HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
Netwalker can use WMI to delete Shadow Volumes.
Technique: T1047: Windows Management Instrumentation
It also can uninstall scripts and delete files to cover its track.
Technique: T1070: Indicator Removal on Host
Javali can use DLL side-loading to load malicious DLLs into legitimate executables.
Technique: T1574: Hijack Execution Flow
Socksbot creates a suspended svchost process and injects its DLL into it.
Technique: T1055: Process Injection
These bits are indicated with an "s" instead of an "x" when viewing a file's attributes via ls -l. The chmod program can set these bits with via bitmasking, chmod 4777 file or via shorthand naming, chmod u+s file.
Technique: T1548: Abuse Elevation Control Mechanism
Hikit supports peer connections.
Technique: T1090: Proxy
Adversaries may abuse mmc.exe to proxy execution of malicious .msc files.
Technique: T1218: Signed Binary Proxy Execution
Naikon has used malicious e-mail attachments to deliver malware.
Technique: T1566: Phishing
Grandoreiro has named malicious browser extensions and update files to appear legitimate.
Technique: T1036: Masquerading
Operation Wocao has staged archived files in a temporary directory prior to exfiltration.
Technique: T1074: Data Staged
RARSTONE obtains installer properties from Uninstall Registry Key entries to obtain information about installed applications and how to uninstall certain applications.
Technique: T1083: File and Directory Discovery
By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic.
Technique: T1001: Data Obfuscation
Attor has used Tor for C2 communication.
Technique: T1090: Proxy
After Comnie has been copied to the %TEMP% directory, it will look for the presence of the ‘DQuit.tmp’ file in this path
Technique: T1074: Data Staged
Another variation, commonly referred to as API hammering, involves making various calls to Native API functions in order to delay execution .
Technique: T1497: Virtualization/Sandbox Evasion
Crimson contains a command to retrieve files from its C2 server.
Technique: T1105: Ingress Tool Transfer
APT28 deployed the open source tool Responder to conduct NetBIOS Name Service poisoning, which captured usernames and hashed passwords that allowed access to legitimate credentials.
Technique: T1040: Network Sniffing
NOKKI uses the Windows call SetWindowsHookEx and begins injecting it into every GUI process running on the victim's machine.
Technique: T1056: Input Capture
EVILNUM has used the Windows Management Instrumentation  tool to enumerate infected machines.
Technique: T1047: Windows Management Instrumentation
Because the cryptographic renegotiation has a meaningful cost in computation cycles, this can cause an impact to the availability of the service when done in volume.
Technique: T1499: Endpoint Denial of Service
APT29 has installed web shells on exploited Microsoft Exchange servers.
Technique: T1505: Server Software Component
Tonto Team has used tools such as NBTscan to enumerate network shares.
Technique: T1135: Network Share Discovery
PLEAD has used HTTP for communications with command and control  servers.
Technique: T1071: Application Layer Protocol
This information allows a threat actor to determine if their messages were delivered, which users are more susceptible to opening them, and basic information regarding the target’s operating system and e-mail client (or browser)
Technique: T1082: System Information Discovery
Commercial and open source products can be leveraged with capabilities such as passive network tapping , network traffic modification  Adversary-in-the-Middle , keystroke injection , kernel memory reading via DMA , addition of new wireless access to an existing network , and others.
Technique: T1200: Hardware Additions
During the installation process, it is common for installers to use a subdirectory within the %TEMP% directory to unpack binaries such as DLLs, EXEs, or other payloads.
Technique: T1574: Hijack Execution Flow
LookBack sets up a Registry Run key to establish a persistence mechanism.
Technique: T1547: Boot or Logon Autostart Execution
KGH_SPY has used encrypted strings in its installer.
Technique: T1027: Obfuscated Files or Information
APT39 has used different versions of Mimikatz to obtain credentials.
Technique: T1003: OS Credential Dumping
This is done for the sake of evading defenses and observation.
Technique: T1036: Masquerading
Proxysvc automatically collects data about the victim and sends it to the control server.
Technique: T1119: Automated Collection
Cobalt Strike can use WinRM to execute a payload on a remote host.
Technique: T1021: Remote Services
Sykipot may use ipconfig /all to gather system network configuration details.
Technique: T1016: System Network Configuration Discovery
There are multiple ways an adversary may escape to a host environment.
Technique: T1611: Escape to Host
DownPaper collects the victim username and sends it to the C2 server.
Technique: T1033: System Owner/User Discovery
TEMP.Veles has used compromised VPN accounts.
Technique: T1078: Valid Accounts
Trojan.Karagany can upload, download, and execute files on the victim.
Technique: T1105: Ingress Tool Transfer
Finally, the first DLL adds the registry key “SysRat,” at SoftWare\Microsoft\Windows\CurrentVersion\Run, to ensure the malware is executed at startup
Technique: T1547: Boot or Logon Autostart Execution
Hildegard has used xmrig to mine cryptocurrency.
Technique: T1496: Resource Hijacking
regsvr32.exe is a native Windows utility for registering and unregistering DLLs and ActiveX controls in the Windows registry.    The script attempts to load the malicious module using regsvr with the run function.   Procmon shows the malicious module loaded to the Avast process
Technique: T1218: Signed Binary Proxy Execution
SynAck clears event logs.
Technique: T1070: Indicator Removal on Host
The main purpose of the IGT tool is to make an inventory of the system, saving information from the network interfaces and addresses, credentials belonging to the Domain and database server, services being run from the OS and everything that could help the Poseidon Group make its attack more customized to its victim
Technique: T1082: System Information Discovery
The HandlePP::getClientID method uses the following environment variables:   Figure 11. Serial number   Figure 12. Hardware UUID   Figure 13. MAC address   Figure 14. Randomly generated UUID For the initial information packet, the backdoor also collects the following:   Figure 15. OS version Running getpwuid ->pw_name , scutil – -get ComputerName, and uname –m will provide the following returns respectively:  Mac OSX 10.12
Technique: T1082: System Information Discovery
Felismus can download files from remote servers.
Technique: T1105: Ingress Tool Transfer
Restriction of traffic can be achieved by prohibiting IP addresses, layer 4 protocol ports, or through deep packet inspection to identify applications.
Technique: T1599: Network Boundary Bridging
Siloscape itself is obfuscated and uses obfuscated API calls.
Technique: T1027: Obfuscated Files or Information
HOPLIGHT has been observed collecting system time from victim machines.
Technique: T1124: System Time Discovery
TeamTNT has searched for unsecured AWS credentials and Docker API credentials.
Technique: T1552: Unsecured Credentials
Newer versions of TrickBot have been known to use a custom communication protocol which sends the data unencrypted over port 443.
Technique: T1571: Non-Standard Port
Bandook is capable of spawning a Windows command shell.
Technique: T1059: Command and Scripting Interpreter
Custom Outlook forms can be created that will execute code when a specifically crafted email is sent by an adversary utilizing the same custom Outlook form.
Technique: T1137: Office Application Startup
Machete's main backdoor Machete is also written in Python.
Technique: T1059: Command and Scripting Interpreter
Adversaries may also Upload Malware and have the link target point to malware for download/execution by the user.
Technique: T1608: Stage Capabilities
Comnie establishes persistence via a .lnk file in the victim’s startup path.
Technique: T1547: Boot or Logon Autostart Execution
REvil has used obfuscated VBA macros for execution.
Technique: T1059: Command and Scripting Interpreter
Lazarus Group malware attempts to maintain persistence by saving itself in the Start menu folder or by adding a Registry Run key.
Technique: T1547: Boot or Logon Autostart Execution
Catchamas captures screenshots based on specific keywords in the window’s title.
Technique: T1113: Screen Capture
Internal proxy connections may use common peer-to-peer  networking protocols, such as SMB, to better blend in with the environment.
Technique: T1090: Proxy
Linux Rabbit opens a socket on port 22 and if it receives a response it attempts to obtain the machine's hostname and Top-Level Domain.
Technique: T1033: System Owner/User Discovery
On October 10, 2017, Kaspersky Lab’s advanced exploit prevention systems identified a new Adobe Flash zero day exploit used in the wild against our customers
Technique: T1203: Exploitation for Client Execution
Tropic Trooper has detected a target system’s OS version and system volume information.
Technique: T1082: System Information Discovery
Proxysvc uses HTTP over SSL to communicate commands with the control server.
Technique: T1071: Application Layer Protocol
Chimera has used WMIC to execute remote commands.
Technique: T1047: Windows Management Instrumentation
Higaisa has exploited CVE-2018-0798 for execution.
Technique: T1203: Exploitation for Client Execution
Ramsay can also embed information within document footers.
Technique: T1027: Obfuscated Files or Information
* Modifying the DLL and Function Registry values in HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{trust provider GUID} that point to the DLL providing a trust provider’s FinalPolicy function, which is where the decoded and parsed signature is checked and the majority of trust decisions are made.
Technique: T1553: Subvert Trust Controls
Pony has sent collected information to the C2 via HTTP POST request.
Technique: T1071: Application Layer Protocol
Dyre has the ability to send information staged on a compromised host externally to C2.
Technique: T1041: Exfiltration Over C2 Channel
Socksbot can take screenshots.
Technique: T1113: Screen Capture
The Windows screensaver application scrnsave.scr is located in C:\Windows\System32\, and C:\Windows\sysWOW64\  on 64-bit Windows systems, along with screensavers included with base Windows installations.
Technique: T1546: Event Triggered Execution
Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files.
Technique: T1080: Taint Shared Content
Nebulae can use TCP in C2 communications.
Technique: T1095: Non-Application Layer Protocol
The login shell configures the system environment using /etc/profile, /etc/zshenv, /etc/zprofile, and /etc/zlogin.
Technique: T1546: Event Triggered Execution
However, in order to kick off the execution of the malware the attacker uses a batch script which executes the malware, but the batch script does more than simply initiate execution of the malware
Technique: T1059: Command and Scripting Interpreter
This provides adversaries with the means to update the ROMMON to gain persistence on a system in a way that may be difficult to detect.
Technique: T1542: Pre-OS Boot
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes.
Technique: T1546: Event Triggered Execution
The White Company has taken advantage of a known vulnerability in Microsoft Word  to execute code.
Technique: T1203: Exploitation for Client Execution
Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles.
Technique: T1546: Event Triggered Execution
The current version, HawkEye Reborn v9 has been modified from earlier versions and heavily obfuscated to make analysis more difficult.The email campaigns that have been observed feature characteristics that are consistent with what is commonly seen with malspam campaigns, with the emails purporting to be associated with various documents such as invoices, bills of materials, order confirmations, and other corporate functions
Technique: T1027: Obfuscated Files or Information
EvilGrab has the capability to capture keystrokes.
Technique: T1056: Input Capture
POWERSOURCE queries Registry keys in preparation for setting Run keys to achieve persistence.
Technique: T1012: Query Registry
BRONZE BUTLER has masked executables with document file icons including Word and Adobe PDF.
Technique: T1036: Masquerading
Table 3: FELIXROOT backdoor parameters  Cryptography All data is transferred to C2 servers using AES encryption and the IbindCtx COM interface using HTTP or HTTPS protocol
Technique: T1071: Application Layer Protocol
TrickBot collects local files and information from the victim’s local machine.
Technique: T1005: Data from Local System
An adversary could utilize regions which do not support advanced detection services in order to avoid detection of their activity.
Technique: T1535: Unused/Unsupported Cloud Regions
Attor's has a plugin that is capable of recording audio using available input sound devices.
Technique: T1123: Audio Capture
POWERTON has the ability to dump password hashes.
Technique: T1003: OS Credential Dumping
MuddyWater has stored obfuscated JavaScript code in an image file named temp.jpg.
Technique: T1027: Obfuscated Files or Information
In 2016, APT28 conducted a distributed denial of service  attack against the World Anti-Doping Agency.
Technique: T1498: Network Denial of Service
APT12 has used blogs and WordPress for C2 infrastructure.
Technique: T1102: Web Service
Javali can capture login credentials from open browsers including Firefox, Chrome, Internet Explorer, and Edge.
Technique: T1555: Credentials from Password Stores
Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer .
Technique: T1059: Command and Scripting Interpreter
Darkhotel has obfuscated code using RC4, XOR, and RSA.
Technique: T1027: Obfuscated Files or Information
Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries.
Technique: T1546: Event Triggered Execution
Silence has used VBS scripts.
Technique: T1059: Command and Scripting Interpreter
SeaDuke is capable of persisting via the Registry Run key or a .lnk file stored in the Startup directory.
Technique: T1547: Boot or Logon Autostart Execution
Mofang delivered spearphishing emails with malicious links included.
Technique: T1566: Phishing
These personas may be fictitious or impersonate real people.
Technique: T1585: Establish Accounts
Remsec can obtain the OS version information, computer name, processor architecture, machine role, and OS edition.
Technique: T1082: System Information Discovery
PoetRAT has the ability to hide and unhide files.
Technique: T1564: Hide Artifacts
Most of the strings in ADVSTORESHELL are encrypted with an XOR-based algorithm; some strings are also encrypted with 3DES and reversed.
Technique: T1027: Obfuscated Files or Information
In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system.
Technique: T1091: Replication Through Removable Media
WellMess can collect the username on the victim machine to send to C2.
Technique: T1033: System Owner/User Discovery
TeamTNT has added RSA keys in authorized_keys.
Technique: T1098: Account Manipulation
Bankshot creates processes using the Windows API calls: CreateProcessA and CreateProcessAsUserA.
Technique: T1106: Native API
Comnie uses the tasklist to view running processes on the victim’s machine.
Technique: T1057: Process Discovery
For early Gazer versions, the compilation timestamp was faked.
Technique: T1070: Indicator Removal on Host
Ragnar Locker has been delivered as an unsigned MSI package that was executed with msiexec.exe.
Technique: T1218: Signed Binary Proxy Execution
CTU researchers identified BRONZE UNION actors using a file named ms.exe that was likely a credential-abuse tool from the Kekeo toolset
Technique: T1036: Masquerading
The second file is a PowerShell script which appears to be based on a Rapid7 Ruby Exploitation script that loads arbitrary shellcode
Technique: T1059: Command and Scripting Interpreter
The Winnti for Windows installer loads a DLL using rundll32.
Technique: T1218: Signed Binary Proxy Execution
Victim Registration SpeakUp uses POST and GET requests over HTTP to communicate with its main C&C which is the compromised website of speakupomaha[.]com
Technique: T1071: Application Layer Protocol
RedLeaves has encrypted C2 traffic with RC4, previously using keys of 88888888 and babybear.
Technique: T1573: Encrypted Channel
SLOWDRIFT collects and sends system information to its C2.
Technique: T1082: System Information Discovery
ROKRAT sends collected files back over same C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
Denis used GetProcAddress and LoadLibrary to dynamically resolve APIs.
Technique: T1106: Native API
XCSSET uses a shell script to execute Mach-o files and osacompile commands such as, osacompile -x -o xcode.app main.applescript.
Technique: T1059: Command and Scripting Interpreter
GoldFinder logged and stored information related to the route or hops a packet took from a compromised machine to a hardcoded C2 server, including the target C2 URL, HTTP response/status code, HTTP response headers and values, and data received from the C2 node.
Technique: T1119: Automated Collection
ECCENTRICBANDWAGON can capture screenshots and store them locally.
Technique: T1113: Screen Capture
The discovery of these available resources may help adversaries determine their next steps in the Cloud environment, such as establishing Persistence.An adversary may also use this information to change the configuration to make the bucket publicly accessible, allowing data to be accessed without authentication.
Technique: T1580: Cloud Infrastructure Discovery
Dyre has been delivered with encrypted resources and must be unpacked for execution.
Technique: T1027: Obfuscated Files or Information
Dtrack can collect network and active connection information.
Technique: T1049: System Network Connections Discovery
MegaCortex has changed user account passwords and logged users off the system.
Technique: T1531: Account Access Removal
Windows system WMI data is stored in the WMI common information model (CIM) repository, which consists of several files in the System32\wbem\Repository directory
Technique: T1047: Windows Management Instrumentation
QakBot can maintain persistence by creating an auto-run Registry key.
Technique: T1547: Boot or Logon Autostart Execution
Remsec is capable of using DNS for C2.
Technique: T1071: Application Layer Protocol
Proton uses macOS' .command file type to script actions.
Technique: T1059: Command and Scripting Interpreter
Remsec can obtain information about network configuration, including the routing table, ARP cache, and DNS cache.
Technique: T1016: System Network Configuration Discovery
Adversaries can obtain digital certificates  or create self-signed certificates .
Technique: T1608: Stage Capabilities
When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger .
Technique: T1546: Event Triggered Execution
119 readFiles Obtains file information on a file or a folder, and supports a “*” wildcard and recursive file list
Technique: T1083: File and Directory Discovery
In some cases the URLs were shortened or linked to Word documents with malicious macros that executed PowerShells scripts to download Pupy.
Technique: T1566: Phishing
APT41 used BITSAdmin to download and install payloads.
Technique: T1197: BITS Jobs
Hi-Zor has the ability to upload and download files from its C2 server.
Technique: T1105: Ingress Tool Transfer
PHOREAL is capable of creating reverse shell.
Technique: T1059: Command and Scripting Interpreter
Instead of compromising a third-party Server or renting a Virtual Private Server, adversaries may opt to configure and run their own servers in support of operations.
Technique: T1583: Acquire Infrastructure
In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.
Technique: T1614: System Location Discovery
Timezone Check The Trojan check to see if the system is configured (“DaylightName”) with one of the following time zones:   Arabic Daylight Time (UTC+3) Arab Daylight Time (UTC+3) Arabian Daylight Time (UTC+4) Middle East Daylight Time (UTC+2) Iran Daylight Time (UTC+3.5)   Human Interaction Check Before executing its functional code, the Trojan presents a dialog box with the following line of code:   Interaction.MsgBox(encodedStringClass.return_user32_bogus_errorcode_(3), MsgBoxStyle.Critical, null);   This dialog box displays  An error occurred while processing user32.dll!, which the user must click the ok button for the Trojan to run its functional code
Technique: T1124: System Time Discovery
Bazar can execute a WMI query to gather information about the installed antivirus engine.
Technique: T1047: Windows Management Instrumentation
VERMIN decrypts code, strings, and commands to use once it's on the victim's machine.
Technique: T1140: Deobfuscate/Decode Files or Information
RGDoor uses cmd.exe to execute commands on the victim’s machine.
Technique: T1059: Command and Scripting Interpreter
Once the host-based enumeration information was obtained, it was base64-encoded and then appended to the URL post request to a C2, whereas in previous versions this information was written to a text file.
Technique: T1132: Data Encoding
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
Technique: T1552: Unsecured Credentials
In May 2016, we published a blog detailing a spear phishing campaign targeting banks in the Middle East region that used macro-enabled attachments to distribute POWBAT malware
Technique: T1566: Phishing
Rancor has downloaded additional malware, including by using certutil.
Technique: T1105: Ingress Tool Transfer
Azorult can collect host IP information from the victim’s machine.
Technique: T1016: System Network Configuration Discovery
SLOTHFULMEDIA can enumerate files and directories.
Technique: T1083: File and Directory Discovery
Azorult can decrypt the payload into memory, create a new suspended process of itself, then inject a decrypted payload to the new process and resume new process execution.
Technique: T1055: Process Injection
RunningRAT uses a batch file to kill a security program task and then attempts to remove itself.
Technique: T1059: Command and Scripting Interpreter
Naikon uses commands such as netsh interface show to discover network interface settings.
Technique: T1016: System Network Configuration Discovery
GoldenSpy can execute remote commands in the Windows command shell using the WinExec API.
Technique: T1106: Native API
PowerDuke uses steganography to hide backdoors in PNG files, which are also encrypted using the Tiny Encryption Algorithm .
Technique: T1027: Obfuscated Files or Information
Dok adds admin  ALL= NOPASSWD: ALL to the /etc/sudoers file.
Technique: T1548: Abuse Elevation Control Mechanism
MarkiRAT can store collected data locally in a created .nfo file.
Technique: T1074: Data Staged
AppleSeed can enumerate the current process on a compromised host.
Technique: T1057: Process Discovery
Okrum was seen using MimikatzLite to perform credential dumping.
Technique: T1003: OS Credential Dumping
Those infected systems can then send the output from those commands back over that Web service channel.
Technique: T1102: Web Service
For example, the application shimming feature allows developers to apply fixes to applications  that were created for Windows XP so that it will work with Windows 10.
Technique: T1546: Event Triggered Execution
Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories.
Technique: T1080: Taint Shared Content
Cardinal RAT can download and execute additional payloads.
Technique: T1105: Ingress Tool Transfer
Inception used a file hunting plugin to collect .txt, .pdf, .xls or .doc files from the infected host.
Technique: T1005: Data from Local System
Lazarus Group has used mshta.exe to run malicious scripts and download programs.
Technique: T1218: Signed Binary Proxy Execution
Kimsuky has used links in e-mail to steal account information.
Technique: T1598: Phishing for Information
Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers.
Technique: T1176: Browser Extensions
Crimson contains a module to collect data from removable drives.
Technique: T1025: Data from Removable Media
Agent Tesla can collect the timestamp from the victim’s machine.
Technique: T1124: System Time Discovery
APT29 has used WMI event subscriptions for persistence.
Technique: T1546: Event Triggered Execution
To run persistently on the system, the Trojan will first create a VBScript file:SpecialFolder.CommonApplicationData\srvResesponded.vbs that contains:CreateObject(“WScript.Shell”).Run(“%app%”) The Trojan replaces the %app% string in the above VBScript with the path to its executable
Technique: T1059: Command and Scripting Interpreter
Valak has used PowerShell to download additional modules.
Technique: T1059: Command and Scripting Interpreter
BADNEWS establishes a backdoor over HTTP.
Technique: T1071: Application Layer Protocol
Adversaries may leverage code repositories to collect valuable information.
Technique: T1213: Data from Information Repositories
Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Technique: T1573: Encrypted Channel
An adversary may add the Global Administrator role to an adversary-controlled account to maintain persistent access to an Office 365 tenant.
Technique: T1098: Account Manipulation
Frankenstein has used WMI queries to detect if virtualization environments or analysis tools were running on the system.
Technique: T1518: Software Discovery
PoetRAT was executed with a Python script and worked in conjunction with additional Python-based post-exploitation tools.
Technique: T1059: Command and Scripting Interpreter
File sharing over a Windows network occurs over the SMB protocol.
Technique: T1135: Network Share Discovery
Naikon renamed a malicious service taskmgr to appear to be a legitimate version of Task Manager.
Technique: T1036: Masquerading
BackdoorDiplomacy has exploited CVE-2020-5902, an F5 BIP-IP vulnerability, to drop a Linux backdoor.
Technique: T1190: Exploit Public-Facing Application
Pteranodon executes functions using rundll32.exe.
Technique: T1218: Signed Binary Proxy Execution
APT41 created the StorSyncSvc service to provide persistence for Cobalt Strike.
Technique: T1543: Create or Modify System Process
Dipsind can download remote files.
Technique: T1105: Ingress Tool Transfer
Chaes has used .MSI files as an initial way to start the infection chain.
Technique: T1218: Signed Binary Proxy Execution
Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service.
Technique: T1056: Input Capture
Lock PowerShell Execution Policy, must be set to “AllSigned” via GPO
Technique: T1546: Event Triggered Execution
Agent Tesla can collect account information from the victim’s machine.
Technique: T1087: Account Discovery
Another variant decodes the embedded file by XORing it with the value "0x35".
Technique: T1140: Deobfuscate/Decode Files or Information
StoneDrill has several VBS scripts used throughout the malware's lifecycle.
Technique: T1059: Command and Scripting Interpreter
An application desiring access to cloud-based services or protected APIs can gain entry using OAuth 2.0 through a variety of authorization protocols.
Technique: T1528: Steal Application Access Token
APT41 used the Steam community page as a fallback mechanism for C2.
Technique: T1008: Fallback Channels
Remsec has a plugin to drop and execute vulnerable Outpost Sandbox or avast!
Technique: T1068: Exploitation for Privilege Escalation
admin@338 has sent emails with malicious Microsoft Office documents attached.
Technique: T1566: Phishing
TSCookie has the ability to decrypt, load, and execute a DLL and its resources.
Technique: T1140: Deobfuscate/Decode Files or Information
Ixeshe has a command to delete a file from the machine.
Technique: T1070: Indicator Removal on Host
QakBot can use obfuscated and encoded scripts; it has also hidden code within Excel spreadsheets by turning the font color to white and splitting it across multiple cells.
Technique: T1027: Obfuscated Files or Information
Machete has relied on users opening malicious attachments delivered through spearphishing to execute malware.
Technique: T1204: User Execution
FIN6 used RDP to move laterally in victim networks.
Technique: T1021: Remote Services
Example commands to find Registry keys related to password information: 
* Local Machine Hive: reg query HKLM /f password /t REG_SZ /s
* Current User Hive: reg query HKCU /f password /t REG_SZ /s TrickBot has retrieved PuTTY credentials by querying the Software\SimonTatham\Putty\Sessions registry key  Valak can use the clientgrabber module to steal e-mail credentials from the Registry.
Technique: T1552: Unsecured Credentials
Most common web applications have standardized and documented cookie values that can be generated using provided tools or interfaces.
Technique: T1606: Forge Web Credentials
A JHUHUGIT variant accesses a screenshot saved in the clipboard and converts it to a JPG image.
Technique: T1115: Clipboard Data
Mis-Type saves itself as a file named msdtc.exe, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.
Technique: T1036: Masquerading
The SSH config file is usually located under /etc/ssh/sshd_config.
Technique: T1098: Account Manipulation
Ajax Security Team has used CWoolger and MPK, custom-developed malware, which recorded all keystrokes on an infected system.
Technique: T1056: Input Capture
TajMahal has the ability to take screenshots on an infected host including capturing content from windows of instant messaging applications.
Technique: T1113: Screen Capture
FIN6 has deployed a utility script named kill.bat to disable anti-virus.
Technique: T1562: Impair Defenses
RDAT can upload a file via HTTP POST response to the C2 split into 102,400-byte portions.
Technique: T1030: Data Transfer Size Limits
PlugX allows actors to spawn a reverse shell on a victim.
Technique: T1059: Command and Scripting Interpreter
Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information  or Compromise Accounts and/or sending multiple, seemingly urgent messages.
Technique: T1598: Phishing for Information
Sidewinder has configured tools to automatically send collected files to attacker controlled servers.
Technique: T1020: Automated Exfiltration
VBA is an event-driven programming language built into Microsoft Office, as well as several third-party applications.
Technique: T1059: Command and Scripting Interpreter
Figure 3: Embedded URL in OLE object CVE-2017-11882 Similarly, we have also observed actors leveraging another recently discovered vulnerability (CVE-2017-11882) in Microsoft Office
Technique: T1203: Exploitation for Client Execution
Process hollowing is a method of executing arbitrary code in the address space of a separate live process.
Technique: T1055: Process Injection
KGH_SPY can send data to C2 with HTTP POST requests.
Technique: T1071: Application Layer Protocol
SMOKEDHAM has used net.exe user and net.exe users to enumerate local accounts on a compromised host.
Technique: T1087: Account Discovery
With SYN floods, excessive amounts of SYN packets are sent, but the 3-way TCP handshake is never completed.
Technique: T1499: Endpoint Denial of Service
The QakBot web inject module can inject Java Script into web banking pages visited by the victim.
Technique: T1059: Command and Scripting Interpreter
In response, if the status is OK, then a TOKEN is received from the C2 server that is used to synchronize the activities between the victim’s machine and the C2 server
Technique: T1041: Exfiltration Over C2 Channel
A startup item is a directory whose executable and configuration property list , StartupParameters.plist, reside in the top-level directory.
Technique: T1037: Boot or Logon Initialization Scripts
It can also obtain browsing history, cookies, and plug-in information.
Technique: T1083: File and Directory Discovery
Adversaries may gather information about the victim's hosts that can be used during targeting.
Technique: T1592: Gather Victim Host Information
DarkHydrus has used -WindowStyle Hidden to conceal PowerShell windows.
Technique: T1564: Hide Artifacts
QakBot can use domain generation algorithms in C2 communication.
Technique: T1568: Dynamic Resolution
Frankenstein has harvested credentials from the victim's machine using Empire.
Technique: T1003: OS Credential Dumping
StrongPity has been bundled with legitimate software installation files for disguise.
Technique: T1036: Masquerading
down_new has the ability to list running processes on a compromised host.
Technique: T1057: Process Discovery
Leviathan has downloaded additional scripts and files from adversary-controlled servers.
Technique: T1105: Ingress Tool Transfer
NativeZone can decrypt and decode embedded  Cobalt Strike beacon stage shellcode.
Technique: T1140: Deobfuscate/Decode Files or Information
Data could also be concealed within the email messages themselves.
Technique: T1071: Application Layer Protocol
Fox Kitten has installed web shells on compromised hosts to maintain access.
Technique: T1505: Server Software Component
The KilaAlfa keylogger also reports the title of the window in the foreground.
Technique: T1010: Application Window Discovery
APT41 added a registry key in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost to establish persistence for Cobalt Strike.
Technique: T1547: Boot or Logon Autostart Execution
Chimera has used tasklist to enumerate processes.
Technique: T1057: Process Discovery
REvil can mimic the names of known executables.
Technique: T1036: Masquerading
Threat Group-1314 actors mapped network drives using net use.
Technique: T1021: Remote Services
Aria-body has the ability to launch files using ShellExecute.
Technique: T1106: Native API
Operation Wocao has used Mimikatz's DCSync to dump credentials from the memory of the targeted system.
Technique: T1003: OS Credential Dumping
SUNSPOT modified its security token to grants itself debugging privileges by adding SeDebugPrivilege.
Technique: T1134: Access Token Manipulation
WannaCry uses Tor for command and control traffic and routes a custom cryptographic protocol over the Tor circuit.
Technique: T1573: Encrypted Channel
Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel.
Technique: T1102: Web Service
Adversaries may abuse PubPrn to execute malicious payloads hosted on remote sites.
Technique: T1216: Signed Script Proxy Execution
While it includes multiple ways to find Explorer, the preferred method is to get the process id from the current desktop window.
Technique: T1057: Process Discovery
Tools that scan for malicious VBA source code may be bypassed as the unwanted code is hidden in the compiled p-code.
Technique: T1564: Hide Artifacts
looks for net and account or domain in close proximity 
Technique: T1201: Password Policy Discovery
Files may be copied from one system to another to stage adversary tools or other files over the course of an operation.
Technique: T1570: Lateral Tool Transfer
Only files with sizes 
less than 500MB are encrypted.
Technique: T1486: Data Encrypted for Impact
Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Technique: T1489: Service Stop
The MBR passes control of the boot process to the VBR.
Technique: T1542: Pre-OS Boot
POSHSPY modifies timestamps of all downloaded executables to match a randomly selected file created prior to 2013.
Technique: T1070: Indicator Removal on Host
17 Complete List of Malware Files  Fig
Technique: T1083: File and Directory Discovery
In 2017, Sandworm Team conducted technical research related to vulnerabilities associated with websites used by the Korean Sport and Olympic Committee, a Korean power company, and a Korean airport.
Technique: T1588: Obtain Capabilities
Botnets are commonly used to conduct network flooding attacks against networks and services.
Technique: T1498: Network Denial of Service
Persistence Once started, the Keydnap backdoor installs a plist file in /Library/LaunchAgents/ if it has root privileges or $USER/Library/LaunchAgents/ otherwise to achieve persistence across reboots
Technique: T1543: Create or Modify System Process
Sibot has obfuscated scripts used in execution.
Technique: T1027: Obfuscated Files or Information
Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-8174, CVE-2018-0802, and CVE-2017-11882, as well as other vulnerabilities such as CVE-2019-9489 and CVE-2020-8468, to enable execution of their delivered malicious payloads.
Technique: T1203: Exploitation for Client Execution
Windshift has used tools that communicate with C2 over HTTP.
Technique: T1071: Application Layer Protocol
Silent Librarian has used collected lists of names and e-mail accounts to use in password spraying attacks against private sector targets.
Technique: T1110: Brute Force
DDE could also be leveraged by an adversary operating on a compromised machine who does not have direct access to a Command and Scripting Interpreter.
Technique: T1559: Inter-Process Communication
The DLL is also digitally signed by a certificate from “AirVPN”
Technique: T1553: Subvert Trust Controls
Adversaries can also abuse poor configurations of these mechanisms to escalate privileges without needing the user's password.
Technique: T1548: Abuse Elevation Control Mechanism
AppleJeus has sent data to its C2 server via POST requests.
Technique: T1071: Application Layer Protocol
ComRAT has encrypted its virtual file system using AES-256 in XTS mode and has encoded PowerShell scripts.
Technique: T1027: Obfuscated Files or Information
Egregor's payloads are custom-packed, archived and encrypted to prevent analysis.
Technique: T1027: Obfuscated Files or Information
Other Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads.
Technique: T1573: Encrypted Channel
GravityRAT collects the victim IP address, MAC address, as well as the victim account domain name.
Technique: T1016: System Network Configuration Discovery
Gathering this information may reveal opportunities for other forms of reconnaissance  or Search Open Websites/Domains, establishing operational resources  or Compromise Accounts, and/or initial access  or Trusted Relationship
Technique: T1591: Gather Victim Org Information
By using this technique, the malware is able to leverage itself from a signed and verified legitimate Windows OS process, or, alternatively, if aswrundll.exe or unins000.exe exists, a signed and verified security product process
Technique: T1553: Subvert Trust Controls
PROMETHIUM has created admin accounts on a compromised host.
Technique: T1078: Valid Accounts
VERMIN can perform screen captures of the victim’s machine.
Technique: T1113: Screen Capture
Revenge RAT collects the IP address and MAC address from the system.
Technique: T1016: System Network Configuration Discovery
Naikon has used the LadonGo scanner to scan target networks.
Technique: T1046: Network Service Scanning
The AES key is unique for each communication and is encrypted with one of two RSA public keys
Technique: T1521: nan
Adversaries may gather credentials from information stored in the Proc filesystem or /proc.
Technique: T1003: OS Credential Dumping
A directory share pivot is a variation on this technique that uses several other techniques to propagate malware when users access a shared network directory.
Technique: T1080: Taint Shared Content
Tonto Team has downloaded malicious DLLs which served as a ShadowPad loader.
Technique: T1105: Ingress Tool Transfer
Agent Tesla has been executed through malicious e-mail attachments  Pony has attempted to lure targets into downloading an attached executable  or document .
Technique: T1204: User Execution
APT39 has used various strains of malware to query the Registry.
Technique: T1012: Query Registry
Glimpse’s Agent Control Panel showing the interface actors would use to send commands The actor clicks the command to view the results in a popup window named “Result Viewer”
Technique: T1059: Command and Scripting Interpreter
BabyShark has added a Registry key to ensure all future macros are enabled for Microsoft Word and Excel as well as for additional persistence.
Technique: T1547: Boot or Logon Autostart Execution
Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host.
Technique: T1614: System Location Discovery
Javali has achieved execution through victims clicking links to malicious websites.
Technique: T1204: User Execution
Astaroth collects the machine name and keyboard language from the system.
Technique: T1082: System Information Discovery
RainyDay has used names to mimic legitimate software including "vmtoolsd.exe" to spoof Vmtools.
Technique: T1036: Masquerading
FIN7 used VBS scripts to help perform tasks on the victim's machine.
Technique: T1059: Command and Scripting Interpreter
POWRUNER may collect user account information by running net user /domain or a series of other commands on a victim.
Technique: T1087: Account Discovery
Revenge RAT gathers the username from the system.
Technique: T1033: System Owner/User Discovery
We’ve identified two such files: settings.db sdfg3d.db Here’s how such a database file appears:  These are BASE64 encoded and use the same RC4 encryption key as the malware configuration
Technique: T1027: Obfuscated Files or Information
Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition.
Technique: T1499: Endpoint Denial of Service
Figure 19. Scrambling ‘Mac OSX 10.12’  Encryption  The scrambled byte sequence is passed onto the constructor of the class Packet::Packet, which creates a random AES256 key and encrypts the buffer with this key
Technique: T1521: nan
XCSSET identifies the macOS version and uses ioreg to determine serial number.
Technique: T1082: System Information Discovery
It also copies files from USB devices to a predefined directory.
Technique: T1074: Data Staged
Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.
Technique: T1055: Process Injection
GALLIUM has used stolen certificates to sign its tools including those from Whizzimo LLC.
Technique: T1553: Subvert Trust Controls
Pillowmint has used shellcode which reads code stored in the registry keys \REGISTRY\SOFTWARE\Microsoft\DRM using the native Windows API as well as read HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces as part of its C2.
Technique: T1012: Query Registry
Ferocious Kitten has acquired domains imitating legitimate sites.
Technique: T1583: Acquire Infrastructure
Delivery TG-3390 conducts SWCs or sends spearphishing emails with ZIP archive attachments
Technique: T1566: Phishing
Kwampirs decrypts and extracts a copy of its main DLL payload when executing.
Technique: T1140: Deobfuscate/Decode Files or Information
UNC2452 obtained information about the configured Exchange virtual directory using Get-WebServicesVirtualDirectory.
Technique: T1083: File and Directory Discovery
GeminiDuke collects information on programs and services on the victim that are configured to automatically run at startup.
Technique: T1007: System Service Discovery
The function will return a copy of the new session's access token and the adversary can use SetThreadToken to assign the token to a thread.
Technique: T1134: Access Token Manipulation
DarkVishnya used ports 5190 and 7900 for shellcode listeners, and 4444, 4445, 31337 for shellcode C2.
Technique: T1571: Non-Standard Port
Molerats saved malicious files within the AppData and Startup folders to maintain persistence.
Technique: T1547: Boot or Logon Autostart Execution
Dacls can encrypt its configuration file with AES CBC.
Technique: T1027: Obfuscated Files or Information
Stuxnet encrypts exfiltrated data via C2 with static 31-byte long XOR keys.
Technique: T1560: Archive Collected Data
This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.
Technique: T1090: Proxy
Sibot has executed downloaded DLLs with rundll32.exe.
Technique: T1218: Signed Binary Proxy Execution
Night Dragon enticed users to click on links in spearphishing emails to download malware.
Technique: T1204: User Execution
Industroyer has a data wiper component that enumerates keys in the Registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services.
Technique: T1012: Query Registry
Egregor has the ability to download files from its C2 server.
Technique: T1105: Ingress Tool Transfer
Sidewinder has lured targets to click on malicious files to gain execution in the target environment.
Technique: T1204: User Execution
Okrum can establish persistence by adding a new service NtmsSvc with the display name Removable Storage to masquerade as a legitimate Removable Storage Manager.
Technique: T1036: Masquerading
WellMess can send files from the victim machine to C2.
Technique: T1005: Data from Local System
Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources.
Technique: T1562: Impair Defenses
Bundlore has used openssl to decrypt AES encrypted payload data.
Technique: T1140: Deobfuscate/Decode Files or Information
FIN6 conducted internal reconnaissance with a Windows batch file leveraging Adfind to query Active Directory, then 7-zip to compress the results for exfiltration
Technique: T1069: Permission Groups Discovery
Adversaries may create self-signed code signing certificates that can be used during targeting.
Technique: T1587: Develop Capabilities
Wizard Spider has lured victims into clicking a malicious link delivered through spearphishing.
Technique: T1204: User Execution
Network packets contain a string with two pieces of information: a file path and the contents of the file in a base64 encoded string.
Technique: T1041: Exfiltration Over C2 Channel
Mitigation As this sample installs itself through the use of EternalBlue, the targeted protocol is SMB.  Because of this, in order to best mitigate and avoid possible installations, you need your system updated to the latest security patches.  Specifically, you’d want to make sure that you have MS17-010 installed, as this is the security patch that patches the EternalBlue vulnerability
Technique: T1518: Software Discovery
sticky key 
Technique: T1546: Event Triggered Execution
APT29 used SDelete to remove artifacts from victims.
Technique: T1070: Indicator Removal on Host
The modification includes a specific password which is implanted in the operating system image via the patch.
Technique: T1556: Modify Authentication Process
Deep Panda has used ping to identify other machines of interest.
Technique: T1018: Remote System Discovery
RDAT can process steganographic images attached to email messages to send and receive C2 commands.
Technique: T1001: Data Obfuscation
APT19 downloaded and launched code within a SCT file.
Technique: T1059: Command and Scripting Interpreter