HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
TrickBot has used macros in Excel documents to download and deploy the malware on the user’s machine.
Technique: T1059: Command and Scripting Interpreter
SombRAT has the ability to use an embedded SOCKS proxy in C2 communications.
Technique: T1090: Proxy
Silent Librarian has exfiltrated entire mailboxes from compromised accounts.
Technique: T1114: Email Collection
Azorult can collect a list of running processes by calling CreateToolhelp32Snapshot.
Technique: T1057: Process Discovery
SeaDuke is capable of executing commands.
Technique: T1059: Command and Scripting Interpreter
HOPLIGHT has the capability to harvest credentials and passwords from the SAM database.
Technique: T1003: OS Credential Dumping
Kobalos's authentication and key exchange is performed using RSA-512.
Technique: T1573: Encrypted Channel
Duqu examines running system processes for tokens that have specific system privileges.
Technique: T1134: Access Token Manipulation
Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule.
Technique: T1114: Email Collection
Machete malware used FTP for C2.
Technique: T1071: Application Layer Protocol
BONDUPDATER can download or upload files from its C2 server.
Technique: T1105: Ingress Tool Transfer
The malware operates on victims’ systems as a svchost-based service and is capable of downloading executables, changing its own configuration, updating its own binaries, terminating its own processes, and activating and terminating denial-of-service attacks
Technique: T1543: Create or Modify System Process
Golden tickets enable adversaries to generate authentication material for any account in Active Directory.
Technique: T1558: Steal or Forge Kerberos Tickets
BabyShark has used dir to search for "programfiles" and "appdata".
Technique: T1083: File and Directory Discovery
OSInfo discovers the current domain information.
Technique: T1016: System Network Configuration Discovery
Pysa has extracted credentials from the password database before encrypting the files.
Technique: T1552: Unsecured Credentials
Adversaries may abuse these functionalities to hide otherwise visible windows from users so as not to alert the user to adversary activity on the system.
Technique: T1564: Hide Artifacts
Instead, an adversary can manipulate domain trusts to add their own signing certificate.
Technique: T1484: Domain Policy Modification
Dragonfly 2.0 has used various forms of spearphishing in attempts to get users to open links.
Technique: T1204: User Execution
WINERACK can enumerate active windows.
Technique: T1010: Application Window Discovery
Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment.
Technique: T1201: Password Policy Discovery
Tasks or services contain other fields, such as a description, that adversaries may attempt to make appear legitimate.
Technique: T1036: Masquerading
Similar to Process Hollowing, process doppelgänging involves replacing the memory of a legitimate process, enabling the veiled execution of malicious code that may evade defenses and detection.
Technique: T1055: Process Injection
Certain methods of executing a program  rely solely on the PATH environment variable to determine the locations that are searched for a program when the path for the program is not given.
Technique: T1574: Hijack Execution Flow
Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace.
Technique: T1574: Hijack Execution Flow
CARROTBAT has the ability to download and execute a remote file via certutil.
Technique: T1105: Ingress Tool Transfer
Information obtained could be used to gain an understanding of common software/applications running on systems within the network.
Technique: T1057: Process Discovery
PoisonIvy also creates a Registry entry modifying the Logical Disk Manager service to point to a malicious DLL dropped to disk.
Technique: T1543: Create or Modify System Process
SharpStage  has been used to target Arabic-speaking users and used code that checks if the compromised machine has the Arabic language installed.
Technique: T1614: System Location Discovery
The image is downloaded directly, and the shellcode is loaded and executed in memory
Technique: T1059: Command and Scripting Interpreter
Cadelspy has the ability to discover information about the compromised host.
Technique: T1082: System Information Discovery
It then sends the following IRC commands: NICK bxphzrjbxp USER bxphzrjbxp bxphzrjbxp bxphzrjbxp bxphzrjbxp To make sure it connected to the correct server, the Trojan checks for the message sent from the IRC server after the bot connects: Welcome to the MpkNet IRC Network The MPK bot does not join a specific IRC channel, instead sending private messages (PRIVMSG) to a user with the nick “mpk”
Technique: T1132: Data Encoding
Sandworm Team also collected a list of computers using specific software as part of its targeting efforts.
Technique: T1592: Gather Victim Host Information
Remsec schedules the execution one of its modules by creating a new scheduler task.
Technique: T1053: Scheduled Task/Job
Kinsing has created and run a Bitcoin cryptocurrency miner.
Technique: T1496: Resource Hijacking
Most utilities include functionality to encrypt and/or compress data.
Technique: T1560: Archive Collected Data
msiexec, odbcconf
Technique: T1218: Signed Binary Proxy Execution
APT29 collected emails from specific individuals, such as executives and IT staff, using New-MailboxExportRequest followed by Get-MailboxExportRequest.
Technique: T1114: Email Collection
One technique the group has used was to perform a WMI query SELECT * FROM MSAcpi_ThermalZoneTemperature to check the temperature to see if it’s running in a virtual environment.
Technique: T1497: Virtualization/Sandbox Evasion
Zeus Panda checks processes on the system and if they meet the necessary requirements, it injects into that process.
Technique: T1055: Process Injection
WinMM sets a WH_CBT Windows hook to collect information on process creation.
Technique: T1057: Process Discovery
StreamEx has the ability to enumerate processes.
Technique: T1057: Process Discovery
TEMP.Veles has obtained and used tools such as Mimikatz and PsExec.
Technique: T1588: Obtain Capabilities
Chimera has used credential stuffing against victim's remote services to obtain valid accounts.
Technique: T1110: Brute Force
Chaes has decrypted an AES encrypted binary file to trigger the download of other files.
Technique: T1140: Deobfuscate/Decode Files or Information
Webshell can issue commands via HTTP POST.
Technique: T1071: Application Layer Protocol
In order to move laterally from a compromised host, adversaries may take advantage of trust relationships established with other systems via public key authentication in active SSH sessions by hijacking an existing connection to another system.
Technique: T1563: Remote Service Session Hijacking
They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems.
Technique: T1027: Obfuscated Files or Information
There are several known examples of this occurring.
Technique: T1189: Drive-by Compromise
AppleScript
Technique: T1059: Command and Scripting Interpreter
APT-C-36 has used port 4050 for C2 communications.
Technique: T1571: Non-Standard Port
Adversaries may gather information about the victim's client configurations that can be used during targeting.
Technique: T1592: Gather Victim Host Information
Metamorfo has injected a malicious DLL into the Windows Media Player process .
Technique: T1055: Process Injection
4H RAT obfuscates C2 communication using a 1-byte XOR with the key 0xBE.
Technique: T1573: Encrypted Channel
Even though Delphi Cannon uses POP3S and SMTPS for its C2 communications like Cannon, it is arguably easier to defend against as it uses an actor owned domain that defenders can easily block and not a legitimate email provider such as Seznam
Technique: T1071: Application Layer Protocol
If an SMS message contained either a phone number, IMSI number, or keyword that matched the predefined list, it is saved to a CSV file for later theft by the threat actor.
Technique: T1119: Automated Collection
UEFI BIOS 
Technique: T1542: Pre-OS Boot
MuddyWater has used developed tools in Python including Out1.
Technique: T1059: Command and Scripting Interpreter
After running the malware, the batch script goes on to cleans up all signs of its existence on the system, this includes:  Deletion of all initial files created during installation, as well as all associated files required on disk during initial execution
Technique: T1070: Indicator Removal on Host
!DWN  Downloads a file from a specified URL
Technique: T1105: Ingress Tool Transfer
Web Distributed Authoring and Versioning  is also typically used by Windows systems as a backup protocol when SMB is blocked or fails.
Technique: T1187: Forced Authentication
Taidoor has modified the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run key for persistence.
Technique: T1547: Boot or Logon Autostart Execution
In Kubernetes, if an adversary has sufficient permissions, they may gain remote execution in a container in the cluster via interaction with the Kubernetes API server, the kubelet, or by running a command such as kubectl exec.
Technique: T1609: Container Administration Command
Depending on the browser, adversaries may also manipulate an extension's update url to install updates from an adversary controlled server or manipulate the mobile configuration file to silently install additional extensions.
Technique: T1176: Browser Extensions
Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails.
Technique: T1564: Hide Artifacts
2 Successful payload download Astaroth’s initial payload is a malicious .lnk file, a common delivery method used by threat actors
Technique: T1547: Boot or Logon Autostart Execution
Higaisa used JavaScript to execute additional files.
Technique: T1059: Command and Scripting Interpreter
Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.
Technique: T1082: System Information Discovery
Netsh.exe  is a command-line scripting utility used to interact with the network configuration of a system.
Technique: T1546: Event Triggered Execution
MegaCortex has checked the number of CPUs in the system to avoid being run in a sandbox or emulator.
Technique: T1497: Virtualization/Sandbox Evasion
Blue Mockingbird has used Mimikatz to retrieve credentials from LSASS memory.
Technique: T1003: OS Credential Dumping
FIN7 has conducted broad phishing campaigns using malicious links.
Technique: T1566: Phishing
AuditCred can search through folders and files on the system.
Technique: T1083: File and Directory Discovery
Bundlore creates a new key pair with ssh-keygen and drops the newly created user key in authorized_keys to enable remote login.
Technique: T1098: Account Manipulation
ShadowPad has used UDP for C2 communications.
Technique: T1095: Non-Application Layer Protocol
BitPaymer has used dynamic API resolution to avoid identifiable strings within the binary, including RegEnumKeyW.
Technique: T1106: Native API
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code.
Technique: T1053: Scheduled Task/Job
Patchwork has used spearphishing with links to try to get users to click, download and open malicious files.
Technique: T1204: User Execution
Adversaries may craft malicious stored procedures that can provide a persistence mechanism in SQL database servers.
Technique: T1505: Server Software Component
Xbash can create a Startup item for persistence if it determines it is on a Windows system.
Technique: T1547: Boot or Logon Autostart Execution
It was pretending to be an Adobe flash player update installer on a compromised website to lure users to click for the execution
Technique: T1036: Masquerading
Stolen Pencil sent spearphishing emails containing links to domains controlled by the threat actor.
Technique: T1566: Phishing
CosmicDuke searches attached and mounted drives for file extensions and keywords that match a predefined list.
Technique: T1083: File and Directory Discovery
Typical web servers and applications only require GET, POST, and HEAD.Where possible, minimize server fingerprinting by configuring web servers to avoid responding with banners identifying the server software and version number.Secure both the operating system and the application.Update and patch production servers regularly.Disable potentially harmful SQL-stored procedure calls.Sanitize and validate input to ensure that it is properly typed and does not contain escaped code.Consider using type-safe stored procedures and prepared statements.Audit transaction logs regularly for suspicious activity.Perform penetration testing on web services.Ensure error messages are generic and do not expose too much information.Permissions, Privileges, and Access ControlsSystem operators should take the following steps to limit permissions, privileges, and access controls.Reduce privileges to only those needed for a user’s duties.Restrict users’ ability (permissions) to install and run unwanted software applications, and apply the principle of “Least Privilege” to all systems and services
Technique: T1505: Server Software Component
Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level.
Technique: T1574: Hijack Execution Flow
HOPLIGHT has been observed enumerating system drives and partitions.
Technique: T1083: File and Directory Discovery
APT19 configured its payload to inject into the rundll32.exe.
Technique: T1218: Signed Binary Proxy Execution
Adversaries may craft various search engine queries depending on what information they seek to gather.
Technique: T1593: Search Open Websites/Domains
FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.
Technique: T1218: Signed Binary Proxy Execution
Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.
Technique: T1560: Archive Collected Data
Netwalker's DLL has also been embedded within the PowerShell script in hex format.
Technique: T1027: Obfuscated Files or Information
Tropic Trooper used letmein to scan for saved usernames on the target system.
Technique: T1033: System Owner/User Discovery
menuPass has used the Csvde tool to collect Active Directory files and data.
Technique: T1119: Automated Collection
In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user.
Technique: T1052: Exfiltration Over Physical Medium
Adversaries may search in different open databases depending on what information they seek to gather.
Technique: T1596: Search Open Technical Databases
Machete has distributed Machete through a fake blog website.
Technique: T1189: Drive-by Compromise
Threat Group-3390 has used CVE-2014-6324 to escalate privileges.
Technique: T1068: Exploitation for Privilege Escalation
Conficker variants used the Windows AUTORUN feature to spread through USB propagation.
Technique: T1091: Replication Through Removable Media
A Patchwork payload has searched all fixed drives on the victim for files matching a specified list of extensions.
Technique: T1083: File and Directory Discovery
One TYPEFRAME variant decrypts an archive using an RC4 key, then decompresses and installs the decrypted malicious DLL module.
Technique: T1140: Deobfuscate/Decode Files or Information
By default, XDG autostart entries are stored within the /etc/xdg/autostart or ~/.config/autostart directories and have a .desktop file extension.
Technique: T1547: Boot or Logon Autostart Execution
OilRig has created scheduled tasks that run a VBScript to execute a payload on victim machines.
Technique: T1053: Scheduled Task/Job
The time of the observed attacker activity coincides with Iran’s Daylight Time, which is +0430 UTC
Technique: T1124: System Time Discovery
BoomBox has the ability to download next stage malware components to a compromised system.
Technique: T1105: Ingress Tool Transfer
Higaisa used AES-128 to encrypt C2 traffic.
Technique: T1573: Encrypted Channel
PoisonIvy can inject a malicious DLL into a process.
Technique: T1055: Process Injection
RogueRobin uses a command prompt to run a PowerShell script from Excel.
Technique: T1059: Command and Scripting Interpreter
An APT3 downloader establishes SOCKS5 connections for its initial C2.
Technique: T1090: Proxy
Ebury can disable SELinux Role-Based Access Control and deactivate PAM modules.
Technique: T1562: Impair Defenses
Adversaries can collect or forward email from mail servers or clients.
Technique: T1114: Email Collection
Turla has used net accounts and net accounts /domain to acquire password policy information.
Technique: T1201: Password Policy Discovery
TA505 has signed payloads with code signing certificates from Thawte and Sectigo.
Technique: T1553: Subvert Trust Controls
WannaCry searches for variety of user files by file extension before encrypting them using RSA and AES, including Office, PDF, image, audio, video, source code, archive/compression format, and key and certificate files.
Technique: T1083: File and Directory Discovery
Tools such as PsExec and sc.exe can accept remote servers as arguments and may be used to conduct remote execution.
Technique: T1569: System Services
Root certificates  can also be cloned and reinstalled.
Technique: T1553: Subvert Trust Controls
Manipulating TLS callbacks may be performed by allocating and writing to specific offsets within a process’ memory space using other Process Injection techniques such as Process Hollowing.
Technique: T1055: Process Injection
FinFisher uses token manipulation with NtFilterToken as part of UAC bypass.
Technique: T1134: Access Token Manipulation
Sandworm Team has crafted phishing emails containing malicious hyperlinks.
Technique: T1566: Phishing
An adversary can create a new access token that duplicates an existing token using DuplicateToken.
Technique: T1134: Access Token Manipulation
Bonadan has maliciously altered the OpenSSH binary on targeted systems to create a backdoor.
Technique: T1554: Compromise Client Software Binary
Ragnar Locker has used rundll32.exe to execute components of VirtualBox.
Technique: T1218: Signed Binary Proxy Execution
During the macOS initialization startup, the launchd process loads the parameters for launch-on-demand system-level daemons from plist files found in /System/Library/LaunchDaemons/ and /Library/LaunchDaemons/.
Technique: T1543: Create or Modify System Process
Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network.
Technique: T1021: Remote Services
Active Setup is a Windows mechanism that is used to execute programs when a user logs in.
Technique: T1547: Boot or Logon Autostart Execution
An APT3 downloader first establishes a SOCKS5 connection to 192.157.198.103 using TCP port 1913; once the server response is verified, it then requests a connection to 192.184.60.229 on TCP port 81.
Technique: T1104: Multi-Stage Channels
GRIFFON has used a persistence module that stores the implant inside the Registry, which executes at logon.
Technique: T1547: Boot or Logon Autostart Execution
TajMahal has the ability to capture keystrokes on an infected host.
Technique: T1056: Input Capture
It also uses launchctl to unload all Launch Daemons when updating to a newer version of LoudMiner.
Technique: T1569: System Services
The at utility exists as an executable within Windows for scheduling tasks at a specified time and date.
Technique: T1053: Scheduled Task/Job
Avaddon encrypts the victim system using a combination of AES256 and RSA encryption schemes.
Technique: T1486: Data Encrypted for Impact
Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt.
Technique: T1056: Input Capture
Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network.
Technique: T1114: Email Collection
GuLoader can download further malware for execution on the victim's machine.
Technique: T1105: Ingress Tool Transfer
Eventually it will start new processes with the stored token attached.
Technique: T1134: Access Token Manipulation
The RAT, however, had a multitude of functionalities (as listed in the table below) such as to download and execute, compress, encrypt, upload, search directories, etc
Technique: T1105: Ingress Tool Transfer
jRAT can map UPnP ports.
Technique: T1120: Peripheral Device Discovery
FIN7 has used application shim databases for persistence.
Technique: T1546: Event Triggered Execution
Adversaries may access network configuration files to collect sensitive data about the device and the network.
Technique: T1602: Data from Configuration Repository
NDiskMonitor obtains the victim computer name and encrypts the information to send over its C2 channel.
Technique: T1082: System Information Discovery
mericcs.org 221.121.138.141 Domain used for spear phish sender e-mail address and to host malicious documents
Technique: T1016: System Network Configuration Discovery
The sudoers file, /etc/sudoers, describes which users can run which commands and from which terminals.
Technique: T1548: Abuse Elevation Control Mechanism
Silence has named its backdoor "WINWORD.exe".
Technique: T1036: Masquerading
Wizard Spider has used file deletion to remove some modules and configurations from an infected host after use.
Technique: T1070: Indicator Removal on Host
KGH_SPY can save collected system information to a file named "info" before exfiltration.
Technique: T1074: Data Staged
Previous to macOS 11, adversaries could silently install browser extensions via the command line using the profiles tool to install malicious .mobileconfig files.
Technique: T1176: Browser Extensions
menuPass has used net use to conduct connectivity checks to machines.
Technique: T1049: System Network Connections Discovery
Following the compromise of this system, analysts identified FIN6 leveraged stolen credentials to move laterally within the environment using the Windows’ Remote Desktop Protocol (RDP).
Technique: T1021: Remote Services
Olympic Destroyer uses WMI to help propagate itself across a network.
Technique: T1047: Windows Management Instrumentation
Siloscape uses Tor to communicate with C2.
Technique: T1090: Proxy
BADFLICK has relied upon users clicking on a malicious attachment delivered through spearphishing.
Technique: T1204: User Execution
Mustang Panda has created the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobelmdyU to maintain persistence.
Technique: T1547: Boot or Logon Autostart Execution
Astaroth uses ActiveX objects for file execution and manipulation.
Technique: T1218: Signed Binary Proxy Execution
Daserf can execute shell commands.
Technique: T1059: Command and Scripting Interpreter
Sibot can decrypt data received from a C2 and save to a file.
Technique: T1140: Deobfuscate/Decode Files or Information
SpicyOmelette has been executed through malicious links within spearphishing emails.
Technique: T1204: User Execution
CallMe exfiltrates data to its C2 server over the same protocol as C2 communications.
Technique: T1041: Exfiltration Over C2 Channel
Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system.
Technique: T1542: Pre-OS Boot
FruitFly executes and stores obfuscated Perl scripts.
Technique: T1027: Obfuscated Files or Information
njRAT can identify remote hosts on connected networks.
Technique: T1018: Remote System Discovery
Additionally, Rising Sun can decrypt its configuration data at runtime.
Technique: T1140: Deobfuscate/Decode Files or Information
TrickBot can steal passwords from the KeePass open source password manager.
Technique: T1555: Credentials from Password Stores
Dyre has the ability to create files in a TEMP folder to act as a database to store information.
Technique: T1074: Data Staged
Threat Group-3390 has detached network shares after exfiltrating files, likely to evade detection.
Technique: T1070: Indicator Removal on Host
yty packs a plugin with UPX.
Technique: T1027: Obfuscated Files or Information
For example, if C:\example path precedes C:\Windows\system32 is in the PATH environment variable, a program that is named net.exe and placed in C:\example path will be called instead of the Windows system "net" when "net" is executed from the command-line.
Technique: T1574: Hijack Execution Flow
XAgentOSX contains the getInfoOSX function to return the OS X version as well as the current user.
Technique: T1033: System Owner/User Discovery
Remote Service Session Hijacking differs from use of Remote Services because it hijacks an existing session rather than creating a new session using Valid Accounts.
Technique: T1563: Remote Service Session Hijacking
Metamorfo uses JavaScript to get the system time.
Technique: T1124: System Time Discovery
Zeus Panda can perform keylogging on the victim’s machine by hooking the functions TranslateMessage and WM_KEYDOWN.
Technique: T1056: Input Capture
Host enumeration and lateral movement After gaining an initial foothold in a compromised environment, the threat actors quickly identify and explore accessible systems
Technique: T1018: Remote System Discovery
WMI is an administration feature that provides a uniform environment to access Windows system components.
Technique: T1047: Windows Management Instrumentation
Cobalt Strike can use self signed Java applets to execute signed applet attacks.
Technique: T1553: Subvert Trust Controls
Taidoor can use TCP for C2 communications.
Technique: T1095: Non-Application Layer Protocol
Adversaries may use search engines to collect information about victims that can be used during targeting.
Technique: T1593: Search Open Websites/Domains
Turla has used the Registry to store encrypted payloads.
Technique: T1112: Modify Registry
Volgmer can execute commands on the victim's machine.
Technique: T1059: Command and Scripting Interpreter
Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.
Technique: T1574: Hijack Execution Flow
SUPERNOVA has masqueraded as a legitimate SolarWinds DLL.
Technique: T1036: Masquerading
Stored procedures can be invoked via SQL statements to the database using the procedure name or via defined events .
Technique: T1505: Server Software Component
Certificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free.
Technique: T1588: Obtain Capabilities
GOLD SOUTHFIELD has breached Managed Service Providers  to deliver malware to MSP customers.
Technique: T1199: Trusted Relationship
Thrip has used WinSCP to exfiltrate data from a targeted organization over FTP.
Technique: T1048: Exfiltration Over Alternative Protocol
Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured.
Technique: T1056: Input Capture
OceanSalt can collect the victim’s IP address.
Technique: T1016: System Network Configuration Discovery
Another Lazarus Group malware sample checks for the presence of the following Registry key:HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt.
Technique: T1012: Query Registry
Comnie appends a total of 64MB of garbage data to a file to deter any security products in place that may be scanning files on disk.
Technique: T1027: Obfuscated Files or Information
The group has also used downloaded encrypted payloads over HTTP.
Technique: T1071: Application Layer Protocol
The value is derived using the IOService to access the IOPlatformUUID property, which is equivalent to the “Hardware UUID” listed in the system information application, as seen in the Figure 3 screenshot of our analysis system
Technique: T1082: System Information Discovery
This is common behavior that can be used across different platforms and the network to evade defenses.
Technique: T1027: Obfuscated Files or Information
Machete has has relied on users opening malicious links delivered through spearphishing to execute malware.
Technique: T1204: User Execution
QakBot can inject itself into processes including explore.exe, Iexplore.exe, and Mobsync.exe.
Technique: T1055: Process Injection
NETWIRE can discover and collect victim system information.
Technique: T1082: System Information Discovery
HTTPBrowser deletes its original installer file once installation is complete.
Technique: T1070: Indicator Removal on Host
EvilBunny has used time measurements from 3 different APIs before and after performing sleep operations to check and abort if the malware is running in a sandbox.
Technique: T1497: Virtualization/Sandbox Evasion
Lokibot has the ability to discover the username on the infected host.
Technique: T1033: System Owner/User Discovery
Threat Group-1314 actors spawned shells on remote systems on a victim network to execute commands.
Technique: T1059: Command and Scripting Interpreter
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Technique: T1049: System Network Connections Discovery
Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.
Technique: T1003: OS Credential Dumping
Olympic Destroyer will shut down the compromised system after it is done modifying system configuration settings.
Technique: T1529: System Shutdown/Reboot
Adversaries can use purchased domains for a variety of purposes, including for Phishing, Drive-by Compromise, and Command and Control.
Technique: T1583: Acquire Infrastructure
Adversaries may abuse Unix shell commands and scripts for execution.
Technique: T1059: Command and Scripting Interpreter
Subdomain hijacking can occur when organizations have DNS entries that point to non-existent or deprovisioned resources.
Technique: T1584: Compromise Infrastructure
Daserf can download remote files.
Technique: T1105: Ingress Tool Transfer
UNC2452 exploited CVE-2020-0688 against the Microsoft Exchange Control Panel to regain access to a network.
Technique: T1190: Exploit Public-Facing Application
down_new has the ability to base64 encode C2 communications.
Technique: T1132: Data Encoding
Adversaries may upload backdoored files, such as application binaries, virtual machine images, or container images, to third-party software stores or repositories .
Technique: T1608: Stage Capabilities
JPIN can communicate over FTP.
Technique: T1071: Application Layer Protocol
Trojan.Karagany can dump passwords and save them into \ProgramData\Mail\MailAg\pwds.txt.
Technique: T1003: OS Credential Dumping
Lucifer can crash a debugger by passing a format string to OutputDebugStringA.
Technique: T1497: Virtualization/Sandbox Evasion
Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts.
Technique: T1110: Brute Force
BackConfig has the ability to use hidden columns in Excel spreadsheets to store executable files or commands for VBA macros.
Technique: T1137: Office Application Startup
SUNBURST source code used generic variable names and pre-obfuscated strings, and was likely sanitized of developer comments before being added to SUNSPOT.
Technique: T1027: Obfuscated Files or Information
Cobalt Strike can use Base64, URL-safe Base64, or NetBIOS encoding in its C2 traffic.
Technique: T1132: Data Encoding
BlackEnergy has removed the watermark associated with enabling the TESTSIGNING boot configuration option by removing the relevant strings in the user32.dll.mui of the system.
Technique: T1070: Indicator Removal on Host
Examples include Arp, ipconfig/ifconfig, nbtstat, and route.
Technique: T1016: System Network Configuration Discovery
GrimAgent has the ability to use HTTP for C2 communications.
Technique: T1071: Application Layer Protocol
APT12 has attempted to get victims to open malicious Microsoft Word and PDF attachment sent via spearphishing.
Technique: T1204: User Execution
Wiarp creates a backdoor through which remote attackers can create a service.
Technique: T1543: Create or Modify System Process
Security controls such as web content filters may not identify smuggled malicious files inside of HTML/JS files, as the content may be based on typically benign MIME types such as text/plain and/or text/html.
Technique: T1027: Obfuscated Files or Information
COM execution
Technique: T1021: Remote Services
Since the system only executes the first existing file in the listed order, adversaries have used ~/.bash_profile to ensure execution.
Technique: T1546: Event Triggered Execution
GALLIUM created high-privileged domain user accounts to maintain access to victim networks.
Technique: T1136: Create Account
PlugX can enumerate and query for information contained within the Windows Registry.
Technique: T1012: Query Registry
BOOSTWRITE has used the DWriteCreateFactory function to load additional modules.
Technique: T1129: Shared Modules
In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program.
Technique: T1574: Hijack Execution Flow
Machete has used pyobfuscate, zlib compression, and base64 encoding for obfuscation.
Technique: T1027: Obfuscated Files or Information
Cuba can query service status using QueryServiceStatusEx function.
Technique: T1007: System Service Discovery
VBScript is a default scripting language on Windows hosts and can also be used in place of JavaScript on HTML Application  webpages served to Internet Explorer .
Technique: T1059: Command and Scripting Interpreter
RedLeaves can obtain information about the logged on user both locally and for Remote Desktop sessions.
Technique: T1033: System Owner/User Discovery
OSInfo enumerates local and domain users USBferry can use net user to gather information about local accounts.
Technique: T1087: Account Discovery
During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from environment variables and files, such as LD_PRELOAD on Linux or DYLD_INSERT_LIBRARIES on macOS.
Technique: T1574: Hijack Execution Flow
Lazarus Group malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims.
Technique: T1048: Exfiltration Over Alternative Protocol
ZIRCONIUM has used GitHub to host malware linked in spearphishing e-mails.
Technique: T1583: Acquire Infrastructure
MegaCortex has used code signing certificates issued to fake companies to bypass security controls.
Technique: T1588: Obtain Capabilities
TAINTEDSCRIBE can randomly pick one of five hard-coded IP addresses for C2 communication; if one of the IP fails, it will wait 60 seconds and then try another IP address.
Technique: T1008: Fallback Channels
These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line.
Technique: T1564: Hide Artifacts
In some Linux systems, this is set by default to "ignoreboth" which covers both of the previous examples.
Technique: T1562: Impair Defenses
4
Technique: T1189: Drive-by Compromise
GravityRAT has been delivered via Word documents using DDE for execution.
Technique: T1559: Inter-Process Communication
One variant of BlackEnergy locates existing driver services that have been disabled and drops its driver component into one of those service's paths, replacing the legitimate executable.
Technique: T1574: Hijack Execution Flow
Several Ke3chang backdoors achieved persistence by adding a Run key.
Technique: T1547: Boot or Logon Autostart Execution
HTTPBrowser has used DLL side-loading.
Technique: T1574: Hijack Execution Flow
APT1 listed connected network shares.
Technique: T1135: Network Share Discovery
KONNI bypassed UAC with the “AlwaysNotify” settings.
Technique: T1548: Abuse Elevation Control Mechanism
Ramsay can hijack outdated Windows application dependencies with malicious versions of its own DLL payload.
Technique: T1574: Hijack Execution Flow
APT32 has also impersonated the legitimate Flash installer file name "install_flashplayer.exe".
Technique: T1036: Masquerading
Adversaries may execute active reconnaissance scans to gather information that can be used during targeting.
Technique: T1595: Active Scanning
APT41 has also environmentally keyed second stage malware with an RC5 key derived in part from the infected system's volume serial number.
Technique: T1480: Execution Guardrails
A JHUHUGIT variant encodes C2 POST data base64.
Technique: T1132: Data Encoding
Whitefly has used an open-source tool to exploit a known Windows privilege escalation vulnerability  on unpatched computers.
Technique: T1068: Exploitation for Privilege Escalation
APT39 has communicated with C2 through files uploaded to and downloaded from DropBox.
Technique: T1102: Web Service
Encrypting communications using AES and RSA public key cryptography   5
Technique: T1521: nan
CookieMiner has used a Unix shell script to run a series of commands targeting macOS.
Technique: T1059: Command and Scripting Interpreter
Adversaries may bridge network boundaries by modifying a network device’s Network Address Translation  configuration.
Technique: T1599: Network Boundary Bridging
The module loader can load DLLs:
* via specification of the  DLL pathname in the IMPORT directory;
* via EXPORT forwarded to another DLL, specified with  pathname ;
* via an NTFS junction or symlink program.exe.local with the fully-qualified or relative pathname of a directory containing the DLLs specified in the IMPORT directory or forwarded EXPORTs;
* via &#x3c;file name="filename.extension" loadFrom="fully-qualified or relative pathname"&#x3e; in an embedded or external "application manifest".
Technique: T1129: Shared Modules
Avaddon looks for and attempts to stop database processes.
Technique: T1489: Service Stop
SoreFang can enumerate domain groups by executing net.exe group /domain.
Technique: T1069: Permission Groups Discovery
APT37 injects its malware variant, ROKRAT, into the cmd.exe process.
Technique: T1055: Process Injection
Valak has the ability to enumerate running processes on a compromised host.
Technique: T1057: Process Discovery
After the C2 information has been collected, BADNEWS leverages HTTP for communication with the remote servers
Technique: T1071: Application Layer Protocol
POWERSTATS can deobfuscate the main backdoor code.
Technique: T1140: Deobfuscate/Decode Files or Information
HIDEDRV is a rootkit that hides certain operating system artifacts.
Technique: T1014: Rootkit
For example, adversaries may first create a malicious registry Class Identifier  subkey, which uniquely identifies a Component Object Model class object.
Technique: T1218: Signed Binary Proxy Execution
Sykipot injects itself into running instances of outlook.exe, iexplore.exe, or firefox.exe.
Technique: T1055: Process Injection
These entries will allow an application to automatically start during the startup of a desktop environment after user logon.
Technique: T1547: Boot or Logon Autostart Execution
TLS callback injection involves manipulating pointers inside a portable executable  to redirect a process to malicious code before reaching the code's legitimate entry point.
Technique: T1055: Process Injection
By modifying the instructions stored in the system image file, adversaries may either weaken existing defenses or provision new capabilities that the device did not have before.
Technique: T1601: Modify System Image
Ursnif has gathered information about running processes.
Technique: T1057: Process Discovery
Chimera has used net start and net use for system service discovery.
Technique: T1007: System Service Discovery
BONDUPDATER uses -windowstyle hidden to conceal a PowerShell window that downloads a payload.
Technique: T1564: Hide Artifacts
BlackEnergy injects its DLL component into svchost.exe.
Technique: T1055: Process Injection
MuddyWater has used malware that leveraged WMI for execution and querying host information.
Technique: T1047: Windows Management Instrumentation
FIN6 has used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.
Technique: T1059: Command and Scripting Interpreter
The majority of documents used the name “gerry knight” for the author field in the document metadata, and the embedded macros largely used direct IP connections to command and control (C2) servers rather than using domain names
Technique: T1102: Web Service
HotCroissant can perform dynamic DLL importing and API lookups using LoadLibrary and GetProcAddress on obfuscated strings.
Technique: T1106: Native API
Dragonfly 2.0 manipulated .lnk files to gather user credentials in conjunction with Forced Authentication.
Technique: T1547: Boot or Logon Autostart Execution
TeamTNT has checked for running containers with docker ps and for specific container names with docker inspect.
Technique: T1613: Container and Resource Discovery
The actor has used several notable techniques in these incidents such as sniffing passwords from Wi-Fi traffic, poisoning the NetBIOS Name Service, and spreading laterally via the EternalBlue exploit.  APT28 Uses Malicious Document to Target Hospitality Industry FireEye has uncovered a malicious document sent in spear phishing emails to multiple companies in the hospitality industry, including hotels in at least seven European countries and one Middle Eastern country in early July
Technique: T1566: Phishing
Hancitor has used Base64 to encode malicious links.
Technique: T1027: Obfuscated Files or Information
GALLIUM has used PsExec to move laterally between hosts in the target network.
Technique: T1570: Lateral Tool Transfer
Audio files may be written to disk and exfiltrated later.
Technique: T1123: Audio Capture
Adversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic  with Web Protocols or even enabling Adversary-in-the-Middle if the certificate is trusted or otherwise added to the root of trust  Install Root Certificate.
Technique: T1588: Obtain Capabilities
A OilRig macro has run a PowerShell command to decode file contents.
Technique: T1140: Deobfuscate/Decode Files or Information
By abusing features of common networking protocols that can determine the flow of network traffic , adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.
Technique: T1557: Adversary-in-the-Middle
SodaMaster can identify the username on a compromised host.
Technique: T1033: System Owner/User Discovery
POSHSPY uses a WMI event subscription to establish persistence.
Technique: T1546: Event Triggered Execution
HALFBAKED can use WMI queries to gather system information.
Technique: T1047: Windows Management Instrumentation
APT29 drops a Windows shortcut file for execution.
Technique: T1547: Boot or Logon Autostart Execution
Trojan.Karagany can use Tasklist to collect a list of running tasks.
Technique: T1057: Process Discovery
TrickBot can identify the groups the user on a compromised host belongs to.
Technique: T1069: Permission Groups Discovery
Upon opening the attachment , the adversary's payload exploits a vulnerability or directly executes on the user's system.
Technique: T1566: Phishing
NanHaiShu can change Internet Explorer settings to reduce warnings about malware activity.
Technique: T1562: Impair Defenses
WellMess can execute command line scripts received from C2.
Technique: T1059: Command and Scripting Interpreter
Crimson can determine when it has been installed on a host for at least 15 days before downloading the final payload.
Technique: T1497: Virtualization/Sandbox Evasion
Sandworm Team used a backdoor to enumerate information about the infected system's operating system.
Technique: T1082: System Information Discovery
Ramsay has been embedded in documents exploiting CVE-2017-0199, CVE-2017-11882, and CVE-2017-8570.
Technique: T1203: Exploitation for Client Execution
In our analysis, the macro is obfuscated, character by character, using the decimal ASCII code
Technique: T1027: Obfuscated Files or Information
BADNEWS encrypts C2 data with a ROR by 3 and an XOR by 0x23.
Technique: T1573: Encrypted Channel
APT28 has used a brute-force/password-spray tooling that operated in two modes: in brute-force mode it typically sent over 300 authentication attempts per hour per targeted account over the course of several hours or days.
Technique: T1110: Brute Force
This technique bypasses Windows file access controls as well as file system monitoring tools.
Technique: T1006: Direct Volume Access
An adversary may monitor vulnerability disclosures/databases to understand the state of existing, as well as newly discovered, vulnerabilities.
Technique: T1588: Obtain Capabilities
BBSRAT has been loaded through DLL side-loading of a legitimate Citrix executable that is set to persist through the Registry Run key location HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ssonsvr.exe.
Technique: T1547: Boot or Logon Autostart Execution
Similar to the case of MBR, an adversary who has raw access to the boot drive may overwrite the VBR to divert execution during startup to adversary code.
Technique: T1542: Pre-OS Boot
Ecipekac has used a valid, legitimate digital signature to evade detection.
Technique: T1553: Subvert Trust Controls
Adversaries may leverage the resources of co-opted systems in order to solve resource intensive problems which may impact system and/or hosted service availability.
Technique: T1496: Resource Hijacking
WellMess can decode and decrypt data received from C2.
Technique: T1140: Deobfuscate/Decode Files or Information
Wizard Spider has used SMB to drop Cobalt Strike Beacon on a domain controller for lateral movement.
Technique: T1021: Remote Services
Navigating to the web page manually to view:source reveals the code, which at the time of writing happened to not be obfuscated in any significant way
Technique: T1027: Obfuscated Files or Information
PUNCHBUGGY can gather user names.
Technique: T1087: Account Discovery
Ramsay has used HTTP for C2.
Technique: T1071: Application Layer Protocol
WellMess can communicate to C2 with mutual TLS where client and server mutually check certificates.
Technique: T1573: Encrypted Channel
APT40 relies heavily on web shells for an initial foothold into an organization
Technique: T1505: Server Software Component
Dragonfly 2.0 modified the Registry to perform multiple techniques through the use of Reg.
Technique: T1112: Modify Registry
APT12 closely monitors online media related to its tools and operations and reacts when its tools are publicly disclosed
Technique: T1518: Software Discovery
The TrickBot downloader has used an icon to appear as a Microsoft Word document.
Technique: T1036: Masquerading
Darkhotel has searched for anti-malware strings and anti-virus processes running on the system.
Technique: T1518: Software Discovery
MoonWind has a command to return a directory listing for a specified directory.
Technique: T1083: File and Directory Discovery
Documents with the Flash exploit managed to evade static defenses and remain undetected as an exploit on VirusTotal
Technique: T1068: Exploitation for Privilege Escalation
One variant of Zebrocy uses WMI queries to gather information.
Technique: T1047: Windows Management Instrumentation
Command and control  information can be encoded using a non-standard data encoding system that diverges from existing protocol specifications.
Technique: T1132: Data Encoding
RDAT can communicate with the C2 via base32-encoded subdomains.
Technique: T1132: Data Encoding
Dragonfly 2.0 added newly created accounts to the administrators group to maintain elevated access.
Technique: T1098: Account Manipulation