HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
This command adds the path of the malicious executable to the login item file list located in ~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm.
Technique: T1547: Boot or Logon Autostart Execution
SMOKEDHAM has used reg.exe to create a Registry Run key.
Technique: T1547: Boot or Logon Autostart Execution
TajMahal has the ability to capture webcam video.
Technique: T1125: Video Capture
Bundlore will enumerate the macOS version to determine which follow-on behaviors to execute using /usr/bin/sw_vers -productVersion.
Technique: T1082: System Information Discovery
Turla has used valid digital certificates from Sysprint AG to sign its Epic dropper.
Technique: T1553: Subvert Trust Controls
In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware.
Technique: T1610: Deploy Container
Attackers may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access.
Technique: T1558: Steal or Forge Kerberos Tickets
3
Technique: T1189: Drive-by Compromise
WastedLocker has the ability to save and execute files as an alternate data stream .
Technique: T1564: Hide Artifacts
WannaCry uses an exploit in SMBv1 to spread itself to other remote systems on a network.
Technique: T1210: Exploitation of Remote Services
RDAT can exfiltrate data gathered from the infected system via the established Exchange Web Services API C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
H1N1 uses multiple techniques to obfuscate strings, including XOR.
Technique: T1027: Obfuscated Files or Information
FIN8 has used emails with malicious links to lure victims into installing malware.
Technique: T1204: User Execution
The DropIt Trojan we analyzed is an executable that builds an embedded executable by decoding embedded blobs of base64 encoded data and concatenating them together in the correct order
Technique: T1132: Data Encoding
GuLoader has the ability to perform anti-debugging based on time checks, API calls, and CPUID.
Technique: T1497: Virtualization/Sandbox Evasion
Magic Hound has collected .PST archives.
Technique: T1114: Email Collection
The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.
Technique: T1203: Exploitation for Client Execution
Astaroth uses a software packer called Pe123\RPolyCryptor.
Technique: T1027: Obfuscated Files or Information
If the base image is pulled from a public registry, defenses will likely not detect the image as malicious since it’s a vanilla image.
Technique: T1612: Build Image on Host
InvisiMole has undergone regular technical improvements in an attempt to evade detection.
Technique: T1027: Obfuscated Files or Information
Ebury has intercepted unencrypted private keys as well as private key pass-phrases.
Technique: T1552: Unsecured Credentials
APT39 has used tools with the ability to search for files on a compromised host.
Technique: T1083: File and Directory Discovery
BackdoorDiplomacy has used an executable to detect removable media, such as USB flash drives.
Technique: T1120: Peripheral Device Discovery
If the machine has the value 0x419 , 0x422 , or 0x423 , it stops execution.
Technique: T1614: System Location Discovery
Fox Kitten has accessed Registry hives ntuser.dat and UserClass.dat.
Technique: T1012: Query Registry
Metamorfo has deleted itself from the system after execution.
Technique: T1070: Indicator Removal on Host
InvisiMole has executed legitimate tools in hidden windows.
Technique: T1564: Hide Artifacts
BackdoorDiplomacy has dropped legitimate software onto a compromised host and used it to execute malicious DLLs.
Technique: T1055: Process Injection
The macro uses PowerShell to download a shellcode-based payload from a remote server using one of two available techniques
Technique: T1546: Event Triggered Execution
Adversaries may bypass UAC mechanisms to elevate process privileges on system.
Technique: T1548: Abuse Elevation Control Mechanism
MechaFlounder has the ability to identify the username and hostname on a compromised host.
Technique: T1033: System Owner/User Discovery
PoetRAT has the ability to take screen captures.
Technique: T1113: Screen Capture
yty has some basic anti-sandbox detection that tries to detect Virtual PC, Sandboxie, and VMware.
Technique: T1497: Virtualization/Sandbox Evasion
Dipsind encrypts C2 data with AES256 in ECB mode.
Technique: T1573: Encrypted Channel
Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP.
Technique: T1563: Remote Service Session Hijacking
Valak has downloaded a variety of modules and payloads to the compromised host, including IcedID and NetSupport Manager RAT-based malware.
Technique: T1105: Ingress Tool Transfer
BLUELIGHT can download additional files onto the host.
Technique: T1105: Ingress Tool Transfer
Dragonfly 2.0 has used various forms of spearphishing in attempts to get users to open attachments.
Technique: T1204: User Execution
Sandworm Team has used VBScript to run WMI queries.
Technique: T1047: Windows Management Instrumentation
Helminth has checked for the domain admin group and Exchange Trusted Subsystem groups using the commands net group Exchange Trusted Subsystem /domain and net group domain admins /domain.
Technique: T1069: Permission Groups Discovery
FIN7 has registered look-alike domains for use in phishing campaigns.
Technique: T1583: Acquire Infrastructure
The payload will construct a message that has the following structure that it will then send to the C2:   bye<char uuid[35]>d   The message above is sent via a simple HTTPS/HTTP POST request to the C2 server
Technique: T1071: Application Layer Protocol
Adversaries may attempt to find local system groups and permission settings.
Technique: T1069: Permission Groups Discovery
Leviathan has used regsvr32 for execution.
Technique: T1218: Signed Binary Proxy Execution
China Chopper's server component executes code sent via HTTP POST commands.
Technique: T1071: Application Layer Protocol
KillDisk terminates various processes to get the user to reboot the victim machine.
Technique: T1489: Service Stop
The payload of the malicious driver  is executed when loaded by lsass.exe before the spoofed service becomes unstable and crashes.
Technique: T1547: Boot or Logon Autostart Execution
Lokibot can search for specific files on an infected host.
Technique: T1083: File and Directory Discovery
Lazarus Group malware families can also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives.
Technique: T1083: File and Directory Discovery
Dark Caracal has used macros in Word documents that would download a second stage if executed.
Technique: T1059: Command and Scripting Interpreter
Sometimes it is a high profile, legitimate site such as “diplomacy.pl”, hosting a ZIP archive
Technique: T1560: Archive Collected Data
This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities.
Technique: T1614: System Location Discovery
KONNI has modified ComSysApp service to load the malicious DLL payload.
Technique: T1546: Event Triggered Execution
FIN7 used a PowerShell script to launch shellcode that retrieved an additional payload.
Technique: T1059: Command and Scripting Interpreter
HIDEDRV injects a DLL for Downdelph into the explorer.exe process.
Technique: T1055: Process Injection
Cobalt Strike can use a custom command and control protocol that can be encapsulated in DNS.
Technique: T1071: Application Layer Protocol
DOGCALL is capable of logging keystrokes.
Technique: T1056: Input Capture
EKANS can use Windows Mangement Instrumentation  calls to execute operations.
Technique: T1047: Windows Management Instrumentation
The FireEye FLARE team released a WMI repository-parsing tool that allows investigators to extract embedded data from the WMI repository and identify WMI persistence.
Technique: T1047: Windows Management Instrumentation
After obtaining the unique ID from the C2 server, the Trojan calls the “SetAbStatById” method to notify the C2 server of its status of “1” to notify the server it had successfully received the filename and file data
Technique: T1041: Exfiltration Over C2 Channel
MobileOrder exfiltrates data collected from the victim mobile device.
Technique: T1005: Data from Local System
FinFisher performs UAC bypass.
Technique: T1548: Abuse Elevation Control Mechanism
Sharpshooter has sent malicious DOC and PDF files to targets so that they can be opened by a user.
Technique: T1204: User Execution
Use of the non-public PowerShell backdoor previously described by Morphisec and MalwareBytes (which we refer to as POWERSTATS)
Technique: T1546: Event Triggered Execution
ROKRAT accesses the HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData Registry key to obtain the System manufacturer value to identify the machine type.
Technique: T1012: Query Registry
ZeroT has used DLL side-loading to load malicious payloads.
Technique: T1574: Hijack Execution Flow
It has also used PowerShell to execute commands and move laterally through a victim network.
Technique: T1059: Command and Scripting Interpreter
Sandworm Team has registered domain names and created URLs that are often designed to mimic or spoof legitimate websites, such as email login pages, online file sharing and storage websites, and password reset pages.
Technique: T1583: Acquire Infrastructure
Avaddon has used encrypted strings.
Technique: T1027: Obfuscated Files or Information
Kessel can download additional modules from the C2 server.
Technique: T1105: Ingress Tool Transfer
AppleJeus has loaded a plist file using the launchctl command.
Technique: T1569: System Services
TA551 has retrieved DLLs and installer binaries for malware execution from C2.
Technique: T1105: Ingress Tool Transfer
Common uses include hosting malicious scripts on websites as part of a Drive-by Compromise or downloading and executing these script files as secondary payloads.
Technique: T1059: Command and Scripting Interpreter
APT39 has been seen using RDP for lateral movement and persistence, in some cases employing the rdpwinst tool for mangement of multiple sessions.
Technique: T1021: Remote Services
A particular variant of this behavior is to use onion routing networks, such as the publicly available TOR network.
Technique: T1090: Proxy
Microsoft Exchange transport agents can operate on email messages passing through the transport pipeline to perform various tasks such as filtering spam, filtering malicious attachments, journaling, or adding a corporate signature to the end of all outgoing emails.
Technique: T1505: Server Software Component
zwShell can obtain the name of the logged-in user on the victim.
Technique: T1033: System Owner/User Discovery
Adversaries may abuse these OS API functions as a means of executing behaviors.
Technique: T1106: Native API
APT38 has used PowerShell to execute commands and other operational tasks.
Technique: T1059: Command and Scripting Interpreter
NETWIRE has used .NET packer tools to evade detection.
Technique: T1027: Obfuscated Files or Information
Property list with persistence settings launchctl load /Library/LaunchDaemons/filename.plist > /dev/nul or launchctl load ~/Library/LaunchAgents/ filename.plist > /dev/nul will then command the operating system to start the dropped backdoor file at login
Technique: T1543: Create or Modify System Process
Sandworm Team has used the Telegram Bot API from Telegram Messenger to send and receive commands to its Python backdoor.
Technique: T1102: Web Service
In many cases, additional stealers, RATs, and other malware were observed being hosted on the same web servers.Analysis of HawkEye Reborn The campaign starts with sending the aforementioned Excel sheets that exploit the well-known CVE-2017-11882 vulnerability, an arbitrary code execution bug in Microsoft Office
Technique: T1203: Exploitation for Client Execution
Code signing to verify software on first run can be used on modern Windows and macOS/OS X systems.
Technique: T1553: Subvert Trust Controls
xCaon has checked for the existence of Kaspersky antivirus software on the system.
Technique: T1518: Software Discovery
Filename qrat.exe   File Size 1093120 bytes   MD5 c05e5131b196f43e1d02ca5ccc48ec0e   SHA1 f28c592833f234c619917b5c7d8974840a810247   Notes Dropper that installs QuasarRAT file microsoft_network.exe and scheduled task wrapper file Microsoft.Win32.TaskScheduler.dll
Technique: T1036: Masquerading
GreyEnergy has used Tor relays for Command and Control servers.
Technique: T1090: Proxy
MURKYTOP has the capability to retrieve information about groups.
Technique: T1069: Permission Groups Discovery
Mis-Type uses cmd.exe to run commands for enumerating the host.
Technique: T1059: Command and Scripting Interpreter
Adversaries may perform RDP session hijacking which involves stealing a legitimate user's remote session.
Technique: T1563: Remote Service Session Hijacking
HyperBro has the ability to take screenshots.
Technique: T1113: Screen Capture
Patchwork leveraged the DDE protocol to deliver their malware.
Technique: T1559: Inter-Process Communication
Gorgon Group malware can use process hollowing to inject one of its trojans into another process.
Technique: T1055: Process Injection
A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.
Technique: T1137: Office Application Startup
Word 2016 will first look for Normal.dotm under C:\Program Files \Microsoft Office\root\Office16\, or by modifying the GlobalDotName registry key.
Technique: T1137: Office Application Startup
Kwampirs collects a list of running services with the command tasklist /v.
Technique: T1057: Process Discovery
A Threat Group-3390 tool can use a public UAC bypass method to elevate privileges.
Technique: T1548: Abuse Elevation Control Mechanism
Adversaries may abuse AuthorizationExecuteWithPrivileges to obtain root privileges in order to install malicious software on victims and install persistence mechanisms.
Technique: T1548: Abuse Elevation Control Mechanism
Comnie allows the attacker to provide and subsequently execute a batch script (BAT), executable file (EXE), or dynamic-link library (DLL)
Technique: T1059: Command and Scripting Interpreter
NETWIRE has used web services including Paste.ee to host payloads.
Technique: T1102: Web Service
Get-PassPol
Technique: T1201: Password Policy Discovery
TURNEDUP is capable of downloading additional files.
Technique: T1105: Ingress Tool Transfer
The following function written in Python may be used to decode this file:def decode(data): 	out = "" 	c = 0 	for d in data: 		out += chr(ord(d)^c) 		c+=1 	return outOnce decoded it is discovered that this instance of OceanSalt attempts to communicate with 61.14.210[.]72 on port 7117
Technique: T1140: Deobfuscate/Decode Files or Information
Ramsay can execute its embedded components via CreateProcessA and ShellExecute.
Technique: T1106: Native API
AppleJeus has used shell scripts to execute commands after installation and set persistence mechanisms.
Technique: T1059: Command and Scripting Interpreter
Conficker uses the current UTC victim system date for domain generation and connects to time servers to determine the current date.
Technique: T1124: System Time Discovery
Lokibot has used LoadLibrary, GetProcAddress and CreateRemoteThread API functions to execute its shellcode.
Technique: T1106: Native API
KGH_SPY can decrypt encrypted strings and write them to a newly created folder.
Technique: T1140: Deobfuscate/Decode Files or Information
If it is successful then it will send out basic host information and await further commands.
Technique: T1082: System Information Discovery
Remsec contains a network loader to receive executable modules from remote attackers and run them on the local victim.
Technique: T1105: Ingress Tool Transfer
MechaFlounder has the ability to use HTTP in communication with C2.
Technique: T1071: Application Layer Protocol
RedLeaves can obtain information about network parameters.
Technique: T1016: System Network Configuration Discovery
UNC2452 leveraged privileged accounts to replicate directory service data with domain controllers.
Technique: T1003: OS Credential Dumping
Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation.
Technique: T1586: Compromise Accounts
Windows API calls 
Technique: T1106: Native API
Information about the installed software may also be exposed to adversaries via online or other accessible data sets .
Technique: T1592: Gather Victim Host Information
BLINDINGCAN has attempted to hide its payload by using legitimate file names such as "iconcache.db".
Technique: T1036: Masquerading
Skidmap has installed itself via crontab.
Technique: T1053: Scheduled Task/Job
Stuxnet enumerates removable drives for infection.
Technique: T1120: Peripheral Device Discovery
Adversaries may also take steps to cultivate a persona around the email account, such as through use of Social Media Accounts, to increase the chance of success of follow-on behaviors.
Technique: T1585: Establish Accounts
menuPass has used Putty Secure Copy Client  to transfer data.
Technique: T1021: Remote Services
Any crontab files are stored in operating system-specific file paths.
Technique: T1053: Scheduled Task/Job
After collecting documents from removable media, Prikormka compresses the collected files, and encrypts it with Blowfish.
Technique: T1560: Archive Collected Data
APT18 uses cmd.exe to execute commands on the victim’s machine.
Technique: T1059: Command and Scripting Interpreter
Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets , also known as a golden ticket.
Technique: T1558: Steal or Forge Kerberos Tickets
QakBot can check the compromised host for the presence of multiple executables associated with analysis tools and halt execution if any are found.
Technique: T1497: Virtualization/Sandbox Evasion
POWERSTATS's backdoor code is a multi-layer obfuscated, encoded, and compressed blob.
Technique: T1027: Obfuscated Files or Information
Sandworm Team has pushed additional malicious tools onto an infected system to steal user credentials, move laterally, and destroy data.
Technique: T1105: Ingress Tool Transfer
MoleNet can achieve persitence on the infected machine by setting the Registry run key.
Technique: T1547: Boot or Logon Autostart Execution
This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.
Technique: T1542: Pre-OS Boot
The interface to create and manage BITS jobs is accessible through PowerShell and the BITSAdmin tool.
Technique: T1197: BITS Jobs
Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model  assemblies.
Technique: T1218: Signed Binary Proxy Execution
Webshell can use a decryption mechanism to process a user supplied password and allow execution.
Technique: T1140: Deobfuscate/Decode Files or Information
MoonWind obtains the victim username.
Technique: T1033: System Owner/User Discovery
The authorized_keys file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured.
Technique: T1098: Account Manipulation
remote template 
Technique: T1221: Template Injection
Operation Wocao has used PowerShell on compromised systems.
Technique: T1059: Command and Scripting Interpreter
Kimsuky has been observed disabling the system firewall.
Technique: T1562: Impair Defenses
AppleJeus has presented the user with a UAC prompt to elevate privileges while installing.
Technique: T1548: Abuse Elevation Control Mechanism
Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting.
Technique: T1598: Phishing for Information
Magic Hound has compromised email credentials in order to steal sensitive data.
Technique: T1114: Email Collection
Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon .
Technique: T1546: Event Triggered Execution
The lnk files were an especially interesting development because the powershell code they contain for decoding and dropping the payload is nearly identical to that utilized by the Zebrocy threat actor a month earlier
Technique: T1547: Boot or Logon Autostart Execution
JHUHUGIT has registered itself as a service to establish persistence.
Technique: T1543: Create or Modify System Process
Lucifer can use system resources to mine cryptocurrency, dropping XMRig to mine Monero.
Technique: T1496: Resource Hijacking
Gallmaker has used WinZip, likely to archive data prior to exfiltration.
Technique: T1560: Archive Collected Data
RedLeaves is launched through use of DLL search order hijacking to load a malicious dll.
Technique: T1574: Hijack Execution Flow
Another JHUHUGIT variant has the capability to delete specified files.
Technique: T1070: Indicator Removal on Host
Adversaries may change where these logs are saved using Set-PSReadLineOption -HistorySavePath {File Path}.
Technique: T1562: Impair Defenses
Enterprises can benefit from Trend Micro’s Smart Protection Suites with XGen security, which infuses high-fidelity machine learning into a blend of threat protection techniques to eliminate security gaps across any user activity and any endpoint
Technique: T1518: Software Discovery
Kobalos can write captured SSH connection credentials to a file under the /var/run directory with a .pid extension for exfiltration.
Technique: T1074: Data Staged
RTM tries to add a Registry Run key under the name "Windows Update" to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
Nebulae can enumerate processes on a target system.
Technique: T1057: Process Discovery
CookieMiner has used base64 encoding to obfuscate scripts on the system.
Technique: T1027: Obfuscated Files or Information
Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses.
Technique: T1055: Process Injection
Kimsuky has used tools that are capable of obtaining credentials from saved mail.
Technique: T1552: Unsecured Credentials
RogueRobin has used Google Drive as a Command and Control channel.
Technique: T1102: Web Service
With Domain Administrator  rights, harvested or well-known SID values  may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators.
Technique: T1134: Access Token Manipulation
Depending on the permissions level of the vulnerable remote service an adversary may achieve Exploitation for Privilege Escalation as a result of lateral movement exploitation as well.
Technique: T1210: Exploitation of Remote Services
T9000 can take screenshots of the desktop and target application windows, saving them to user directories as one byte XOR encrypted .dat files.
Technique: T1113: Screen Capture
Two prominent protocols that have enabled Reflection Amplification Floods are DNS and NTP, though the use of several others in the wild have been documented.
Technique: T1498: Network Denial of Service
BlackMould can run cmd.exe with parameters.
Technique: T1059: Command and Scripting Interpreter
If the key does not exist, gh0st RAT will create and run the service.
Technique: T1569: System Services
Sharpshooter downloaded additional payloads after a target was infected with a first-stage downloader.
Technique: T1105: Ingress Tool Transfer
Cobalt Strike has the ability to use an Excel Workbook to execute additional code by enabling Office to trust macros and execute code without user permission.
Technique: T1137: Office Application Startup
Caterpillar WebShell can run commands on the compromised asset with CMD functions.
Technique: T1059: Command and Scripting Interpreter
Frankenstein has used CVE-2017-11882 to execute code on the victim's machine.
Technique: T1203: Exploitation for Client Execution
Pteranodon can download and execute additional files.
Technique: T1105: Ingress Tool Transfer
They have also dropped QuasarRAT binaries as files named microsoft_network.exe and crome.exe.
Technique: T1036: Masquerading
Remexi performs exfiltration over BITSAdmin, which is also used for the C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
SodaMaster can use RC4 to encrypt C2 communications.
Technique: T1573: Encrypted Channel
Sharpshooter's first-stage downloader resolved various Windows libraries and APIs, including LoadLibraryA, GetProcAddress, and CreateProcessA.
Technique: T1106: Native API
RATANKBA gathers the victim’s IP address via the ipconfig -all command.
Technique: T1016: System Network Configuration Discovery
Higaisa used a payload that creates a hidden window.
Technique: T1564: Hide Artifacts
Specific VNC libraries/implementations have also been susceptible to brute force attacks and memory usage exploitation.
Technique: T1021: Remote Services
Darkhotel has used first-stage payloads that download additional malware from C2 servers.
Technique: T1105: Ingress Tool Transfer
OopsIE can upload files from the victim's machine to its C2 server.
Technique: T1041: Exfiltration Over C2 Channel
Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Technique: T1014: Rootkit
On Linux and Mac, users can mark specific files as hidden simply by putting a “.” as the first character in the file or folder name   .
Technique: T1564: Hide Artifacts
Lucifer has established persistence by creating the following scheduled task schtasks /create /sc minute /mo 1 /tn QQMusic ^ /tr C:Users\%USERPROFILE%\Downloads\spread.exe /F.
Technique: T1053: Scheduled Task/Job
PLATINUM has used the Intel® Active Management Technology  Serial-over-LAN  channel for command and control.
Technique: T1095: Non-Application Layer Protocol
Kwampirs collects a list of network shares with the command net share.
Technique: T1135: Network Share Discovery
Adversaries possessing a valid Kerberos ticket-granting ticket  may request one or more Kerberos ticket-granting service  service tickets for any SPN from a domain controller .
Technique: T1558: Steal or Forge Kerberos Tickets
Ramsay can spread itself by infecting other portable executable files on networks shared drives.
Technique: T1080: Taint Shared Content
Some Volgmer variants add new services with display names generated by a list of hard-coded strings such as Application, Background, Security, and Windows, presumably as a way to masquerade as a legitimate service.
Technique: T1036: Masquerading
Lazarus Group has rebooted victim machines to establish persistence by installing a SSP DLL.
Technique: T1547: Boot or Logon Autostart Execution
Helminth has used a scheduled task for persistence.
Technique: T1053: Scheduled Task/Job
Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information.
Technique: T1598: Phishing for Information
GALLIUM used PowerShell for execution to assist in lateral movement as well as for dumping credentials stored on compromised machines.
Technique: T1059: Command and Scripting Interpreter
This round of FIN7 phishing lures implements hidden shortcut files (LNK files) to initiate the infection and VBScript functionality launched by mshta.exe to infect the victim
Technique: T1547: Boot or Logon Autostart Execution
Apps and files loaded onto the system from a USB flash drive, optical disk, external hard drive, from a drive shared over the local network, or using the curl command do not set this flag.
Technique: T1553: Subvert Trust Controls
If after the package has been decoded its size is bigger than 3 bytes, the Trojan decrypts its first 11 bytes with XOR using the method similar to the one described above
Technique: T1140: Deobfuscate/Decode Files or Information
It hands over the decrypted buffer extracted from the resource section and the path from the original RegAsm executable to the start_protect_hexcode function.Then it starts the process-hollowing shellcode, which is stored in the HEXCODE1 variable
Technique: T1055: Process Injection
StrongPity can use multiple layers of proxy servers to hide terminal nodes in its infrastructure.
Technique: T1090: Proxy
This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.
Technique: T1562: Impair Defenses
Caterpillar WebShell can obtain a list of user accounts from a victim's machine.
Technique: T1033: System Owner/User Discovery
A TYPEFRAME variant can force the compromised system to function as a proxy server.
Technique: T1090: Proxy
The initial infection vector of this campaign is a Microsoft Office Excel Worksheet with an Office macro that uses the mshta.exe Windows executable to run scripts, which are embedded in the HTML of a specially-crafted blogspot.com page
Technique: T1566: Phishing
Another bypass is possible through some lateral movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on remote systems and default to high integrity.
Technique: T1548: Abuse Elevation Control Mechanism
In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files.
Technique: T1552: Unsecured Credentials
Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation.
Technique: T1046: Network Service Scanning
When the Terminal.app is opened, the application launches a zsh login shell and a zsh interactive shell.
Technique: T1546: Event Triggered Execution
Javali can read C2 information from Google Documents and YouTube.
Technique: T1102: Web Service
A noteworthy addition to the Poseidon toolkit is the IGT supertool (Information Gathering toolkit), a bulking 15 megabyte executable that orchestrates a series of different information collections steps, exfiltration, and the cleanup of components
Technique: T1082: System Information Discovery
XCSSET performs AES-CBC encryption on files under ~/Documents, ~/Downloads, and
~/Desktop with a fixed key and renames files to give them a .enc extension.
Technique: T1486: Data Encrypted for Impact
The HyperShell and HighShell webshells are variants of what we track as TwoFace, with HyperShell being related to the TwoFace loader and HighShell being related to the TwoFace payload, as we reported in July 2017
Technique: T1027: Obfuscated Files or Information
FELIXROOT deletes the .LNK file from the startup directory as well as the dropper components.
Technique: T1070: Indicator Removal on Host
Ryuk has called GetLogicalDrives to emumerate all mounted drives, and GetDriveTypeW to determine the drive type.
Technique: T1083: File and Directory Discovery
StreamEx has the ability to scan for security tools such as firewalls and antivirus tools.
Technique: T1518: Software Discovery
The access may be used to laterally move to other systems, gather information, or cause a specific effect, such as wiping the hard drives on all endpoints.
Technique: T1072: Software Deployment Tools
WMI permanent event subscriptions can be used to trigger actions when specified conditions are met
Technique: T1047: Windows Management Instrumentation
PlugX has a module to create, delete, or modify Registry keys.
Technique: T1112: Modify Registry
Deep Panda has used PowerShell scripts to download and execute programs in memory, without writing to disk.
Technique: T1059: Command and Scripting Interpreter
Adversaries may upload malware to support their operations, such as making a payload available to a victim network to enable Ingress Tool Transfer by placing it on an Internet accessible web server.
Technique: T1608: Stage Capabilities
As with legitimate development efforts, different skill sets may be required for developing exploits.
Technique: T1587: Develop Capabilities
JPIN can send email over SMTP.
Technique: T1071: Application Layer Protocol
BlackTech has exploited a buffer overflow vulnerability in Microsoft Internet Information Services  6.0, CVE-2017-7269, in order to establish a new HTTP or command and control  server.
Technique: T1190: Exploit Public-Facing Application
NOKKI has used rundll32 for execution.
Technique: T1218: Signed Binary Proxy Execution
SNUGRIDE establishes persistence through a Registry Run key.
Technique: T1547: Boot or Logon Autostart Execution
Kimsuky has used modified versions of PHProxy to examine web traffic between the victim and the accessed website.
Technique: T1557: Adversary-in-the-Middle
Once these variables are set, the malware uses the SoapHttpClientProtocol class to communicate with its C2 server, which issues an HTTP POST requests that appears as:  As you can see from the above request, the SoapHttpClientProtocol class neatly structures data into an HTTP POST request
Technique: T1071: Application Layer Protocol
APT19 has obtained and used publicly-available tools like Empire.
Technique: T1588: Obtain Capabilities
APT38 used a Trojan called KEYLIME to capture keystrokes from the victim’s machine.
Technique: T1056: Input Capture
Stateless protocols such as UDP or ICMP are commonly used but stateful protocols such as TCP can be used as well.
Technique: T1498: Network Denial of Service
APT41 has enumerated IP addresses of network resources and used the netstat command as part of network reconnaissance.
Technique: T1049: System Network Connections Discovery
BlackEnergy has run a plug-in on a victim to spread through the local network by using PsExec and accessing admin shares.
Technique: T1021: Remote Services
Winnti for Linux has used a custom TCP protocol with four-byte XOR for command and control .
Technique: T1573: Encrypted Channel
PoisonIvy captures window titles.
Technique: T1010: Application Window Discovery
KONNI has used tasklist.exe to get a snapshot of the current processes’ state of the target machine.
Technique: T1057: Process Discovery
Zebrocy performs persistence with a logon script via adding to the Registry key HKCU\Environment\UserInitMprLogonScript.
Technique: T1037: Boot or Logon Initialization Scripts
Once adversaries gain access to a victim network or a private code repository, they may collect sensitive information such as proprietary source code or credentials contained within software's source code.
Technique: T1213: Data from Information Repositories
Pteranodon schedules tasks to invoke its components in order to establish persistence.
Technique: T1053: Scheduled Task/Job
FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.
Technique: T1087: Account Discovery
BoxCaon established persistence by setting the HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load registry key to point to its executable.
Technique: T1547: Boot or Logon Autostart Execution
After checking for the existence of two files, keyword_parm.txt and parm.txt, MESSAGETAP XOR decodes and read the contents of the files.
Technique: T1140: Deobfuscate/Decode Files or Information
When it first starts, BADNEWS spawns a new thread to log keystrokes.
Technique: T1056: Input Capture
The generation of web credentials often requires secret values, such as passwords, Private Keys, or other cryptographic seed values.
Technique: T1606: Forge Web Credentials
OopsIE concatenates then decompresses multiple resources to load an embedded .Net Framework assembly.
Technique: T1140: Deobfuscate/Decode Files or Information
APT29 has used spearphishing emails with an attachment to deliver files with exploits to initial victims.
Technique: T1566: Phishing
Adversaries may target the different network services provided by systems to conduct a DoS.
Technique: T1499: Endpoint Denial of Service
After connecting to the IRC server, the MPK bot sends custom ping messages and provides an introduction via a “!Hello” message that contains the current logged in user of the infected host, if the user has administrator privileges, the hostname, the UUID of the system, and operating system version
Technique: T1082: System Information Discovery
QakBot can use cmd.exe to launch itself and to execute multiple C2 commands.
Technique: T1059: Command and Scripting Interpreter
Stuxnet enumerates user accounts of the local host.
Technique: T1087: Account Discovery
* Windows Registry modifications.
Technique: T1056: Input Capture
BRONZE BUTLER has compressed data into password-protected RAR archives prior to exfiltration.
Technique: T1560: Archive Collected Data
Cobalt Strike can use process hollowing for execution.
Technique: T1055: Process Injection
OSX_OCEANLOTUS.D has variants that check a number of system parameters to see if it is being run on real hardware or in a virtual machine environment, such as sysctl hw.model.
Technique: T1497: Virtualization/Sandbox Evasion
NETEAGLE will also use HTTP to download resources that contain an IP address and Port Number pair to connect to for further C2.
Technique: T1071: Application Layer Protocol
Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.
Technique: T1569: System Services
It first grabs an encrypted blob stored away in a global variable and pulls out 381 bytes of this encrypted data:  The standard win32 api CryptDecrypt uses rc4 to decrypt this blob into a hardcoded c2, url path, and url parameters listed below with a simple 140-bit key “\x8B\xFF\x55\x8B\xEC\x83\xEC\x50\xA1\x84\x18\x03\x68\x33\xC9\x66\xF7\x45\x10\xE8\x1F\x89\x45\xFC\x8B\x45\x14\x56″
Technique: T1521: nan
Bandook can support commands to execute Python-based payloads.
Technique: T1059: Command and Scripting Interpreter
We analyzed the command handler and found that it provided the necessary commands for a fully functional backdoor, as seen in Table 1
Technique: T1059: Command and Scripting Interpreter
FIN8 has attempted to map to C$ on enumerated hosts to test the scope of their current credentials/context.
Technique: T1021: Remote Services
HOPLIGHT has utilized Zlib compression to obfuscate the communications payload.
Technique: T1132: Data Encoding
Adversaries likely use side-loading as a means of masking actions they perform under a legitimate, trusted, and potentially elevated system or software process.
Technique: T1574: Hijack Execution Flow
Indrik Spider has downloaded additional scripts, malware, and tools onto a compromised host.
Technique: T1105: Ingress Tool Transfer
CHOPSTICK is capable of performing keylogging.
Technique: T1056: Input Capture
Old Comnie Variant C2 Decoder      12345678910111213141516171819  import requestsimport sysimport redef decode(data):  o = ""  for c in data:    if c == "*":      o += "."    elif c == "|":      o += ":"    elif c == "+":      o += ";"    else:      o += chr(ord(c)-49)  return or = requests.get(sys.argv[1])fd = r.textdata = fd.split("++a++")[1].split("++a++")[0]print(decode(data))       Samples Analyzed eed5945c36ba22a2531dd2d9dd7bc4e17e68544d512be75670919caf287c1b4a 8026442b812469e48ccd11611ab6eacdcb312a8f1aabd563b7f4cb4868315e16 c8951038fd53321661274e5a12532c3fb6f73c75fd75503a1089c56990658fef 48a1ce103e5bf47c47cc5ed40b2dc687ebaf3674d667419287bcb1d0b8d8dda6 e06b797a24fa03a77e0d5f11b0cf0f4f038e0a9ea04d4981d39148969349c79c 7282d0709449abe16457864f58157cac8d007571dc5d463d393d1ae2605d17e0 bf6ee8426245b167a69292e513c0841d818b310dda87daea649221f4e0afd1b3 62b98dde60cb4dd0d0088bde222c5c2c4c92560cccf4753f1ce94e044093ab85 756952652290ad09fe03c8674d44eab2077b091398187c3abcb6f1ddc462c32d 639a49390c6f8597d36ec0bd245efa1b4a078c0506fb515e577a40389b39a614 29ed6eb3c882b018c2bb6bf2f8eb15069dc5510ca119abebf24f09e3c91f10aa 0e8a4e4d5ca501bad25a730fb5de534fa324c6ac23e0a573524693f2d996d105 316a0c6849f183a1a52d0c7648e722c4ca85bd57b0804a147c0c8656b84bbdb9   Identified C2s 121.126.211[.]94:8080 113.196.70[.]11:80,8080 133.130.101[.]47:443 123.51.208[.]157:443;8000;8080   C2 Hosting URLs (DDR URLs) github[.]com/korlee5643 itsmonsee.tumblr[.]com allworldnewsway.blogspot[.]com
Technique: T1571: Non-Standard Port
Clop can delete the shadow volumes with vssadmin Delete Shadows /all /quiet and can use bcdedit to disable recovery options.
Technique: T1490: Inhibit System Recovery
Caterpillar WebShell can upload files over the C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
CORALDECK has exfiltrated data in HTTP POST headers.
Technique: T1048: Exfiltration Over Alternative Protocol
BlackMould has the ability to download files to the victim's machine.
Technique: T1105: Ingress Tool Transfer
OLDBAIT obfuscates internal strings and unpacks them at startup.
Technique: T1027: Obfuscated Files or Information
Maze has inserted large blocks of junk code, including some components to decrypt strings and other important information for later in the encryption process.
Technique: T1027: Obfuscated Files or Information
Fysbis has the ability to delete files.
Technique: T1070: Indicator Removal on Host
Sidewinder has used tools to enumerate software installed on an infected host.
Technique: T1518: Software Discovery
The Name key indicates an arbitrary name assigned by the creator and the Exec key indicates the application and command line arguments to execute.
Technique: T1547: Boot or Logon Autostart Execution
In Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks.
Technique: T1053: Scheduled Task/Job
Trend Micro Solutions Trend Micro™ Deep Security™ and Vulnerability Protection provide virtual patching that protects endpoints from threats such as malicious redirections to malware-hosting URLs, as well as those that exploit unpatched vulnerabilities
Technique: T1068: Exploitation for Privilege Escalation
Execution via proc memory injection may also evade detection from security products since the execution is masked under a legitimate process.
Technique: T1055: Process Injection
OopsIE encodes data in hexadecimal format over the C2 channel.
Technique: T1132: Data Encoding
This greatly reduces the resources available for providing the targeted service.
Technique: T1499: Endpoint Denial of Service
Lokibot has used HTTP for C2 communications.
Technique: T1071: Application Layer Protocol
Carbanak has named malware "svchost.exe," which is the name of the Windows shared service host program.
Technique: T1036: Masquerading
Chimera has utilized various scans and queries to find domain controllers and remote services in the target environment.
Technique: T1018: Remote System Discovery
Initially, the key is sent to the C2 server with the entire message and headers encrypted with the RSA key exchange algorithm
Technique: T1521: nan
The Poison Frog server handles both the HTTP and DNS tunneling channels used by the hUpdater.ps1 and dUpdater.ps1 scripts
Technique: T1071: Application Layer Protocol
KillDisk has called GetCurrentProcess.
Technique: T1057: Process Discovery
Malicious Outlook rules can be created that can trigger code execution when an adversary sends a specifically crafted email to that user.
Technique: T1137: Office Application Startup
Ajax Security Team has used FireMalv custom-developed malware, which collected passwords from the Firefox browser storage.
Technique: T1555: Credentials from Password Stores
PlugX has a module for capturing keystrokes per process including window titles.
Technique: T1056: Input Capture
The main CozyCar dropper checks whether the victim has an anti-virus product installed.
Technique: T1518: Software Discovery
ZIRCONIUM has created a run key named Dropbox Update Setup to mask a persistence mechanism for a malicious binary.
Technique: T1036: Masquerading
However, the system may require an administrative account to log in or to perform it's intended purpose.
Technique: T1072: Software Deployment Tools
Backdoor.Oldrea collects information about running processes.
Technique: T1057: Process Discovery
SUNBURST remained dormant after initial access for a period of up to two weeks.
Technique: T1497: Virtualization/Sandbox Evasion
Similarly, adversaries may also utilize publicly disclosed or stolen Private Keys or credential materials to legitimately connect to remote environments via Remote Services.
Technique: T1078: Valid Accounts
Hi-Zor has the ability to create a reverse shell.
Technique: T1059: Command and Scripting Interpreter
Poseidon Group conducts credential dumping on victims, with a focus on obtaining credentials belonging to domain and database servers.
Technique: T1003: OS Credential Dumping
UBoatRAT takes advantage of the /SetNotifyCmdLine option in BITSAdmin to ensure it stays running on a system to maintain persistence.
Technique: T1197: BITS Jobs
As a result of all these steps, the last-stage Trojan is injected into svchost.exe’s process memory
Technique: T1055: Process Injection
SYSCON has the ability to use Systeminfo to identify system information.
Technique: T1082: System Information Discovery
Okrum can identify proxy servers configured and used by the victim, and use it to make HTTP requests to C2 its server.
Technique: T1090: Proxy
QakBot can use advanced web injects to steal web banking credentials.
Technique: T1185: Browser Session Hijacking
Hydraq uses basic obfuscation in the form of spaghetti code.
Technique: T1027: Obfuscated Files or Information
DDE execution can be invoked remotely via Remote Services such as Distributed Component Object Model .
Technique: T1559: Inter-Process Communication
poison name services
Technique: T1557: Adversary-in-the-Middle
InvisiMole can use zlib to compress and decompress data.
Technique: T1560: Archive Collected Data
RemoteCMD can execute commands remotely by creating a new schedule task on the remote system RTM tries to add a scheduled task to establish persistence.
Technique: T1053: Scheduled Task/Job
Brave Prince gathers file and directory information from the victim’s machine.
Technique: T1083: File and Directory Discovery
Additionally, some variants of FakeM use modified SSL code for communications back to C2 servers, making SSL decryption ineffective.
Technique: T1001: Data Obfuscation
RDAT can issue SOAP requests to delete already processed C2 emails.
Technique: T1070: Indicator Removal on Host
admin@338 has exploited client software vulnerabilities for execution, such as Microsoft Word CVE-2012-0158.
Technique: T1203: Exploitation for Client Execution
Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through Credential Access techniques.
Technique: T1550: Use Alternate Authentication Material
AppleScripts can also be executed as plain text shell scripts by adding #!/usr/bin/osascript to the start of the script file.
Technique: T1059: Command and Scripting Interpreter
Several BRONZE BUTLER tools encode data with base64 when posting it to a C2 server.
Technique: T1132: Data Encoding
Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them.
Technique: T1588: Obtain Capabilities
KeyBoy uses Python scripts for installing files and performing execution.
Technique: T1059: Command and Scripting Interpreter
When calling this API, the user will be prompted to enter their credentials but no checks on the origin or integrity of the program are made.
Technique: T1548: Abuse Elevation Control Mechanism
Cobalt Strike can spawn a job to inject into LSASS memory and dump password hashes.
Technique: T1003: OS Credential Dumping
admin@338 actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe The file name AcroRD32.exe, a legitimate process name for Adobe's Acrobat Reader, was used by APT1 as a name for malware.
Technique: T1036: Masquerading
Zeus Panda collects the OS version, system architecture, computer name, product ID, install date, and information on the keyboard mapping to determine the language used on the system.
Technique: T1082: System Information Discovery
Equation has used tools with the functionality to search for specific information about the attached hard drive that could be used to identify and overwrite the firmware.
Technique: T1120: Peripheral Device Discovery