HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
Machete has used base64 encoding.
Technique: T1132: Data Encoding
WINDSHIELD can gather Registry values.
Technique: T1012: Query Registry
Adversaries may clear Windows Event Logs to hide the activity of an intrusion.
Technique: T1070: Indicator Removal on Host
The C2 server can also send a PowerShell command to capture and store a screenshot of a victim’s system
Technique: T1113: Screen Capture
Cuba can modify services by using the OpenService and ChangeServiceConfig functions.
Technique: T1543: Create or Modify System Process
REvil has the capability to stop services and kill processes.
Technique: T1489: Service Stop
InvisiMole can can remove all system restore points.
Technique: T1490: Inhibit System Recovery
Zebrocy uses netstat -aon to gather network connection information.
Technique: T1049: System Network Connections Discovery
QakBot has the ability use TCP to send or receive C2 packets.
Technique: T1095: Non-Application Layer Protocol
Lazarus Group uses multiple proxies to obfuscate network traffic from victims.
Technique: T1090: Proxy
Stolen Pencil has a tool to log keystrokes to %userprofile%\appdata\roaming\apach.{txt,log}.
Technique: T1056: Input Capture
Attor's dispatcher can establish persistence via adding a Registry key with a logon script HKEY_CURRENT_USER\Environment "UserInitMprLogonScript" .
Technique: T1037: Boot or Logon Initialization Scripts
Command and control  information can be encoded using a standard data encoding system.
Technique: T1132: Data Encoding
Mustang Panda has used a customized PlugX variant which could spread through USB connections.
Technique: T1091: Replication Through Removable Media
Chimera has used net user for account discovery.
Technique: T1087: Account Discovery
SynAck lists all the keyboard layouts installed on the victim’s system using GetKeyboardLayoutList API and checks against a hardcoded language code list.
Technique: T1614: System Location Discovery
Adversaries may upload or inject malicious web content, such as JavaScript, into websites.
Technique: T1608: Stage Capabilities
Egregor can collect any files found in the enumerated drivers before sending it to its C2 channel.
Technique: T1039: Data from Network Shared Drive
MiniDuke can download additional encrypted backdoors onto the victim via GIF files.
Technique: T1105: Ingress Tool Transfer
Micropsia creates a shortcut to maintain persistence.
Technique: T1547: Boot or Logon Autostart Execution
Examining passive DNS (pDNS) records from PassiveTotal revealed several domain names associated with this IP that mimic popular technology companies
Technique: T1016: System Network Configuration Discovery
This most likely means there is some type of DLL hijacking going on by distributing a legitimate McAfee binary with MirageFox to load up the DLL properly into a legitimate looking process
Technique: T1574: Hijack Execution Flow
HyperStack can enumerate all account names on a remote share.
Technique: T1087: Account Discovery
StrongPity can install a service to execute itself as a service.
Technique: T1569: System Services
APT32 has sent spearphishing emails containing malicious links.
Technique: T1566: Phishing
QUADAGENT checks if a value exists within a Registry key in the HKCU hive whose name is the same as the scheduled task it has created.
Technique: T1012: Query Registry
InvisiMole can replace legitimate software or documents in the compromised network with their trojanized versions, in an attempt to propagate itself within the network.
Technique: T1080: Taint Shared Content
Adversaries may also obtain leaked credentials in source repositories, logs, or other means as a way to gain access to cloud storage objects that have access permission controls.
Technique: T1530: Data from Cloud Storage Object
MarkiRAT can masquerade as update.exe and svehost.exe; it has also mimicked legitimate Telegram and Chrome files.
Technique: T1036: Masquerading
At this point the process can be unmapped using APIs calls such as ZwUnmapViewOfSection or NtUnmapViewOfSection  before being written to, realigned to the injected code, and resumed via VirtualAllocEx, WriteProcessMemory, SetThreadContext, then ResumeThread respectively.
Technique: T1055: Process Injection
This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption .
Technique: T1572: Protocol Tunneling
InnaputRAT has a command to delete files.
Technique: T1070: Indicator Removal on Host
These payloads may be used during Initial Access or later to mitigate detection.
Technique: T1027: Obfuscated Files or Information
APT41 used a tool called CLASSFON to covertly proxy network communications.
Technique: T1090: Proxy
Kinsing has downloaded additional lateral movement scripts from C2.
Technique: T1105: Ingress Tool Transfer
An adversary accomplishes a reflection attack by sending packets to reflectors with the spoofed address of the victim.
Technique: T1498: Network Denial of Service
admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about files and directories: dir c:\ >> %temp%\download dir "c:\Documents and Settings" >> %temp%\download dir "c:\Program Files\" >> %temp%\download dir d:\ >> %temp%\download Dust Storm has used Android backdoors capable of enumerating specific files on the infected devices.
Technique: T1083: File and Directory Discovery
USBStealer registers itself under a Registry Run key with the name "USB Disk Security."
Technique: T1547: Boot or Logon Autostart Execution
This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications.
Technique: T1137: Office Application Startup
Malicious modifications to the PAM system may also be abused to steal credentials.
Technique: T1556: Modify Authentication Process
Carbon creates a base directory that contains the files and folders that are collected.
Technique: T1074: Data Staged
RDAT can use email attachments for C2 communications.
Technique: T1071: Application Layer Protocol
APT33 has downloaded additional files and programs from its C2 server.
Technique: T1105: Ingress Tool Transfer
A complete wipe of all disk sectors may be attempted.
Technique: T1561: Disk Wipe
This information may also reveal times/dates of purchases and shipments of the victim’s hardware and software resources.
Technique: T1591: Gather Victim Org Information
UNC2452 used Rundll32 to execute payloads.
Technique: T1218: Signed Binary Proxy Execution
Ebury has injected its dynamic library into descendent processes of sshd via LD_PRELOAD.
Technique: T1574: Hijack Execution Flow
BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain a dead drop resolver containing an encoded tag with the IP address of a command and control server.
Technique: T1102: Web Service
MuddyWater has used mshta.exe to execute its POWERSTATS payload and to pass a PowerShell one-liner for execution.
Technique: T1218: Signed Binary Proxy Execution
TClient is injected into dllhost.exe Malware Analysis  wab32res.dll (FakeRun loader) loads TClient
Technique: T1055: Process Injection
This may result in multiple layers of encryption  or encryption in protocols that not typically encrypted .
Technique: T1048: Exfiltration Over Alternative Protocol
Sidewinder has lured targets to click on malicious links to gain execution in the target environment.
Technique: T1204: User Execution
HISTCONTROL does not exist by default on macOS, but can be set by the user and will be respected.
Technique: T1562: Impair Defenses
BUBBLEWRAP can communicate using HTTP or HTTPS.
Technique: T1071: Application Layer Protocol
Other common checks may enumerate services running that are unique to these applications, installed programs on the system, manufacturer/product fields for strings relating to virtual machine applications, and VME-specific hardware/processor instructions.
Technique: T1497: Virtualization/Sandbox Evasion
ThiefQuest also calls ptrace with the PTRACE_DENY_ATTACH flag to prevent debugging.
Technique: T1497: Virtualization/Sandbox Evasion
Grandoreiro can log keystrokes on the victim's machine.
Technique: T1056: Input Capture
Astaroth uses a fromCharCode deobfuscation method to avoid explicitly writing execution commands and to hide its code.
Technique: T1140: Deobfuscate/Decode Files or Information
Netwalker can encrypt files on infected machines to extort victims.
Technique: T1486: Data Encrypted for Impact
The decompressed PowerShell payload has some similarities to the PowerShell Empire agent, such as the use of a jitter value and commands referred to by job ID, but we do not have conclusive evidence that the author of this tool used Empire as a basis for their tool
Technique: T1546: Event Triggered Execution
TA505 has used TinyMet to enumerate members of privileged groups.
Technique: T1069: Permission Groups Discovery
Cobalt Strike can use PsExec to execute a payload on a remote host.
Technique: T1569: System Services
Ajax Security Team has used Wrapper/Gholee, custom-developed malware, which downloaded additional malware to the infected system.
Technique: T1105: Ingress Tool Transfer
ADVSTORESHELL can delete files and directories.
Technique: T1070: Indicator Removal on Host
Shamoon accesses network share, enables share access to the target device, copies an executable payload to the target system, and uses a Scheduled Task/Job to execute the malware.
Technique: T1021: Remote Services
Unlike Exploit Public-Facing Application, the focus of this technique is to exploit software on a client endpoint upon visiting a website.
Technique: T1189: Drive-by Compromise
GrimAgent can use the Windows Command Shell to execute commands, including its own removal.
Technique: T1059: Command and Scripting Interpreter
Cardinal RAT applies compression to C2 traffic using the ZLIB library.
Technique: T1560: Archive Collected Data
MarkiRAT can capture clipboard content.
Technique: T1115: Clipboard Data
Leviathan has sent spearphishing emails with malicious attachments, including .rtf, .doc, and .xls files.
Technique: T1566: Phishing
Bonadan can download additional modules from the C2 server.
Technique: T1105: Ingress Tool Transfer
AppleSeed has been distributed to victims through malicious e-mail attachments.
Technique: T1566: Phishing
Emotet has maintained persistence through a scheduled task.
Technique: T1053: Scheduled Task/Job
APT37 delivers malware using spearphishing emails with malicious HWP attachments.
Technique: T1566: Phishing
Zebrocy also uses AES and XOR to decrypt strings and payloads.
Technique: T1140: Deobfuscate/Decode Files or Information
Prior to compromising email accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation.
Technique: T1586: Compromise Accounts
Windshift has used tools to deploy additional payloads to compromised hosts.
Technique: T1105: Ingress Tool Transfer
Adversaries may also alter other Registry keys in the service’s Registry tree.
Technique: T1574: Hijack Execution Flow
QUADAGENT gathers the current domain the victim system belongs to.
Technique: T1016: System Network Configuration Discovery
BoxCaon used the "StackStrings" obfuscation technique to hide malicious functionalities.
Technique: T1027: Obfuscated Files or Information
Bazar can query the Registry for installed applications.
Technique: T1518: Software Discovery
BRONZE BUTLER has used steganography in multiple operations to conceal malicious payloads.
Technique: T1027: Obfuscated Files or Information
Any matching files are encrypted and written to a local user directory.
Technique: T1119: Automated Collection
FIN8 has used RAR to compress collected data before exfiltration.
Technique: T1560: Archive Collected Data
Are the attackers using any zero-day vulnerabilities? No zero-day vulnerabilities have been found in the analysis of the samples obtained regarding this campaign
Technique: T1068: Exploitation for Privilege Escalation
Naikon has used the RoyalRoad exploit builder to drop a second stage loader, intel.wll, into the Word Startup folder on the compromised host.
Technique: T1137: Office Application Startup
Exaramel for Windows specifies a path to store files scheduled for exfiltration.
Technique: T1074: Data Staged
Ixeshe has used registry values and file names associated with Adobe software, such as AcroRd32.exe.
Technique: T1036: Masquerading
Xbash can attempt to exploit known vulnerabilities in Hadoop, Redis, or ActiveMQ when it finds those services running in order to conduct further execution.
Technique: T1203: Exploitation for Client Execution
Remexi achieves persistence using Userinit by adding the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit.
Technique: T1547: Boot or Logon Autostart Execution
Grandoreiro can write or modify browser shortcuts to enable launching of malicious browser extensions.
Technique: T1547: Boot or Logon Autostart Execution
Hancitor has used CallWindowProc and EnumResourceTypesA to interpret and execute shellcode.
Technique: T1106: Native API
In the case of network designs that do not require NAT, address translation can be used by adversaries to obscure their activities, as changing the addresses of packets that traverse a network boundary device can make monitoring data transmissions more challenging for defenders.
Technique: T1599: Network Boundary Bridging
Whitefly has used a simple remote shell tool that will call back to the C2 server and wait for commands.
Technique: T1059: Command and Scripting Interpreter
One common purpose for Resource Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency.
Technique: T1496: Resource Hijacking
Adversaries may modify client software binaries to establish persistent access to systems.
Technique: T1554: Compromise Client Software Binary
JCry has used VBS scripts.
Technique: T1059: Command and Scripting Interpreter
Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components.
Technique: T1562: Impair Defenses
Cobalt Strike has the ability to load DLLs via reflective injection.
Technique: T1055: Process Injection
Common malicious usage includes automating execution of behaviors with VBScript or embedding VBA content into Spearphishing Attachment payloads.
Technique: T1059: Command and Scripting Interpreter
ShimRat can uninstall itself from compromised hosts, as well create and modify directories, delete, move, copy, and rename files.
Technique: T1070: Indicator Removal on Host
Typical drive-by compromise process:
1.
Technique: T1189: Drive-by Compromise
Patchwork collected the victim username and whether it was running as admin, then sent the information to its C2 server.
Technique: T1033: System Owner/User Discovery
More_eggs has used a signed binary shellcode loader and a signed Dynamic Link Library  to create a reverse shell.
Technique: T1553: Subvert Trust Controls
Adversaries may also combine brute forcing activity with behaviors such as External Remote Services as part of Initial Access.
Technique: T1110: Brute Force
Some data in Remsec is encrypted using RC5 in CBC mode, AES-CBC with a hardcoded key, RC4, or Salsa20.
Technique: T1027: Obfuscated Files or Information
MuddyWater has used malware that can execute PowerShell scripts via DDE.
Technique: T1559: Inter-Process Communication
MuddyWater has used CMSTP.exe and a malicious INF to execute its POWERSTATS payload.
Technique: T1218: Signed Binary Proxy Execution
APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke.
Technique: T1059: Command and Scripting Interpreter
RTM can delete all Registry entries created during its execution.
Technique: T1112: Modify Registry
build_downer has the ability to add itself to the Registry Run key for persistence.
Technique: T1547: Boot or Logon Autostart Execution
This attack diverged from previous attacks we observed from this group as it involved spear-phishing emails sent to targeted organizations with password protected RAR archive attachments that contained malicious Excel Web Query files (.iqy)
Technique: T1566: Phishing
Socksbot can start SOCKS proxy threads.
Technique: T1090: Proxy
Indrik Spider has used PsExec to stop services prior to the execution of ransomware.
Technique: T1489: Service Stop
GuLoader has the ability to inject shellcode into a donor processes that is started in a suspended state.
Technique: T1055: Process Injection
Blue Mockingbird has used wmic.exe to set environment variables.
Technique: T1047: Windows Management Instrumentation
Adversaries may abuse the Windows command shell for execution.
Technique: T1059: Command and Scripting Interpreter
Figure 3: The first step of decryption will perform XOR on one byte using the previous adjacent byte, starting from the last byte and excluding the first byte  Figure 4: The second step uses RC4, using the first 0x20 bytes from the result of the first step as the RC4 key  Figure 5: Encrypted (Top) and decrypted (bottom) configuration file It is also important to note that while the loader component and the configuration file are located in the same directory (%windows%\system32), the encrypted backdoor is located in a different directory (%Program Files%\Common Files\System\ado)
Technique: T1027: Obfuscated Files or Information
One computer that was infected with both Cadelspy and Remexi was a system that ran a SIM card editing application
Technique: T1082: System Information Discovery
InvisiMole can capture screenshots of not only the entire screen, but of each separate window open, in case they are overlapping.
Technique: T1113: Screen Capture
An adversary may achieve the same goal by modifying or extending features of the kernel.
Technique: T1547: Boot or Logon Autostart Execution
RegDuke can store its encryption key in the Registry.
Technique: T1112: Modify Registry
Registering a rogue DC involves creating a new server and nTDSDSA objects in the Configuration partition of the AD schema, which requires Administrator privileges  or the KRBTGT hash.
Technique: T1207: Rogue Domain Controller
The MPK IRC Bot monitors active application windows and writes the title of the open window along with the logged keystrokes to a file at “%temp%\Save.tmp”
Technique: T1010: Application Window Discovery
Adversaries may exfiltrate data by transferring the data, including backups of cloud environments, to another cloud account they control on the same service to avoid typical file transfers/downloads and network-based exfiltration detection.
Technique: T1537: Transfer Data to Cloud Account
Elise encrypts several of its files, including configuration files.
Technique: T1027: Obfuscated Files or Information
Threat Group-3390 has locally staged encrypted archives for later exfiltration efforts.
Technique: T1074: Data Staged
A Patchwork payload uses process hollowing to hide the UAC bypass vulnerability exploitation inside svchost.exe.
Technique: T1055: Process Injection
Kwampirs collects a list of domain groups with the command net localgroup /domain.
Technique: T1069: Permission Groups Discovery
Blue Mockingbird has used Windows Explorer to manually copy malicious files to remote hosts over SMB.
Technique: T1021: Remote Services
These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry.
Technique: T1547: Boot or Logon Autostart Execution
PLEAD has the ability to delete files on the compromised host.
Technique: T1070: Indicator Removal on Host
The decrypted shellcode is dropped as a Microsoft Word plugin WLL  into C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Word\STARTUP.
Technique: T1137: Office Application Startup
In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook  service.
Technique: T1087: Account Discovery
Nidiran can download and execute files.
Technique: T1105: Ingress Tool Transfer
jRAT can steal keys for VPNs and cryptocurrency wallets.
Technique: T1552: Unsecured Credentials
iKitten will look for the current IP address.
Technique: T1016: System Network Configuration Discovery
Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration.
Technique: T1074: Data Staged
Kimsuky has used RC4 encryption before exfil.
Technique: T1560: Archive Collected Data
CookieMiner has looked for files in the user's home directory with "wallet" in their name using find.
Technique: T1083: File and Directory Discovery
NETWIRE has been spread via e-mail campaigns utilizing malicious links.
Technique: T1566: Phishing
FIN7 sent spearphishing emails with either malicious Microsoft Documents or RTF files attached.
Technique: T1566: Phishing
EVILNUM can make modifications to the Regsitry for persistence.
Technique: T1112: Modify Registry
APT28 has used the ntdsutil.exe utility to export the Active Directory database for credential access.
Technique: T1003: OS Credential Dumping
Silence has been observed making videos of victims to observe bank employees day to day activities.
Technique: T1125: Video Capture
The group has also globally opened port 3389.
Technique: T1562: Impair Defenses
RDAT can download files via DNS.
Technique: T1105: Ingress Tool Transfer
Kwampirs uses rundll32.exe in a Registry value added to establish persistence.
Technique: T1218: Signed Binary Proxy Execution
Malicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system.
Technique: T1176: Browser Extensions
Adversaries may use MMC commands to perform malicious tasks.
Technique: T1218: Signed Binary Proxy Execution
Ragnar Locker has used sc.exe to execute a service that it creates.
Technique: T1569: System Services
If an attacker has sufficient permissions, they can disable logging to avoid detection of their activities.
Technique: T1562: Impair Defenses
Some of the targeted apps were:    Whatsapp  YouTube Video Downloader  Google Update   Instagram  Hack Wifi   AirDroid   WifiHacker     Facebook   Photoshop   SkyTV     Hotstar  Trump Dash   PokemonGo  With many more to come
Technique: T1102: Web Service
Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a Phishing.
Technique: T1027: Obfuscated Files or Information
PROMETHIUM has used a script that configures the knockd service and firewall to only accept C2 connections from systems that use a specified sequence of knock ports.
Technique: T1205: Traffic Signaling
OceanSalt can collect the name and ID for every process running on the system.
Technique: T1057: Process Discovery
ShimRat can enumerate connected drives for infected host machines.
Technique: T1135: Network Share Discovery
Bazar downloads have been hosted on Google Docs.
Technique: T1102: Web Service
OceanSalt has been delivered via spearphishing emails with Microsoft Office attachments.
Technique: T1566: Phishing
In the case of network-based reporting of indicators, an adversary may block traffic associated with reporting to prevent central analysis.
Technique: T1562: Impair Defenses
Aria-body has established persistence via the Startup folder or Run Registry key.
Technique: T1547: Boot or Logon Autostart Execution
In the wild, malware has disabled tty_tickets to potentially make scripting easier by issuing echo \'Defaults !tty_tickets\' >> /etc/sudoers .
Technique: T1548: Abuse Elevation Control Mechanism
The MPK Trojan also monitors specifically for windows that are likely to contain login forms for popular web-based email clients, such as titles that contain: “Gmail -” “Yahoo – login” “Sign In -” “Outlook.com -“ MPK will attempt to parse these window titles to identify the associated email address and record these to the log file using the following format: ///////////// Mail Find <email address> /////////// If the Trojan does not find the window titles associated with Gmail, Yahoo or Outlook, it saves the title to the “Save.tmp” file in the following format: +++++++++++++ Window= <window title> +++++++++++++ The major difference between the IRC variant and non-IRC variant of MPK is the C2 protocol used
Technique: T1010: Application Window Discovery
Kwampirs uses a large list of C2 servers that it cycles through until a successful connection is established.
Technique: T1008: Fallback Channels
The Helminth config file is encrypted with RC4.
Technique: T1027: Obfuscated Files or Information
APT32 has used JavaScript for drive-by downloads and C2 communications.
Technique: T1059: Command and Scripting Interpreter
Injects ma32.dll into “wwahost.exe” or “audacity.exe”
Technique: T1055: Process Injection
Okrum's loader can detect presence of an emulator by using two calls to GetTickCount API, and checking whether the time has been accelerated.
Technique: T1497: Virtualization/Sandbox Evasion
ThiefQuest encrypts a set of file extensions on a host, deletes the original files, and provides a ransom note with no contact information.
Technique: T1486: Data Encrypted for Impact
Systemd timers are unit files with file extension .timer that control services.
Technique: T1053: Scheduled Task/Job
BOOTRASH is a Volume Boot Record  bootkit that uses the VBR to maintain persistence.
Technique: T1542: Pre-OS Boot
LoudMiner used plists to execute shell scripts and maintain persistence on boot.
Technique: T1547: Boot or Logon Autostart Execution
menuPass has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as UPPERCUT.
Technique: T1574: Hijack Execution Flow
Utilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender, etc.
Technique: T1546: Event Triggered Execution
Wizard Spider has exfiltrated domain credentials and network enumeration information over command and control  channels.
Technique: T1041: Exfiltration Over C2 Channel
Mis-Type may create a file containing the results of the command cmd.exe /c ipconfig /all.
Technique: T1016: System Network Configuration Discovery
Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable  files with a .scr file extension.
Technique: T1546: Event Triggered Execution
SUNSPOT encrypted log entries it collected with the stream cipher RC4 using a hard-coded key.
Technique: T1027: Obfuscated Files or Information
Adversaries may also create a valid Kerberos ticket using other user information, such as stolen password hashes or AES keys.
Technique: T1550: Use Alternate Authentication Material
TEMP.Veles utilized RDP throughout an operation.
Technique: T1021: Remote Services
Pysa has used Powershell scripts to deploy its ransomware.
Technique: T1059: Command and Scripting Interpreter
Here’s a python code to decode
Technique: T1140: Deobfuscate/Decode Files or Information
TYPEFRAME can search directories for files on the victim’s machine.
Technique: T1083: File and Directory Discovery
Winnti for Linux can encode its configuration file with single-byte XOR encoding.
Technique: T1027: Obfuscated Files or Information
Cannon exfiltrates collected data over email via SMTP/S and POP3/S C2 channels.
Technique: T1041: Exfiltration Over C2 Channel
Chaes has used Python scripts for execution and the installation of additional files.
Technique: T1059: Command and Scripting Interpreter
Adversaries may also look in common key directories, such as ~/.ssh for SSH keys on * nix-based systems or C:&#92;Users&#92;&#92;.ssh&#92; on Windows.
Technique: T1552: Unsecured Credentials
The service checks every 60 seconds to determine if the malware is running; if not, it will spawn a new instance.
Technique: T1543: Create or Modify System Process
GravityRAT executes commands remotely on the infected host.
Technique: T1059: Command and Scripting Interpreter
SUPERNOVA contained Base64-encoded strings.
Technique: T1027: Obfuscated Files or Information
Hunter queried the following URIs in a specific order to determine if the associated software configurations are insecure, and all queries contained the HttpClient User-Agent:  GET /manager/html/ — Tomcat web application manager GET /jmx-console/ — JBoss configuration GET /CFIDE/administrator/login.cfm — ColdFusion configuration  Installation TG-3390 uses DLL side loading, a technique that involves running a legitimate, typically digitally signed, program that loads a malicious DLL
Technique: T1574: Hijack Execution Flow
Tropic Trooper has created the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell and sets the value to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
Adversaries may compromise third-party Virtual Private Servers  that can be used during targeting.
Technique: T1584: Compromise Infrastructure
The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled.
Technique: T1546: Event Triggered Execution
DEATHRANSOM can delete volume shadow copies on compromised hosts.
Technique: T1490: Inhibit System Recovery
Interactive shells may be accessed through command and control channels or during lateral movement such as with SSH.
Technique: T1059: Command and Scripting Interpreter
APT29 has conducted widespread scanning of target environments to identify vulnerabilities for exploit.
Technique: T1595: Active Scanning
zwShell can modify the Registry.
Technique: T1112: Modify Registry
Inception has used VBScript to execute malicious commands and payloads.
Technique: T1059: Command and Scripting Interpreter
SoreFang can collect the hostname, operating system configuration, product ID, and disk space on victim machines by executing Systeminfo.
Technique: T1082: System Information Discovery
Drovorub has de-obsfuscated XOR encrypted payloads in WebSocket messages.
Technique: T1140: Deobfuscate/Decode Files or Information
APT41 attempted to remove evidence of some of its activity by clearing Windows security and system events.
Technique: T1070: Indicator Removal on Host
BlackEnergy has used a plug-in to gather credentials from web browsers including FireFox, Google Chrome, and Internet Explorer.
Technique: T1555: Credentials from Password Stores
APT39 has used various tools to proxy C2 communications.
Technique: T1090: Proxy
When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel and Exfiltration Over Alternative Protocol.
Technique: T1020: Automated Exfiltration
* Animate – Create a process from the tainted section of memory and initiate execution.
Technique: T1055: Process Injection
Adversaries may abuse Internet browser extensions to establish persistent access to victim systems.
Technique: T1176: Browser Extensions
WindTail can identify and add files that possess specific file extensions to an array for archiving.
Technique: T1119: Automated Collection
IndigoZebra has established domains, some of which were designed to look like official government domains, for their operations.
Technique: T1583: Acquire Infrastructure
Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor , an Internet Explorer vulnerability , CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.
Technique: T1203: Exploitation for Client Execution
Threat Group-3390 has used RAR to compress, encrypt, and password-protect files prior to exfiltration.
Technique: T1560: Archive Collected Data
Since it is signed and native on Windows systems, proxying execution via verclsid.exe may bypass application control solutions that do not account for its potential abuse.
Technique: T1218: Signed Binary Proxy Execution
Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information.
Technique: T1598: Phishing for Information
For example, an executable file attachment named Evil.txt.exe may display as Evil.txt to a user.
Technique: T1036: Masquerading
Matryoshka is capable of providing Meterpreter shell access.
Technique: T1059: Command and Scripting Interpreter
Rocke has looked for IP addresses in the known_hosts file on the infected system and attempted to SSH into them.
Technique: T1018: Remote System Discovery
WellMail can identify the current username on the victim system.
Technique: T1033: System Owner/User Discovery
PipeMon can check for the presence of ESET and Kaspersky security software.
Technique: T1518: Software Discovery
Babuk has the ability to enumerate network shares.
Technique: T1135: Network Share Discovery
Cannon uses SMTP/S and POP3/S for C2 communications by sending and receiving emails.
Technique: T1071: Application Layer Protocol
LightNeuron has used AES and XOR to decrypt configuration files and commands.
Technique: T1140: Deobfuscate/Decode Files or Information
Each service unit file may contain numerous directives that can execute system commands:
* ExecStart, ExecStartPre, and ExecStartPost directives cover execution of commands when a services is started manually by 'systemctl' or on system start if the service is set to automatically start.
Technique: T1543: Create or Modify System Process
PolyglotDuke can custom encrypt strings.
Technique: T1027: Obfuscated Files or Information
Lazarus Group keylogger KiloAlfa obtains user tokens from interactive sessions to execute itself with API call CreateProcessAsUserA under that user's context.
Technique: T1134: Access Token Manipulation
HOPLIGHT has multiple C2 channels in place in case one fails.
Technique: T1008: Fallback Channels
Turla surveys a system upon check-in to discover running processes using the tasklist /v command.
Technique: T1057: Process Discovery
Adversaries may inject portable executables  into processes in order to evade process-based defenses as well as possibly elevate privileges.
Technique: T1055: Process Injection
Attacker deception and attribution The deobfuscated PowerShell code used by the MuddyWater group resembles previously seen PowerShell scripts that most likely served as prototypes
Technique: T1546: Event Triggered Execution
Smoke Loader searches through Outlook files and directories .
Technique: T1114: Email Collection
Some MiniDuke components use Twitter to initially obtain the address of a C2 server or as a backup if no hard-coded C2 server responds.
Technique: T1102: Web Service
Sharpshooter has sent malicious Word OLE documents to victims.
Technique: T1559: Inter-Process Communication
The majority of ActiveX Objects created with Wscript.Shell and Shell.Application are used to run programs, create shortcuts, manipulate the contents of the registry, or access system folders
Technique: T1059: Command and Scripting Interpreter
SpeakUp downloads and executes additional files from a remote server.
Technique: T1105: Ingress Tool Transfer
down_new has the ability to list the directories on a compromised host.
Technique: T1083: File and Directory Discovery
These infections may target both binary and non-binary formats that end with extensions including, but not limited to, .EXE, .DLL, .SCR, .BAT, and/or .VBS.
Technique: T1080: Taint Shared Content
Machete employed some visual obfuscation techniques by naming variables as combinations of letters to hinder analysis.
Technique: T1027: Obfuscated Files or Information
Higaisa dropped and added officeupdate.exe to scheduled tasks.
Technique: T1053: Scheduled Task/Job
VB is a programming language created by Microsoft with interoperability with many Windows technologies such as Component Object Model and the Native API through the Windows API.
Technique: T1059: Command and Scripting Interpreter
MoonWind can execute commands via an interactive command shell.
Technique: T1059: Command and Scripting Interpreter
Anchor can support windows execution via SMB shares.
Technique: T1021: Remote Services
PLEAD has been executed via malicious e-mail attachments.
Technique: T1204: User Execution
PoetRAT has used FTP for C2 communications.
Technique: T1071: Application Layer Protocol
Night Dragon has obtained and used tools such as gsecdump.
Technique: T1588: Obtain Capabilities
In a later variant, randomly generated data was used for data overwrites.
Technique: T1485: Data Destruction
This is because sudo has the ability to cache credentials for a period of time.
Technique: T1548: Abuse Elevation Control Mechanism
OSX_OCEANLOTUS.D can use the touch -t command to change timestamps.
Technique: T1070: Indicator Removal on Host
Exaramel for Linux has a hardcoded location under systemd that it uses to achieve persistence if it is running as root.
Technique: T1543: Create or Modify System Process
When the Duqu command and control is operating over HTTP or HTTPS, Duqu uploads data to its controller by appending it to a blank JPG file.
Technique: T1001: Data Obfuscation
Rover automatically searches for files on local drives based on a predefined list of file extensions and sends them to the command and control server every 60 minutes.
Technique: T1020: Automated Exfiltration
Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.
Technique: T1048: Exfiltration Over Alternative Protocol
Machete's collected data is exfiltrated over the same channel used for C2.
Technique: T1041: Exfiltration Over C2 Channel
NanHaiShu uses DNS for the C2 communications.
Technique: T1071: Application Layer Protocol
Chimera has used ipconfig, Ping, and tracert to enumerate the IP address and network environment and settings of the local host.
Technique: T1016: System Network Configuration Discovery
Higaisa’s JavaScript file used a legitimate Microsoft Office 2007 package to side-load the OINFO12.OCX dynamic link library.
Technique: T1574: Hijack Execution Flow
APT19 used an HTTP malware variant and a Port 22 malware variant to gather the hostname and CPU information from the victim’s machine.
Technique: T1082: System Information Discovery
Benign executables used to side-load payloads may not be flagged during delivery and/or execution.
Technique: T1574: Hijack Execution Flow
H1N1 kills and disables services for Windows Firewall.
Technique: T1562: Impair Defenses
We mentioned earlier that due to the nature of the IE injection technique used by the HTTP-based backdoors, a number of C2 commands were cached to disk
Technique: T1071: Application Layer Protocol
GoldMax has decoded and decrypted the configuration file when executed.
Technique: T1140: Deobfuscate/Decode Files or Information
Babuk has the ability to use the command line to control execution on compromised hosts.
Technique: T1059: Command and Scripting Interpreter
Carbanak actors used legitimate credentials of banking employees to perform operations that sent them millions of dollars.
Technique: T1078: Valid Accounts
DustySky checks for the existence of anti-virus.
Technique: T1518: Software Discovery
VERMIN uses WMI to check for anti-virus software installed on the system.
Technique: T1518: Software Discovery
This same attack could be executed using service tickets captured from network traffic.
Technique: T1558: Steal or Forge Kerberos Tickets
XCSSET will create an ssh key if necessary with the ssh-keygen -t rsa -f $HOME/.ssh/id_rsa -P command.
Technique: T1098: Account Manipulation
By default, only Administrators may remotely activate and launch COM objects through DCOM.
Technique: T1021: Remote Services
In one instance, a log file recovered from an open indexed server revealed that an IP address (112.66.188.28) located in Hainan, China had been used to administer the command and control node that was communicating with malware on victim machines
Technique: T1016: System Network Configuration Discovery
Dridex's strings are obfuscated using RC4.
Technique: T1027: Obfuscated Files or Information
Lokibot embedded the commands schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I inside a batch script.
Technique: T1053: Scheduled Task/Job
Explosive has used HTTP for communication.
Technique: T1071: Application Layer Protocol
It’s important to remember, that while we were using Bitly links to help gauge click location, anyone who clicks these links (including researchers) are also counted
Technique: T1566: Phishing
OilRig has used brute force techniques to obtain credentials.
Technique: T1110: Brute Force
It also deleted previously-created Image File Execution Options  Debugger registry values and registry keys related to HTTP proxy to clean up traces of its activity.
Technique: T1112: Modify Registry
MobileOrder has a command to upload to its C2 server information about files on the victim mobile device, including SD card size, installed app list, SMS content, contacts, and calling history.
Technique: T1083: File and Directory Discovery
FinFisher probes the system to check for antimalware processes.
Technique: T1518: Software Discovery
TrickBot can modify registry entries.
Technique: T1112: Modify Registry
The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell subkeys can automatically launch programs.
Technique: T1547: Boot or Logon Autostart Execution
Stuxnet uses encrypted configuration blocks and writes encrypted files to disk.
Technique: T1027: Obfuscated Files or Information
One of the malware families tied to this group, BADNEWS, continues to be updated both in how it uses dead drop resolvers, as well as how it communicates with a remote C2 server
Technique: T1102: Web Service
Symmetric encryption algorithms are those that use shared or the same keys/secrets on each end of the channel.
Technique: T1048: Exfiltration Over Alternative Protocol
Operation Wocao has used valid VPN credentials to gain initial access.
Technique: T1078: Valid Accounts
Keydnap uses a Launch Agent to persist.
Technique: T1543: Create or Modify System Process
Mustang Panda has encrypted documents with RC4 prior to exfiltration.
Technique: T1560: Archive Collected Data
Fox Kitten has used Google Chrome bookmarks to identify internal resources and assets.
Technique: T1217: Browser Bookmark Discovery
The autonomous system name of the IP shows that the allocation is controlled by Serverius Holding B.V., which is an autonomous system name we have previously seen associated with the OilRig group
Technique: T1082: System Information Discovery
Doki has disguised a file as a Linux kernel module.
Technique: T1036: Masquerading
Adversaries may modify SSH authorized_keys files directly with scripts or shell commands to add their own adversary-supplied public keys.
Technique: T1098: Account Manipulation
4H RAT uses HTTP for command and control.
Technique: T1071: Application Layer Protocol
For example, if a token grants access to a victim’s primary email, the adversary may be able to extend access to all other services which the target subscribes by triggering forgotten password routines.
Technique: T1550: Use Alternate Authentication Material
Bonadan has discovered the OS version, CPU model, and RAM size of the system it has been installed on.
Technique: T1082: System Information Discovery
Operation Wocao has discovered the local network configuration with ipconfig.
Technique: T1016: System Network Configuration Discovery
SideTwist can execute shell commands on a compromised host.
Technique: T1059: Command and Scripting Interpreter
OOXML files are packed together ZIP archives compromised of various XML files, referred to as parts, containing properties that collectively define how a document is rendered.
Technique: T1221: Template Injection
Adversaries can direct BACKSPACE to execute from the command line on infected hosts, or have BACKSPACE create a reverse shell.
Technique: T1059: Command and Scripting Interpreter
Emissary is capable of configuring itself as a service.
Technique: T1543: Create or Modify System Process
The text of the spearphishing email usually tries to give a plausible reason why the file should be filled-in, such as a request for information from a business associate.
Technique: T1598: Phishing for Information
Adversaries may also use local host files  in order to discover the hostname to IP address mappings of remote systems.
Technique: T1018: Remote System Discovery
Malicious modifications to network devices to enable traffic redirection may be possible through ROMMONkit or Patch System Image.
Technique: T1020: Automated Exfiltration
It can also run with ShellExecute.
Technique: T1106: Native API
JHUHUGIT has exploited CVE-2015-1701 and CVE-2015-2387 to escalate privileges.
Technique: T1068: Exploitation for Privilege Escalation
It also searches for ICS-related software files.
Technique: T1083: File and Directory Discovery
Drovorub can delete specific files from a compromised host.
Technique: T1070: Indicator Removal on Host
Nebulae can list files and directories on a compromised host.
Technique: T1083: File and Directory Discovery
Ke3chang performs discovery of permission groups net group /domain.
Technique: T1069: Permission Groups Discovery
ShimRat has installed shim databases in the AppPatch folder.
Technique: T1546: Event Triggered Execution
Operation Wocao has used scripts to detect security software.
Technique: T1518: Software Discovery
Emotet has been observed adding the downloaded payload to the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key to maintain persistence.
Technique: T1547: Boot or Logon Autostart Execution
APT28 has changed extensions on files containing exfiltrated data to make them appear benign, and renamed a web shell instance to appear as a legitimate OWA page.
Technique: T1036: Masquerading
If the permissions for users and groups are not properly set and allow access to the Registry keys for a service, adversaries may change the service's binPath/ImagePath to point to a different executable under their control.
Technique: T1574: Hijack Execution Flow
Higaisa sent the victim computer identifier in a User-Agent string back to the C2 server every 10 minutes.
Technique: T1029: Scheduled Transfer
ThiefQuest can download and execute payloads in-memory or from disk.
Technique: T1105: Ingress Tool Transfer
XCSSET prompts the user to input credentials using a native macOS dialog box leveraging the system process /Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment.
Technique: T1056: Input Capture
zwShell can obtain the victim PC name and OS version.
Technique: T1082: System Information Discovery
Ragnar Locker has used regsvr32.exe to execute components of VirtualBox.
Technique: T1218: Signed Binary Proxy Execution
Calisto uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.
Technique: T1074: Data Staged
Carberp has connected to C2 servers via HTTP.
Technique: T1071: Application Layer Protocol
Next, the buffer is encrypted using the RC4 algorithm with the 50-byte key (also stored in the backdoor’s body)
Technique: T1027: Obfuscated Files or Information
APT19 used HTTP for C2 communications.
Technique: T1071: Application Layer Protocol
BlackEnergy has used Systeminfo to gather the OS version, as well as information on the system configuration, BIOS, the motherboard, and the processor.
Technique: T1082: System Information Discovery
TrickBot can use secondary C2 servers for communication after establishing connectivity and relaying victim information to primary C2 servers.
Technique: T1008: Fallback Channels
SodaMaster can use RegOpenKeyW to access the Registry.
Technique: T1106: Native API
In some cases, cloud accounts may be federated with traditional identity management system, such as Window Active Directory.
Technique: T1078: Valid Accounts
HAMMERTOSS has used -WindowStyle hidden to conceal PowerShell windows.
Technique: T1564: Hide Artifacts
Grandoreiro can steal cookie data and credentials from Google Chrome.
Technique: T1555: Credentials from Password Stores
Adversaries may also employ a keylogger to similarly target other hardware tokens, such as RSA SecurID.
Technique: T1111: Two-Factor Authentication Interception
zwShell has been copied over network shares to move laterally.
Technique: T1021: Remote Services
Crimson can capture webcam video on targeted systems.
Technique: T1125: Video Capture
Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.
Technique: T1497: Virtualization/Sandbox Evasion