HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
Technique: T1547: Boot or Logon Autostart Execution
If any directories are listed in the PATH environment variable before the Windows directory, %SystemRoot%\system32 , a program may be placed in the preceding directory that is named the same as a Windows program , which will be executed when that command is executed from a script or command-line.
Technique: T1574: Hijack Execution Flow
ComRAT can execute PowerShell scripts loaded into memory or from the file system.
Technique: T1059: Command and Scripting Interpreter
Machete renamed payloads to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python executables.
Technique: T1036: Masquerading
Figure 1: Malicious FIN7 lure asking victim to double click to unlock contents The malicious LNK launches “mshta.exe” with the following arguments passed to it: vbscript:Execute("On Error Resume Next:set w=GetObject(,""Word.Application""):execute w.ActiveDocument.Shapes(2).TextFrame.TextRange.Text:close") The script in the argument combines all the textbox contents in the document and executes them, as seen in Figure 2
Technique: T1204: User Execution
Rocke has compiled malware, delivered to victims as .c files, with the GNU Compiler Collection .
Technique: T1027: Obfuscated Files or Information
Volatile Cedar can inject web shell code into a server.
Technique: T1505: Server Software Component
Magic Hound used FireMalv, custom-developed malware, which collected passwords from the Firefox browser storage.
Technique: T1555: Credentials from Password Stores
EvilBunny has used the API calls NtQuerySystemTime, GetSystemTimeAsFileTime, and GetTickCount to gather time metrics as part of its checks to see if the malware is running in a sandbox.
Technique: T1124: System Time Discovery
Restricting these privileges may prevent malware from running or limit its capability to spread through the network.Carefully consider the risks before granting administrative rights to users on their own machines.Scrub and verify all administrator accounts regularly.Configure Group Policy to restrict all users to only one login session, where possible.Enforce secure network authentication, where possible.Instruct administrators to use non-privileged accounts for standard functions such as web browsing or checking webmail.Segment networks into logical enclaves and restrict host-to-host communication paths
Technique: T1087: Account Discovery
There is usually a delay between when a vulnerability is discovered and when it is made public.
Technique: T1588: Obtain Capabilities
Carberp has used the NtQueryDirectoryFile and ZwQueryDirectoryFile functions to hide files and directories.
Technique: T1106: Native API
Cobalt Strike can modify Registry values within HKEY_CURRENT_USER\Software\Microsoft\Office\<Excel Version>\Excel\Security\AccessVBOM\ to enable the execution of additional code.
Technique: T1112: Modify Registry
Adversaries may communicate using a protocol and port paring that are typically not associated.
Technique: T1571: Non-Standard Port
ZxShell is injected into a shared SVCHOST process.
Technique: T1055: Process Injection
NETWIRE has been executed through convincing victims into clicking malicious links.
Technique: T1204: User Execution
MSBuild will compile and execute the inline task.
Technique: T1127: Trusted Developer Utilities Proxy Execution
Ramsay can collect directory and file lists.
Technique: T1083: File and Directory Discovery
Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.
Technique: T1218: Signed Binary Proxy Execution
Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture audio.
Technique: T1123: Audio Capture
Volatile Cedar has targeted publicly facing web servers, with both automatic and manual vulnerability discovery.
Technique: T1190: Exploit Public-Facing Application
SUNBURST used DNS for C2 traffic designed to mimic normal SolarWinds API communications.
Technique: T1071: Application Layer Protocol
This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations.
Technique: T1027: Obfuscated Files or Information
APT39 has used malware disguised as Mozilla Firefox and a tool named mfevtpse.exe to proxy C2 communications, closely mimicking a legitimate McAfee file mfevtps.exe.
Technique: T1036: Masquerading
BBSRAT has been seen persisting via COM hijacking through replacement of the COM object for MruPidlList {42aedc87-2188-41fd-b9a3-0c966feabec1} or Microsoft WBEM New Event Subsystem {F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} depending on the system's CPU architecture.
Technique: T1546: Event Triggered Execution
Gamaredon Group has delivered self-extracting 7z archive files within malicious document attachments, and used obfuscated or encrypted scripts.
Technique: T1027: Obfuscated Files or Information
Then pastebin.com, github.com, mailimg.com, upload.cat, dev-point.com and pomf.cat were used as channels for the different malware stages before achieving a full RAT implementation, which then communicates with the corresponding C2 server
Technique: T1102: Web Service
Carberp has collected a list of running processes.
Technique: T1057: Process Discovery
Rocke has deleted files on infected machines.
Technique: T1070: Indicator Removal on Host
Mis-Type network traffic can communicate over HTTP.
Technique: T1071: Application Layer Protocol
yty gathers the computer name, the serial number of the main disk volume, CPU information, Microsoft Windows version, and runs the command systeminfo.
Technique: T1082: System Information Discovery
The Windows security identifier  is a unique value that identifies a user or group account.
Technique: T1134: Access Token Manipulation
Adversaries can abuse this to operate without leaving traces by simply prepending a space to all of their terminal commands.
Technique: T1562: Impair Defenses
Wizard Spider has used valid credentials for privileged accounts with the goal of accessing domain controllers.
Technique: T1078: Valid Accounts
Lucifer can clear and remove event logs.
Technique: T1070: Indicator Removal on Host
These strings have the following format:uuid=[Victim ID]#un=[Username]#cn=[Hostname]#on=[OS Version]#lan=[IP Address]#nop=#ver=1.0uuid=[Victim ID]#un=[Username]#An example of the first string may be seen below:uuid=e29ac6c0-7037-11de-816d-806e6f6e696351c5#un=Josh Grunzweig#cn=WIN-LJLV2NKIOKP#on=mav6miv1#lan=192.168.217.141#nop=#ver=1.0It should be noted that the variables used for this string are different from previous versions
Technique: T1033: System Owner/User Discovery
CosmicDuke uses a keylogger.
Technique: T1056: Input Capture
capture video 
Technique: T1125: Video Capture
The generated buffer is encoded using the BASE64 alphabet to be sent in the POST request
Technique: T1132: Data Encoding
The Penquin C2 mechanism is based on TCP and UDP packets.
Technique: T1095: Non-Application Layer Protocol
PE injection is a method of executing arbitrary code in the address space of a separate live process.
Technique: T1055: Process Injection
APT30 may have used the SHIPSHAPE malware to move onto air-gapped networks.
Technique: T1091: Replication Through Removable Media
KARAE was distributed through torrent file-sharing websites to South Korean victims, using a YouTube video downloader application as a lure.
Technique: T1189: Drive-by Compromise
template injeciton
Technique: T1221: Template Injection
MarkiRAT can drop its payload into the Startup directory to ensure it automatically runs when the compromised system is started.
Technique: T1547: Boot or Logon Autostart Execution
Local Accounts may also be abused to elevate privileges and harvest credentials through OS Credential Dumping.
Technique: T1078: Valid Accounts
The QakBot payload has been disguised as a PNG file.
Technique: T1036: Masquerading
Octopus has used wmic.exe for local discovery information.
Technique: T1047: Windows Management Instrumentation
TAINTEDSCRIBE can execute GetLocalTime for time discovery.
Technique: T1124: System Time Discovery
The oldest known sample of the Delphi variant (SHA256: 5a02d4e5f6…) provided us a much stronger linkage between this Delphi Cannon and Cannon, as this sample collects system information and sends it to the C2 email address, which includes the path of the running process appended to the string Running place
Technique: T1057: Process Discovery
Wizard Spider has used stolen credentials to copy tools into the %TEMP% directory of domain controllers.
Technique: T1570: Lateral Tool Transfer
These user actions will typically be observed as follow-on behavior from forms of Phishing.
Technique: T1204: User Execution
Authentication processes generally require a valid identity  along with one or more authentication factors .
Technique: T1550: Use Alternate Authentication Material
Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as  Ping or net view using Net.
Technique: T1018: Remote System Discovery
Dragonfly has performed forced authentication to gather hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems.
Technique: T1187: Forced Authentication
TAINTEDSCRIBE uses a Linear Feedback Shift Register  algorithm for network encryption.
Technique: T1573: Encrypted Channel
Catchamas creates three Registry keys to establish persistence by adding a Windows Service.
Technique: T1112: Modify Registry
It allows a user to connect to another system via an encrypted tunnel, commonly authenticating through a password, certificate or the use of an asymmetric encryption key pair.
Technique: T1563: Remote Service Session Hijacking
BADCALL modifies the firewall Registry key SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfileGloballyOpenPorts\\List.
Technique: T1112: Modify Registry
Both create one thread, and each thread is responsible for either downloading and executing the file or running a command line program in the terminal:   Figure 28. Commands used for downloading and executing, and running a command in terminal   Figure 29. Commands used in uploading and downloading file Figure 30
Technique: T1059: Command and Scripting Interpreter
Nebulae can use RC4 and XOR to encrypt C2 communications.
Technique: T1573: Encrypted Channel
The group has also set the creation time of the files dropped by the second stage of the exploit to match the creation time of kernel32.dll.
Technique: T1070: Indicator Removal on Host
As mentioned previously, Buckeye also uses a number of hacking tools, including the following: Keylogger: The keylogger is configured using the command line parameters: NetworkService, Replace, Install, Register and Unregister
Technique: T1056: Input Capture
APIs and strings in some TYPEFRAME variants are RC4 encrypted.
Technique: T1027: Obfuscated Files or Information
Ixeshe is capable of executing commands via cmd.
Technique: T1059: Command and Scripting Interpreter
Adversaries may use exploits during various phases of the adversary lifecycle  Exploit Public-Facing Application, Exploitation for Client Execution, Exploitation for Privilege Escalation, Exploitation for Defense Evasion, Exploitation for Credential Access, Exploitation of Remote Services, and Application or System Exploitation.
Technique: T1587: Develop Capabilities
FELIXROOT gathers the time zone information from the victim’s machine.
Technique: T1124: System Time Discovery
It also allows macro code to access internal VBA objects for stealthier macro code execution in future attacks
Technique: T1140: Deobfuscate/Decode Files or Information
Cannon adds the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
The various commands are then listed as subkeys underneath the shell key at HKEY_CLASSES_ROOT\handler\shell\action\command.
Technique: T1546: Event Triggered Execution
If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency  channel.
Technique: T1011: Exfiltration Over Other Network Medium
ZxShell has a command to perform video device spying.
Technique: T1125: Video Capture
Adversaries may take control of preexisting sessions with remote services to move laterally in an environment.
Technique: T1563: Remote Service Session Hijacking
Andariel has used a variety of publicly-available remote access Trojans  for its operations.
Technique: T1588: Obtain Capabilities
Persistence can also be achieved by modifying the LSEnvironment key in the application's Info.plist file.
Technique: T1547: Boot or Logon Autostart Execution
Lazarus Group replaced the background wallpaper of systems with a threatening image after rendering the system unbootable with a Disk Structure Wipe
Technique: T1491: Defacement
Proton gathers credentials in files for keychains.
Technique: T1555: Credentials from Password Stores
HAMMERTOSS is controlled via commands that are appended to image files.
Technique: T1001: Data Obfuscation
Calisto adds a .plist file to the /Library/LaunchAgents folder to maintain persistence.
Technique: T1543: Create or Modify System Process
APT38 used a Trojan called KEYLIME to collect data from the clipboard.
Technique: T1115: Clipboard Data
3PARA RAT has a command to retrieve metadata for files on disk as well as a command to list the current working directory.
Technique: T1083: File and Directory Discovery
Waterbear has used RC4 encrypted shellcode.
Technique: T1027: Obfuscated Files or Information
Derusbi is capable of obtaining directory, file, and drive listings.
Technique: T1083: File and Directory Discovery
Trojan.Karagany can detect commonly used and generic virtualization platforms based primarily on drivers and file paths.
Technique: T1497: Virtualization/Sandbox Evasion
Similar to Reaver as posted by Palo Alto, it gets the IP or domain of the C&C server, the port, name of the binary, a sleep timer, and what Palo Alto calls a “campaign identifier.” Technical Details At this moment, we were unable to retrieve the original infection vector and other information regarding what other tools the APT15 group is using to attack their targets
Technique: T1016: System Network Configuration Discovery
APT38 have enumerated files and directories, or searched in specific locations within a compromised host.
Technique: T1083: File and Directory Discovery
Grandoreiro has infected victims via malicious attachments.
Technique: T1204: User Execution
BBK has the ability to use cmd to run a Portable Executable  on the compromised host.
Technique: T1059: Command and Scripting Interpreter
Indrik Spider has used malicious JavaScript files for several components of their attack.
Technique: T1059: Command and Scripting Interpreter
Once executed, Vcrodat loads an encrypted payload on to the victim’s computer.
Technique: T1027: Obfuscated Files or Information
Commands such as net group /domain of the Net utility,  dscacheutil -q group on macOS, and ldapsearch on Linux can list domain-level groups.
Technique: T1069: Permission Groups Discovery
XCSSET collects contacts and application data from files in Desktop, Documents, Downloads, Dropbox, and WeChat folders.
Technique: T1005: Data from Local System
In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.
Technique: T1070: Indicator Removal on Host
GravityRAT collects the volumes mapped on the system, and also steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.
Technique: T1083: File and Directory Discovery
Information from these scans may reveal opportunities for other forms of reconnaissance  or Search Open Technical Databases, establishing operational resources  or Obtain Capabilities, and/or initial access  or Exploit Public-Facing Application.
Technique: T1595: Active Scanning
IcedID has been executed through Word documents with malicious embedded macros.
Technique: T1204: User Execution
POSHSPY encrypts C2 traffic with AES and RSA.
Technique: T1573: Encrypted Channel
Similar to TFTP Boot, an adversary may upgrade the ROMMON image locally or remotely  with adversary code and restart the device in order to overwrite the existing ROMMON image.
Technique: T1542: Pre-OS Boot
This targeting of third party organizations to attack further targets is a risky move on the attackers’ part, as it potentially reveals their activity within the compromised third party organizations to the new target (those receiving the malicious documents  Making sense of MuddyWater When we looked at the cluster of activity which consisted of what appeared to be espionage-focused attacks in the Middle East, we were somewhat confused as the previous public reporting had attributed these attacks to FIN7
Technique: T1189: Drive-by Compromise
By responding to LLMNR/NBT-NS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system.
Technique: T1557: Adversary-in-the-Middle
Flash object in the .docx file, stored in uncompressed format The Flash object contains an ActionScript which is responsible for extracting the exploit using a custom packer seen in other FinSpy exploits
Technique: T1027: Obfuscated Files or Information
Crimson can spread across systems by infecting removable media.
Technique: T1091: Replication Through Removable Media
BISCUIT malware contains a secondary fallback command and control server that is contacted after the primary command and control server.
Technique: T1008: Fallback Channels
Threat Group-3390 has used PowerShell for execution.
Technique: T1059: Command and Scripting Interpreter
OopsIE has the capability to delete files and scripts from the victim's machine.
Technique: T1070: Indicator Removal on Host
MuddyWater has distributed URLs in phishing e-mails that link to lure documents.
Technique: T1204: User Execution
Derusbi is capable of capturing video.
Technique: T1125: Video Capture
Zebrocy stores all collected information in a single file before exfiltration.
Technique: T1074: Data Staged
Lucifer can exploit multiple vulnerabilities including EternalBlue  and EternalRomance .
Technique: T1210: Exploitation of Remote Services
Hydraq creates a backdoor through which remote attackers can retrieve IP addresses of compromised machines.
Technique: T1016: System Network Configuration Discovery
Some Reaver variants use HTTP for C2.
Technique: T1071: Application Layer Protocol
Caterpillar WebShell has a module to download and upload files to the system.
Technique: T1105: Ingress Tool Transfer
Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Technique: T1053: Scheduled Task/Job
StrongPity can use HTTP and HTTPS in C2 communications.
Technique: T1071: Application Layer Protocol
HTTPBrowser is capable of writing a file to the compromised system from the C2 server.
Technique: T1105: Ingress Tool Transfer
Carbanak downloads an executable and injects it directly into a new process.
Technique: T1055: Process Injection
Kimsuky has used RDP to establish persistence.
Technique: T1133: External Remote Services
Input capture mechanisms may be transparent to the user  or rely on deceiving the user into providing input into what they believe to be a genuine service .
Technique: T1056: Input Capture
Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.
Technique: T1124: System Time Discovery
APT3 has a tool that can copy files to remote machines.
Technique: T1105: Ingress Tool Transfer
Outlook forms are used as templates for presentation and functionality in Outlook messages.
Technique: T1137: Office Application Startup
This callback function will call a function named pressedKeyWithKeyCode, which is responsible for logging the keystrokes
Technique: T1056: Input Capture
FIN5 has used the open source tool Essential NetTools to map the network and build a list of targets.
Technique: T1018: Remote System Discovery
HAWKBALL has created a cmd.exe reverse shell, executed commands, and uploaded output via the command line.
Technique: T1059: Command and Scripting Interpreter
APT19 attempted to get users to launch malicious attachments delivered via spearphishing emails.
Technique: T1204: User Execution
Figure 2 Code that issues DNS query to gogle.co if a debugger is detected All DNS requests issued by RogueRobin use the built in nslookup.exe application to communicate to the C2 server and the Trojan will use a variety of regular expressions to extract data from the DNS response
Technique: T1071: Application Layer Protocol
TeamTNT has used the open-source rootkit Diamorphine to hide cryptocurrency mining activities on the machine.
Technique: T1014: Rootkit
Comnie executes a batch script to store discovery information in %TEMP%\info.dat and then uploads the temporarily file to the remote C2 server.
Technique: T1119: Automated Collection
Olympic Destroyer uses the native Windows utilities vssadmin, wbadmin, and bcdedit to delete and disable operating system recovery features such as the Windows backup catalog and Windows Automatic Repair.
Technique: T1490: Inhibit System Recovery
TA505 has executed commands using cmd.exe.
Technique: T1059: Command and Scripting Interpreter
yty contains several references to football  in a likely attempt to disguise its traffic.
Technique: T1036: Masquerading
APT28 uses cmd.exe to execute commands and custom backdoors.
Technique: T1059: Command and Scripting Interpreter
Operation Wocao has discovered network disks mounted to the system using netstat.
Technique: T1135: Network Share Discovery
Bazar has used XOR, RSA2, and RC4 encrypted files.
Technique: T1027: Obfuscated Files or Information
Fox Kitten has used 7-Zip to archive data.
Technique: T1560: Archive Collected Data
ChChes can encode C2 data with a custom technique that utilizes Base64.
Technique: T1132: Data Encoding
Our observation of related actions here:    u ps start password stealing (Windows)   Ps_mps/ps_hwi start start password stealing (Linux, MIPS,  ARM)   uper_mps/uper_hwi start rewrite hook module with a new version and launch it (Linux, MIPS, ARM)   Nm_mps/nm_hwi start  –ban -middle Scan ports and retrieve banners on the router subnet  (Linux, MIPS,  ARM)   U fsget * 7 *.docx, *.pdf, *.doc * search for docs with the given filetypes (Windows)   S sinfo retrieve information on installed programs and launch commands: systeminfo, tasklist, ipconfig, netstat, route print, tracert www.google.com (Windows)   weap_mps/weap_hwi host188.128.123.52 port[25,26,110,465,995]  typetcpconnect DDoS on 188.128.123.52 (Linux, MIPS,  ARM)   weap_mps/weap_hwi  typesynflood port80 cnt100000 spdmedium host212.175.109.10 DDoS on 212.175.109.10 (Linux, MIPS,  ARM)    The issued commands for the Linux plugins suggest the attackers controlled infected MIPS/ARM devices. We want to pay special attention to the DDoS commands meant for these routers
Technique: T1003: OS Credential Dumping
Backdoor.Oldrea injects itself into explorer.exe.
Technique: T1055: Process Injection
Operating systems may have mechanisms for automatically running a program on system boot or account logon.
Technique: T1547: Boot or Logon Autostart Execution
PinchDuke searches for files created within a certain timeframe and whose file extension matches a predefined list.
Technique: T1083: File and Directory Discovery
After selecting a payload URL, the script will create copies of certutil and regsvr32 to the temp directory for later use
Technique: T1218: Signed Binary Proxy Execution
Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals.
Technique: T1588: Obtain Capabilities
Mustang Panda has created a scheduled task to execute additional malicious software, as well as maintain persistence.
Technique: T1053: Scheduled Task/Job
The document brought Talos a new gift - a new version of ROKRAT
Technique: T1543: Create or Modify System Process
InvisiMole has used scheduled tasks named MSST and \Microsoft\Windows\Autochk\Scheduled to establish persistence.
Technique: T1053: Scheduled Task/Job
When Duqu is active, the operating system believes that the driver is legitimate, as it has been signed with a valid private key.
Technique: T1543: Create or Modify System Process
TA551 has used a DGA to generate URLs from executed macros.
Technique: T1568: Dynamic Resolution
KGH_SPY can execute PowerShell commands on the victim's machine.
Technique: T1059: Command and Scripting Interpreter
Ursnif has used hooked APIs to take screenshots.
Technique: T1113: Screen Capture
The .lnk file extracted from the .7zip file
Technique: T1547: Boot or Logon Autostart Execution
We found a mechanism for decrypting, executing, and downloading an additional payload from the C&C server.
Technique: T1105: Ingress Tool Transfer
DEATHRANSOM can use loop operations to enumerate directories on a compromised host.
Technique: T1083: File and Directory Discovery
While Malicious File frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it.
Technique: T1204: User Execution
Mimikatz The threat actors also uploaded tools to scan for and exploit potential vulnerabilities in the network, such as the well-known SMB vulnerability patched in commonly exploited by EternalBlue to move laterally to other systems on the network.
Technique: T1046: Network Service Scanning
Cobalt Strike can recover hashed passwords.
Technique: T1003: OS Credential Dumping
Maze has injected the malware DLL into a target process.
Technique: T1055: Process Injection
Threat Group-1314 actors used compromised domain credentials for the victim's endpoint management platform, Altiris, to move laterally.
Technique: T1078: Valid Accounts
Before writing to disk, Kwampirs inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.
Technique: T1027: Obfuscated Files or Information
Figure 6: SpeakUp receives additional commands to execute, this time in plain text
Technique: T1059: Command and Scripting Interpreter
For example, if the path in a shortcut is C:\program files\myapp.exe, an adversary may create a program at C:\program.exe that will be run instead of the intended program.
Technique: T1574: Hijack Execution Flow
njRAT has used the ShellExecute function within a script.
Technique: T1106: Native API
Zeus Panda encrypts strings with XOR and obfuscates the macro code from the initial payload.
Technique: T1027: Obfuscated Files or Information
Similar to a standard ACL, DACLs identifies the accounts that are allowed or denied access to a securable object.
Technique: T1222: File and Directory Permissions Modification
Known as DNS over HTTPS , queries to resolve C2 infrastructure may be encapsulated within encrypted HTTPS packets.
Technique: T1572: Protocol Tunneling
PLAINTEE performs the tasklist command to list running processes.
Technique: T1057: Process Discovery
Explosive has encrypted communications with the RC4 method.
Technique: T1573: Encrypted Channel
Elise configures itself as a service.
Technique: T1543: Create or Modify System Process
FELIXROOT checks for installed security software like antivirus and firewall.
Technique: T1518: Software Discovery
LoudMiner has monitored CPU usage.
Technique: T1082: System Information Discovery
It is created as a separate process instead of child process of Office applications
Technique: T1057: Process Discovery
Hikit has used HTTP for C2.
Technique: T1071: Application Layer Protocol
ShimRat has decompressed its core DLL using shellcode once an impersonated antivirus component was running on a system.
Technique: T1140: Deobfuscate/Decode Files or Information
Python can be executed interactively from the command-line  or via scripts  that can be written and distributed to different systems.
Technique: T1059: Command and Scripting Interpreter
The command index table and command handler address table.  Implant Capabilities Based on the responses received from the control server, the malware can carry out the following malicious tasks:  Recursively generate a list of files in a directory and send to the control server Terminate a specific process
Technique: T1102: Web Service
NETWIRE can use launch agents for persistence.
Technique: T1543: Create or Modify System Process
However, the OwaAuth web shell password contains the victim organization's name
Technique: T1505: Server Software Component
TEMP.Veles used timestomping to modify the $STANDARD_INFORMATION attribute on tools.
Technique: T1070: Indicator Removal on Host
Silent Librarian has obtained free and publicly available tools including SingleFile and HTTrack to copy login pages of targeted organizations.
Technique: T1588: Obtain Capabilities
Turla RPC backdoors have also searched for files matching the lPH*.dll pattern.
Technique: T1083: File and Directory Discovery
Shamoon scans the C-class subnet of the IPs on the victim's interfaces.
Technique: T1018: Remote System Discovery
This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature validation on systems.
Technique: T1216: Signed Script Proxy Execution
Ability to disable Microsoft Office Protected View (as shown in Figure 15) by setting the following keys in the Windows Registry: DisableAttachmentsInPV DisableInternetFilesInPV DisableUnsafeLocationsInPV       Figure 15: Disabling Microsoft Office Protected View  Ability to remotely reboot or shut down or clean the system based on the command received from the C2 server, as shown in Figure 16
Technique: T1562: Impair Defenses
TeamTNT has leveraged iplogger.org to send collected data back to C2.
Technique: T1102: Web Service
EnvyScout can use hidden directories and files to hide malicious executables.
Technique: T1564: Hide Artifacts
Kazuar has used compromised WordPress blogs as C2 servers.
Technique: T1102: Web Service
BitPaymer compares file names and paths to a list of excluded names and directory names during encryption.
Technique: T1480: Execution Guardrails
Remsec can perform DLL injection.
Technique: T1055: Process Injection
PipeMon modules are stored on disk with seemingly benign names including use of a file extension associated with a popular word processor.
Technique: T1036: Masquerading
APT29 created tokens using compromised SAML signing certificates.
Technique: T1606: Forge Web Credentials
Stuxnet has the ability to generate new C2 domains.
Technique: T1008: Fallback Channels
Lucifer can collect the computer name, system architecture, default language, and processor frequency of a compromised host.
Technique: T1082: System Information Discovery
APT29 has extracted files from compromised networks.
Technique: T1005: Data from Local System
During the booting process of a computer, firmware and various startup services are loaded before the operating system.
Technique: T1542: Pre-OS Boot
Figure 2 – The GitHub profile for F0R3X containing both legitimate forked code and the binaries created by the attacker
Technique: T1140: Deobfuscate/Decode Files or Information
APT32 has used JavaScript that communicates over HTTP or HTTPS to attacker controlled domains to download additional frameworks.
Technique: T1071: Application Layer Protocol
Sandworm Team checks for connectivity to other resources in the network.
Technique: T1016: System Network Configuration Discovery
Adversaries can inspect the configuration files to reveal information about the target network and its layout, the network device and its software, or identifying legitimate accounts and credentials for later use.
Technique: T1602: Data from Configuration Repository
The security software will likely be targeted directly for exploitation.
Technique: T1211: Exploitation for Defense Evasion
APT41 used a batch file to install persistence for the Cobalt Strike BEACON loader.
Technique: T1059: Command and Scripting Interpreter
Services such as Windows Remote Management and VNC can also be used externally.
Technique: T1133: External Remote Services
Similar to Process Injection, these values may also be abused to obtain privilege escalation by causing a malicious executable to be loaded and run in the context of separate processes on the computer.
Technique: T1546: Event Triggered Execution
Taidoor can search for specific files.
Technique: T1083: File and Directory Discovery
Rocke has changed file permissions of files so they could not be modified.
Technique: T1222: File and Directory Permissions Modification
Cardinal RAT uses a secret key with a series of XOR and addition operations to encrypt C2 traffic.
Technique: T1573: Encrypted Channel
Endpoint systems may be compromised through normal web browsing or from certain users being targeted by links in spearphishing emails to adversary controlled sites used to exploit the web browser.
Technique: T1203: Exploitation for Client Execution
OwaAuth is a Web shell that appears to be exclusively used by Threat Group-3390.
Technique: T1505: Server Software Component
Penquin can add the executable flag to a downloaded file.
Technique: T1222: File and Directory Permissions Modification
SideTwist can encrypt C2 communications with a randomly generated key.
Technique: T1573: Encrypted Channel
smb and exploit in same sentence 
Technique: T1210: Exploitation of Remote Services
PipeMon can attempt to gain administrative privileges using token impersonation.
Technique: T1134: Access Token Manipulation
CopyKittens has used -w hidden and -windowstyle hidden to conceal PowerShell windows.
Technique: T1564: Hide Artifacts
A Winnti for Windows implant file was named ASPNET_FILTER.DLL, mimicking the legitimate ASP.NET ISAPI filter DLL with the same name.
Technique: T1036: Masquerading
When opened and then executed, the key components of the HTA file downloads and executes further malware from a remote URLand loads a decoy image hosted externally (Figure 3)
Technique: T1105: Ingress Tool Transfer
FIN7 has downloaded additional malware to execute on the victim's machine, including by using a PowerShell script to launch shellcode that retrieves an additional payload.
Technique: T1105: Ingress Tool Transfer
Command_Down_exec: This command downloads and executes new modules.  It takes a url as the argument and uses that to download and execute files
Technique: T1105: Ingress Tool Transfer
SamSam has used garbage code to pad some of its malware components.
Technique: T1027: Obfuscated Files or Information
The ensuing connection is a plaintext C2 channel in which commands are specified by DWORDs.
Technique: T1095: Non-Application Layer Protocol
Industroyer’s data wiper component enumerates specific files on all the Windows drives.
Technique: T1083: File and Directory Discovery
GuLoader can use a number of different APIs for discovery and execution.
Technique: T1106: Native API
Vasport copies itself to disk and creates an associated run key Registry entry to establish.
Technique: T1547: Boot or Logon Autostart Execution
Astaroth has been delivered via malicious e-mail attachments.
Technique: T1598: Phishing for Information
APT29 has acquired C2 domains, sometimes through resellers.
Technique: T1583: Acquire Infrastructure
Octopus has compressed data before exfiltrating it using a tool called Abbrevia.
Technique: T1560: Archive Collected Data
Other methods of 2FA may be intercepted and used by an adversary to authenticate.
Technique: T1111: Two-Factor Authentication Interception
Cobalt Group has sent emails containing malicious attachments that require users to execute a file or macro to infect the victim machine.
Technique: T1204: User Execution
Cuba can check if Russian language is installed on the infected machine by using the function GetKeyboardLayoutList.
Technique: T1614: System Location Discovery
With certain file types , appending a space to the end of a filename will change how the file is processed by the operating system.
Technique: T1036: Masquerading
InvisiMole has used Windows services as a way to execute its malicious payload.
Technique: T1569: System Services
Pony has been delivered via spearphishing emails which contained malicious links.
Technique: T1566: Phishing
Babuk has the ability to delete shadow volumes using vssadmin.exe delete shadows /all /quiet.
Technique: T1490: Inhibit System Recovery
Microsoft Office contains templates that are part of common Office applications and are used to customize styles.
Technique: T1137: Office Application Startup
Daserf can log keystrokes.
Technique: T1056: Input Capture
Once inside the network of a hospitality company, APT28 sought out machines that controlled both guest and internal Wi-Fi networks. No guest credentials were observed being stolen at the compromised hotels; however, in a separate incident that occurred in Fall 2016, APT28 gained initial access to a victim’s network via credentials likely stolen from a hotel Wi-Fi network.  Upon gaining access to the machines connected to corporate and guest Wi-Fi networks, APT28 deployed Responder
Technique: T1018: Remote System Discovery
An example of this decompressed configuration may be seen below:  Figure 2 Decompressed Reaver configuration This configuration contains multiple pieces of information, including the following:  Network port Sleep timer between network requests Remote Command and Control (C2) Service Name Service Description Service Display Name Hardcoded String
Technique: T1569: System Services
It is prepended to the encrypted and encoded message
Technique: T1027: Obfuscated Files or Information
It may be called with the `winrm` command or by any number of programs such as PowerShell.
Technique: T1021: Remote Services
Required Launch Daemons parameters include a Label to identify the task, Program to provide a path to the executable, and RunAtLoad to specify when the task is run.
Technique: T1543: Create or Modify System Process
Older operating system versions on network devices often have weaker encryption ciphers and, in general, fewer/less updated defensive features.
Technique: T1601: Modify System Image
BoomBox can use RunDLL32 for execution.
Technique: T1218: Signed Binary Proxy Execution
PowerShower is a backdoor written in PowerShell.
Technique: T1059: Command and Scripting Interpreter
Turla has used net localgroup and net localgroup Administrators to enumerate group information, including members of the local administrators group.
Technique: T1069: Permission Groups Discovery
UBoatRAT encrypts instructions in the payload using a simple XOR cipher.
Technique: T1027: Obfuscated Files or Information
Dipsind can spawn remote shells.
Technique: T1059: Command and Scripting Interpreter
RegDuke can decrypt strings with a key either stored in the Registry or hardcoded in the code.
Technique: T1140: Deobfuscate/Decode Files or Information
SeaDuke uses a module to execute Mimikatz with PowerShell to perform Pass the Ticket.
Technique: T1059: Command and Scripting Interpreter
There are several different ways this can occur.
Technique: T1187: Forced Authentication
Machete uses FTP for Command & Control.
Technique: T1071: Application Layer Protocol
Lazarus Group malware SHARPKNOT overwrites and deletes the Master Boot Record  on the victim's machine and has possessed MBR wiper malware since at least 2009.
Technique: T1561: Disk Wipe
XCSSET downloads browser specific AppleScript modules using a constructed URL with the curl command, https://" & domain & "/agent/scripts/" & moduleName & ".applescript.
Technique: T1105: Ingress Tool Transfer
TajMahal has the ability to use the open source libraries XZip/Xunzip and zlib to compress files.
Technique: T1560: Archive Collected Data
ZxShell can check the services on the system.
Technique: T1007: System Service Discovery
DHS and FBI are distributing these IP addresses to enable network defense activities and reduce exposure to the DDoS command-and-control network
Technique: T1016: System Network Configuration Discovery
Several of the tools are freely-available Windows utilities, such as Amplia Security’s Windows Credential Editor. We also found a nearly complete set of the Microsoft SysInternals  PsTools package, a copy of NLBrute (which attempts to brute-force passwords), installers for the commercial TeamViewer and AnyDesk remote support tools, and a number of utilities created by endpoint security vendors that are designed to remove their (and other companies’) endpoint security and antivirus tools from a computer.
Technique: T1110: Brute Force
DEATHRANSOM can use public and private key pair encryption to encrypt files for ransom payment.
Technique: T1486: Data Encrypted for Impact
PUNCHBUGGY mimics filenames from %SYSTEM%\System32 to hide DLLs in %WINDIR% and/or %TEMP%.
Technique: T1036: Masquerading
For example, we analyzed a DropIt sample (SHA256: cca268c13885ad5751eb70371bbc9ce8c8795654fedb90d9e3886cbcfe323671) that dropped two executables, one of which was saved to “%TEMP%\flash_update.exe” that was a legitimate Flash Player installer
Technique: T1036: Masquerading
Adversaries may use SMB to interact with file shares, allowing them to move laterally throughout a network.
Technique: T1021: Remote Services
Remsec is capable of using ICMP, TCP, and UDP for C2.
Technique: T1095: Non-Application Layer Protocol
Upon execution in a vulnerable environment, the PowerShell based payload takes over
Technique: T1546: Event Triggered Execution
Azure CLI  and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups.
Technique: T1069: Permission Groups Discovery
InvisiMole can use a JavaScript file as part of its execution chain.
Technique: T1059: Command and Scripting Interpreter
Similarly, on macOS the configurations for how applications run are listed in property list  files.
Technique: T1564: Hide Artifacts
Bazar can delete its loader using a batch file in the Windows temporary folder.
Technique: T1070: Indicator Removal on Host
HTTPBrowser's installer contains a malicious file named navlu.dll to decrypt and run the RAT.
Technique: T1036: Masquerading
Agent Tesla can steal data from the victim’s clipboard.
Technique: T1115: Clipboard Data
Figure 2 Employee survey displayed after credential theft The November 2017 document displays a password handover document after credential theft occurs, as seen in Figure 3
Technique: T1003: OS Credential Dumping
LookBack uses a modified version of RC4 for data transfer.
Technique: T1573: Encrypted Channel
Adversaries can use a compromised email account to hijack existing email threads with targets of interest.
Technique: T1586: Compromise Accounts
Reg can be used to extract from the Registry.
Technique: T1003: OS Credential Dumping
Ammy 
Technique: T1219: Remote Access Software
Dragonfly 2.0 likely obtained a list of hosts in the victim environment.
Technique: T1018: Remote System Discovery
BoomBox has the ability to execute an LDAP query to enumerate the distinguished name, SAM account name, and display name for all domain users.
Technique: T1087: Account Discovery
WIRTE has decoded a base64 encoded document which was embedded in a VBS script.
Technique: T1140: Deobfuscate/Decode Files or Information
APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.
Technique: T1203: Exploitation for Client Execution
Parameter   Description    ‘u=’  This parameter contains target machine information in the following format: <Computer Name>, <User Name>, <Windows Versions>, <Processor Architecture>, <1.3>, < KdfrJKN >, <Volume Serial Number>    ‘&h=’  This parameter includes the information about the command executed and its results
Technique: T1082: System Information Discovery
GALLIUM used DLL side-loading to covertly load PoisonIvy into memory on the victim machine.
Technique: T1574: Hijack Execution Flow
FatDuke can collect the user name, Windows version, computer name, and available space on discs from a compromised host.
Technique: T1082: System Information Discovery
PUNCHBUGGY has Gzipped information and saved it to a random temp file before exfil.
Technique: T1560: Archive Collected Data
Proc memory injection is a method of executing arbitrary code in the address space of a separate live process.
Technique: T1055: Process Injection
Matryoshka is capable of performing screen captures.
Technique: T1113: Screen Capture
Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk.
Technique: T1620: Reflective Code Loading
A variety of methods exist for compromising email accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, or by brute forcing credentials .
Technique: T1586: Compromise Accounts
The malware initiates its main function of capturing user keystrokes and sending them to the control server using standard Windows networking APIs
Technique: T1056: Input Capture
APT39 has used malware to drop encrypted CAB files.
Technique: T1027: Obfuscated Files or Information
Fox Kitten has used tools including NMAP to conduct broad scanning to identify open ports.
Technique: T1046: Network Service Scanning
Wizard Spider has modified the Registry key HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest by setting the UseLogonCredential registry value to 1 in order to force credentials to be stored in clear text in memory.
Technique: T1112: Modify Registry
Stuxnet sends compromised victim information via HTTP.
Technique: T1041: Exfiltration Over C2 Channel
Adversaries may therefore obscure malicious code by creating multiple identical exported function names and appending W and/or A to harmless ones.
Technique: T1218: Signed Binary Proxy Execution
APT32 has used legitimate local admin account credentials.
Technique: T1078: Valid Accounts
While nuances of each platform’s permissions implementation may vary, most of the platforms provide two primary commands used to manipulate file and directory ACLs: chown , and chmod .
Technique: T1222: File and Directory Permissions Modification
SoreFang can use HTTP in C2 communications.
Technique: T1071: Application Layer Protocol
QUADAGENT creates a scheduled task to maintain persistence on the victim’s machine.
Technique: T1053: Scheduled Task/Job
Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time.
Technique: T1574: Hijack Execution Flow
Remote shells on Unix & Windows clients have a real tty with all keyboard signals working just like an SSH shell
Technique: T1059: Command and Scripting Interpreter
StrongPity can identify the IP address of a compromised host.
Technique: T1016: System Network Configuration Discovery
Ragnar Locker has used sc.exe to create a new service for the VirtualBox driver.
Technique: T1543: Create or Modify System Process
Netwalker has been written in PowerShell and executed directly in memory, avoiding detection.
Technique: T1059: Command and Scripting Interpreter
KONNI has modified registry keys of ComSysApp service and Svchost on the machine to gain persistence.
Technique: T1112: Modify Registry
The group has also used macros to execute payloads.
Technique: T1059: Command and Scripting Interpreter
LOWBALL abuses the Dropbox cloud storage service for command and control (CnC)
Technique: T1102: Web Service
ZIRCONIUM has used a tool to open a Windows Command Shell on a remote host.
Technique: T1059: Command and Scripting Interpreter
APT33 has obtained and leveraged publicly-available tools for early intrusion activities.
Technique: T1588: Obtain Capabilities
BRONZE BUTLER uses the command-line interface.
Technique: T1059: Command and Scripting Interpreter
OwaAuth — This web shell and credential stealer deployed to Microsoft Exchange servers is installed as an ISAPI filter
Technique: T1505: Server Software Component
Sowbug extracted documents and bundled them into a RAR archive.
Technique: T1560: Archive Collected Data