HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
Grandoreiro can bypass UAC by registering as the default handler for .MSC files.
Technique: T1548: Abuse Elevation Control Mechanism
gh0st RAT has gathered system architecture, processor, OS configuration, and installed hardware information.
Technique: T1082: System Information Discovery
Analysis of the domains and IP address infrastructure used by APT15 identified a number of similar possible domains, shown at the bottom of the post
Technique: T1016: System Network Configuration Discovery
Chaes can capture screenshots of the infected machine.
Technique: T1113: Screen Capture
Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.
Technique: T1037: Boot or Logon Initialization Scripts
RTM can delete all files created during its execution.
Technique: T1070: Indicator Removal on Host
There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.
Technique: T1070: Indicator Removal on Host
On a macOS or Linux system, adversaries may query locale to retrieve the value of the $LANG environment variable.
Technique: T1614: System Location Discovery
Information about hardware infrastructure may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections .
Technique: T1592: Gather Victim Host Information
Rocke used scripts which detected and uninstalled antivirus software.
Technique: T1562: Impair Defenses
KillDisk deletes system files to make the OS unbootable.
Technique: T1485: Data Destruction
Cobalt Strike uses a custom command and control protocol that can be encapsulated in HTTP or HTTPS, or DNS.
Technique: T1071: Application Layer Protocol
Bad Rabbit has used Mimikatz to harvest credentials from the victim's machine.
Technique: T1003: OS Credential Dumping
Caterpillar WebShell has a module to collect information from the local database.
Technique: T1005: Data from Local System
Doki was run through a deployed container.
Technique: T1610: Deploy Container
The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Technique: T1124: System Time Discovery
Preauthentication offers protection against offline Password Cracking.
Technique: T1558: Steal or Forge Kerberos Tickets
DCOM 
Technique: T1021: Remote Services
However, an adversary may hijack the syscall interface code stubs mapped into a process from the vdso shared object to execute syscalls to open and map a malicious shared object.
Technique: T1055: Process Injection
T9000 gathers and beacons the operating system build number and CPU Architecture  during installation.
Technique: T1082: System Information Discovery
These accounts may be leveraged during other phases of the adversary lifecycle, such as during Initial Access .
Technique: T1585: Establish Accounts
chmod 
Technique: T1222: File and Directory Permissions Modification
Stealth Falcon malware encrypts C2 traffic using RC4 with a hard-coded key.
Technique: T1573: Encrypted Channel
Dragonfly 2.0 used VPNs and Outlook Web Access  to maintain access to victim networks.
Technique: T1133: External Remote Services
Object Linking and Embedding , or the ability to link data between documents, was originally implemented through DDE.
Technique: T1559: Inter-Process Communication
APT3 has lured victims into clicking malicious links delivered through spearphishing.
Technique: T1204: User Execution
Ke3chang has used network scanning and enumeration tools, including Ping.
Technique: T1018: Remote System Discovery
11 bytes of this buffer are encrypted with the XOR algorithm as follows: i = 0 while ( 1 ) {   crypted_buffer = (_BYTE *)this_->crypted_buffer;   if ( i gt;= this-gt;crypted_buffer_size - 4 ) // this-gt;crypted_buffer_size == 15     break;   ++i;   crypted_buffer[i + 4] ^= crypted_buffer[i & 3];  The generated buffer in encoded using the BASE64 alphabet, where the last two characters are replaced with “-” and “_”
Technique: T1027: Obfuscated Files or Information
Egregor has communicated with its C2 servers via HTTPS protocol.
Technique: T1071: Application Layer Protocol
Cuba can retrieve the ARP cache from the local system by using GetIpNetTable.
Technique: T1016: System Network Configuration Discovery
Ursnif droppers have used COM properties to execute malware in hidden windows.
Technique: T1564: Hide Artifacts
RTM samples have been signed with a code-signing certificates.
Technique: T1553: Subvert Trust Controls
Siloscape impersonates the main thread of CExecSvc.exe by calling NtImpersonateThread.
Technique: T1134: Access Token Manipulation
Leviathan has utilized techniques like reflective DLL loading to write a DLL into memory and load a shell that provides backdoor access to the victim.
Technique: T1055: Process Injection
Adversaries may encode data to make the content of command and control traffic more difficult to detect.
Technique: T1132: Data Encoding
This technique has also been shown to work by modifying legitimate programs present on the machine that make use of this API.
Technique: T1548: Abuse Elevation Control Mechanism
Chaes has used JavaScript and Node.Js information stealer script that exfiltrates data using the node process.
Technique: T1059: Command and Scripting Interpreter
Adversaries may target two-factor authentication mechanisms, such as smart cards, to gain access to credentials that can be used to access systems, services, and network resources.
Technique: T1111: Two-Factor Authentication Interception
MuddyWater has used the native Windows cabinet creation tool, makecab.exe, likely to compress stolen data to be uploaded.
Technique: T1560: Archive Collected Data
SodaMaster has the ability to query the Registry to detect a key specific to VMware.
Technique: T1012: Query Registry
Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network.
Technique: T1078: Valid Accounts
Night Dragon used pass-the-hash tools to gain usernames and passwords.
Technique: T1550: Use Alternate Authentication Material
Conti can delete Windows Volume Shadow Copies using vssadmin.
Technique: T1490: Inhibit System Recovery
Several Microsoft signed scripts that are default on Windows installations can be used to proxy execution of other files.
Technique: T1216: Signed Script Proxy Execution
It writes encrypted data to %APPDATA%\Intel\Skype.
Technique: T1123: Audio Capture
Malware used by Putter Panda attempts to terminate processes corresponding to two components of Sophos Anti-Virus .
Technique: T1562: Impair Defenses
A backdoor that communicates with a single command and control (C2) server using HTTP GET and POST requests, TONEDEAF supports collecting system information, uploading and downloading of files, and arbitrary shell command execution.
Technique: T1105: Ingress Tool Transfer
SpeakUp uses the arp -a command.
Technique: T1049: System Network Connections Discovery
Penquin will connect to C2 only after sniffing a "magic packet" value in TCP or UDP packets matching specific conditions.
Technique: T1205: Traffic Signaling
Exaramel for Windows has a command to launch a remote shell and executes commands on the victim’s machine.
Technique: T1059: Command and Scripting Interpreter
Exaramel for Linux can attempt to find a new C2 server if it receives an error.
Technique: T1008: Fallback Channels
DarkComet can steal data from the clipboard.
Technique: T1115: Clipboard Data
Variants of WEBC2 achieve persistence by using DLL search order hijacking, usually by copying the DLL file to %SYSTEMROOT% .
Technique: T1574: Hijack Execution Flow
When installers create subdirectories and files they often do not set appropriate permissions to restrict write access, which allows for execution of untrusted code placed in the subdirectories or overwriting of binaries used in the installation process.
Technique: T1574: Hijack Execution Flow
FIN8 has used WMI event subscriptions for persistence.
Technique: T1546: Event Triggered Execution
CosmicDuke searches for Microsoft Outlook data files with extensions .pst and .ost for collection and exfiltration.
Technique: T1114: Email Collection
Adversaries may modify component firmware to persist on systems.
Technique: T1542: Pre-OS Boot
The payload then calls the VirtualAllocEx API to create a buffer in the newly hollowed process and the WriteProcessMemory API to write the supplied data buffer that contains the code to inject to this newly created buffer
Technique: T1106: Native API
H1N1 obfuscates C2 traffic with an altered version of base64.
Technique: T1132: Data Encoding
For example, mmc C:\Users\foo\admintools.msc /a will open a custom, saved console msc file in author mode.
Technique: T1218: Signed Binary Proxy Execution
ProLock can use WMIC to execute scripts on targeted hosts.
Technique: T1047: Windows Management Instrumentation
Aria-body has the ability to duplicate a token from ntprint.exe.
Technique: T1134: Access Token Manipulation
Doki has downloaded scripts from C2.
Technique: T1105: Ingress Tool Transfer
Carberp can capture display screenshots with the screens_dll.dll plugin.
Technique: T1113: Screen Capture
Information about business roles may also be exposed to adversaries via online or other accessible data sets  or Search Victim-Owned Websites.
Technique: T1591: Gather Victim Org Information
Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program.
Technique: T1036: Masquerading
APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.
Technique: T1070: Indicator Removal on Host
Cardinal RAT injects into a newly spawned process created from a native Windows executable.
Technique: T1055: Process Injection
Lazarus Group malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.
Technique: T1098: Account Manipulation
This includes, but is not limited to, the following:  AES encryption of network communication File management Functionality to download, upload, and execute files Keylogging Remote desktop access Remote webcam viewing Reverse proxy Browser and FTP client password recovery  The images below are what a target user opening a malicious RTF document would see from within Microsoft Word
Technique: T1105: Ingress Tool Transfer
If it finds one, it will copy the token and store it for later use.
Technique: T1134: Access Token Manipulation
It has changed the proxy configuration of a victim system by modifying the HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap registry.
Technique: T1112: Modify Registry
StreamEx obfuscates some commands by using statically programmed fragments of strings when starting a DLL.
Technique: T1027: Obfuscated Files or Information
NETWIRE can automatically archive collected data.
Technique: T1119: Automated Collection
BADNEWS is capable of executing commands via cmd.exe.
Technique: T1059: Command and Scripting Interpreter
During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control .
Technique: T1583: Acquire Infrastructure
Gathering this information may reveal opportunities for other forms of reconnaissance  or Search Open Websites/Domains, establishing operational resources  or Obtain Capabilities, and/or initial access .
Technique: T1590: Gather Victim Network Information
Kerrdown can download additional software including Cobalt Strike from servers on the victim's network.
Technique: T1570: Lateral Tool Transfer
Explosive can scan all .exe files located in the USB drive.
Technique: T1025: Data from Removable Media
When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.
Technique: T1568: Dynamic Resolution
Adversaries may place a program in an earlier entry in the list of directories stored in the PATH environment variable, which Windows will then execute when it searches sequentially through that PATH listing in search of the binary that was called from a script or the command line.
Technique: T1574: Hijack Execution Flow
This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.
Technique: T1585: Establish Accounts
ProLock can use CVE-2019-0859 to escalate privileges on a compromised host.
Technique: T1068: Exploitation for Privilege Escalation
GreyEnergy is packed for obfuscation.
Technique: T1027: Obfuscated Files or Information
Kazuar can delete files.
Technique: T1070: Indicator Removal on Host
Kerberos TGS tickets are also known as service tickets.
Technique: T1558: Steal or Forge Kerberos Tickets
This forces the OS to search its state table for a related TCP connection that has already been established.
Technique: T1499: Endpoint Denial of Service
Code signing certificates may be used to bypass security policies that require signed code to execute on a system.
Technique: T1553: Subvert Trust Controls
Shamoon creates a new service named “ntssrv” to execute the payload.
Technique: T1569: System Services
Pysa has modified the registry key “SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System” and added the ransom note.
Technique: T1112: Modify Registry
NOKKI can collect the current timestamp of the victim's machine.
Technique: T1124: System Time Discovery
TA551 has used rundll32.exe to load malicious DLLs.
Technique: T1218: Signed Binary Proxy Execution
Gamaredon Group tools have registered Run keys in the registry to give malicious VBS files persistence.
Technique: T1547: Boot or Logon Autostart Execution
menuPass uses PowerSploit to inject shellcode into PowerShell.
Technique: T1059: Command and Scripting Interpreter
Cobalt Strike can query HKEY_CURRENT_USER\Software\Microsoft\Office\<Excel Version>\Excel\Security\AccessVBOM\  to determine if the security setting for restricting default programmatic access is enabled.
Technique: T1012: Query Registry
LiteDuke can use HTTP GET requests in C2 communications.
Technique: T1071: Application Layer Protocol
Sibot checked if the compromised system is configured to use proxies.
Technique: T1016: System Network Configuration Discovery
BLINDINGCAN has deleted itself and associated artifacts from victim machines.
Technique: T1070: Indicator Removal on Host
Kimsuky has used modified versions of open source PHP web shells to maintain access, often adding "Dinosaur" references within the code.
Technique: T1505: Server Software Component
Bad Rabbit has used various Windows API calls.
Technique: T1106: Native API
They have manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.
Technique: T1053: Scheduled Task/Job
Bisonal checks if the malware was executed within a VMware environment.
Technique: T1497: Virtualization/Sandbox Evasion
down_new has the ability to identify the MAC address of a compromised host.
Technique: T1016: System Network Configuration Discovery
Zeus Panda can uninstall scripts and delete files to cover its track.
Technique: T1070: Indicator Removal on Host
This tool was originally intended to aid defenders in simulating obfuscated PowerShell commands to better their defenses
Technique: T1027: Obfuscated Files or Information
Adversaries may install a Launch Daemon configured to execute at startup by using the RunAtLoad parameter set to true and the Program parameter set to the malicious executable path.
Technique: T1543: Create or Modify System Process
GALLIUM used Web shells and HTRAN for C2 and to exfiltrate data.
Technique: T1041: Exfiltration Over C2 Channel
An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.
Technique: T1546: Event Triggered Execution
Operators deploying Netwalker have used psexec to copy the Netwalker payload across accessible systems.
Technique: T1570: Lateral Tool Transfer
Adversaries may gather information about the victim's network security appliances that can be used during targeting.
Technique: T1590: Gather Victim Network Information
Adversaries may also directly modify the search order via DLL redirection, which after being enabled  may cause a program to load a different DLL.
Technique: T1574: Hijack Execution Flow
GoldFinder performed HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request traveled through.
Technique: T1016: System Network Configuration Discovery
Machete has a component to check for running processes to look for web browsers.
Technique: T1057: Process Discovery
Blue Mockingbird has used Windows Registry modifications to specify a DLL payload.
Technique: T1112: Modify Registry
HAWKBALL can collect the OS version, architecture information, and computer name.
Technique: T1082: System Information Discovery
WannaCry will attempt to determine the local network segment it is a part of.
Technique: T1016: System Network Configuration Discovery
Andariel has attempted to lure victims into enabling malicious macros within email attachments.
Technique: T1204: User Execution
Hydraq uses svchost.exe to execute a malicious DLL included in a new service group.
Technique: T1569: System Services
GuLoader has previously used RegAsm as a donor process.
Technique: T1055: Process Injection
Grandoreiro can determine the time on the victim machine via IPinfo.
Technique: T1124: System Time Discovery
BabyShark has used scheduled tasks to maintain persistence.
Technique: T1053: Scheduled Task/Job
Kazuar can also act as a webserver and listen for inbound HTTP requests through an exposed API.
Technique: T1071: Application Layer Protocol
Dyre decrypts resources needed for targeting the victim.
Technique: T1140: Deobfuscate/Decode Files or Information
Bisonal has the capability to download files to execute on the victim’s machine.
Technique: T1105: Ingress Tool Transfer
In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult.
Technique: T1498: Network Denial of Service
This file is then copied to a filename of ‘Windows Update.lnk’, which is placed in the startup path previously identified
Technique: T1547: Boot or Logon Autostart Execution
Elderwood has used exploitation of endpoint software, including Microsoft Internet Explorer Adobe Flash vulnerabilities, to gain execution.
Technique: T1203: Exploitation for Client Execution
TAINTEDSCRIBE can execute FileRecvWriteRand to append random bytes to the end of a file received from C2.
Technique: T1027: Obfuscated Files or Information
InvisiMole can check for artifacts of VirtualBox, Virtual PC and VMware environment, and terminate itself if they are detected.
Technique: T1497: Virtualization/Sandbox Evasion
In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority .
Technique: T1587: Develop Capabilities
Threat Group-3390 has used WinRM to enable remote execution.
Technique: T1021: Remote Services
The IIS w3wp.exe process then loads the malicious DLL.
Technique: T1505: Server Software Component
ShadowPad has discovered system information including memory status, CPU frequency, OS versions, and volume serial numbers.
Technique: T1082: System Information Discovery
MegaCortex has added entries to the Registry for ransom contact information.
Technique: T1112: Modify Registry
Dacls can collect data on running and parent processes.
Technique: T1057: Process Discovery
yty communicates to the C2 server by retrieving a Google Doc.
Technique: T1102: Web Service
Hancitor has also extracted executables from ZIP files.
Technique: T1140: Deobfuscate/Decode Files or Information
To maximize impact on the target organization, malware designed for encrypting data may have worm-like features to propagate across a network by leveraging other attack techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.
Technique: T1486: Data Encrypted for Impact
Adversaries may transfer tools or other files between systems in a compromised environment.
Technique: T1570: Lateral Tool Transfer
Magic Hound malware can list a victim's logical drives and the type, as well the total/free space of the fixed devices.
Technique: T1083: File and Directory Discovery
PUNCHBUGGY has hashed most its code's functions and encrypted payloads with base64 and XOR.
Technique: T1027: Obfuscated Files or Information
Establishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for Phishing for Information or Phishing.
Technique: T1585: Establish Accounts
Adversaries often target DNS and web services, however others have been targeted as well.
Technique: T1499: Endpoint Denial of Service
Industroyer can use an arbitrary system service to load at system boot for persistence and replaces the ImagePath registry value of a Windows service with a new backdoor binary.
Technique: T1543: Create or Modify System Process
ChChes collects its process identifier  on the victim.
Technique: T1057: Process Discovery
Nebulae has created a service named "Windows Update Agent1" to appear legitimate.
Technique: T1036: Masquerading
Aria-body has used HTTP in C2 communications.
Technique: T1071: Application Layer Protocol
Hildegard has decrypted ELF files with AES.
Technique: T1140: Deobfuscate/Decode Files or Information
TA505 has used fast flux to mask botnets by distributing payloads across multiple IPs.
Technique: T1568: Dynamic Resolution
ProLock can use .jpg and .bmp files to store its payload.
Technique: T1027: Obfuscated Files or Information
Adversaries may search the Registry on compromised systems for insecurely stored credentials.
Technique: T1552: Unsecured Credentials
Gather network addresses and operating system version Execute arbitrary commands using “cmd.exe /c”  The capability to execute system commands
Technique: T1059: Command and Scripting Interpreter
Adversaries may establish persistence by executing malicious content triggered by the execution of tainted binaries.
Technique: T1546: Event Triggered Execution
Valak has the ability to enumerate domain admin accounts.
Technique: T1087: Account Discovery
Adversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
Technique: T1078: Valid Accounts
It’s also used to inject code into its target processes using the technique.
Technique: T1055: Process Injection
In Windows, when files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream  named Zone.Identifier with a specific value known as the MOTW.
Technique: T1553: Subvert Trust Controls
Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations.
Technique: T1584: Compromise Infrastructure
menuPass has installed updates and new malware on victims.
Technique: T1105: Ingress Tool Transfer
ZxShell can create a new service using the service parser function ProcessScCommand.
Technique: T1543: Create or Modify System Process
Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface     to simulate the replication process from a remote domain controller using a technique called DCSync.
Technique: T1003: OS Credential Dumping
This may allow API callers to execute a binary, run a CLI command, load modules, etc.
Technique: T1106: Native API
The Remsec loader implements itself with the name Security Support Provider, a legitimate Windows function.
Technique: T1036: Masquerading
Zebrocy collects the OS version, computer name and serial number for the storage volume C:\.
Technique: T1082: System Information Discovery
TFTP boot  is commonly used by network administrators to load configuration-controlled network device images from a centralized management server.
Technique: T1542: Pre-OS Boot
TeamTNT has encrypted its binaries via AES.
Technique: T1027: Obfuscated Files or Information
There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries , VBA add-ins, Office Component Object Model  add-ins, automation add-ins, VBA Editor , Visual Studio Tools for Office  add-ins, and Outlook add-ins.
Technique: T1137: Office Application Startup
TA505 has used lures to get users to click links in emails and attachments.
Technique: T1204: User Execution
Several examples of this weakness in existing common installers have been reported to software vendors.
Technique: T1574: Hijack Execution Flow
Ryuk has used multiple native APIs including ShellExecuteW to run executables,GetWindowsDirectoryW to create folders, and VirtualAlloc, WriteProcessMemory, and CreateRemoteThread for process injection.
Technique: T1106: Native API
POSHSPY's use of WMI to both store and persist the backdoor code makes it nearly invisible to anyone not familiar with the intricacies of WMI
Technique: T1047: Windows Management Instrumentation
FIN6 used publicly available tools  to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language  servers, and NetBIOS.
Technique: T1046: Network Service Scanning
The Retriever Trojan uses the following namespace: using pcchekapp.grp.ammar.samaneh; Android.The malware begins by creating a web service object and uses the following URL within its configuration: http:// service.chrome-up[.]date:8080 /WebService.asmx It then calls a function called “SetLog2”, which sets variables for the system’s IP address, MAC address and hostname
Technique: T1016: System Network Configuration Discovery
Agent Tesla has he ability to perform anti-sandboxing and anti-virtualization checks.
Technique: T1497: Virtualization/Sandbox Evasion
Adversaries may downgrade and use less-secure versions of various features of a system, such as Command and Scripting Interpreters or even network protocols that can be abused to enable Adversary-in-the-Middle.
Technique: T1562: Impair Defenses
Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via Exploitation for Client Execution.
Technique: T1204: User Execution
WastedLocker can execute itself as a service.
Technique: T1569: System Services
Rocke can detect a running process's PID on the infected machine.
Technique: T1057: Process Discovery
Forged SAML tokens enable adversaries to authenticate across services that use SAML 2.0 as an SSO  mechanism.
Technique: T1606: Forge Web Credentials
This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key  or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Technique: T1486: Data Encrypted for Impact
When initially gaining access to a system, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system.
Technique: T1068: Exploitation for Privilege Escalation
Crimson contains a command to collect and exfiltrate emails from Outlook.
Technique: T1114: Email Collection
Lucifer can decrypt its C2 address upon execution.
Technique: T1140: Deobfuscate/Decode Files or Information
NanHaiShu uses mshta.exe to load its program and files.
Technique: T1218: Signed Binary Proxy Execution
On modern Redhat Enterprise Linux systems, and derivative distributions, the System Security Services Daemon  handles Kerberos tickets.
Technique: T1558: Steal or Forge Kerberos Tickets
Within an XDG autostart entry file, the Type key specifies if the entry is an application , link  or directory .
Technique: T1547: Boot or Logon Autostart Execution
QUADAGENT uses PowerShell scripts for execution.
Technique: T1059: Command and Scripting Interpreter
FIN7 lured victims to double-click on images in the attachments they sent which would then execute the hidden LNK file.
Technique: T1204: User Execution
Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence.
Technique: T1053: Scheduled Task/Job
It contains functionality to add helper DLLs for extending functionality of the utility.
Technique: T1546: Event Triggered Execution
Although this API is deprecated, it still fully functions in the latest releases of macOS.
Technique: T1548: Abuse Elevation Control Mechanism
SUNBURST collected all network interface MAC addresses that are up and not loopback devices, as well as IP address, DHCP configuration, and domain information.
Technique: T1016: System Network Configuration Discovery
External Defacement may be used as a catalyst to trigger events, or as a response to actions taken by an organization or government.
Technique: T1491: Defacement
ThiefQuest invokes time call to check the system's time, executes a sleep command, invokes a second time call, and then compares the time difference between the two time calls and the amount of time the system slept to identify the sandbox.
Technique: T1497: Virtualization/Sandbox Evasion
Steganographic techniques can be used to hide data in digital messages that are transferred between systems.
Technique: T1001: Data Obfuscation
Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information.
Technique: T1590: Gather Victim Network Information
The unauthorized image allows adversaries to modify device configuration, add malicious capabilities to the device, and introduce backdoors to maintain control of the network device while minimizing detection through use of a standard functionality.
Technique: T1542: Pre-OS Boot
Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries  or executables .
Technique: T1559: Inter-Process Communication
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.
Technique: T1546: Event Triggered Execution
capture webcam data 
Technique: T1125: Video Capture
Stuxnet uses an RPC server that contains a routine for file deletion.
Technique: T1070: Indicator Removal on Host
HAFNIUM has collected e-mail addresses for users they intended to target.
Technique: T1589: Gather Victim Identity Information
Cobalt Strike can hash functions to obfuscate calls to the Windows API and use a public/private key pair to encrypt Beacon session metadata.
Technique: T1027: Obfuscated Files or Information
Ramsay can store collected documents in a custom container after encrypting and compressing them using RC4 and WinRAR.
Technique: T1560: Archive Collected Data
This value will serve as the program that will be executed when a user logs into the computer.
Technique: T1547: Boot or Logon Autostart Execution
Dok exfiltrates logs of its execution stored in the /tmp folder over FTP using the curl command.
Technique: T1048: Exfiltration Over Alternative Protocol
WMI classes are the primary structure within WMI
Technique: T1047: Windows Management Instrumentation
Crimson contains a command to collect information about anti-virus software on the victim.
Technique: T1518: Software Discovery
DarkVishnya created new services for shellcode loaders distribution.
Technique: T1543: Create or Modify System Process
FIN6 has used the Stealer One credential stealer to target web browsers.
Technique: T1555: Credentials from Password Stores
RTM can record keystrokes from both the keyboard and virtual keyboard.
Technique: T1056: Input Capture
Linux Rabbit sends the payload from the C2 server as an encoded URL parameter.
Technique: T1132: Data Encoding
Although any changes will invalidate digital signatures on binaries because the binary is being modified, this can be remediated by simply removing the LC_CODE_SIGNATURE command from the binary so that the signature isn’t checked at load time.
Technique: T1546: Event Triggered Execution
Comnie runs the command: net start >> %TEMP%\info.dat on a victim.
Technique: T1007: System Service Discovery
admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to display network connections: netstat -ano >> %temp%\download APT1 used the net use command to get a listing on network connections.
Technique: T1049: System Network Connections Discovery
McAfee ATR has now discovered additional implants that are part of an operation to gain persistence for continued data exfiltration and for targeted access
Technique: T1132: Data Encoding
To maximize impact on the target organization, malware designed for destroying disk structures may have worm-like features to propagate across a network by leveraging other techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.
Technique: T1561: Disk Wipe
Chimera has registered alternate phone numbers for compromised users to intercept 2FA codes sent via SMS.
Technique: T1111: Two-Factor Authentication Interception
Machete has sent phishing emails that contain a link to an external server with ZIP and RAR archives.
Technique: T1566: Phishing
They can be purchased or, in some cases, acquired for free.
Technique: T1583: Acquire Infrastructure
Leviathan has used valid, compromised email accounts for defense evasion, including to send malicious emails to other victim organizations.
Technique: T1078: Valid Accounts
Leafminer has used Process Doppelgänging to evade security software while deploying tools on compromised systems.
Technique: T1055: Process Injection
Attor’s plugin deletes the collected files and log files after exfiltration.
Technique: T1070: Indicator Removal on Host
Maze also calls certain functions dynamically to hinder analysis.
Technique: T1027: Obfuscated Files or Information
APT39 has used malware to set LoadAppInit_DLLs in the Registry key SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows in order to establish persistence.
Technique: T1546: Event Triggered Execution
Scarlet Mimic has used the left-to-right override character in self-extracting RAR archive spearphishing attachment file names.
Technique: T1036: Masquerading
Chimera has dumped password hashes for use in pass the hash authentication attacks.
Technique: T1550: Use Alternate Authentication Material
This technique may be combined with Masquerading to trick the user into granting escalated privileges to malicious code.
Technique: T1548: Abuse Elevation Control Mechanism
REvil has used HTTP and HTTPS in communication with C2.
Technique: T1071: Application Layer Protocol
XCSSET uses a malicious browser application to replace the legitimate browser in order to continuously capture credentials, monitor web traffic, and download additional modules.
Technique: T1554: Compromise Client Software Binary
Additionally, other applications on the targets machine might store sensitive authentication cookies in memory .
Technique: T1539: Steal Web Session Cookie
This can be seen in the following images taken from hxxp:// feeds.rapidfeeds[.]com/88604/, which is one of the dead drop resolvers we encountered in this sample:  Figure 7 Dead drop resolver used by BADNEWS   In order to decrypt this data, the authors have included additional steps from previous versions
Technique: T1102: Web Service
The magic value 0xFEEDFACF that belongs to Mach-O Executable (64 bit) Methods GET_LAUNCHNAME and GET_LABELNAME will return the hardcoded name of the property list “.plist” for the root user (com.apple.screen.assistantd.plist) and for the regular user (com.apple.spell.agent.plist)
Technique: T1033: System Owner/User Discovery
Although the activity was previously linked by others to the FIN7 threat actor group, our research suggests the activity is in fact espionage related and unlikely to be FIN7 related
Technique: T1027: Obfuscated Files or Information
Dtrack has used a dropper that embeds an encrypted payload as extra data.
Technique: T1027: Obfuscated Files or Information
APT37 has used the command-line interface.
Technique: T1059: Command and Scripting Interpreter
Zebrocy obtains additional code to execute on the victim's machine, including the downloading of a secondary payload.
Technique: T1105: Ingress Tool Transfer
Specific checks will vary based on the target and/or adversary, but may involve behaviors such as Windows Management Instrumentation, PowerShell, System Information Discovery, and Query Registry to obtain system information and search for VME artifacts.
Technique: T1497: Virtualization/Sandbox Evasion
VERMIN is obfuscated using the obfuscation tool called ConfuserEx.
Technique: T1027: Obfuscated Files or Information
For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system.
Technique: T1547: Boot or Logon Autostart Execution
Supported commands “upload“, “screenshot“, “Excel“, “Outlook“, “risk“, “reboot“, “shutdown“, “clean“
Technique: T1059: Command and Scripting Interpreter
FIN10 has used batch scripts and scheduled tasks to delete critical system files.
Technique: T1070: Indicator Removal on Host
EnvyScout can call window.location.pathname to ensure that embedded files are being executed from the C: drive, and will terminate if they are not.
Technique: T1480: Execution Guardrails
When that system component is executed through normal system operation the adversary's code will be executed instead.
Technique: T1546: Event Triggered Execution
DNS traffic may also be allowed even before network authentication is completed.
Technique: T1071: Application Layer Protocol
The C2 server used by XTunnel provides a port number to the victim to use as a fallback in case the connection closes on the currently used port.
Technique: T1008: Fallback Channels
This Registry value could also be redirected to a suitable exported function from an already present DLL, avoiding the requirement to drop and execute a new file on disk.
Technique: T1553: Subvert Trust Controls
Tunneling involves explicitly encapsulating a protocol within another.
Technique: T1572: Protocol Tunneling
Get2 has the ability to use HTTP to send information collected from an infected host to C2.
Technique: T1071: Application Layer Protocol
The group then was able to authenticate to the intended victim's OWA  portal and read hundreds of email communications for information on Middle East organizations.
Technique: T1098: Account Manipulation
Matryoshka is capable of stealing Outlook passwords.
Technique: T1555: Credentials from Password Stores
Cardinal RAT encodes many of its artifacts and is encrypted  when downloaded.
Technique: T1027: Obfuscated Files or Information
Crimson contains commands to list files and directories, as well as search for files matching certain extensions from a defined list.
Technique: T1083: File and Directory Discovery
Adversaries may use methods of capturing user input to obtain credentials or collect information.
Technique: T1056: Input Capture
Sidewinder has used malware to collect information on files and directories.
Technique: T1083: File and Directory Discovery
Hydraq creates a backdoor through which remote attackers can read data from files.
Technique: T1005: Data from Local System
Bazar can inject code through calling VirtualAllocExNuma.
Technique: T1055: Process Injection
Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution.
Technique: T1140: Deobfuscate/Decode Files or Information
XTunnel uses SSL/TLS and RC4 to encrypt traffic.
Technique: T1573: Encrypted Channel
Additionally, it is possible to turn off logging to this file using the PowerShell command Set-PSReadlineOption -HistorySaveStyle SaveNothing.
Technique: T1562: Impair Defenses
Okrum loader only executes the payload after the left mouse button has been pressed at least three times, in order to avoid being executed within virtualized or emulated environments.
Technique: T1497: Virtualization/Sandbox Evasion
The primary difference was that this sample was encrypted and password protected, requiring the victim to enter in a password which was likely provided by the adversary to view the document
Technique: T1018: Remote System Discovery
For example, a Windows screensaver executable named March 25 \u202Excod.scr will display as March 25 rcs.docx.
Technique: T1036: Masquerading
KillDisk uses VMProtect to make reverse engineering the malware more difficult.
Technique: T1027: Obfuscated Files or Information
TA551 has used spoofed company emails that were acquired from email clients on previously infected hosts to target other individuals.
Technique: T1589: Gather Victim Identity Information
GreyEnergy uses HTTP and HTTPS for C2 communications.
Technique: T1071: Application Layer Protocol
Kasidet has the ability to download and execute additional files.
Technique: T1105: Ingress Tool Transfer
Adversaries may add new domain trusts or modify the properties of existing domain trusts to evade defenses and/or elevate privileges.
Technique: T1484: Domain Policy Modification
WellMess can identify the computer name of a compromised host.
Technique: T1082: System Information Discovery
MuddyWater has used malware that can collect the victim’s username.
Technique: T1033: System Owner/User Discovery
Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the Windows Credential Manager.
Technique: T1555: Credentials from Password Stores
jRAT has the capability to capture video from a webcam.
Technique: T1125: Video Capture
GeminiDuke collects information from the victim, including installed drivers, programs previously executed by users, programs and services configured to automatically run at startup, files and folders present in any user's home folder, files and folders present in any user's My Documents, programs installed to the Program Files folder, and recently accessed files, folders, and programs.
Technique: T1083: File and Directory Discovery
Upon reboot, the system executes the script's contents as root, resulting in persistence.
Technique: T1037: Boot or Logon Initialization Scripts
For example, the EventLog service may be disabled using the following PowerShell line: Stop-Service -Name EventLog.
Technique: T1562: Impair Defenses
Adversaries may add junk data to protocols used for command and control to make detection more difficult.
Technique: T1001: Data Obfuscation
Molerats has used msiexec.exe to execute an MSI payload.
Technique: T1218: Signed Binary Proxy Execution
SLOTHFULMEDIA can add, modify, and/or delete registry keys.
Technique: T1112: Modify Registry
The Visual Basic macro uses the following command line:  cmd /c expand %TEMP%\setup.cab -F:* %TEMP% && cd /d %TEMP% && del /f /q setup.cab && uacme.exe  The control server credential information contained in the CAB files is different:   Decoded credential data contained in another ipnet.ini
Technique: T1059: Command and Scripting Interpreter
Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one.
Technique: T1566: Phishing
Turla has used IronPython scripts as part of the IronNetInjector toolchain to drop payloads.
Technique: T1059: Command and Scripting Interpreter
Credentials can then be used to perform Lateral Movement and access restricted information.
Technique: T1003: OS Credential Dumping
MarkiRAT can obtain the computer name from a compromised host.
Technique: T1082: System Information Discovery
Daserf can use steganography to hide malicious code downloaded to the victim.
Technique: T1001: Data Obfuscation
Adversaries may buy, steal, or download software tools that can be used during targeting.
Technique: T1588: Obtain Capabilities
FlawedAmmyy enumerates the current user during the initial infection.
Technique: T1033: System Owner/User Discovery
Catchamas stores the gathered data from the machine in .db files and .bmp files under four separate locations.
Technique: T1074: Data Staged
SLOTHFULMEDIA has mimicked the names of known executables, such as mediaplayer.exe.
Technique: T1036: Masquerading
Sandworm Team's VBS backdoor can decode Base64-encoded data and save it to the %TEMP% folder.
Technique: T1140: Deobfuscate/Decode Files or Information
menuPass has renamed certutil and moved it to a different location on the system to avoid detection based on use of the tool.
Technique: T1036: Masquerading
An adversary may also incorporate Masquerading by using a service name from a related operating system or benign software, or by modifying existing services to make detection analysis more challenging.
Technique: T1543: Create or Modify System Process
This information can be used to enumerate offsets  and gadgets  otherwise hidden by process memory protections such as address space layout randomization .
Technique: T1055: Process Injection
Epic gathers information on local group names.
Technique: T1069: Permission Groups Discovery
Its C2 is based on IIS using .asp technology to handle the victims’ HTTP requests
Technique: T1071: Application Layer Protocol
RunningRAT kills antimalware running process.
Technique: T1562: Impair Defenses
OilRig has delivered malicious links to achieve execution on the target system.
Technique: T1204: User Execution
Digital certificates are issued by a certificate authority  in order to cryptographically verify the origin of signed content.
Technique: T1596: Search Open Technical Databases
Data that is sent is compressed and then base64-encoded before being included in the requests
Technique: T1132: Data Encoding
StoneDrill has used several anti-emulation techniques to prevent automated analysis by emulators or sandboxes.
Technique: T1497: Virtualization/Sandbox Evasion
WinMM sets a WH_CBT Windows hook to search for and capture files on the victim.
Technique: T1083: File and Directory Discovery
The malware then requests a connection to 192.184.60.229 on TCP port 81 using the command "05 01 00 01 c0 b8 3c e5 00 51" and verifies that the first two bytes from the server are "05 00" (c0 b8 3c e5 is the IP address and 00 51 is the port in network byte order)
Technique: T1016: System Network Configuration Discovery
Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files.
Technique: T1220: XSL Script Processing
It is not used on Linux due to the decentralized nature of the platform.
Technique: T1553: Subvert Trust Controls
Proton prompts users for their credentials.
Technique: T1056: Input Capture
However, in this new variant, all the DNS activity is initiated and executed solely from memory – unlike previous attacks which used PowerShell commands
Technique: T1546: Event Triggered Execution
Loops or otherwise needless repetitions of commands, such as Pings, may be used to delay malware execution and potentially exceed time thresholds of automated analysis environments.
Technique: T1497: Virtualization/Sandbox Evasion
Linux malware detection and prevention is not prevalent at this time, but Palo Alto Networks customers are protected through our next-generation security platform:  IPS signature 14917 deployed to identify and prevent command and control activity The C2 domains and files mentioned in this report are blocked in our Threat Prevention product
Technique: T1070: Indicator Removal on Host
TajMahal has the ability to steal documents from the local system including the print spooler queue.
Technique: T1005: Data from Local System
Chimera has copied tools between compromised hosts using SMB.
Technique: T1570: Lateral Tool Transfer
Inception has maintained persistence by modifying Registry run key value 
 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\.
Technique: T1547: Boot or Logon Autostart Execution
QUADAGENT uses cmd.exe to execute scripts and commands on the victim’s machine.
Technique: T1059: Command and Scripting Interpreter
Patchwork collected and exfiltrated files from the infected system.
Technique: T1005: Data from Local System
Webshell can use predefined users and passwords to execute brute force attacks against SSH, FTP, POP3, MySQL, MSSQL, and PostgreSQL services.
Technique: T1110: Brute Force
APT28 has performed large-scale scans in an attempt to find vulnerable servers.
Technique: T1595: Active Scanning