HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
APT39 has used remote access tools that leverage DNS in communications with C2.
Technique: T1071: Application Layer Protocol
SeaDuke has been packed with the UPX packer.
Technique: T1027: Obfuscated Files or Information
Before exfiltration, Okrum's backdoor has used hidden files to store logs and outputs from backdoor commands.
Technique: T1564: Hide Artifacts
LLMNR is based upon the Domain Name System  format and allows hosts on the same local link to perform name resolution for other hosts.
Technique: T1557: Adversary-in-the-Middle
ADVSTORESHELL can list running processes.
Technique: T1057: Process Discovery
Adversaries may also conduct a takeover of an existing botnet, such as redirecting bots to adversary-controlled C2 servers.
Technique: T1584: Compromise Infrastructure
MuddyWater has run tools including Browser64 to steal passwords saved in victim web browsers.
Technique: T1555: Credentials from Password Stores
Cobalt Strike can perform pass the hash.
Technique: T1550: Use Alternate Authentication Material
Cardinal RAT can uninstall itself, including deleting its executable.
Technique: T1070: Indicator Removal on Host
Patchwork has obfuscated a script with Crypto Obfuscator.
Technique: T1027: Obfuscated Files or Information
The Komplex trojan supports file deletion.
Technique: T1070: Indicator Removal on Host
Crutch has used a hardcoded GitHub repository as a fallback channel.
Technique: T1008: Fallback Channels
The PowerShell implant used in the Olympics campaign was a stager based on the PowerShell Empire framework that created an encrypted channel to the attacker’s server
Technique: T1546: Event Triggered Execution
RTM has distributed its malware via the RIG and SUNDOWN exploit kits, as well as online advertising network Yandex.Direct.
Technique: T1189: Drive-by Compromise
Sometimes a user's action may be required to open and Deobfuscate/Decode Files or Information for User Execution.
Technique: T1027: Obfuscated Files or Information
This can occur through social engineering and typically requires user action to grant access.
Technique: T1528: Steal Application Access Token
These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW.
Technique: T1027: Obfuscated Files or Information
Chaos conducts brute force attacks against SSH services to gain initial access.
Technique: T1110: Brute Force
Stuxnet removes itself from the system through a DLL export by deleting specific files and stored procedures.
Technique: T1070: Indicator Removal on Host
After a container file is extracted and/or mounted, the files contained within them may be treated as local files on disk and run without protections.
Technique: T1553: Subvert Trust Controls
JHUHUGIT has used COM hijacking to establish persistence by hijacking a class named MMDeviceEnumerator and also by registering the payload as a Shell Icon Overlay handler COM object .
Technique: T1546: Event Triggered Execution
A tool can be used for malicious purposes by an adversary, but  were not intended to be used for those purposes .
Technique: T1588: Obtain Capabilities
APT39 has used Ncrack to reveal credentials.
Technique: T1110: Brute Force
In Figure 9, below, red indicates targeted IP addresses, malware, registrant information, and domains associated with the targeted attack campaign while blue indicates criminal attack IP addresses, malware used, registrant information, and domains:  Figure 9
Technique: T1016: System Network Configuration Discovery
Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities.
Technique: T1562: Impair Defenses
Fox Kitten has named binaries and configuration files svhost and dllhost respectively to appear legitimate.
Technique: T1036: Masquerading
Remexi utilizes Run Registry keys in the HKLM hive as a persistence mechanism.
Technique: T1547: Boot or Logon Autostart Execution
TeamTNT executed Hildegard through the kubelet API run command and by executing commands on running containers.
Technique: T1609: Container Administration Command
Adversaries may abuse the RTLO character as a means of tricking a user into executing what they think is a benign file type.
Technique: T1036: Masquerading
jRAT collects information about the OS  as well as system up-time upon receiving a connection from a backdoor.
Technique: T1082: System Information Discovery
SynAck abuses NTFS transactions to launch and conceal malicious processes.
Technique: T1055: Process Injection
Webshell to maintain access to victim networks.
Technique: T1505: Server Software Component
Tonto Team has used a first stage web shell after compromising a vulnerable Exchange server.
Technique: T1505: Server Software Component
Olympic Destroyer uses API calls to enumerate the infected system's ARP table.
Technique: T1016: System Network Configuration Discovery
Anchor can self delete its dropper after the malware is successfully deployed.
Technique: T1070: Indicator Removal on Host
Prior to compromising social media accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation.
Technique: T1586: Compromise Accounts
In others, an adversary may deploy a new container configured without network rules, user limitations, etc.
Technique: T1610: Deploy Container
APT33 has used kill dates in their malware to guardrail execution.
Technique: T1480: Execution Guardrails
Remsec can obtain a process list from the victim.
Technique: T1057: Process Discovery
Hildegard has used an IRC channel for C2 communications.
Technique: T1071: Application Layer Protocol
gh0st RAT has decrypted and loaded the gh0st RAT DLL into memory, once the initial dropper executable is launched.
Technique: T1140: Deobfuscate/Decode Files or Information
QakBot has a module that can proxy C2 communications.
Technique: T1090: Proxy
Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network.
Technique: T1095: Non-Application Layer Protocol
ZIRCONIUM has used Dropbox for C2 allowing upload and download of files as well as execution of arbitrary commands.
Technique: T1102: Web Service
Some variants of FakeM use SSL to communicate with C2 servers.
Technique: T1095: Non-Application Layer Protocol
Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain.
Technique: T1136: Create Account
APT38  has attempted to lure victims into enabling malicious macros within email attachments.
Technique: T1204: User Execution
Doki was executed through an open Docker daemon API port.
Technique: T1133: External Remote Services
BabyShark has cleaned up all files associated with the secondary payload execution.
Technique: T1070: Indicator Removal on Host
Industroyer can enumerate remote computers in the compromised network.
Technique: T1018: Remote System Discovery
Kazuar gathers information on the system and local drives.
Technique: T1082: System Information Discovery
DLL side-loading has been used to execute BBSRAT through a legitimate Citrix executable, ssonsvr.exe.
Technique: T1574: Hijack Execution Flow
Once the second DLL is executed, it gathers information about the victim system’s setup, such as operating system version, and driver and processor information
Technique: T1082: System Information Discovery
BRONZE BUTLER has used a batch script that adds a Registry Run key to establish malware persistence.
Technique: T1547: Boot or Logon Autostart Execution
The daemon name may be disguised by using a name from a related operating system or benign software  Masquerading.
Technique: T1543: Create or Modify System Process
Mosquito runs whoami on the victim’s machine.
Technique: T1033: System Owner/User Discovery
Hildegard has encrypted an ELF file.
Technique: T1027: Obfuscated Files or Information
Most cloud providers provide various types of storage including persistent, local, and/or ephemeral, with the ephemeral types often reset upon stop/restart of the VM.
Technique: T1578: Modify Cloud Compute Infrastructure
BackConfig has been signed with self signed digital certificates mimicking a legitimate software company.
Technique: T1553: Subvert Trust Controls
NavRAT writes multiple outputs to a TMP file using the >> method.
Technique: T1074: Data Staged
Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Technique: T1078: Valid Accounts
Cobalt Group has used Remote Desktop Protocol to conduct lateral movement.
Technique: T1021: Remote Services
Adversaries may search public digital certificate data for information about victims that can be used during targeting.
Technique: T1596: Search Open Technical Databases
SombRAT has the ability to respawn itself using ShellExecuteW and CreateProcessW.
Technique: T1106: Native API
CORESHELL C2 messages are encrypted with custom stream ciphers using six-byte or eight-byte keys.
Technique: T1573: Encrypted Channel
Attor has automatically collected data about the compromised system.
Technique: T1119: Automated Collection
The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group.
Technique: T1069: Permission Groups Discovery
SUNSPOT enumerated the Orion software Visual Studio solution directory path.
Technique: T1083: File and Directory Discovery
Gazer injects its communication module into an Internet accessible process through which it performs C2.
Technique: T1055: Process Injection
Dragonfly 2.0 used a batch script to gather folder and file names from victim hosts.
Technique: T1083: File and Directory Discovery
PowerDuke has a command to list the victim's processes.
Technique: T1057: Process Discovery
Compromising a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers as well as that added by the compromised third-party.
Technique: T1584: Compromise Infrastructure
Zebrocy uses cmd.exe to execute commands on the system.
Technique: T1059: Command and Scripting Interpreter
Sakula calls cmd.exe to run various DLL files via rundll32.
Technique: T1218: Signed Binary Proxy Execution
StrongPity can use PowerShell to add files to the Windows Defender exclusions list.
Technique: T1059: Command and Scripting Interpreter
Lazarus Group malware uses multiple types of encryption and encoding in its malware files, including AES, Caracachs, RC4, basic XOR with constant 0xA7, and other techniques.
Technique: T1027: Obfuscated Files or Information
InvisiMole can inject its backdoor as a portable executable into a target process.
Technique: T1055: Process Injection
Threat Group-3390 has performed DLL search order hijacking to execute their payload.
Technique: T1574: Hijack Execution Flow
Zeus Panda can take screenshots of the victim’s machine.
Technique: T1113: Screen Capture
LockerGoga has encrypted files, including core Windows OS files, using RSA-OAEP MGF1 and then demanded Bitcoin be paid for the decryption key.
Technique: T1486: Data Encrypted for Impact
Adversaries may buy, steal, or download exploits that can be used during targeting.
Technique: T1588: Obtain Capabilities
njRAT can launch a command shell interface for executing commands.
Technique: T1059: Command and Scripting Interpreter
Wizard Spider has exploited or attempted to exploit Zerologon  and EternalBlue  vulnerabilities.
Technique: T1210: Exploitation of Remote Services
ROKRAT captures screenshots of the infected system using the gdi32 library.
Technique: T1113: Screen Capture
Trojan.Karagany can communicate with C2 via HTTP POST requests.
Technique: T1071: Application Layer Protocol
APT38 has used brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable.
Technique: T1110: Brute Force
The purchase of code signing certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity.
Technique: T1588: Obtain Capabilities
Zebrocy also runs the systeminfo command to gather system information.
Technique: T1082: System Information Discovery
With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token.
Technique: T1189: Drive-by Compromise
Turla surveys a system upon check-in to discover Group Policy details using the gpresult command.
Technique: T1615: Group Policy Discovery
This shortcut file points to the path of the previously written ‘winhelp.cpl’ file
Technique: T1547: Boot or Logon Autostart Execution
An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software.
Technique: T1587: Develop Capabilities
This user action will typically be observed as follow-on behavior from Spearphishing Attachment.
Technique: T1204: User Execution
Figure 15: Structure used to send data to server    Figure 16: Structure used to send data to C2 server The structure is converted to Base64 using the CryptBinaryToStringA function
Technique: T1048: Exfiltration Over Alternative Protocol
BRONZE BUTLER has made use of Python-based remote access tools.
Technique: T1059: Command and Scripting Interpreter
SideTwist has primarily used port 443 for C2 but can use port 80 as a fallback.
Technique: T1008: Fallback Channels
Leviathan relies on web shells for an initial foothold as well as persistence into the victim's systems.
Technique: T1505: Server Software Component
Wizard Spider has used networkdll for network discovery and psfin specifically for financial and point of sale indicators.
Technique: T1018: Remote System Discovery
Babuk has the ability to unpack itself into memory using XOR.
Technique: T1140: Deobfuscate/Decode Files or Information
By utilizing target-specific values to decrypt the payload the adversary can avoid packaging the decryption key with the payload or sending it over a potentially monitored network connection.
Technique: T1480: Execution Guardrails
In one instance we observed, one of the initial malware delivered to the victim, RATANKBA (TROJ_RATANKBA.A), connects to a legitimate but compromised website (eye-watch[.]in:443, a mobile application-selling site) from which a hack tool (nbt_scan.exe) is also downloaded
Technique: T1036: Masquerading
Grandoreiro can delete .LNK files created in the Startup folder.
Technique: T1070: Indicator Removal on Host
Windows uses access tokens to determine the ownership of a running process.
Technique: T1134: Access Token Manipulation
MoonWind can delete itself or specified files.
Technique: T1070: Indicator Removal on Host
ThiefQuest exfiltrates targeted file extensions in the /Users/ folder to the command and control server via unencrypted HTTP.
Technique: T1041: Exfiltration Over C2 Channel
the PowerShell is executed using reflectively loaded ReflectivePicker from the Empire project
Technique: T1546: Event Triggered Execution
Malware may possibly utilize this memory location in part of an attack chain that includes writing code to shared sections of the process’s memory, placing a pointer to the code in EWM, then invoking execution by returning execution control to the address in the process’s EWM.
Technique: T1055: Process Injection
Cobian RAT uses DNS for C2.
Technique: T1071: Application Layer Protocol
Calisto has the capability to use rm -rf to remove folders and files from the victim's machine.
Technique: T1070: Indicator Removal on Host
KeyBoy has a command to launch a file browser or explorer on the system.
Technique: T1083: File and Directory Discovery
SeaDuke is capable of uploading and downloading files.
Technique: T1105: Ingress Tool Transfer
Adversaries may abuse specific file formats to subvert Mark-of-the-Web  controls.
Technique: T1553: Subvert Trust Controls
Adversaries may hijack a legitimate user's SSH session to move laterally within an environment.
Technique: T1563: Remote Service Session Hijacking
RTM can obtain information about process integrity levels.
Technique: T1057: Process Discovery
Each OID identifies a variable that can be read or set and permits active management tasks, such as configuration changes, through remote modification of these variables.
Technique: T1602: Data from Configuration Repository
Tropic Trooper has deleted dropper files on an infected system using command scripts.
Technique: T1070: Indicator Removal on Host
GrimAgent can collect data and files from a compromised host.
Technique: T1005: Data from Local System
Valak has been executed via Microsoft Word documents containing malicious macros.
Technique: T1204: User Execution
KONNI can delete files.
Technique: T1070: Indicator Removal on Host
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.
Technique: T1547: Boot or Logon Autostart Execution
The email address is associated with the Lebanese domain of a major global financial institution
Technique: T1016: System Network Configuration Discovery
Volgmer can gather information about TCP connection state.
Technique: T1049: System Network Connections Discovery
This information may also reveal supply chains and shipment paths for the victim’s hardware and software resources.
Technique: T1591: Gather Victim Org Information
What does the Poseidon Group do? What happens after a target machine is infected? Once the target’s machine is compromised, the attacker first enumerates all processes running in the system and all services
Technique: T1057: Process Discovery
Adversaries may grant additional permission levels, such as ReadPermission or FullAccess, to maintain persistent access to an adversary-controlled email account.
Technique: T1098: Account Manipulation
An adversary may guess login credentials without prior knowledge of system or environment passwords during an operation by using a list of common passwords.
Technique: T1110: Brute Force
GrimAgent has sent data related to a compromise host over its C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
Azorult can capture screenshots of the victim’s machines.
Technique: T1113: Screen Capture
Symantec determined a more accurate picture of Buckeye’s targets by looking at where Buckeye remained active on the network longer than a day, deployed additional tools, and spread onto multiple computers
Technique: T1105: Ingress Tool Transfer
Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
Technique: T1567: Exfiltration Over Web Service
Adversaries may compromise email accounts that can be used during targeting.
Technique: T1586: Compromise Accounts
IcedID can query LDAP to identify additional users on the network to infect.
Technique: T1087: Account Discovery
APT41 used certutil to download additional files.
Technique: T1105: Ingress Tool Transfer
Lucifer can identify the IP and port numbers for all remote connections from the compromised host.
Technique: T1049: System Network Connections Discovery
BACKSPACE may collect information about running processes.
Technique: T1057: Process Discovery
APT33 has lured users to click links to malicious HTML applications delivered via spearphishing emails.
Technique: T1204: User Execution
The event logs can be cleared with the following utility commands:
* wevtutil cl system
* wevtutil cl application
* wevtutil cl security
These logs may also be cleared through other mechanisms, such as the event viewer GUI or PowerShell.
Technique: T1070: Indicator Removal on Host
The group has also leveraged default manufacturer's passwords to gain initial access to corporate networks via IoT devices such as a VOIP phone, printer, and video decoder.
Technique: T1078: Valid Accounts
Adversaries may search private data from threat intelligence vendors for information that can be used during targeting.
Technique: T1597: Search Closed Sources
Astaroth can abuse alternate data streams  to store content for malicious payloads.
Technique: T1564: Hide Artifacts
Sandworm Team has enumerated files on a compromised host.
Technique: T1083: File and Directory Discovery
OilRig has used DNS for C2 including the publicly available requestbin.net tunneling service.
Technique: T1071: Application Layer Protocol
Uroburos uses a custom packer.
Technique: T1027: Obfuscated Files or Information
Users must explicitly ask to show the hidden files either via a series of Graphical User Interface  prompts or with command line switches .
Technique: T1564: Hide Artifacts
Turla has used WebDAV to upload stolen USB files to a cloud drive.
Technique: T1567: Exfiltration Over Web Service
This file is usually found in the user's home directory under &lt;user-home&gt;/.ssh/authorized_keys.
Technique: T1098: Account Manipulation
EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Technique: T1055: Process Injection
Machete has used msiexec to install the Machete malware.
Technique: T1218: Signed Binary Proxy Execution
The launcher module, obfuscated with the notorious Metasploit’s shikata_ga_nai encoder, is the same for all the droppers
Technique: T1027: Obfuscated Files or Information
If the executing process is set to run at a specific time or during a certain event  then this technique can also be used for persistence.
Technique: T1574: Hijack Execution Flow
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise.
Technique: T1195: Supply Chain Compromise
Operation Wocao has used local account credentials found during the intrusion for lateral movement and privilege escalation.
Technique: T1078: Valid Accounts
The Deep Panda group is known to utilize WMI for lateral movement.
Technique: T1047: Windows Management Instrumentation
On macOS systems the dscl -create command can be used to create a local account.
Technique: T1136: Create Account
Melcoz can monitor the clipboard for cryptocurrency addresses and change the intended address to one controlled by the adversary.
Technique: T1565: Data Manipulation
The emond binary at /sbin/emond will load any rules from the /etc/emond.d/rules/ directory and take action once an explicitly defined event takes place.
Technique: T1546: Event Triggered Execution
Create a process by impersonating a logged-on user  Getting a user token using WTSQueryUserToken
Technique: T1134: Access Token Manipulation
InvisiMole can use Data Protection API to encrypt its components on the victim’s computer, to evade detection, and to make sure the payload can only be decrypted and loaded on one specific compromised computer.
Technique: T1480: Execution Guardrails
Epic uses the net view command on the victim’s machine.
Technique: T1018: Remote System Discovery
Egregor contains functionality to query the local/system time.
Technique: T1124: System Time Discovery
This is done by limiting the protocol specified in the second parameter to LDAP://, vice the script: moniker which could be used to reference remote code via HTTP.
Technique: T1216: Signed Script Proxy Execution
These four were then all modified on the same date and time on October 13, 2018 08:21
Technique: T1124: System Time Discovery
Tropic Trooper has encrypted traffic with the C2 to prevent network detection.
Technique: T1573: Encrypted Channel
Adversaries may abuse AppleScript to execute various behaviors, such as interacting with an open SSH connection, moving to remote machines, and even presenting users with fake dialog boxes.
Technique: T1059: Command and Scripting Interpreter
If there is a version match between the _VBA_PROJECT stream and host MS Office application, the p-code will be executed, otherwise the benign VBA source code will be decompressed and recompiled to p-code, thus removing malicious p-code and potentially bypassing dynamic analysis.
Technique: T1564: Hide Artifacts
FatDuke can copy files and directories from a compromised host.
Technique: T1005: Data from Local System
Lucifer can scan for open ports including TCP ports 135 and 1433.
Technique: T1046: Network Service Scanning
FLIPSIDE is a simple proxy that creates an outbound RDP connection.
Technique: T1090: Proxy
injects a malicious DLL into the IExplorer.exe process.
Technique: T1055: Process Injection
Business and government personnel who are traveling, especially in a foreign country, often rely on systems to conduct business other than those at their home office, and may be unfamiliar with threats posed while abroad
Technique: T1083: File and Directory Discovery
Plist files are used by macOS applications to store properties and configuration settings for applications and services.
Technique: T1547: Boot or Logon Autostart Execution
Okrum can collect computer name, locale information, and information about the OS and architecture.
Technique: T1082: System Information Discovery
Kasidet creates a Registry Run key to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Technique: T1548: Abuse Elevation Control Mechanism
Chimera has used scheduled tasks to invoke Cobalt Strike including through batch script schtasks /create /ru "SYSTEM" /tn "update" /tr "cmd /c c:\windows\temp\update.bat" /sc once /f /st and to maintain persistence.
Technique: T1053: Scheduled Task/Job
After compromising a victim, Poseidon Group discovers all running services.
Technique: T1007: System Service Discovery
PROMETHIUM has used Registry run keys to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
PoetRAT used TLS to encrypt communications over port 143 RTM used Port 44443 for its VNC module.
Technique: T1571: Non-Standard Port
This behavior is related to and may take advantage of DLL Search Order Hijacking.
Technique: T1574: Hijack Execution Flow
FIN10 has moved laterally using the Local Administrator account.
Technique: T1078: Valid Accounts
Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.
Technique: T1078: Valid Accounts
Honeybee gathers a list of processes using the tasklist command and then is sent back to the control server.
Technique: T1057: Process Discovery
SpicyOmelette has been distributed via emails containing a malicious link that appears to be a PDF document.
Technique: T1566: Phishing
Sidewinder has used tools to collect the computer name, OS version, installed hotfixes, as well as information regarding the memory and processor on a compromised host.
Technique: T1082: System Information Discovery
Felismus collects the current username and sends it to the C2 server.
Technique: T1033: System Owner/User Discovery
Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges.
Technique: T1055: Process Injection
Avenger has the ability to download files from C2 to a compromised host.
Technique: T1105: Ingress Tool Transfer
Adversaries may use Valid Accounts to log into remote machines using Secure Shell .
Technique: T1021: Remote Services
The CozyCar dropper copies the system file rundll32.exe to the install location for the malware, then uses the copy of rundll32.exe to load and execute the main CozyCar component.
Technique: T1218: Signed Binary Proxy Execution
For instance, when using this string we observed DNS queries for “apple-search.infoclose”, as the string “close” was supposed to be the next portion of the C2 URL
Technique: T1071: Application Layer Protocol
FinFisher is heavily obfuscated in many ways, including through the use of spaghetti code in its functions in an effort to confuse disassembly programs.
Technique: T1027: Obfuscated Files or Information
Ryuk has used vssadmin Delete Shadows /all /quiet to to delete volume shadow copies and vssadmin resize shadowstorage to force deletion of shadow copies created by third-party applications.
Technique: T1490: Inhibit System Recovery
The dropper installs 2 files:netwf.bat : executes netwf.dllnetwf.dll : the payloadThe dropper implements 2 persistence mechanisms:HKCU\Environment\UserInitMprLogonScript to execute the netwf.bat fileCOM Object hijack of the following CLSID: {BCDE0395-E52F-467C-8E3D-C4579291692E}, the CLSID of the class MMDeviceEnumerator.These 2 techniques have also been previously used by this actor.Finally the payload is executed by rundll32.exe (and the ordinal #1 in argument) or by explorer.exe if the COM Object hijack is performed
Technique: T1218: Signed Binary Proxy Execution
Explosive has leveraged its keylogging capabilities to gain access to administrator accounts on target servers.
Technique: T1056: Input Capture
while making connection with the C2, hindering detection efforts.
Technique: T1568: Dynamic Resolution
APT1 uses two utilities, GETMAIL and MAPIGET, to steal email.
Technique: T1114: Email Collection
Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL.
Technique: T1574: Hijack Execution Flow
This technique uses a fully qualified domain name, with multiple IP addresses assigned to it which are swapped with high frequency, using a combination of round robin IP addressing and short Time-To-Live  for a DNS resource record.
Technique: T1568: Dynamic Resolution
Malicious rules commonly filter out emails based on key words  found in message bodies and subject lines.
Technique: T1564: Hide Artifacts
Cobalt Strike can download a hosted "beacon" payload using BITSAdmin.
Technique: T1197: BITS Jobs
Sandworm Team researched Ukraine's unique legal entity identifier , including running queries on the EDRPOU website, in preparation for the NotPetya attack.
Technique: T1593: Search Open Websites/Domains
Kasidet has the ability to change firewall settings to allow a plug-in to be downloaded.
Technique: T1562: Impair Defenses
Here is a list of the platforms used by this variant: Twitter, Yandex and Mediafire
Technique: T1102: Web Service
The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
Technique: T1052: Exfiltration Over Physical Medium
Industroyer downloads a shellcode payload from a remote C2 server and loads it into memory.
Technique: T1105: Ingress Tool Transfer
Axiom actors have been known to use the Sticky Keys replacement within RDP sessions to obtain persistence.
Technique: T1546: Event Triggered Execution
Grandoreiro can capture clipboard data from a compromised host.
Technique: T1115: Clipboard Data
This IP also belongs to the same service provider and class B network range as another IP we had associated with DarkHydrus, 107.175.150[.]113 which specifically resolved to a domain name containing a victim organization’s name
Technique: T1016: System Network Configuration Discovery
Rising Sun can send data gathered from the infected machine via HTTP POST request to the C2.
Technique: T1041: Exfiltration Over C2 Channel
EKANS can determine the domain of a compromised host.
Technique: T1016: System Network Configuration Discovery
BadPatch uses SMTP for C2.
Technique: T1071: Application Layer Protocol
Linfo creates a backdoor through which remote attackers can delete files.
Technique: T1070: Indicator Removal on Host
Modifying existing services may interrupt their functionality or may enable services that are disabled or otherwise not commonly used.
Technique: T1543: Create or Modify System Process
Bankshot uploads files and secondary payloads to the victim's machine.
Technique: T1105: Ingress Tool Transfer
WellMess can write files to a compromised host.
Technique: T1105: Ingress Tool Transfer
Magic Hound malware has used Registry Run keys to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
LoudMiner adds plist files with the naming format com.random_name.plist in the /Library/LaunchDaemons folder with the RunAtLoad and KeepAlive keys set to true.
Technique: T1543: Create or Modify System Process
Supply chain compromise can take place at any stage of the supply chain including:
* Manipulation of development tools
* Manipulation of a development environment
* Manipulation of source code repositories 
* Manipulation of source code in open-source dependencies
* Manipulation of software update/distribution mechanisms
* Compromised/infected system images    
* Replacement of legitimate software with modified versions
* Sales of modified/counterfeit products to legitimate distributors
* Shipment interdiction
While supply chain compromise can impact any component of hardware or software, attackers looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels.
Technique: T1195: Supply Chain Compromise
APT33 has used WinRAR to compress data prior to exfil.
Technique: T1560: Archive Collected Data
Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting.
Technique: T1584: Compromise Infrastructure
During execution, Threat Group-3390 malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.
Technique: T1140: Deobfuscate/Decode Files or Information
(Source: Dell SecureWorks) Appendix D — Domain name parking example CTU researchers have observed TG-3390 parking domains by pointing their A record to a non-routable IP space, including the 127.0.0.[x] loopback address
Technique: T1016: System Network Configuration Discovery
Sandworm Team has used the BlackEnergy KillDisk component to corrupt the infected system's master boot record.
Technique: T1561: Disk Wipe
Gamaredon Group tools decrypted additional payloads from the C2.
Technique: T1140: Deobfuscate/Decode Files or Information
Nebulae can use CMD to execute a process.
Technique: T1059: Command and Scripting Interpreter
SpeakUp uses Perl scripts.
Technique: T1059: Command and Scripting Interpreter
End users can benefit from security solutions such as Trend Micro Home Security for Mac, which provides comprehensive security and multi-device protection against cyberthreats
Technique: T1518: Software Discovery
APT28 has queried information on machines to determine the current user or system owner .
Technique: T1033: System Owner/User Discovery
Octopus has uploaded stolen files and data from a victim's machine over its C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
PLEAD has been executed via malicious links in e-mails.
Technique: T1204: User Execution
The given website may closely resemble a legitimate site in appearance and have a URL containing elements from the real site.
Technique: T1598: Phishing for Information
Proxysvc lists files in directories.
Technique: T1083: File and Directory Discovery
Adversaries may use password recovery tools to obtain plain text passwords from the Credential Manager.
Technique: T1555: Credentials from Password Stores
NanHaiShu modifies the %regrun% Registry to point itself to an autostart mechanism.
Technique: T1547: Boot or Logon Autostart Execution
Until the write handle transaction is terminated, all other handles are isolated from the writer and may only read the committed version of the file that existed at the time the handle was opened.
Technique: T1055: Process Injection
Backdoor.Oldrea writes collected data to a temporary file in an encrypted form before exfiltration to a C2 server.
Technique: T1560: Archive Collected Data
RDAT can also download data from the C2 which is split into 81,920-byte portions.
Technique: T1030: Data Transfer Size Limits
Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept.
Technique: T1187: Forced Authentication
Regin stage 1 modules for 64-bit systems have been found to be signed with fake certificates masquerading as originating from Microsoft Corporation and Broadcom Corporation.
Technique: T1036: Masquerading
Adversaries may install an older version of the operating system of a network device to weaken security.
Technique: T1601: Modify System Image
I download my tools from GitHub, and so do my victims
Technique: T1105: Ingress Tool Transfer
To report an intrusion and request resources for incident response or technical assistance, you are encouraged to contact DHS NCCIC (NCCICCustomerService@hq.dhs.gov or 888-282-0870), the FBI through a local field office, or the FBI’s Cyber Division (CyWatch@fbi.gov or 855-292-3937).Protect Against SQL Injection and Other Attacks on Web ServicesTo protect against code injections and other attacks, system operators should routinely evaluate known and published vulnerabilities, periodically perform software updates and technology refreshes, and audit external-facing systems for known web application vulnerabilities
Technique: T1505: Server Software Component
By doing so, the main content of the macro itself (Figure 2) can be kept relatively simple, and the malicious’ codes small footprint can help enable evasion of automated detection mechanisms based on macro content
Technique: T1204: User Execution
Hard Disk Check The Trojan will perform the following WMI query:   Select * from Win32_DiskDrive   The Trojan will check the Caption and Model fields in the results for the strings Virtual, VMWare, VM, VBox or Oracle
Technique: T1497: Virtualization/Sandbox Evasion
PipeMon can establish persistence by registering a malicious DLL as an alternative Print Processor which is loaded when the print spooler service starts.
Technique: T1543: Create or Modify System Process
Adversaries may attempt to remove such artifacts.
Technique: T1553: Subvert Trust Controls
Clicking on the shortcut ultimately leads to Backdoor.Pirpi being downloaded and executed on the affected computer
Technique: T1547: Boot or Logon Autostart Execution
ShimRat has the capability to upload collected files to a C2.
Technique: T1005: Data from Local System
H1N1 kills and disables services by using cmd.exe.
Technique: T1059: Command and Scripting Interpreter
* ExecReload directive covers when a service restarts.
Technique: T1543: Create or Modify System Process
QakBot can use large file sizes to evade detection.
Technique: T1027: Obfuscated Files or Information
Filter DLLs can be positioned on local computers for local accounts and/or domain controllers for domain accounts.
Technique: T1556: Modify Authentication Process
This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment  or sandbox.
Technique: T1497: Virtualization/Sandbox Evasion
ZxShell has a command to transfer files from a remote host.
Technique: T1105: Ingress Tool Transfer
A Lazarus Group malware sample adds persistence on the system by creating a shortcut in the user’s Startup folder.
Technique: T1547: Boot or Logon Autostart Execution
Adversaries may abuse a double extension in the filename as a means of masquerading the true file type.
Technique: T1036: Masquerading
InvisiMole can obtain running services on the victim.
Technique: T1007: System Service Discovery
Keydnap uses a resource fork to present a macOS JPEG or text file icon rather than the executable's icon assigned by the operating system.
Technique: T1564: Hide Artifacts
Dyre can detect sandbox analysis environments by inspecting the process list and Registry.
Technique: T1497: Virtualization/Sandbox Evasion
Transparent Tribe has embedded links to malicious downloads in e-mails.
Technique: T1566: Phishing
Kinsing was executed in an Ubuntu container deployed via an open Docker daemon API.
Technique: T1133: External Remote Services
The displacement of the injected code does introduce the additional requirement for functionality to remap memory references.
Technique: T1055: Process Injection
Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool.
Technique: T1036: Masquerading
Spark has been packed with Enigma Protector to obfuscate its contents.
Technique: T1027: Obfuscated Files or Information
A Turla JavaScript backdoor has used Google Apps Script as its C2 server.
Technique: T1102: Web Service
UNC2452 modified timestamps of backdoors to match legitimate Windows files.
Technique: T1070: Indicator Removal on Host
Carbanak logs key strokes for configured processes and sends them back to the C2 server.
Technique: T1056: Input Capture
In addition, it conducts peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol.
Technique: T1572: Protocol Tunneling
GCMAN uses Putty for lateral movement.
Technique: T1021: Remote Services
Sandworm Team has also used ROT13 encoding, AES encryption and compression with the zlib library for their Python-based backdoor.
Technique: T1027: Obfuscated Files or Information
APT34 uses remote services such as VPN, Citrix, or OWA to persist in an environment.
Technique: T1133: External Remote Services
Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Technique: T1518: Software Discovery
TajMahal has the ability to determine local time on a compromised host.
Technique: T1124: System Time Discovery
Adversaries may use these scripts to maintain persistence on a network.
Technique: T1037: Boot or Logon Initialization Scripts
SUNSPOT only replaces SolarWinds Orion source code if the MD5 checksums of both the original source code file and backdoored replacement source code match hardcoded values.
Technique: T1480: Execution Guardrails
Example execution techniques that rely on authenticated sessions over SMB/RPC are Scheduled Task/Job, Service Execution, and Windows Management Instrumentation.
Technique: T1021: Remote Services
Password managers are applications designed to store user credentials, normally in an encrypted database.
Technique: T1555: Credentials from Password Stores
Malicious forms will execute when an adversary sends a specifically crafted email to the user.
Technique: T1137: Office Application Startup
The Ke3chang group has been known to compress data before exfiltration.
Technique: T1560: Archive Collected Data
This could enable someone to move from unprivileged or user level permissions to SYSTEM or root permissions depending on the component that is vulnerable.
Technique: T1068: Exploitation for Privilege Escalation
The main function of the Trojan interacts with its configured C2 server to obtain additional code to execute
Technique: T1140: Deobfuscate/Decode Files or Information
as thousands of similar API functions exist for various system operations.
Technique: T1106: Native API
C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding.
Technique: T1132: Data Encoding
An adversary may create a new instance or virtual machine  within the compute service of a cloud account to evade defenses.
Technique: T1578: Modify Cloud Compute Infrastructure
The same code snippets are combined into a second stage JavaScript in “C:\Users\<User Name>\”
Technique: T1033: System Owner/User Discovery
Pillowmint has stored its malicious payload in the registry key HKLM\SOFTWARE\Microsoft\DRM.
Technique: T1112: Modify Registry
Industroyer’s 61850 payload component enumerates connected network adapters and their corresponding IP addresses.
Technique: T1016: System Network Configuration Discovery
InvisiMole has exploited CVE-2007-5633 vulnerability in the speedfan.sys driver to obtain kernel mode privileges.
Technique: T1068: Exploitation for Privilege Escalation
RogueRobin can save a new file to the system from the C2 server.
Technique: T1105: Ingress Tool Transfer
SDBbot has the ability to identify the user on a compromised host.
Technique: T1033: System Owner/User Discovery
Netwalker's PowerShell script can decode and decrypt multiple layers of obfuscation, leading to the Netwalker DLL being loaded into memory.
Technique: T1140: Deobfuscate/Decode Files or Information
exploits a known Windows privilege escalation vulnerability ( ) on unpatched computers.
Technique: T1068: Exploitation for Privilege Escalation
Melcoz can use DLL hijacking to bypass security controls.
Technique: T1574: Hijack Execution Flow
If the language is found in the list, the process terminates.
Technique: T1614: System Location Discovery
SideTwist has the ability to collect the domain name on a compromised host.
Technique: T1016: System Network Configuration Discovery
XCSSET uses ps aux with the grep command to enumerate common browsers and system processes potentially impacting XCSSET's exfiltration capabilities.
Technique: T1518: Software Discovery
Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain.
Technique: T1583: Acquire Infrastructure
These attacks do not need to exhaust the actual resources on a system since they can simply exhaust the limits that an OS self-imposes to prevent the entire system from being overwhelmed by excessive demands on its capacity.
Technique: T1499: Endpoint Denial of Service
SLOTHFULMEDIA has created a service on victim machines named "TaskFrame" to establish persistence.
Technique: T1543: Create or Modify System Process
Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting.
Technique: T1598: Phishing for Information
Wizard Spider has collected and staged credentials and network enumeration information, using  the networkdll and psfin TrickBot modules.
Technique: T1074: Data Staged
Kimsuky has signed files with the name EGIS CO,.
Technique: T1553: Subvert Trust Controls
Sykipot may use net group "domain admins" /domain to display accounts in the "domain admins" permissions group and net localgroup "administrators" to list local system administrator group membership.
Technique: T1087: Account Discovery
The tool dumps process memory, then harvests passwords and hashes by looking for text strings and regex patterns for how given applications such as Gnome Keyring, sshd, and Apache use memory to store such authentication artifacts.
Technique: T1003: OS Credential Dumping
Darkhotel used embedded iframes on hotel login portals to redirect selected victims to download malware.
Technique: T1189: Drive-by Compromise
Honeybee uses a batch file to load a DLL into the svchost.exe process.
Technique: T1055: Process Injection
Adversaries may leverage these mechanisms to execute malicious content.
Technique: T1569: System Services
CHOPSTICK provides access to the Windows Registry, which can be used to gather information.
Technique: T1012: Query Registry
After decryption, these 34 commands are plain text with parameters that are space delimited much like a command line
Technique: T1059: Command and Scripting Interpreter
ServHelper will attempt to enumerate Windows version and system architecture.
Technique: T1082: System Information Discovery
Adversaries may hijack SIP and trust provider components to mislead operating system and application control tools to classify malicious  code as signed by: 
* Modifying the Dll and FuncName Registry values in HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{SIP_GUID} that point to the dynamic link library  providing a SIP’s CryptSIPDllGetSignedDataMsg function, which retrieves an encoded digital certificate from a signed file.
Technique: T1553: Subvert Trust Controls
gh0st RAT has the capability to to delete files.
Technique: T1070: Indicator Removal on Host
Figure 5 Remote template document requesting the user to click “Enable Content” to run macro Clustering The delivery documents used in the October and November waves shared a large number of similarities, as seen in Table 1, which allowed us to cluster the activity together
Technique: T1204: User Execution
Queued APC functions are executed when the thread enters an alterable state.
Technique: T1055: Process Injection