HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
DealersChoice leverages vulnerable versions of Flash to perform execution.
Technique: T1203: Exploitation for Client Execution
APT28 has also obfuscated payloads with base64, XOR, and RC4.
Technique: T1027: Obfuscated Files or Information
TSCookie has the ability to proxy communications with command and control  servers.
Technique: T1090: Proxy
APT39 has used NBTscan and custom tools to discover remote systems.
Technique: T1018: Remote System Discovery
There are various means to encapsulate a protocol within another protocol.
Technique: T1572: Protocol Tunneling
Machete has used TLS-encrypted FTP to exfiltrate data.
Technique: T1573: Encrypted Channel
menuPass has used dynamic DNS service providers to host malicious domains.
Technique: T1568: Dynamic Resolution
Dridex has collected the computer name and OS architecture information from the system.
Technique: T1082: System Information Discovery
Application access tokens are used to make authorized API requests on behalf of a user and are commonly used as a way to access resources in cloud-based applications and software-as-a-service .
Technique: T1550: Use Alternate Authentication Material
APT38 has used Task Scheduler to run programs at system startup or on a scheduled basis for persistence.
Technique: T1053: Scheduled Task/Job
Maze has disabled dynamic analysis and other security tools including IDA debugger, x32dbg, and OllyDbg.
Technique: T1562: Impair Defenses
Grandoreiro can parse Outlook .pst files to extract e-mail addresses.
Technique: T1087: Account Discovery
Adversaries may also opt to enumerate processes via /proc.
Technique: T1057: Process Discovery
Chaes has used HTTP for C2 communications.
Technique: T1071: Application Layer Protocol
Sandworm Team has acquired open-source tools for some of it's operations; for example it acquired Invoke-PSImage to establish an encrypted channel from a compromised host to Sandworm Team's C2 server as part of its preparation for the 2018 Winter Olympics attack.
Technique: T1588: Obtain Capabilities
VERMIN is initially packed.
Technique: T1027: Obfuscated Files or Information
SLOTHFULMEDIA has hashed a string containing system information prior to exfiltration via POST requests.
Technique: T1001: Data Obfuscation
APT12 has used the RIPTIDE RAT, which communicates over HTTP with a payload encrypted with RC4.
Technique: T1573: Encrypted Channel
Sys10 collects the account name of the logged-in user and sends it to the C2.
Technique: T1033: System Owner/User Discovery
Disk Structure Wipe may be performed in isolation, or along with Disk Content Wipe if all sectors of a disk are wiped.
Technique: T1561: Disk Wipe
Explosive has collected the MAC address from the victim's machine.
Technique: T1016: System Network Configuration Discovery
GRIFFON has used a screenshot module that can be used to take a screenshot of the remote system.
Technique: T1113: Screen Capture
QakBot can use net share to identify network shares for use in lateral movement.
Technique: T1135: Network Share Discovery
SOUNDBITE is capable of enumerating and manipulating files and directories.
Technique: T1083: File and Directory Discovery
The command prompt can be invoked remotely via Remote Services such as SSH.
Technique: T1059: Command and Scripting Interpreter
Grandoreiro can collect the computer name and OS version from a compromised host.
Technique: T1082: System Information Discovery
HOPLIGHT has used WMI to recompile the Managed Object Format  files in the WMI repository.
Technique: T1047: Windows Management Instrumentation
This variation of the Zebrocy downloader begins by gathering the serial number for the storage volume with the label “C:\” and the computer name
Technique: T1082: System Information Discovery
FlawedAmmyy enumerates the privilege level of the victim during the initial infection.
Technique: T1069: Permission Groups Discovery
MuddyWater has used malware that can upload additional files to the victim’s machine.
Technique: T1105: Ingress Tool Transfer
WinRM  can be used as a method of remotely interacting with Windows Management Instrumentation.
Technique: T1021: Remote Services
RTM has been delivered via spearphishing attachments disguised as PDF documents.
Technique: T1566: Phishing
APT41 deployed rootkits on Linux systems.
Technique: T1014: Rootkit
In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user.
Technique: T1052: Exfiltration Over Physical Medium
Wizard Spider has used the “net view” command to locate mapped network shares.
Technique: T1135: Network Share Discovery
Turla has also exfiltrated stolen files to OneDrive and 4shared.
Technique: T1567: Exfiltration Over Web Service
GALLIUM used a modified version of HTRAN in which they obfuscated strings such as debug messages in an apparent attempt to evade detection.
Technique: T1027: Obfuscated Files or Information
The Grandoreiro payload has been delivered encrypted with a custom XOR-based algorithm and also as a base64-encoded ZIP file.
Technique: T1027: Obfuscated Files or Information
Explosive has a function to download a file to the infected system.
Technique: T1105: Ingress Tool Transfer
Okrum can obtain the date and time of the compromised system.
Technique: T1124: System Time Discovery
UBoatRAT can start a command shell.
Technique: T1059: Command and Scripting Interpreter
FlawedAmmyy beacons out the victim operating system and computer name during the initial infection.
Technique: T1082: System Information Discovery
Magic Hound has used RAR to stage and compress local folders.
Technique: T1560: Archive Collected Data
The PowerShell script executes a compressed first stage PowerShell child process, which then performs a second stage PowerShell process
Technique: T1546: Event Triggered Execution
Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors and enabling root access to non-privileged users.
Technique: T1547: Boot or Logon Autostart Execution
Bandook has a command built in to use a raw TCP socket.
Technique: T1095: Non-Application Layer Protocol
Tonto Team has used Python-based tools for execution.
Technique: T1059: Command and Scripting Interpreter
The persona may exist on a single site or across multiple sites .
Technique: T1585: Establish Accounts
An adversary is likely to hijack objects that are used frequently enough to maintain a consistent level of persistence, but are unlikely to break noticeable functionality within the system as to avoid system instability that could lead to detection.
Technique: T1546: Event Triggered Execution
Operation Wocao has accessed and collected credentials from password managers.
Technique: T1555: Credentials from Password Stores
GoldenSpy has been packaged with a legitimate tax preparation software.
Technique: T1195: Supply Chain Compromise
Command and control  communications are hidden  in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen.
Technique: T1001: Data Obfuscation
Rocke used malware to download additional malicious files to the target system.
Technique: T1105: Ingress Tool Transfer
Valak can collect sensitive mailing information from Exchange servers, including credentials and the domain certificate of an enterprise.
Technique: T1114: Email Collection
TA505 has used malware to gather credentials from FTP clients and Outlook.
Technique: T1552: Unsecured Credentials
Proxysvc can overwrite files indicated by the attacker before deleting them.
Technique: T1485: Data Destruction
Pysa has used PsExec to copy and execute the ransomware.
Technique: T1569: System Services
PLEAD has the ability to upload and download files to and from an infected host.
Technique: T1105: Ingress Tool Transfer
A keylogging tool used by APT3 gathers network information from the victim, including the MAC address, IP address, WINS, DHCP server, and gateway.
Technique: T1016: System Network Configuration Discovery
OwaAuth has been loaded onto Exchange servers and disguised as an ISAPI filter .
Technique: T1505: Server Software Component
Bazar can create a scheduled task for persistence.
Technique: T1053: Scheduled Task/Job
The case we found arrived through a targeted email that contained a document file (in docx format).
Technique: T1566: Phishing
InstallUtil.exe
Technique: T1218: Signed Binary Proxy Execution
APT33 has used malicious e-mail attachments to lure victims into executing malware.
Technique: T1204: User Execution
Adversaries may buy, lease, or rent a network of compromised systems that can be used during targeting.
Technique: T1583: Acquire Infrastructure
This also describes which commands users can run as other users or groups.
Technique: T1548: Abuse Elevation Control Mechanism
Taidoor can copy cmd.exe into the system temp folder.
Technique: T1059: Command and Scripting Interpreter
LiteDuke can wait 30 seconds before executing additional code if security software is detected.
Technique: T1497: Virtualization/Sandbox Evasion
Denis has a version written in PowerShell.
Technique: T1059: Command and Scripting Interpreter
Indrik Spider has used Group Policy Objects to deploy batch scripts.
Technique: T1484: Domain Policy Modification
OopsIE uses HTTP for C2 communications.
Technique: T1071: Application Layer Protocol
Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open links.
Technique: T1204: User Execution
Adversaries may attempt to subvert these trust mechanisms.
Technique: T1553: Subvert Trust Controls
Within Linux and MacOS systems, sudo  allows users to perform commands from terminals with elevated privileges and to control who can perform these commands on the system.
Technique: T1548: Abuse Elevation Control Mechanism
With elevated permission , this attribute can be removed from any file.
Technique: T1553: Subvert Trust Controls
Remexi obfuscates its configuration data with XOR.
Technique: T1027: Obfuscated Files or Information
SUNSPOT decrypts SUNBURST, which was stored in AES128-CBC encrypted blobs.
Technique: T1140: Deobfuscate/Decode Files or Information
The attack is part of a trend where threat groups hide malicious activity by communicating with legitimate web services such as social networking and cloud storage sites to foil detection efforts.[2][3] A Cyber Campaign Likely Intended to Monitor Hong Kong Media During a Period of Crisis The threat group has previously used newsworthy events as lures to deliver malware.[4] They have largely targeted organizations involved in financial, economic and trade policy, typically using publicly available RATs such as Poison Ivy, as well some non-public backdoors.[5] The group started targeting Hong Kong media companies, probably in response to political and economic challenges in Hong Kong and China
Technique: T1102: Web Service
The resulting HTTP POST request looks like the following: POST http://185.25.50[.]93/syshelp/kd8812u/protocol.php HTTP/1.1 Host: 185.25.50[.]93 Content-Type: application/x-www-form-urlencoded Content-Length: 21 porg=44908AE0524f422d We have not seen a C2 server respond to our requests during our analysis, however, we do know how the Trojan will parse the C2’s response for specific data
Technique: T1071: Application Layer Protocol
A JavaScript file named photo_high_re\u202Egnp.js will be displayed as photo_high_resj.png.
Technique: T1036: Masquerading
GreyEnergy has a module for Mimikatz to collect Windows credentials from the victim’s machine.
Technique: T1003: OS Credential Dumping
Adversaries may easily gather employee names, since they may be readily available and exposed via online or other accessible data sets  or Search Victim-Owned Websites.
Technique: T1589: Gather Victim Identity Information
Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable to Exploitation for Privilege Escalation.
Technique: T1518: Software Discovery
Patchwork has used spearphishing with links to deliver files with exploits to initial victims.
Technique: T1566: Phishing
A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.
Technique: T1505: Server Software Component
Mosquito uses a custom encryption algorithm, which consists of XOR and a stream that is similar to the Blum Blum Shub algorithm.
Technique: T1573: Encrypted Channel
Cleaver has obtained and used open-source tools such as PsExec, Windows Credential Editor, and Mimikatz.
Technique: T1588: Obtain Capabilities
Revenge RAT has a plugin to perform RDP access.
Technique: T1021: Remote Services
Kazuar obtains a list of running processes through WMI querying.
Technique: T1047: Windows Management Instrumentation
BitPaymer can enumerate the sessions for each user logged onto the infected host.
Technique: T1087: Account Discovery
Final1stspy creates a Registry Run key to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
Internal Reconnaissance APT40 uses compromised credentials to log on to other connected systems and conduct reconnaissance
Technique: T1021: Remote Services
Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer.
Technique: T1574: Hijack Execution Flow
Nidiran can create a new service named msamger .
Technique: T1543: Create or Modify System Process
If an adversary has a username and password but the user is not logged onto the system, the adversary can then create a logon session for the user using the LogonUser function.
Technique: T1134: Access Token Manipulation
Ixeshe uses custom Base64 encoding schemes to obfuscate command and control traffic in the message body of HTTP requests.
Technique: T1132: Data Encoding
Sykipot has been known to establish persistence by adding programs to the Run Registry key.
Technique: T1547: Boot or Logon Autostart Execution
Wingbird side loads a malicious file, sspisrv.dll, in part of a spoofed lssas.exe service.
Technique: T1574: Hijack Execution Flow
iKitten will zip up the /Library/Keychains directory before exfiltrating it.
Technique: T1560: Archive Collected Data
Gold Dragon stores information gathered from the endpoint in a file named 1.hwp.
Technique: T1074: Data Staged
BLUELIGHT can collect passwords stored in web browers, including Internet Explorer, Edge, Chrome, and Naver Whale.
Technique: T1555: Credentials from Password Stores
Rising Sun can detect the computer name, operating system, and other native system information.
Technique: T1082: System Information Discovery
Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses.
Technique: T1601: Modify System Image
POWERTON is written in PowerShell.
Technique: T1059: Command and Scripting Interpreter
Lucifer has attempted to brute force TCP ports 135  and 1433  with the default username or list of usernames and    passwords.
Technique: T1110: Brute Force
Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity.
Technique: T1001: Data Obfuscation
To gain access to kernel memory to modify variables related to signature checks, such as modifying g_CiOptions to disable Driver Signature Enforcement, adversaries may conduct Exploitation for Privilege Escalation using a signed, but vulnerable driver.
Technique: T1553: Subvert Trust Controls
Conficker copies itself into the %systemroot%\system32 directory and registers as a service.
Technique: T1543: Create or Modify System Process
Adversaries may leverage cmd to execute various commands and payloads.
Technique: T1059: Command and Scripting Interpreter
GRIFFON has used a reconnaissance module that can be used to retrieve Windows domain membership information.
Technique: T1069: Permission Groups Discovery
These scans may also include more broad attempts to Gather Victim Host Information that can be used to identify more commonly known, exploitable vulnerabilities.
Technique: T1595: Active Scanning
DarkHydrus has sent spearphishing emails with password-protected RAR archives containing malicious Excel Web Query files .
Technique: T1566: Phishing
Notes: 
* RID 500 account is the local, built-in administrator.
Technique: T1003: OS Credential Dumping
Bandook has a command to get the public IP address from a system.
Technique: T1016: System Network Configuration Discovery
BackdoorDiplomacy has used NetCat and PortQry  to enumerate network connections and display the status of related TCP and UDP ports.
Technique: T1049: System Network Connections Discovery
OilRig can download remote files onto victims.
Technique: T1105: Ingress Tool Transfer
ServHelper has the ability to execute a PowerShell script to get information from the infected host.
Technique: T1059: Command and Scripting Interpreter
Scripts can be executed via the command line utility osascript, they can be compiled into applications or script files via osacompile, and they can be compiled and executed in memory of other programs by leveraging the OSAKit Framework.
Technique: T1059: Command and Scripting Interpreter
Hildegard has downloaded scripts from GitHub.
Technique: T1102: Web Service
Remsec also disguised malicious modules using similar filenames as custom network encryption software on victims.
Technique: T1036: Masquerading
Some adversaries may also use Automated Collection on the local system.
Technique: T1005: Data from Local System
Gamaredon Group has loaded the group's previously delivered VBA project by relaunching Microsoft Outlook with the /altvba option, once the Application.Startup event is received.
Technique: T1137: Office Application Startup
Indrik Spider has used WMIC to execute commands on remote computers.
Technique: T1047: Windows Management Instrumentation
Information about network topologies may also be exposed to adversaries via online or other accessible data sets .
Technique: T1590: Gather Victim Network Information
Adversaries can compromise and manipulate devices that perform encryption of network traffic.
Technique: T1600: Weaken Encryption
Comnie uses blogs and third-party sites  to avoid DNS-based blocking of their communication to the command and control server.
Technique: T1102: Web Service
The overwritten instruction (displayed in Figure 1) is used to call the “WinExec” function from kernel32.dll, as depicted in the instruction at 00430c12, which calls the “WinExec” function
Technique: T1106: Native API
Adversaries have also may use infrastructure discovery APIs such as DescribeDBInstances to determine size, owner, permissions, and network ACLs of database resources.
Technique: T1580: Cloud Infrastructure Discovery
TEARDROP ran as a Windows service from the c:\windows\syswow64 folder.
Technique: T1543: Create or Modify System Process
Detecting Avast  A unique feature of this latest Astaroth Trojan campaign is the malware's ability to search for specific security products and exploit them
Technique: T1518: Software Discovery
RainyDay can use tools to collect credentials from web browsers.
Technique: T1555: Credentials from Password Stores
MiniDuke can gather the hostname on a compromised machine.
Technique: T1082: System Information Discovery
jRAT has a function to delete files from the victim’s machine.
Technique: T1070: Indicator Removal on Host
Aria-body has the ability to identify the location, public IP address, and domain name on a compromised host.
Technique: T1016: System Network Configuration Discovery
SombRAT can use a legitimate process name to hide itself.
Technique: T1036: Masquerading
Mustang Panda has embedded VBScript components in LNK files to download additional files and automate collection.
Technique: T1059: Command and Scripting Interpreter
Hildegard has used the BOtB tool which exploits CVE-2019-5736.
Technique: T1068: Exploitation for Privilege Escalation
An adversary can modify one of these files directly to include a link to their malicious executable to provide a persistence mechanism each time the user reboots their machine .
Technique: T1547: Boot or Logon Autostart Execution
gh0st RAT is able to wipe event logs.
Technique: T1070: Indicator Removal on Host
SDBbot has the ability to use application shimming for persistence if it detects it is running as admin on Windows XP or 7, by creating a shim database to patch services.exe.
Technique: T1546: Event Triggered Execution
DarkComet gathers the username from the victim’s machine.
Technique: T1033: System Owner/User Discovery
AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products
Technique: T1518: Software Discovery
Bazar can query Windows\CurrentVersion\Uninstall for installed applications.
Technique: T1012: Query Registry
Dragonfly 2.0 commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files.
Technique: T1505: Server Software Component
SUNSPOT malware was designed and used to insert SUNBURST into software builds of the SolarWinds Orion IT management product.
Technique: T1195: Supply Chain Compromise
Figure 11 Embedded BMP file containing encrypted string data RC4 is used to decrypt this data using a 16-byte key that is stored within the BMP file at offset 0x502
Technique: T1140: Deobfuscate/Decode Files or Information
SQL Stored Procedures are code that can be saved and reused so that database users do not waste time rewriting frequently used SQL queries.
Technique: T1505: Server Software Component
HAWKBALL has used HTTP to communicate with a single hard-coded C2 server.
Technique: T1071: Application Layer Protocol
ARTIFACTS: Documents:     2781526f6b302da00661b9a6a625a5a6ecf4ffccafa61202e9b0e9b61b657867     c357396ca82fdcd6b6f46b748f2b6941051dbc81be5326cf9548e6e95507af7c     ffebcc4d2e851baecd89bf11103e3c9de86f428fdeaf0f8b33d9ea6f5ef56685     Domains:  true-deals[.]com; strikes-withlucky[.]com Email account in registration is: isvarawski@yahoo.com Attacker email account: adrian.1987clark@yahoo.com
Technique: T1087: Account Discovery
Metamorfo has used raw TCP for C2.
Technique: T1095: Non-Application Layer Protocol
ShadowPad has downloaded code from a C2 server.
Technique: T1105: Ingress Tool Transfer
Leviathan has created new social media accounts for targeting efforts.
Technique: T1585: Establish Accounts
nan
Technique: T1059: Command and Scripting Interpreter
Stormspotter is an open source tool for enumerating and constructing a graph for Azure resources and services, and Pacu is an open source AWS exploitation framework that supports several methods for discovering cloud services.
Technique: T1526: Cloud Service Discovery
WinMM is usually configured with primary and backup domains for C2 communications.
Technique: T1008: Fallback Channels
TEXTMATE executes cmd.exe to provide a reverse shell to adversaries.
Technique: T1059: Command and Scripting Interpreter
Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient.
Technique: T1114: Email Collection
gh0st RAT has checked for the existence of a Service key to determine if it has already been installed on the system.
Technique: T1012: Query Registry
The encrypted file contains a config file of 0x78 bytes. The data is decrypted with an 0xD9 XOR operation.
Technique: T1027: Obfuscated Files or Information
Bazar can download and deploy additional payloads, including ransomware and post-exploitation frameworks such as Cobalt Strike.
Technique: T1105: Ingress Tool Transfer
Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location.
Technique: T1074: Data Staged
Strider has registered its persistence module on domain controllers as a Windows LSA  password filter to acquire credentials any time a domain, local user, or administrator logs in or changes a password.
Technique: T1556: Modify Authentication Process
After creating a digital certificate, an adversary may then install that certificate  on infrastructure under their control.
Technique: T1587: Develop Capabilities
The malware then sets the hijacked service to start automatically to establish persistence.
Technique: T1574: Hijack Execution Flow
PLEAD samples were found to be highly obfuscated with junk code.
Technique: T1001: Data Obfuscation
APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection.
Technique: T1083: File and Directory Discovery
The White Company has used phishing lure documents that trick users into opening them and infecting their computers.
Technique: T1204: User Execution
Adversaries may use internal spearphishing to gain access to additional information or exploit other users within the same organization after they already have access to accounts or systems within the environment.
Technique: T1534: Internal Spearphishing
Zyklon is a publicly available, full-featured backdoor capable of keylogging, password harvesting, downloading and executing additional plugins, conducting distributed denial-of-service (DDoS) attacks, and self-updating and self-removal
Technique: T1105: Ingress Tool Transfer
APT37 collects the computer name, the BIOS model, and execution path.
Technique: T1082: System Information Discovery
Turla has also used PowerShell scripts to load and execute malware in memory.
Technique: T1059: Command and Scripting Interpreter
Remsec harvests plain-text credentials as a password filter registered on domain controllers.
Technique: T1556: Modify Authentication Process
Sandworm Team has used a script to attempt RPC authentication against a number of hosts.
Technique: T1110: Brute Force
Carbon uses the command net time \\127.0.0.1 to get information the system’s time.
Technique: T1124: System Time Discovery
APT32 has used scheduled task raw XML with a backdated timestamp of June 2, 2016.
Technique: T1070: Indicator Removal on Host
FIN10 has used RDP to move laterally to systems in the victim environment.
Technique: T1021: Remote Services
SynAck checks its directory location in an attempt to avoid launching in a sandbox.
Technique: T1083: File and Directory Discovery
Ke3chang transferred compressed and encrypted RAR files containing exfiltration through the established backdoor command and control channel during operations.
Technique: T1041: Exfiltration Over C2 Channel
Gathering this information may reveal opportunities for other forms of reconnaissance  or Search Open Technical Databases, establishing operational resources  or Obtain Capabilities, and/or initial access  or Hardware Additions.
Technique: T1592: Gather Victim Host Information
KeyBoy uses -w Hidden to conceal a PowerShell window that downloads a payload.
Technique: T1564: Hide Artifacts
OSX_OCEANLOTUS.D encrypts its strings in RSA256 and encodes them in a custom base64 scheme and XOR.
Technique: T1027: Obfuscated Files or Information
Cobalt Group has used DNS tunneling for C2.
Technique: T1071: Application Layer Protocol
Sandworm Team's BCS-server tool connects to the designated C2 server via HTTP.
Technique: T1071: Application Layer Protocol
CosmicDuke exfiltrates collected files automatically over FTP to remote servers.
Technique: T1020: Automated Exfiltration
NativeZone can display an RTF document to the user  to enable execution of  Cobalt Strike stage shellcode.
Technique: T1204: User Execution
An adversary may target the systems of those known to conduct exploit research and development in order to gain that knowledge for use during a subsequent operation.
Technique: T1588: Obtain Capabilities
RTM can scan victim drives to look for specific banking software on the machine to determine next actions.
Technique: T1518: Software Discovery
Following exploitation with LOWBALL malware, admin@338 actors created a file containing a list of commands to be executed on the compromised computer.
Technique: T1059: Command and Scripting Interpreter
Infrastructure solutions include physical or cloud servers, domains, and third-party web services.
Technique: T1583: Acquire Infrastructure
CrossRAT uses run keys for persistence on Windows Seasalt creates a Registry entry to ensure infection after reboot under HKLM\Software\Microsoft\Windows\currentVersion\Run.
Technique: T1547: Boot or Logon Autostart Execution
Caterpillar WebShell can obtain a list of local groups of users from a system.
Technique: T1069: Permission Groups Discovery
The "ZR" variant of BACKSPACE will check to see if known host-based firewalls are installed on the infected systems.
Technique: T1562: Impair Defenses
Adversaries may delete files left behind by the actions of their intrusion activity.
Technique: T1070: Indicator Removal on Host
These logon scripts run with the privileges of the user they are assigned to.
Technique: T1037: Boot or Logon Initialization Scripts
GALLIUM packed some payloads using different types of packers, both known and custom.
Technique: T1027: Obfuscated Files or Information
APT28 has mapped network drives using Net and administrator credentials.
Technique: T1021: Remote Services
JHUHUGIT uses a .bat file to execute a .dll.
Technique: T1059: Command and Scripting Interpreter
Sowbug obtained OS version and hardware configuration from a victim.
Technique: T1082: System Information Discovery
Adversaries may use XDG autostart entries to maintain persistence by executing malicious commands and payloads, such as remote access tools, during the startup of a desktop environment.
Technique: T1547: Boot or Logon Autostart Execution
CosmicDuke exfiltrates collected files over FTP or WebDAV.
Technique: T1048: Exfiltration Over Alternative Protocol
Taidoor can perform DLL loading.
Technique: T1055: Process Injection
SamSam uses custom batch scripts to execute some of its components.
Technique: T1059: Command and Scripting Interpreter
APT28 has exploited Microsoft Office vulnerability CVE-2017-0262 for execution.
Technique: T1203: Exploitation for Client Execution
Olympic Destroyer utilizes PsExec to help propagate itself across a network.
Technique: T1569: System Services
Agent Tesla can encrypt data with 3DES before sending it over to a C2 server.
Technique: T1560: Archive Collected Data
BoxCaon has the capability to download folders' contents on the system and upload the results back to its Dropbox drive.
Technique: T1567: Exfiltration Over Web Service
Melcoz can use VBS scripts to execute malicious DLLs.
Technique: T1059: Command and Scripting Interpreter
Launch Daemons are often used to provide access to shared resources, updates to software, or conduct automation tasks.
Technique: T1543: Create or Modify System Process
A Night Dragon DLL included an XOR-encoded section.
Technique: T1027: Obfuscated Files or Information
SHOTPUT has a command to obtain a process listing.
Technique: T1057: Process Discovery
Ursnif has injected code into target processes via thread local storage callbacks.
Technique: T1055: Process Injection
Adversaries may clear system logs to hide evidence of an intrusion.
Technique: T1070: Indicator Removal on Host
APT39 used Remexi to collect usernames from the system.
Technique: T1033: System Owner/User Discovery
Waterbear can identify the process for a specific security product.
Technique: T1057: Process Discovery
Adversaries may create a domain account to maintain access to victim systems.
Technique: T1136: Create Account
Ragnar Locker has attempted to stop services associated with business applications and databases to release the lock on files used by these applications so they may be encrypted.
Technique: T1489: Service Stop
Dtrack can save collected data to disk, different file formats, and network shares.
Technique: T1074: Data Staged
Windigo has delivered a generic Windows proxy Win32/Glubteta.M.
Technique: T1090: Proxy
MESSAGETAP has XOR-encrypted and stored contents of SMS messages that matched its target list.
Technique: T1560: Archive Collected Data
Sowbug has used command line during its intrusions.
Technique: T1059: Command and Scripting Interpreter
Unknown Logger has functionality to disable security tools, including Kaspersky, BitDefender, and MalwareBytes.
Technique: T1562: Impair Defenses
APT28 has harvested user's login credentials.
Technique: T1589: Gather Victim Identity Information
Crimson can identify the geographical location of a victim host.
Technique: T1614: System Location Discovery
Cobian RAT can launch a remote command shell interface for executing commands.
Technique: T1059: Command and Scripting Interpreter
Elise creates a file in AppData\Local\Microsoft\Windows\Explorer and stores all harvested data in that file.
Technique: T1074: Data Staged
After the .NET PE file has been run, we observed the same behavior as the above QUADAGENT sample of dropping a PowerShell script with the filename SystemDiskClean.ps1 alongside a VBScript file with the same name
Technique: T1036: Masquerading
Mavinject.exe is the Microsoft Application Virtualization Injector, a Windows utility that can inject code into external processes as part of Microsoft Application Virtualization .
Technique: T1218: Signed Binary Proxy Execution
APT3 has used tools to dump passwords from browsers.
Technique: T1555: Credentials from Password Stores
Trojan.Karagany samples sometimes use common binary packers such as UPX and Aspack on top of a custom Delphi binary packer.
Technique: T1027: Obfuscated Files or Information
Hildegard has used history -c to clear script shell logs.
Technique: T1070: Indicator Removal on Host
An adversary may introduce new firewall rules or policies to allow access into a victim cloud environment.
Technique: T1562: Impair Defenses
Similar to Regsvr32 / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs   and/or COM scriptlets  from remote servers.
Technique: T1218: Signed Binary Proxy Execution
FinFisher contains junk code in its functions in an effort to confuse disassembly programs.
Technique: T1027: Obfuscated Files or Information
Smoke Loader deobfuscates its code.
Technique: T1140: Deobfuscate/Decode Files or Information
Catchamas collects keystrokes from the victim’s machine.
Technique: T1056: Input Capture
After creating a new service for persistence, TDTESS sets the file creation time for the service to the creation time of the victim's legitimate svchost.exe file.
Technique: T1070: Indicator Removal on Host
APT29 used the Get-AcceptedDomain PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell.
Technique: T1482: Domain Trust Discovery
On macOS, launchd processes known as Launch Daemon and Launch Agent are run to finish system initialization and load user specific parameters.
Technique: T1543: Create or Modify System Process
BLINDINGCAN has collected from a victim machine the system name, processor information, OS version, and disk information, including type and free space available.
Technique: T1082: System Information Discovery
Carbon can use Pastebin to receive C2 commands.
Technique: T1102: Web Service
Seasalt obfuscates configuration data.
Technique: T1027: Obfuscated Files or Information
Dragonfly 2.0 used various types of scripting to perform operations, including batch scripts.
Technique: T1059: Command and Scripting Interpreter
Gorgon Group sent emails to victims with malicious Microsoft Office documents attached.
Technique: T1566: Phishing
StoneDrill can obtain the current date and time of the victim machine.
Technique: T1124: System Time Discovery
Hydraq creates new services to establish persistence.
Technique: T1543: Create or Modify System Process
LoudMiner has set the attributes of the VirtualBox directory and VBoxVmService parent directory to "hidden".
Technique: T1564: Hide Artifacts
Turla has exploited vulnerabilities in the VBoxDrv.sys driver to obtain kernel mode privileges.
Technique: T1068: Exploitation for Privilege Escalation
Malicious processes are marked red (click image to enlarge):  The following malicious files are dropped and run:  C:\ProgramData\{2ED05C38-D464-4188-BC7F-F6915DE8D764}\OFFLINE\9A189DFE\C7B7C186\main.vbs dcac79d7dc4365c6d742a49244e81fd0 C:\Users\Public\Libraries\RecordedTV\DnE.ps1 7fe0cb5edc11861bc4313a6b04aeedb2 C:\Users\Public\Libraries\RecordedTV\DnS.ps1 3920c11797ed7d489ca2a40201c66dd4 “C:\Windows\System32\schtasks.exe” /create /F /sc minute /mo 3 /tn “GoogleUpdateTasksMachineUI” /tr C:\Users\Public\Libraries\RecordedTV\backup.vbs 7528c387f853d96420cf7e20f2ad1d32  Command and control server is located in the following domain: tecsupport[.]in A detailed analysis of the malware is provided in two posts by Palo Alto networks and in a post by FireEye, which wrote about previous campaigns by this threat agent
Technique: T1204: User Execution
They also used AdFind to enumerate domains and to discover trust between federated domains.
Technique: T1482: Domain Trust Discovery
MS Office documents with embedded VBA content store source code inside of module streams.
Technique: T1564: Hide Artifacts
APT32's backdoor has used LZMA compression and RC4 encryption before exfiltration.
Technique: T1560: Archive Collected Data
This is the first time that Bankshot has been tied directly to financial-related hacking and the first time it has been used since November 2017
Technique: T1124: System Time Discovery
GreyEnergy can download additional modules and payloads.
Technique: T1105: Ingress Tool Transfer
A module in Prikormka collects passwords stored in applications installed on the victim.
Technique: T1555: Credentials from Password Stores
Cobalt Strike can set its "beacon" payload to reach out to the C2 server on an arbitrary and random interval.
Technique: T1029: Scheduled Transfer
Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information.
Technique: T1591: Gather Victim Org Information
Information from these sources may reveal opportunities for other forms of reconnaissance  or Phishing for Information, establishing operational resources  or Compromise Infrastructure, and/or initial access  or Trusted Relationship.
Technique: T1596: Search Open Technical Databases
This data is used by security tools and analysts to generate detections.
Technique: T1562: Impair Defenses
At this point QueueUserAPC can be used to invoke a function .
Technique: T1055: Process Injection
Lokibot has modified the Registry as part of its UAC bypass process.
Technique: T1112: Modify Registry
VaporRage has the ability to download malicious shellcode to compromised systems.
Technique: T1105: Ingress Tool Transfer
This is very similar to Thread Local Storage but creates a new process rather than targeting an existing process.
Technique: T1055: Process Injection
Micropsia can perform a recursive directory listing for all volume drives available on the victim's machine and can also fetch specific files by their paths.
Technique: T1083: File and Directory Discovery
HTTPBrowser has established persistence by setting the HKCU\Software\Microsoft\Windows\CurrentVersion\Run key value for wdm to the path of the executable.
Technique: T1547: Boot or Logon Autostart Execution
Information about business roles may reveal a variety of targetable details, including identifiable information for key personnel as well as what data/resources they have access to.
Technique: T1591: Gather Victim Org Information
Lazarus Group has exploited Adobe Flash vulnerability CVE-2018-4878 for execution.
Technique: T1203: Exploitation for Client Execution
A variant of Zebrocy captures screenshots of the victim’s machine in JPEG and BMP format.
Technique: T1113: Screen Capture
The method adversaries use will depend on the specific mechanism they seek to subvert.
Technique: T1553: Subvert Trust Controls
Dark Caracal collected complete contents of the 'Pictures' folder from compromised Windows systems.
Technique: T1005: Data from Local System
Goopy has the ability to  enumerate the infected system's user name via GetUserNameW.
Technique: T1106: Native API
Grandoreiro has the ability to use HTTP in C2 communications.
Technique: T1071: Application Layer Protocol
Mustang Panda has exploited CVE-2017-0199 in Microsoft Word to execute code.
Technique: T1203: Exploitation for Client Execution
AppleJeus has used a valid digital signature from Sectigo to appear legitimate.
Technique: T1553: Subvert Trust Controls
Adversaries may install malicious components that run on Internet Information Services  web servers to establish persistence.
Technique: T1505: Server Software Component
Machete uses HTTP for Command & Control.
Technique: T1071: Application Layer Protocol
Additional, if tty_tickets is disabled, adversaries can do this from any tty for that user.
Technique: T1548: Abuse Elevation Control Mechanism
Flame contains modules to infect USB sticks and spread laterally to other Windows systems the stick is plugged into using Autorun functionality.
Technique: T1091: Replication Through Removable Media
To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file.
Technique: T1564: Hide Artifacts
PROMETHIUM has used watering hole attacks to deliver malicious versions of legitimate installers.
Technique: T1189: Drive-by Compromise
The malicious .LNK-based directories have an embedded command that executes the hidden malware file in the directory and then opens the real intended directory so that the user's expected action still occurs.
Technique: T1080: Taint Shared Content
Once APT28 gained access to the DCCC network, the group then proceeded to use that access to compromise the DNC network.
Technique: T1199: Trusted Relationship
down_new has the ability to detect anti-virus products and processes on a compromised host.
Technique: T1518: Software Discovery
Note: aswrundll.exe is very similar to Microsoft’s own rundll32.exe - it allows you to execute DLLs by calling their exported functions
Technique: T1218: Signed Binary Proxy Execution
PipeMon has stored its encrypted payload in the Registry.
Technique: T1112: Modify Registry
PUNCHBUGGY can gather domain and workgroup information.
Technique: T1069: Permission Groups Discovery
Briba downloads files onto infected hosts.
Technique: T1105: Ingress Tool Transfer
DarkVishnya used brute-force attack to obtain login data.
Technique: T1110: Brute Force
LoJax has loaded an embedded NTFS DXE driver to be able to access and write to NTFS partitions.
Technique: T1564: Hide Artifacts
Dragonfly 2.0 compromised legitimate organizations' websites to create watering holes to compromise victims.
Technique: T1189: Drive-by Compromise
TEMP.Veles has used port-protocol mismatches on ports such as 443, 4444, 8531, and 50501 during C2.
Technique: T1571: Non-Standard Port
H1N1 encrypts C2 traffic using an RC4 key.
Technique: T1573: Encrypted Channel
However, execution via process doppelgänging may evade detection from security products since the execution is masked under a legitimate process.
Technique: T1055: Process Injection
This user action will typically be observed as follow-on behavior from Spearphishing Link.
Technique: T1204: User Execution
At a high-level, their targeting of financial organizations and subsequent heists have followed the same general pattern:   Information Gathering: Conducted research into an organization’s personnel and targeted third party vendors with likely access to SWIFT transaction systems to understand the mechanics of SWIFT transactions on victim networks (Please note: The systems in question are those used by the victim to conduct SWIFT transactions
Technique: T1018: Remote System Discovery
A version of XTunnel introduced in July 2015 inserted junk code into the binary in a likely attempt to obfuscate it and bypass security products.
Technique: T1027: Obfuscated Files or Information
It has also used common document file names for other malware binaries.
Technique: T1036: Masquerading
Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage.
Technique: T1562: Impair Defenses
Before executing malicious code, Ragnar Locker checks the Windows API GetLocaleInfoW and doesn't encrypt files if it finds a former Soviet country.
Technique: T1614: System Location Discovery
Cannon can collect the current time zone information from the victim’s machine.
Technique: T1124: System Time Discovery
VERMIN can delete files on the victim’s machine.
Technique: T1070: Indicator Removal on Host
Avaddon can collect the external IP address of the victim.
Technique: T1016: System Network Configuration Discovery
Initial triage begins with connecting to Windows Management Instrumentation (WMI) via the “ROOT\CIMV2” namespace
Technique: T1047: Windows Management Instrumentation
SharpStage can use WMI for execution.
Technique: T1047: Windows Management Instrumentation
SUNBURST communicated via HTTP GET or HTTP POST requests to third party servers for C2.
Technique: T1071: Application Layer Protocol
FIN7 has used port-protocol mismatches on ports such as 53, 80, 443, and 8080 during C2.
Technique: T1571: Non-Standard Port
Trojan.Karagany can inject a suspended thread of its own process into a new process and initiate via the ResumeThread API.
Technique: T1055: Process Injection
Several tools exist that can be used to poison name services within local networks such as NBNSpoof, Metasploit, and Responder.
Technique: T1557: Adversary-in-the-Middle
KONNI has used FTP to exfiltrate reconnaissance data out.
Technique: T1048: Exfiltration Over Alternative Protocol
The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at HKLM\SOFTWARE\Microsoft\Netsh.
Technique: T1546: Event Triggered Execution
SeaDuke C2 traffic has been encrypted with RC4 and AES.
Technique: T1573: Encrypted Channel
Cobalt Group has used odbcconf to proxy the execution of malicious DLL files.
Technique: T1218: Signed Binary Proxy Execution
Matryoshka uses reflective DLL injection to inject the malicious library and execute the RAT.
Technique: T1055: Process Injection
Ramsay can scan for network drives which may contain documents for collection.
Technique: T1135: Network Share Discovery
InvisiMole uses variations of a simple XOR encryption routine for C&C communications.
Technique: T1573: Encrypted Channel
Cobalt Strike can set its Beacon payload to reach out to the C2 server on an arbitrary and random interval.
Technique: T1029: Scheduled Transfer
These frameworks are used collaboratively to verify the user and determine what actions the user is allowed to perform.
Technique: T1550: Use Alternate Authentication Material
PLATINUM has sent spearphishing emails with attachments to victims as its primary initial access vector.
Technique: T1566: Phishing
OilRig uses remote services such as VPN, Citrix, or OWA to persist in an environment.
Technique: T1133: External Remote Services
BackConfig has the ability to use scheduled tasks to repeatedly execute malicious payloads on a compromised host.
Technique: T1053: Scheduled Task/Job
Windshift has used malware to identify installed AV and commonly used forensic and malware analysis tools.
Technique: T1518: Software Discovery
WIRTE has downloaded PowerShell code from the C2 server to be executed.
Technique: T1105: Ingress Tool Transfer
HOPLIGHT has been observed collecting victim machine information like OS version, drivers, volume information and more.
Technique: T1082: System Information Discovery
keylog 
Technique: T1056: Input Capture
HAFNIUM has used rundll32 to load malicious DLLs.
Technique: T1218: Signed Binary Proxy Execution
Turla established persistence by adding a Shell value under the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.
Technique: T1547: Boot or Logon Autostart Execution
Agent Tesla has the ability to use form-grabbing to extract data from web data forms.
Technique: T1185: Browser Session Hijacking
ISMInjector creates scheduled tasks to establish persistence.
Technique: T1053: Scheduled Task/Job
Sandworm Team has used a keylogger to capture keystrokes by using the SetWindowsHookEx function.
Technique: T1056: Input Capture
Remote desktop is a common feature in operating systems.
Technique: T1563: Remote Service Session Hijacking
Machete saves the window names.
Technique: T1010: Application Window Discovery