Technique: T1547: Boot or Logon Autostart Execution
ZxShell can launch port scans.
Technique: T1046: Network Service Scanning
The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password.
Technique: T1021: Remote Services
PipeMon can decrypt password-protected executables.
Technique: T1140: Deobfuscate/Decode Files or Information
Depending on the technique for gathering target-specific values, reverse engineering of the encrypted payload can be exceptionally difficult.
Technique: T1480: Execution Guardrails
If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate securely with its owner.
Technique: T1608: Stage Capabilities
<?XML version=”1.0″?> <scriptlet> <registration description=”fjzmpcjvqp” progid=”fjzmpcjvqp” version=”1.00″ classid=”{204774CF-D251-4F02-855B-2BE70585184B}” remotable=”true” > </registration> <script language=”JScript”> <![CDATA[ var r = new ActiveXObject(“WScript.Shell”).Run(“cmd /c %tmp%\\qrat.exe”,0,false); exit(); ]]> </script> </scriptlet> After the initial dropper (qrat.exe) has been executed by the embedded scriptlet, it creates a directory in C:\Users\%username%\AppData\Roaming\Microsoft Network\microsoft_network\1.0.0.0 and unpacks/drops the final QuasarRAT binary named microsoft_network.exe
Technique: T1059: Command and Scripting Interpreter
Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block .
Technique: T1021: Remote Services
In the event of sandbox detection, it would delete itself by overwriting the malware scripts with the contents of "License.txt" and exiting.
Technique: T1497: Virtualization/Sandbox Evasion
APT3 will copy files over to Windows Admin Shares  as part of lateral movement.
Technique: T1021: Remote Services
Figure 2: AuditCred/ROptimizer Service If successfully installed, this particular backdoor poses quite a threat to its target
Technique: T1543: Create or Modify System Process
Once the .msc file is saved, adversaries may invoke the malicious CLSID payload with the following command: mmc.exe -Embedding C:\path\to\test.msc.
Technique: T1218: Signed Binary Proxy Execution
OilRig has used PowerShell scripts for execution, including use of a macro to run a PowerShell command to decode file contents.
Technique: T1059: Command and Scripting Interpreter
Emotet has used WMI to execute powershell.exe.
Technique: T1047: Windows Management Instrumentation
These parameters install it as a service
Technique: T1543: Create or Modify System Process
Figure 1 Side-by-side of the lure images within ThreeDollars in the October 2017 and the January 2018 attacks   Superficially, we can immediately see the images are quite similar, but with some glaring differences
Technique: T1574: Hijack Execution Flow
Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs.
Technique: T1546: Event Triggered Execution
BRONZE BUTLER typically use ping and Net to enumerate systems.
Technique: T1018: Remote System Discovery
In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution.
Technique: T1566: Phishing
Sandworm Team has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.
Technique: T1204: User Execution
Catchamas steals data stored in the clipboard.
Technique: T1115: Clipboard Data
Avaddon checks for specific keyboard layouts and OS languages to avoid targeting Commonwealth of Independent States  entities.
Technique: T1614: System Location Discovery
NanHaiShu executes additional VBScript code on the victim's machine.
Technique: T1059: Command and Scripting Interpreter
Other variants have set the following Registry keys for persistence: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\imejp : self and HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IAStorD.
Technique: T1547: Boot or Logon Autostart Execution
The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands.
Technique: T1027: Obfuscated Files or Information
Dtrack has used cmd.exe to add a persistent service.
Technique: T1059: Command and Scripting Interpreter
Orz can gather a process list from the victim.
Technique: T1057: Process Discovery
Egregor has used DLL side-loading to execute its payload.
Technique: T1574: Hijack Execution Flow
LockerGoga has been signed with stolen certificates in order to make it look more legitimate.
Technique: T1553: Subvert Trust Controls
Shortcuts or symbolic links are ways of referencing other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.
Technique: T1547: Boot or Logon Autostart Execution
Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.
Technique: T1584: Compromise Infrastructure
Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including :
* Staging web resources necessary to conduct Drive-by Compromise when a user browses to a site.
Technique: T1608: Stage Capabilities
Users may be subjected to social engineering to get them to click on a link that will lead to code execution.
Technique: T1204: User Execution
Malware features Remexi boasts features that allow it to gather keystrokes, take screenshots of windows of interest (as defined in its configuration), steal credentials, logons and the browser history, and execute remote commands
Technique: T1113: Screen Capture
PoetRAT has executed a Lua script through a Lua interpreter for Windows.
Technique: T1059: Command and Scripting Interpreter
ShellExecute
Technique: T1106: Native API
BUGJUICE defaults to TCP using a custom binary protocol to communicate with the C2, but can also use HTTP and HTTPs if directed by the C2
Technique: T1071: Application Layer Protocol
SUNBURST collected a list of service names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.
Technique: T1007: System Service Discovery
The adversary may then perform actions as the logged-on user.
Technique: T1021: Remote Services
TrickBot has come with a signed downloader component.
Technique: T1553: Subvert Trust Controls
Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence.
Technique: T1578: Modify Cloud Compute Infrastructure
CoinTicker creates user launch agents named .espl.plist and com.apple.random string.plist to establish persistence.
Technique: T1543: Create or Modify System Process
BabyShark has a PowerShell-based remote administration ability that can implement a PowerShell or C# based keylogger.
Technique: T1056: Input Capture
Trojan.Mebromi performs BIOS modification and can download and execute a file as well as protect itself from removal.
Technique: T1542: Pre-OS Boot
Kobalos can chain together multiple compromised machines as proxies to reach their final targets.
Technique: T1090: Proxy
Msiexec.exe is digitally signed by Microsoft.
Technique: T1218: Signed Binary Proxy Execution
Rocke has executed wget and curl commands to Pastebin over the HTTPS protocol.
Technique: T1071: Application Layer Protocol
Matryoshka can establish persistence by adding Registry Run keys.
Technique: T1547: Boot or Logon Autostart Execution
Penquin can execute the command code do_download to retrieve remote files from C2.
Technique: T1105: Ingress Tool Transfer
Trojan.Karagany can create a link to itself in the Startup folder to automatically start itself upon system restart.
Technique: T1547: Boot or Logon Autostart Execution
Dok uses AppleScript to create a login item for persistence.
Technique: T1059: Command and Scripting Interpreter
MuddyWater has performed credential dumping with LaZagne.
Technique: T1003: OS Credential Dumping
The bootkit shares code with some variants of BlackEnergy.
Technique: T1542: Pre-OS Boot
Cobalt Group has sent emails containing malicious links that require users to execute a file or macro to infect the victim machine.
Technique: T1204: User Execution
Lazarus Group malware deletes files in various ways, including "suicide scripts" to delete malware binaries from the victim.
Technique: T1070: Indicator Removal on Host
Versions of OSX/Shlayer pass encrypted and password-protected code to openssl and then write the payload to the /tmp folder.
Technique: T1140: Deobfuscate/Decode Files or Information
The rest of MirageFox functions similarly to previous malware created by APT15, first collecting information about the computer like the username, CPU information, architecture, and so forth
Technique: T1082: System Information Discovery
SEASHARPEE can download remote files onto victims.
Technique: T1105: Ingress Tool Transfer
Lucifer can check for specific usernames, computer names, device drivers, DLL's, and virtual devices associated with sandboxed environments and can enter an infinite loop and stop itself if any are detected.
Technique: T1497: Virtualization/Sandbox Evasion
RTM has used Registry run keys to establish persistence for the RTM Trojan and other tools, such as a modified version of TeamViewer remote desktop software.
Technique: T1547: Boot or Logon Autostart Execution
Cobalt Group has obtained and used a variety of tools including Mimikatz, PsExec, Cobalt Strike, and SDelete.
Technique: T1588: Obtain Capabilities
Socksbot can write and execute PowerShell scripts.
Technique: T1059: Command and Scripting Interpreter
Volgmer can delete files and itself after infection to avoid analysis.
Technique: T1070: Indicator Removal on Host
APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices.
Technique: T1120: Peripheral Device Discovery
Misdat network traffic is Base64-encoded plaintext.
Technique: T1132: Data Encoding
Valak has the ability save and execute files as alternate data streams .
Technique: T1564: Hide Artifacts
SMOKEDHAM has used Google Drive and Dropbox to host files downloaded by victims via malicious links.
Technique: T1102: Web Service
TeamTNT has disabled iptables.
Technique: T1562: Impair Defenses
APT32 performed network scanning on the network to search for open ports, services, OS finger-printing, and other vulnerabilities.
Technique: T1046: Network Service Scanning
PolyglotDuke can retrieve payloads from the C2 server.
Technique: T1105: Ingress Tool Transfer
DEATHRANSOM has the ability to use loop operations to enumerate network resources.
Technique: T1135: Network Share Discovery
The RIPTIDE exploit document drops its executable file into the C:\Documents and Settings\{user}\Application Data\Location folder while the HIGHTIDE exploit document drops its executable file into the C:\DOCUMENTS and SETTINGS\{user}\LOCAL SETTINGS\Temp\ folder
Technique: T1533: nan
APT3 has a tool that looks for files and directories on the local file system.
Technique: T1083: File and Directory Discovery
Silence has used Windows command-line to run commands.
Technique: T1059: Command and Scripting Interpreter
Therefore, compromise of the token can grant the adversary access to resources of other sites through a malicious application.
Technique: T1550: Use Alternate Authentication Material
Mustang Panda has sent malicious links directing victims to a Google Drive folder.
Technique: T1204: User Execution
FIN8 harvests credentials using Invoke-Mimikatz or Windows Credentials Editor .
Technique: T1003: OS Credential Dumping
APT28 has obtained and used open-source tools like Koadic, Mimikatz, and Responder.
Technique: T1588: Obtain Capabilities
This spawns the hidden embedded malicious LNK file in the document
Technique: T1547: Boot or Logon Autostart Execution
The main function gets pertinent strings to communicate with its C2 by calling a sub-function with a specific number that the sub-function uses as a case within a switch statement to decrypt the desired string
Technique: T1140: Deobfuscate/Decode Files or Information
Rising Sun has used HTTP for command and control.
Technique: T1071: Application Layer Protocol
FIN7 has harvested valid administrative credentials for lateral movement.
Technique: T1078: Valid Accounts
sc query
Technique: T1007: System Service Discovery
pbpaste 
Technique: T1115: Clipboard Data
While use of Virtualization/Sandbox Evasion may involve checking for known sandbox values and continuing with execution only if there is no match, the use of environmental keying will involve checking for an expected target-specific value that must match for decryption and subsequent execution to be successful.
Technique: T1480: Execution Guardrails
APT32 has used hidden or non-printing characters to help masquerade service names, such as appending a Unicode no-break space character to a legitimate service name.
Technique: T1036: Masquerading
starts a rootkit from a malicious file dropped to disk.
Technique: T1014: Rootkit
Malicious AppInit DLLs may also provide persistence by continuously being triggered by API activity.
Technique: T1546: Event Triggered Execution
OilRig has used various types of scripting for execution.
Technique: T1059: Command and Scripting Interpreter
In at least some of these recent attacks, Buckeye used spear-phishing emails with a malicious .zip attachment
Technique: T1566: Phishing
Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.
Technique: T1546: Event Triggered Execution
SpeakUp can perform brute forcing using a pre-defined list of usernames and passwords in an attempt to log in to administrative panels.
Technique: T1110: Brute Force
Sibot has queried the registry for proxy server information.
Technique: T1012: Query Registry
Additionally, adversaries may use auditpol and its sub-commands in a command prompt to disable auditing or clear the audit policy.
Technique: T1562: Impair Defenses
BlackEnergy has searched for given file types.
Technique: T1083: File and Directory Discovery
An adversary who gains access to a system that is part of a cloud-based environment may map out Virtual Private Clouds or Virtual Networks in order to determine what systems and services are connected.
Technique: T1049: System Network Connections Discovery
TeamTNT has the curl command to send credentials over HTTP and download new software.
Technique: T1071: Application Layer Protocol
Adversaries could use shortcuts to execute their tools for persistence.
Technique: T1547: Boot or Logon Autostart Execution
Equation is known to have the capability to overwrite the firmware on hard drives from some manufacturers.
Technique: T1542: Pre-OS Boot
Ferocious Kitten has conducted spearphishing campaigns containing malicious documents to lure victims to open the attachments.
Technique: T1566: Phishing
Misdat is capable of deleting Registry keys used for persistence.
Technique: T1070: Indicator Removal on Host
KGH_SPY has the ability to set the HKCU\Environment\UserInitMprLogonScript Registry key to execute logon scripts.
Technique: T1037: Boot or Logon Initialization Scripts
Ramsay can collect Microsoft Word documents from the target's file system, as well as .txt, .doc, and .xls files from the Internet Explorer cache.
Technique: T1005: Data from Local System
Adversaries may also create or steal code signing certificates to acquire trust on target systems.
Technique: T1553: Subvert Trust Controls
Leviathan has utilized OLE as a method to insert malicious content inside various phishing documents.
Technique: T1559: Inter-Process Communication
Frankenstein has used spearphishing emails to send trojanized Microsoft Word documents.
Technique: T1566: Phishing
Cobalt Strike can conduct peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol.
Technique: T1071: Application Layer Protocol
GoldMax can spawn a command shell, and execute native commands.
Technique: T1059: Command and Scripting Interpreter
Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task.
Technique: T1205: Traffic Signaling
Additional bypass methods are regularly discovered and some used in the wild, such as:
* eventvwr.exe can auto-elevate and execute a specified binary or script.
Technique: T1548: Abuse Elevation Control Mechanism
Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers.
Technique: T1596: Search Open Technical Databases
APT-C-36 obtained and used a modified variant of Imminent Monitor.
Technique: T1588: Obtain Capabilities
Kimsuky has obtained and used tools such as Mimikatz and PsExec.
Technique: T1588: Obtain Capabilities
Taidoor can use a stream cipher to decrypt stings used by the malware.
Technique: T1140: Deobfuscate/Decode Files or Information
LiteDuke has the ability to check for the presence of Kaspersky security software.
Technique: T1518: Software Discovery
Deep Panda uses net.exe to connect to network shares using net use commands with compromised credentials.
Technique: T1021: Remote Services
Network protocols that use asymmetric encryption  often utilize symmetric encryption once keys are exchanged.
Technique: T1048: Exfiltration Over Alternative Protocol
BADFLICK has download files from its C2 server.
Technique: T1105: Ingress Tool Transfer
EVILNUM has used the malware variant, TerraTV, to run a legitimate TeamViewer application to connect to compromrised machines.
Technique: T1219: Remote Access Software
4H RAT has the capability to obtain file and directory listings.
Technique: T1083: File and Directory Discovery
BadPatch attempts to detect if it is being run in a Virtual Machine  using a WMI query for disk drive name, BIOS, and motherboard information.
Technique: T1497: Virtualization/Sandbox Evasion
Grandoreiro has been spread via malicious links embedded in e-mails.
Technique: T1566: Phishing
Cyber threat groups’ access to the media organization’s networks could potentially provide the government advance warning on upcoming protests, information on pro-democracy group leaders, and insights needed to disrupt activity on the Internet, such as what occurred in mid-2014 when several websites were brought down in denial of service attacks.[8] Threat Actors Use Spear Phishing Written in Traditional Chinese Script in Attempted Intrusions In August 2015, the threat actors sent spear phishing emails to a number of Hong Kong-based media organizations, including newspapers, radio, and television
Technique: T1566: Phishing
Duqu was an early example of malware that used steganography.
Technique: T1027: Obfuscated Files or Information
Windows Management Instrumentation WMI is an administrative framework that is built into every version of Windows since 2000
Technique: T1047: Windows Management Instrumentation
NETWIRE can issue commands using cmd.exe.
Technique: T1059: Command and Scripting Interpreter
WIRTE has used PowerShell for script execution.
Technique: T1059: Command and Scripting Interpreter
Microphone, Voice IP applications
Technique: T1123: Audio Capture
The group has also sent spearphishing emails that contained malicious Microsoft Office documents that use the “attachedTemplate” technique to load a template from a remote server.
Technique: T1566: Phishing
TajMahal has the ability to steal data from the clipboard of an infected host.
Technique: T1115: Clipboard Data
DropBook can communicate with its operators by exploiting the Simplenote, DropBox, and the social media platform, Facebook, where it can create fake accounts to control the backdoor and receive instructions.
Technique: T1102: Web Service
InvisiMole can sort and collect specific documents as well as generate a list of all files on a newly inserted drive and store them in an encrypted file.
Technique: T1119: Automated Collection
Honeybee uses a dropper called MaoCheng that harvests a stolen digital signature from Adobe Systems.
Technique: T1553: Subvert Trust Controls
Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials.
Technique: T1552: Unsecured Credentials
SLOTHFULMEDIA has collected system name, OS version, adapter information, memory usage, and disk information from a victim machine.
Technique: T1082: System Information Discovery
Windigo has used a script to detect which Linux distribution and version is currently installed on the system.
Technique: T1082: System Information Discovery
On January 1, 2017, we observed this URL responding to the above HTTP request with the following data:powershell.exe -exec bypass -window hidden -noni -nop -encoded JABjAG8AbQBtAGEAbgBkACAAPQAgACcAVwB3AEIATwBBAEcAVQBBAGQAQQBBAHUAQQBGAE0AQQBaAFEAQgB5AEEASABZAEEAYQBRAEIAagBBAEcAVQBBAFUAQQBCAHYAQQBHAGsAQQBiAGcAQgAwAEEARQAwAEEAWQBRAEIAdQBBAEcARQBBAFoAdwBCAGwAQQBIAEkAQQBYAFEAQQA2AEEARABvAEEAVQB3AEIAbABBAEgASQBBAGQAZwBCAGwAQQBIAEkAQQBRAHcAQgBsAEEASABJAEEAZABBAEIAcABBAEcAWQBBAGEAUQBCAGoAQQBHAEUAQQBkAEEAQgBsAEEARgBZAEEAWQBRAEIAcwBBAEcAawBBAFoAQQBCAGgAQQBIAF..snip..As you can see, the C2 server responds with a PowerShell command that will run on the system
Technique: T1546: Event Triggered Execution
Adversaries may use malicious code previously implanted in the boot loader, such as through the ROMMONkit method, to directly manipulate running operating system code in memory.
Technique: T1601: Modify System Image
Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time.
Technique: T1053: Scheduled Task/Job
Ramsay can use UACMe for privilege escalation.
Technique: T1548: Abuse Elevation Control Mechanism
Adversaries may use a hidden file system to conceal malicious activity from users and security tools.
Technique: T1564: Hide Artifacts
Access may also be gained through an exposed service that doesn’t require authentication.
Technique: T1133: External Remote Services
These devices could include the motherboard, hard drive, or video cards.
Technique: T1495: Firmware Corruption
IndigoZebra has compromised legitimate email accounts to use in their spearphishing operations.
Technique: T1586: Compromise Accounts
It is a preferred platform within data centers and the cloud for businesses, as well as an ongoing favorite when it comes to a majority of Internet-facing web and application servers
Technique: T1505: Server Software Component
Stealth Falcon malware creates a scheduled task entitled “IE Web Cache” to execute a malicious file hourly.
Technique: T1053: Scheduled Task/Job
By pointing to a maliciously-crafted DLL with an exported function that always returns a known good signature value  rather than the file’s real signature, an adversary can apply an acceptable signature value to all files using that SIP  .
Technique: T1553: Subvert Trust Controls
Ryuk has used the Windows command line to create a Registry entry under HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
Since these applications may be routinely executed by the user, the adversary can leverage this for persistent access to the host.
Technique: T1554: Compromise Client Software Binary
Valak has used regsvr32.exe to launch malicious DLLs.
Technique: T1218: Signed Binary Proxy Execution
AppleSeed has the ability to execute its payload via PowerShell.
Technique: T1059: Command and Scripting Interpreter
This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions.
Technique: T1069: Permission Groups Discovery
Rather than creating and cultivating social media profiles  Social Media Accounts, adversaries may compromise existing social media accounts.
Technique: T1586: Compromise Accounts
Character  Description  0  File contains batch commands, it executes the batch commands  1  Rename the temporary file as .ps1 extension  2  Rename the temporary file as .vbs extension   Table 2: BONDUPDATER Actions Figure 8 is a screenshot of BONDUPDATER’s DGA implementation
Technique: T1059: Command and Scripting Interpreter
Tropic Trooper's backdoor could list the infected system's installed software.
Technique: T1518: Software Discovery
Ke3chang has obtained and used tools such as Mimikatz.
Technique: T1588: Obtain Capabilities
APT41 used a compromised account to create a scheduled task on a system.
Technique: T1053: Scheduled Task/Job
Typosquatting may be used to aid in delivery of payloads via Drive-by Compromise.
Technique: T1583: Acquire Infrastructure
CORESHELL has established persistence by creating autostart extensibility point  Registry entries in the Run key and other Registry keys, as well as by creating shortcuts in the Internet Explorer Quick Start folder.
Technique: T1547: Boot or Logon Autostart Execution
The Dacls Mach-O binary has been disguised as a .nib file.
Technique: T1036: Masquerading
Sibot has installed a second-stage script in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot registry key.
Technique: T1112: Modify Registry
RDAT can deobfuscate the base64-encoded and AES-encrypted files downloaded from the C2 server.
Technique: T1140: Deobfuscate/Decode Files or Information
Some versions of CozyCar will check to ensure it is not being executed inside a virtual machine or a known malware analysis sandbox environment.
Technique: T1497: Virtualization/Sandbox Evasion
APT32 also encrypts the library used for network exfiltration with AES-256 in CBC mode in their macOS backdoor.
Technique: T1027: Obfuscated Files or Information
Adversaries may abuse Python commands and scripts for execution.
Technique: T1059: Command and Scripting Interpreter
CHOPSTICK encrypts C2 communications with RC4.
Technique: T1573: Encrypted Channel
BLINDINGCAN has obfuscated code using Base64 encoding.
Technique: T1027: Obfuscated Files or Information
IcedID has established persistence by creating a Registry run key.
Technique: T1547: Boot or Logon Autostart Execution
Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Technique: T1543: Create or Modify System Process
ComRAT can use email attachments for command and control.
Technique: T1071: Application Layer Protocol
Bundlore uses the mktemp utility to make unique file and directory names for payloads, such as TMP_DIR=`mktemp -d -t x. OSX/Shlayer uses the mktemp utility to make random and unique filenames for payloads, such as export tmpDir="$" or mktemp -t Installer.
Technique: T1564: Hide Artifacts
Some versions of UPPERCUT have used the hard-coded string “this is the encrypt key” for Blowfish encryption when communicating with a C2.
Technique: T1573: Encrypted Channel
Raindrop encrypted its payload using a simple XOR algorithm with a single-byte key.
Technique: T1027: Obfuscated Files or Information
LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets.
Technique: T1003: OS Credential Dumping
Carberp has used XOR-based encryption to mask C2 server locations within the trojan.
Technique: T1027: Obfuscated Files or Information
WastedLocker contains junk code to increase its entropy and hide the actual code.
Technique: T1027: Obfuscated Files or Information
Misdat is capable of downloading files from the C2.
Technique: T1105: Ingress Tool Transfer
This parameter transmits the agent_id to the C2 server to obtain commands the actor wishes to execute on the compromised system
Technique: T1059: Command and Scripting Interpreter
PLAINTEE has downloaded and executed additional plugins.
Technique: T1105: Ingress Tool Transfer
Freenki is used to gather information about the infected system and to download a subsequent stage payload
Technique: T1082: System Information Discovery
With a sufficient level of access, the net user /add /domain command can be used to create a domain account.
Technique: T1136: Create Account
Peppy can log keystrokes on compromised hosts.
Technique: T1056: Input Capture
APT1 has created email accounts for later use in social engineering, phishing, and when registering domains.
Technique: T1585: Establish Accounts
BADNEWS has a command to take a screenshot and send it to the C2 server.
Technique: T1113: Screen Capture
A second remote access tool  could be uploaded at that point to redirect the host to the second-stage command and control server.
Technique: T1104: Multi-Stage Channels
This activity may be used to collect and/or relay data such as credentials, especially those sent over an insecure, unencrypted protocol.
Technique: T1557: Adversary-in-the-Middle
MegaCortex has used rundll32.exe to load a DLL for file encryption.
Technique: T1218: Signed Binary Proxy Execution
Any application or user with write permissions to the file can change or strip the quarantine flag.
Technique: T1553: Subvert Trust Controls
The observation of the signal packets to trigger the communication can be conducted through different methods.
Technique: T1205: Traffic Signaling
Remexi decrypts the configuration data using XOR with 25-character keys.
Technique: T1140: Deobfuscate/Decode Files or Information
Wizard Spider has used scheduled tasks to install TrickBot, using task names to appear legitimate such as WinDotNet, GoogleTask, or Sysnetsf.
Technique: T1036: Masquerading
Adversaries may use hidden windows to conceal malicious activity from the plain sight of users.
Technique: T1564: Hide Artifacts
Honeybee's service-based DLL implant traverses the FTP server’s directories looking for files with keyword matches for computer names or certain keywords.
Technique: T1083: File and Directory Discovery
Derusbi uses a backup communication method with an HTTP beacon.
Technique: T1008: Fallback Channels
Adversaries may abuse this functionality to execute arbitrary files while potentially bypassing application control.
Technique: T1220: XSL Script Processing
SUPERNOVA was installed via exploitation of a SolarWinds Orion API authentication bypass vulnerability .
Technique: T1203: Exploitation for Client Execution
Looking at earlier attacks between 2013 and 2016, we believe Comnie was also used in targeted attacks against the following individuals or organizations:  Taiwan government IT service vendor in Asia Journalist of a Tibetan radio station   Figure 6 Email sent to Journalist of Tibetan radio station   Malicious Macros The malicious macro documents used to deliver Comnie initially hide the content inside and requests that the user enables macros prior to viewing the document
Technique: T1566: Phishing
Darkhotel has collected the hostname, OS version, service pack version, and the processor architecture from the victim’s machine.
Technique: T1082: System Information Discovery
Deep Panda has used regsvr32.exe to execute a server variant of Derusbi in victim networks.
Technique: T1218: Signed Binary Proxy Execution
Remsec has a plugin to detect active drivers of some security products.
Technique: T1518: Software Discovery
Stealth Falcon malware gathers the registered user and primary owner name via WMI.
Technique: T1033: System Owner/User Discovery
The at command within Linux operating systems enables administrators to schedule tasks.
Technique: T1053: Scheduled Task/Job
Some adversaries may also use Automated Collection on removable media.
Technique: T1025: Data from Removable Media
Members of the Administrators, Domain Admins, and Enterprise Admin groups or computer accounts on the domain controller are able to run DCSync to pull password data from Active Directory, which may include current and historical hashes of potentially useful accounts such as KRBTGT and Administrators.
Technique: T1003: OS Credential Dumping
Kobalos can remove all command history on compromised hosts.
Technique: T1070: Indicator Removal on Host
Adversaries may gather this information in various ways, such as querying or otherwise collecting details via DNS/Passive DNS.
Technique: T1590: Gather Victim Network Information
Word Normal.dotm location:<br>
C:\Users\&lt;username&gt;\AppData\Roaming\Microsoft\Templates\Normal.dotm
Excel Personal.xlsb location:<br>
C:\Users\&lt;username&gt;\AppData\Roaming\Microsoft\Excel\XLSTART\PERSONAL.XLSB
Adversaries may also change the location of the base template to point to their own by hijacking the application's search order, e.g.
Technique: T1137: Office Application Startup
TINYTYPHON has used XOR with 0x90 to obfuscate its configuration file.
Technique: T1027: Obfuscated Files or Information
Commercial software may be obtained through purchase, stealing licenses , or cracking trial versions.
Technique: T1588: Obtain Capabilities
Links may also lead users to download files that require execution via Malicious File.
Technique: T1204: User Execution
CPL files not exporting CPlApplet are not directly executable.
Technique: T1218: Signed Binary Proxy Execution
Tropic Trooper has detected a target system’s OS version.
Technique: T1082: System Information Discovery
Sibot will delete itself if a certain server response is received.
Technique: T1070: Indicator Removal on Host
Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.
Technique: T1539: Steal Web Session Cookie
Turla has used Metasploit to perform reflective DLL injection in order to escalate privileges.
Technique: T1055: Process Injection
This technique does not write any data to disk.
Technique: T1059: Command and Scripting Interpreter
InvisiMole can collect information about installed software used by specific users, software executed on user login, and software executed by each system.
Technique: T1518: Software Discovery
RunningRAT contains code to delete files from the victim’s machine.
Technique: T1070: Indicator Removal on Host
QakBot can move laterally using worm-like functionality through exploitation of SMB.
Technique: T1210: Exploitation of Remote Services
FIN10 has established persistence by using the Registry option in PowerShell Empire to add a Run key.
Technique: T1547: Boot or Logon Autostart Execution
Adversaries may use scripting to automate these checks  into one script and then have the program exit if it determines the system to be a virtual environment.
Technique: T1497: Virtualization/Sandbox Evasion
Proxysvc gathers product names from the Registry key: HKLM\Software\Microsoft\Windows NT\CurrentVersion ProductName and the processor description from the Registry key HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessorNameString.
Technique: T1012: Query Registry
RobbinHood deletes shadow copies to ensure that all the data cannot be restored easily.
Technique: T1490: Inhibit System Recovery
Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable.
Technique: T1578: Modify Cloud Compute Infrastructure
TinyZBot contains keylogger functionality.
Technique: T1056: Input Capture
A Threat Group-3390 tool can add the binary’s path to the Registry key Software\Microsoft\Windows\CurrentVersion\Run to add persistence.
Technique: T1547: Boot or Logon Autostart Execution
Stuxnet uses a Windows rootkit to mask its binaries and other relevant files.
Technique: T1014: Rootkit
BLINDINGCAN has executed commands via cmd.exe.
Technique: T1059: Command and Scripting Interpreter
APT32 modified Windows Services to ensure PowerShell scripts were loaded on the system.
Technique: T1543: Create or Modify System Process
Flame can use Windows Authentication Packages for persistence.
Technique: T1547: Boot or Logon Autostart Execution
Adversaries may abuse IPC to execute arbitrary code or commands.
Technique: T1559: Inter-Process Communication
USBferry can collect information from an air-gapped host machine.
Technique: T1005: Data from Local System
It can also change file permissions using cacls.exe.
Technique: T1083: File and Directory Discovery
KONNI is a RAT that is believed to have  been in use for over four years, with a wide array of functionalities, often leveraging free web hosting providers like 000webhost for its C2 infrastructure
Technique: T1571: Non-Standard Port
Strider has used local servers with both local network and Internet access to act as internal proxy nodes to exfiltrate data from other parts of the network without direct Internet access.
Technique: T1090: Proxy
The document also contained a lure image, similar to ones commonly found in malicious macro documents which ask the user to click on “Enable Content” as seen in Figure 2
Technique: T1204: User Execution
These policies allow administrators to set local accounts.
Technique: T1552: Unsecured Credentials
DustySky can compress files via RAR while staging data to be exfiltrated.
Technique: T1560: Archive Collected Data
PROMETHIUM has disguised malicious installer files by bundling them with legitimate software installers.
Technique: T1036: Masquerading
Elise is capable of launching a remote shell on the host to delete itself.
Technique: T1070: Indicator Removal on Host
Silent Librarian has cloned victim organization login pages and staged them for later use in credential harvesting campaigns.
Technique: T1608: Stage Capabilities
Microsoft’s Office Open XML  specification defines an XML-based format for Office documents  to replace older binary formats .
Technique: T1221: Template Injection
Avenger has the ability to identify installed anti-virus products on a compromised host.
Technique: T1518: Software Discovery
OSInfo discovers information about the infected machine.
Technique: T1082: System Information Discovery
FIVEHANDS can receive a command line argument to limit file encryption to specified directories.
Technique: T1059: Command and Scripting Interpreter
BitPaymer can search for network shares on the domain or workgroup using net view <host>.
Technique: T1135: Network Share Discovery
menuPass has leveraged vulnerabilities in Pulse Secure VPNs to hijack sessions.
Technique: T1190: Exploit Public-Facing Application
BoxCaon has searched for files on the system, such as documents located in the desktop folder.
Technique: T1083: File and Directory Discovery
An APT28 backdoor may collect the entire contents of an inserted USB device.
Technique: T1025: Data from Removable Media
menuPass has encoded strings in its malware with base64 as well as with a simple, single-byte XOR obfuscation using key 0x40.
Technique: T1027: Obfuscated Files or Information
Linfo creates a backdoor through which remote attackers can retrieve a list of running processes.
Technique: T1057: Process Discovery
Cobalt Strike's "beacon" payload is capable of running shell commands without cmd.exe and PowerShell commands without powershell.exe APT37 leverages the Windows API calls: VirtualAlloc, WriteProcessMemory, and CreateRemoteThread for process injection.
Technique: T1106: Native API
These mechanisms can also be abused to run a process under the context of a specified account .
Technique: T1053: Scheduled Task/Job
ShimRat can be issued a command shell function from the C2.
Technique: T1059: Command and Scripting Interpreter
Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, or DNS.
Technique: T1071: Application Layer Protocol
Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage.
Technique: T1619: Cloud Storage Object Discovery
Sidewinder has used PowerShell to drop and execute malware loaders.
Technique: T1059: Command and Scripting Interpreter
APT29 used UPX to pack files.
Technique: T1027: Obfuscated Files or Information
XCSSET saves a screen capture of the victim's system with a numbered filename and .jpg extension.
Technique: T1113: Screen Capture
APT29 obtained a list of users and their roles from an Exchange server using Get-ManagementRoleAssignment.
Technique: T1087: Account Discovery
Observed vulnerabilities include:  CVE-2012-0158  CVE-2017-0199  CVE-2017-8759  CVE-2017-11882       Figure 2: APT40 attack lifecycle  Establish Foothold APT40 uses a variety of malware and tools to establish a foothold, many of which are either publicly available or used by other threat groups
Technique: T1203: Exploitation for Client Execution
ZxShell can query the netsvc group value data located in the svchost group Registry key.
Technique: T1012: Query Registry
An adversary may gain administrative Azure AD privileges if a SAML token is forged which claims to represent a highly privileged account.
Technique: T1606: Forge Web Credentials
email with an embedded tracking link
Technique: T1566: Phishing
Hi-Zor encrypts C2 traffic with TLS.
Technique: T1573: Encrypted Channel
Adversaries have also leveraged the ~/.bashrc file which is additionally executed if the connection is established remotely or an additional interactive shell is opened, such as a new tab in the command-line interface.
Technique: T1546: Event Triggered Execution
Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive.
Technique: T1052: Exfiltration Over Physical Medium
A virtual machine is then called to run this code.
Technique: T1027: Obfuscated Files or Information
UNC2452 bypassed MFA set on OWA accounts by generating a cookie value from a previously stolen secret key.
Technique: T1606: Forge Web Credentials
Turian can insert pseudo-random characters into its network encryption setup.
Technique: T1001: Data Obfuscation
This differs from Steal Application Access Token and other similar behaviors in that the tokens are new and forged by the adversary, rather than stolen or intercepted from legitimate users.
Technique: T1606: Forge Web Credentials
More_eggs will decode malware components that are then dropped to the system.
Technique: T1140: Deobfuscate/Decode Files or Information
OSX/Shlayer can disable Gatekeeper using the native spctl application.
Technique: T1562: Impair Defenses
menuPass has registered malicious domains for use in intrusion campaigns.
Technique: T1583: Acquire Infrastructure
Honeybee uses a combination of NTWDBLIB.dll and cliconfg.exe to bypass UAC protections using DLL hijacking.
Technique: T1548: Abuse Elevation Control Mechanism
GoldenSpy has included a program "ExeProtector", which monitors for the existence of GoldenSpy on the infected system and redownloads if necessary.
Technique: T1083: File and Directory Discovery
CORESHELL obfuscates strings using a custom stream cipher.
Technique: T1027: Obfuscated Files or Information
The cab file was encrypted and decrypted using a simple xor cipher with a rotating 16 byte key: \x36\x11\xdd\x08\xac\x4b\x72\xf8\x51\x04\x68\x2e\x3e\x38\x64\x32
Technique: T1027: Obfuscated Files or Information
An APT19 HTTP malware variant establishes persistence by setting the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Debug Tools-%LOCALAPPDATA%\.
Technique: T1547: Boot or Logon Autostart Execution
Access to cloud accounts can also be abused to gain Initial Access to a network by abusing a Trusted Relationship.
Technique: T1078: Valid Accounts
Ramsay has base64-encoded its portable executable and hidden itself under a JPG header.
Technique: T1027: Obfuscated Files or Information
IP addresses may also enable an adversary to derive other details about a victim, such as organizational size, physical location, Internet service provider, and or where/how their publicly-facing infrastructure is hosted.
Technique: T1590: Gather Victim Network Information
BRONZE BUTLER has also used a tool called RarStar that encodes data with a custom XOR algorithm when posting it to a C2 server.
Technique: T1573: Encrypted Channel
Magic Hound malware can list running processes.
Technique: T1057: Process Discovery
Valak has used scheduled tasks to execute additional payloads and to gain persistence on a compromised host.
Technique: T1053: Scheduled Task/Job
There are two forms of encrypted strings: an RSA256-encrypted string, and custom base64-encoded and RSA256-encrypted string
Technique: T1027: Obfuscated Files or Information
The Netwalker DLL has been injected reflectively into the memory of a legitimate running process.
Technique: T1055: Process Injection
Gathering this information may reveal opportunities for other forms of reconnaissance  or Search Open Technical Databases, establishing operational resources  or Obtain Capabilities, and/or for initial access  or External Remote Services.
Technique: T1592: Gather Victim Host Information
Adversaries can also use NTLM hashes to access administrator shares on systems with Pass the Hash and certain configuration and patch levels.
Technique: T1021: Remote Services
During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control.
Technique: T1583: Acquire Infrastructure
Maze has communicated to hard-coded IP addresses via HTTP.
Technique: T1071: Application Layer Protocol
OopsIE compresses collected files with GZipStream before sending them to its C2 server.
Technique: T1560: Archive Collected Data
Zebrocy runs the ipconfig /all command.
Technique: T1016: System Network Configuration Discovery
Tropic Trooper has used JPG files with encrypted payloads to mask their backdoor routines and evade detection.
Technique: T1027: Obfuscated Files or Information
Both “%APPDATA%\\Microsoft\Windows\Cookies.txt” and “%APPDATA%\\Microsoft\Windows\Cookies.exe” are then deleted
Technique: T1070: Indicator Removal on Host
Cardinal RAT can collect the hostname, Microsoft Windows version, and processor architecture from a victim machine.
Technique: T1082: System Information Discovery
Silence has used PowerShell to download and execute payloads.
Technique: T1059: Command and Scripting Interpreter
Carbanak encrypts the message body of HTTP traffic with RC2 .
Technique: T1573: Encrypted Channel
BLINDINGCAN has sent user and system information to a C2 server via HTTP POST requests.
Technique: T1041: Exfiltration Over C2 Channel
Orz has used Technet and Pastebin web pages for command and control.
Technique: T1102: Web Service
HAWKBALL has used an OLE object that uses Equation Editor to drop the embedded shellcode.
Technique: T1559: Inter-Process Communication
net group 
Technique: T1087: Account Discovery
SoreFang can gain persistence through use of scheduled tasks.
Technique: T1053: Scheduled Task/Job
NotPetya encrypts user files and disk structures like the MBR with 2048-bit RSA.
Technique: T1486: Data Encrypted for Impact
MegaCortex can wipe deleted data from all drives using cipher.exe.
Technique: T1561: Disk Wipe
Orz can gather victim proxy information.
Technique: T1016: System Network Configuration Discovery
Once encrypted, the system information is sent in the body of an HTTP POST
Technique: T1486: Data Encrypted for Impact
DLL side loading has been used to maintain persistence on the compromised system
Technique: T1574: Hijack Execution Flow
A wide variety of infrastructure exists for hosting and orchestrating adversary operations.
Technique: T1583: Acquire Infrastructure
Carbanak installs VNC server software that executes through rundll32.
Technique: T1218: Signed Binary Proxy Execution
Cuba has used multiple layers of obfuscation to avoid analysis, including its Base64 encoded payload.
Technique: T1027: Obfuscated Files or Information
OwaAuth captures and DES-encrypts credentials before writing the username and password to a log file, C:\log.txt.
Technique: T1056: Input Capture
An account can hold additional SIDs in the SID-History Active Directory attribute , allowing inter-operable account migration between domains .
Technique: T1134: Access Token Manipulation
FIN6 has used encoded PowerShell commands.
Technique: T1027: Obfuscated Files or Information
Intrusions and campaigns conducted by this group are in-line with PRC goals and self-interest in Taiwan
Technique: T1059: Command and Scripting Interpreter
This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.
Technique: T1087: Account Discovery