HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
Trojan.Karagany can secure C2 communications with SSL and TLS.
Technique: T1573: Encrypted Channel
Pisloader has a command to upload a file to the victim machine.
Technique: T1105: Ingress Tool Transfer
Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service .
Technique: T1003: OS Credential Dumping
Then, they can send a link through Spearphishing Link to the target user to entice them to grant access to the application.
Technique: T1528: Steal Application Access Token
Cadelle and Chafer are most active during the day time within Iran’s time zone and primarily operate during Iran’s business week (Saturday through Thursday)
Technique: T1124: System Time Discovery
SeaDuke C2 traffic is base64-encoded.
Technique: T1132: Data Encoding
DustySky has exfiltrated data to the C2 server.
Technique: T1041: Exfiltration Over C2 Channel
Ke3chang performs local network connection discovery using netstat.
Technique: T1049: System Network Connections Discovery
Adversaries may also assign mailbox folder permissions through individual folder permissions or roles.
Technique: T1098: Account Manipulation
VERMIN collects keystrokes from the victim machine.
Technique: T1056: Input Capture
Azorult can check for installed software on the system under the Registry key Software\Microsoft\Windows\CurrentVersion\Uninstall.
Technique: T1012: Query Registry
Most cloud service providers support a Cloud Instance Metadata API which is a service provided to running virtual instances that allows applications to access information about the running virtual instance.
Technique: T1552: Unsecured Credentials
Rover automatically searches for files on local drives based on a predefined list of file extensions.
Technique: T1083: File and Directory Discovery
Emotet has been observed dropping password grabber modules including Mimikatz.
Technique: T1003: OS Credential Dumping
For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.
Technique: T1102: Web Service
Molerats has sent phishing emails with malicious Microsoft Word and PDF attachments.
Technique: T1566: Phishing
BoxCaon can collect the victim's MAC address by using the GetAdaptersInfo API.
Technique: T1016: System Network Configuration Discovery
POWERSTATS can retrieve usernames from compromised hosts.
Technique: T1087: Account Discovery
Turla and its RPC backdoors have used APIs calls for various tasks related to subverting AMSI and accessing then executing commands through RPC and/or named pipes.
Technique: T1106: Native API
InvisiMole can gather information on the mapped drives, OS version, computer name, DEP policy, memory size, and system volume serial number.
Technique: T1082: System Information Discovery
This phase will often leverage a specialized tool that automatically collects a wide array of information including credentials, group management policies, and even system logs to better hone further attacks and assure execution of their malware
Technique: T1082: System Information Discovery
Lokibot has used VBS scripts and XLS macros for execution.
Technique: T1059: Command and Scripting Interpreter
Adversaries may also used compressed or archived scripts, such as JavaScript.
Technique: T1027: Obfuscated Files or Information
cmd.exe /C choice /C Y /N /D Y /T 2 & Del After sleeping, the Trojan will create a GUID and write it to %APPDATA%\Windows\GDI.bin
Technique: T1059: Command and Scripting Interpreter
Ursnif has used CreateProcessW to create child processes.
Technique: T1106: Native API
GreyEnergy enumerates all Windows services.
Technique: T1007: System Service Discovery
DCShadow may be used to create a rogue Domain Controller .
Technique: T1207: Rogue Domain Controller
RedLeaves can delete specified files.
Technique: T1070: Indicator Removal on Host
Tropic Trooper has hidden payloads in Flash directories and fake installer files.
Technique: T1036: Masquerading
Gorgon Group malware can download a remote access tool, ShiftyBug, and inject into another process.
Technique: T1055: Process Injection
Patchwork used Base64 to encode C2 traffic.
Technique: T1132: Data Encoding
Silent Librarian has obtained free Let's Encrypt SSL certificates for use on their phishing pages.
Technique: T1588: Obtain Capabilities
A gh0st RAT variant has used rundll32 for execution.
Technique: T1218: Signed Binary Proxy Execution
menuPass has used a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI.
Technique: T1047: Windows Management Instrumentation
Egregor can perform a language check of the infected system and can query the CPU information .
Technique: T1082: System Information Discovery
BADFLICK has compressed data using the aPLib compression library.
Technique: T1560: Archive Collected Data
Adversaries may search connected removable media on computers they have compromised to find files of interest.
Technique: T1025: Data from Removable Media
Ixeshe collects the computer name of the victim's system during the initial infection.
Technique: T1082: System Information Discovery
A closer examination revealed the obfuscation used by the OilRig group in these QUADAGENT samples were likely the result of using an open-source toolkit called Invoke-Obfuscation
Technique: T1027: Obfuscated Files or Information
Goopy has the ability to disable Microsoft Outlook's security policies to disable macro warnings.
Technique: T1562: Impair Defenses
BADFLICK has searched for files on the infected host.
Technique: T1083: File and Directory Discovery
What does the resulting watering hole look like? The websites were compromised to redirect visitors to instances of both ScanBox and BEeF
Technique: T1189: Drive-by Compromise
Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting.
Technique: T1608: Stage Capabilities
Sharpshooter's first-stage downloader was a VBA macro.
Technique: T1059: Command and Scripting Interpreter
These private keys can be used to authenticate to Remote Services like SSH or for use in decrypting other collected files such as email.
Technique: T1552: Unsecured Credentials
Sensitive data can be collected from remote systems via shared network drives  that are accessible from the current system prior to Exfiltration.
Technique: T1039: Data from Network Shared Drive
APT29 removed evidence of email export requests using Remove-MailboxExportRequest.
Technique: T1070: Indicator Removal on Host
Volatile Cedar has performed vulnerability scans of the target server.
Technique: T1595: Active Scanning
ROMMON is a Cisco network device firmware that functions as a boot loader, boot image, or boot helper to initialize hardware and software when the platform is powered on or reset.
Technique: T1542: Pre-OS Boot
The backdoor will modify the registry for the Windows Media Player to store its C&C configuration.
Technique: T1112: Modify Registry
Both utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: ComRegisterFunction or ComUnregisterFunction respectively.
Technique: T1218: Signed Binary Proxy Execution
Micropsia creates a new hidden directory to store all components' outputs in a dedicated sub-folder for each.
Technique: T1564: Hide Artifacts
Valak can communicate over multiple C2 hosts.
Technique: T1008: Fallback Channels
OLDBAIT can use HTTP for C2.
Technique: T1071: Application Layer Protocol
GrimAgent  can pad C2 messages with random generated values.
Technique: T1001: Data Obfuscation
Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries.
Technique: T1114: Email Collection
Adversaries may impair command history logging to hide commands they run on a compromised system.
Technique: T1562: Impair Defenses
Utilizing an existing persona with a compromised email account may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona.
Technique: T1586: Compromise Accounts
Patchwork has created self-signed certificates from fictitious and spoofed legitimate software companies that were later used to sign malware.
Technique: T1587: Develop Capabilities
MacSpy uses Tor for command and control.
Technique: T1090: Proxy
They may also search for VME artifacts before dropping secondary or additional payloads.
Technique: T1497: Virtualization/Sandbox Evasion
Stuxnet enumerates the currently running processes related to a variety of security products.
Technique: T1518: Software Discovery
Accounts may be created on the local system or within a domain or cloud tenant.
Technique: T1136: Create Account
BoxCaon has used Windows API calls to obtain information about the compromised host.
Technique: T1106: Native API
FIN8 has used malicious e-mail attachments to lure victims into executing malware.
Technique: T1204: User Execution
To perform Network DoS attacks several aspects apply to multiple methods, including IP address spoofing, and botnets.
Technique: T1498: Network Denial of Service
Adversaries may abuse a valid Kerberos ticket-granting ticket  or sniff network traffic to obtain a ticket-granting service  ticket that may be vulnerable to Brute Force.
Technique: T1558: Steal or Forge Kerberos Tickets
NanoCore uses DES to encrypt the C2 traffic.
Technique: T1573: Encrypted Channel
UNC2452 has used compromised identities to access VPNs and remote access tools.
Technique: T1133: External Remote Services
JPIN can list running processes.
Technique: T1057: Process Discovery
BadPatch collects the OS system, OS version, MAC address, and the computer name from the victim’s machine.
Technique: T1082: System Information Discovery
The first link was labeled as "Comparison of Major Tasks in '16 & '17" and the second link was identified as "Comparison between '16 & '17".Upon opening these links the user was presented with a further decoy Hangul document
Technique: T1566: Phishing
File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.
Technique: T1197: BITS Jobs
Kimsuky has used e-mail to send exfiltrated data to C2 servers.
Technique: T1071: Application Layer Protocol
Doki has used the embedTLS library for network communications.
Technique: T1573: Encrypted Channel
Hancitor has used malicious Microsoft Word documents, sent via email, which prompted the victim to enable macros.
Technique: T1204: User Execution
Turla RPC backdoors have included local UPnP RPC proxies.
Technique: T1090: Proxy
Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops.
Technique: T1059: Command and Scripting Interpreter
Industroyer’s data wiper module clears registry keys and overwrites both ICS configuration and Windows files.
Technique: T1485: Data Destruction
TURNEDUP is capable of gathering system information.
Technique: T1082: System Information Discovery
CrossRAT creates a Launch Agent on macOS.
Technique: T1543: Create or Modify System Process
Adversaries may modify pluggable authentication modules  to access user credentials or enable otherwise unwarranted access to accounts.
Technique: T1556: Modify Authentication Process
APT3 has a tool that creates a new service for persistence.
Technique: T1543: Create or Modify System Process
The BRONZE BUTLER uploader or malware the uploader uses command to delete the RAR archives after they have been exfiltrated.
Technique: T1070: Indicator Removal on Host
SNUGRIDE encrypts C2 traffic using AES with a static key.
Technique: T1573: Encrypted Channel
FIN8 has used RDP for lateral movement.
Technique: T1021: Remote Services
Mis-Type runs tests to determine the privilege level of the compromised user.
Technique: T1033: System Owner/User Discovery
Turla RPC backdoors can impersonate or steal process tokens before executing commands.
Technique: T1134: Access Token Manipulation
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence.
Technique: T1543: Create or Modify System Process
Andariel has used watering hole attacks, often with zero-day exploits, to gain initial access to victims within a specific IP range.
Technique: T1189: Drive-by Compromise
Higaisa performed padding with null bytes before calculating its hash.
Technique: T1027: Obfuscated Files or Information
The PipeMon communication module can use a custom protocol based on TLS over TCP.
Technique: T1095: Non-Application Layer Protocol
Drovorub can download files to a compromised host.
Technique: T1105: Ingress Tool Transfer
Rancor has used cmd.exe to execute commmands.
Technique: T1059: Command and Scripting Interpreter
TrickBot can send information about the compromised host and upload data to a hardcoded C2 server.
Technique: T1041: Exfiltration Over C2 Channel
StoneDrill has downloaded and dropped temporary files containing scripts; it additionally has a function to upload files from the victims machine.
Technique: T1105: Ingress Tool Transfer
Psylo has a command to download a file to the system from its C2 server.
Technique: T1105: Ingress Tool Transfer
By compromising a VPS to use as infrastructure, adversaries can make it difficult to physically tie back operations to themselves.
Technique: T1584: Compromise Infrastructure
Some Volgmer variants use SSL to encrypt C2 communications.
Technique: T1573: Encrypted Channel
PowerShower has the ability to identify the current user on the infected host.
Technique: T1033: System Owner/User Discovery
Bazar can create or add files to Registry Run Keys to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
DarkComet adds a Registry value for its installation routine to the Registry Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System Enable LUA=”0” and HKEY_CURRENT_USER\Software\DC3_FEXEC.
Technique: T1112: Modify Registry
Because the ACK packets are for connections that do not exist, the OS will have to search the entire state table to confirm that no match exists.
Technique: T1499: Endpoint Denial of Service
Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system.
Technique: T1102: Web Service
By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making.
Technique: T1565: Data Manipulation
Sandworm Team has used intercepter-NG to sniff passwords in network traffic.
Technique: T1040: Network Sniffing
MarkiRAT can retrieve the victim’s username.
Technique: T1033: System Owner/User Discovery
This allows the shell to upload and download files, execute applications with web server account permissions, list directory contents, access Active Directory, access databases, and any other action allowed by the .NET runtime
Technique: T1083: File and Directory Discovery
APT40 leverages custom credential theft utilities such as HOMEFRY, a password dumper/cracker used alongside the AIRBREAK and BADFLICK backdoors
Technique: T1003: OS Credential Dumping
Dyre uses HTTPS for C2 communications.
Technique: T1071: Application Layer Protocol
The group has also used embedded image tags  with unique, per-recipient tracking links in their emails for the purpose of identifying which recipients opened messages.
Technique: T1566: Phishing
Gamaredon Group has removed security settings for VBA macro execution by changing registry values HKCU\Software\Microsoft\Office\&lt;version&gt;\&lt;product&gt;\Security\VBAWarnings and HKCU\Software\Microsoft\Office\&lt;version&gt;\&lt;product&gt;\Security\AccessVBOM.
Technique: T1112: Modify Registry
Execution via APC injection may also evade detection from security products since the execution is masked under a legitimate process.
Technique: T1055: Process Injection
OopsIE uses the Confuser protector to obfuscate an embedded .Net Framework assembly used for C2.
Technique: T1027: Obfuscated Files or Information
Turla RPC backdoors can collect files from USB thumb drives.
Technique: T1025: Data from Removable Media
Reaver collects the victim's username.
Technique: T1033: System Owner/User Discovery
Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence.
Technique: T1543: Create or Modify System Process
Wizard Spider has used the Invoke-Inveigh PowerShell cmdlets, likely for name service poisoning.
Technique: T1557: Adversary-in-the-Middle
For example, APT32 installed one backdoor as a persistent service with a legitimate service name that had a Unicode no-break space character appended to it
Technique: T1036: Masquerading
An OAuth access token enables a third-party application to interact with resources containing user data in the ways requested by the application without obtaining user credentials.
Technique: T1528: Steal Application Access Token
The group also side-loads its backdoor by dropping a library and a legitimate, signed executable .
Technique: T1574: Hijack Execution Flow
RGDoor encrypts files with XOR before sending them back to the C2 server.
Technique: T1560: Archive Collected Data
Kessel can split the data to be exilftrated into chunks that will fit in subdomains of DNS queries.
Technique: T1030: Data Transfer Size Limits
Figure 1: Contents of the Email A review of the email header data from the spear phishing messages showed that the threat actors sent the emails using the same infrastructure they have used in the past
Technique: T1566: Phishing
Metamorfo has used YouTube to store and hide C&C server domains.
Technique: T1102: Web Service
SombRAT has the ability to run cancel or closeanddeletestorage to remove all files from storage and delete the storage temp file on a compromised host.
Technique: T1070: Indicator Removal on Host
APT3 has a tool that can locate credentials in files on the file system such as those from Firefox or Chrome.
Technique: T1552: Unsecured Credentials
PipeMon can collect and send the local IP address, RDP information, and the network adapter physical address as a part of its C2 beacon.
Technique: T1016: System Network Configuration Discovery
Cobalt Group leveraged an open-source tool called SoftPerfect Network Scanner to perform network scanning.
Technique: T1046: Network Service Scanning
Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.
Technique: T1562: Impair Defenses
This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Technique: T1036: Masquerading
Pillowmint can uninstall the malicious service from an infected machine.
Technique: T1070: Indicator Removal on Host
The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary.
Technique: T1565: Data Manipulation
One version of Helminth uses batch scripting.
Technique: T1059: Command and Scripting Interpreter
In some cases, adversaries may stop or disable many or all services to render systems unusable.
Technique: T1489: Service Stop
In addition to downloading free exploits from the internet, adversaries may purchase exploits from third-party entities.
Technique: T1588: Obtain Capabilities
8 Making a copy of certutil and regsvr32 Certutil.exe (a copy is renamed to certis.exe by the trojan) is normally used in a windows environment to manage certificates, but in this case, it is used by the second stylesheet to download the malware payloads
Technique: T1218: Signed Binary Proxy Execution
Waterbear can receive and load executables from remote C2 servers.
Technique: T1105: Ingress Tool Transfer
Pony has used scripts to delete itself after execution.
Technique: T1070: Indicator Removal on Host
Conficker terminates various services related to system security and Windows.
Technique: T1562: Impair Defenses
RATANKBA runs the whoami and query user commands.
Technique: T1033: System Owner/User Discovery
Honeybee collects data from the local victim system.
Technique: T1005: Data from Local System
Rocke conducted scanning for exposed TCP port 7001 as well as SSH and Redis servers.
Technique: T1046: Network Service Scanning
Cuba has used SeDebugPrivilege and AdjustTokenPrivileges to elevate privileges.
Technique: T1134: Access Token Manipulation
Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events.
Technique: T1546: Event Triggered Execution
Carberp has maintained persistence by placing itself inside the current user's startup folder.
Technique: T1547: Boot or Logon Autostart Execution
SharpStage has used a legitimate web service for evading detection.
Technique: T1102: Web Service
VDSO hijacking involves redirecting calls to dynamically linked shared libraries.
Technique: T1055: Process Injection
PipeMon can iterate over the running processes to find a suitable injection target.
Technique: T1057: Process Discovery
Darkhotel used a virus that propagates by infecting executables stored on shared drives.
Technique: T1080: Taint Shared Content
Adversaries may scan victims for vulnerabilities that can be used during targeting.
Technique: T1595: Active Scanning
Carberp has queried the infected system's registry searching for specific registry keys associated with antivirus products.
Technique: T1518: Software Discovery
Bankshot marks files to be deleted upon the next system reboot and uninstalls and removes itself from the system.
Technique: T1070: Indicator Removal on Host
BackdoorDiplomacy has dropped implants in folders named for legitimate software.
Technique: T1036: Masquerading
Magic Hound has used SMS and email messages with links designed to steal credentials.
Technique: T1598: Phishing for Information
DGAs can take the form of apparently random or “gibberish” strings  when they construct domain names by generating each letter.
Technique: T1568: Dynamic Resolution
Bankshot modifies the time of a file as specified by the control server.
Technique: T1070: Indicator Removal on Host
OopsIE uses the command prompt to execute commands on the victim's machine.
Technique: T1059: Command and Scripting Interpreter
LiteDuke has been packed with multiple layers of encryption.
Technique: T1027: Obfuscated Files or Information
Smoke Loader uses HTTP for C2.
Technique: T1071: Application Layer Protocol
Figure 3: no detections for SpeakUp in Virus Total In an attempt to endure the investigation process by security researchers, the second stage payload was encoded with salted base64
Technique: T1027: Obfuscated Files or Information
BISCUIT has a command to periodically take screenshots of the system.
Technique: T1113: Screen Capture
APT19 uses a Port 22 malware variant to modify several Registry keys.
Technique: T1112: Modify Registry
* Built-in web application interfaces are leveraged for the insertion of any other kind of object that can be used to display web content or contain a script that executes on the visiting client .
Technique: T1189: Drive-by Compromise
Alternatively, a file or container image name given may be a close approximation to legitimate programs/images or something innocuous.
Technique: T1036: Masquerading
In this campaign, we observed threat actors exploiting CVE-2017-0199 and CVE-2017-11882 to distribute malware
Technique: T1203: Exploitation for Client Execution
Kimsuky has used Twitter to monitor potential victims and to prepare targeted phishing e-mails.
Technique: T1593: Search Open Websites/Domains
Mustang Panda have acquired C2 domains prior to operations.
Technique: T1583: Acquire Infrastructure
Sandworm Team used UPX to pack a copy of Mimikatz.
Technique: T1027: Obfuscated Files or Information
RARM Creates RAR files per logical drive containing data with timestamps for the past 30 days, then uploads RAR to the C2 server using a POST command at the path “/FeedBack.php”
Technique: T1560: Archive Collected Data
Clop has been packed to help avoid detection.
Technique: T1027: Obfuscated Files or Information
REvil has been executed via malicious MS Word e-mail attachments.
Technique: T1204: User Execution
APT41 malware TIDYELF loaded the main WINTERLOVE component by injecting it into the iexplore.exe process.
Technique: T1055: Process Injection
The executable version of Helminth has a module to log clipboard contents.
Technique: T1115: Clipboard Data
CoinTicker executes a Python script to download its second stage.
Technique: T1105: Ingress Tool Transfer
MURKYTOP uses the command-line interface.
Technique: T1059: Command and Scripting Interpreter
yty establishes persistence by creating a scheduled task with the command SchTasks /Create /SC DAILY /TN BigData /TR “ + path_file + “/ST 09:30“.
Technique: T1053: Scheduled Task/Job
Transparent Tribe has registered domains to mimic file sharing, government, defense, and research websites for use in targeted campaigns.
Technique: T1583: Acquire Infrastructure
Cobalt Strike's Beacon payload is capable of running shell commands without cmd.exe and PowerShell commands without powershell.exe Grandoreiro can execute through the WinExec API.
Technique: T1106: Native API
Honeybee's service-based DLL implant can execute a downloaded file with parameters specified using CreateProcessAsUser.
Technique: T1546: Event Triggered Execution
Cadelspy initially arrives on the computer as a dropper, which downloads two installer components catering to whether the victim is running a 32-bit or 64-bit system
Technique: T1082: System Information Discovery
Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.
Technique: T1588: Obtain Capabilities
InvisiMole can use the ITaskService, ITaskDefinition and ITaskSettings COM interfaces to schedule a task.
Technique: T1559: Inter-Process Communication
APT29 has conducted brute force password spray attacks.
Technique: T1110: Brute Force
Digital certificates can then be installed on adversary controlled infrastructure that may have been acquired  or previously compromised .
Technique: T1608: Stage Capabilities
LSA secrets can also be dumped from memory.
Technique: T1003: OS Credential Dumping
Similarly, at may also be used for Privilege Escalation if the binary is allowed to run as superuser via sudo.
Technique: T1053: Scheduled Task/Job
Comnie is able to achieve persistence via a .lnk file that is stored within the victim’s startup path
Technique: T1547: Boot or Logon Autostart Execution
Elderwood has encrypted documents and malicious executables.
Technique: T1027: Obfuscated Files or Information
Adversaries may also acquire infrastructure from VPS service providers that are known for renting VPSs with minimal registration information, allowing for more anonymous acquisitions of infrastructure.
Technique: T1583: Acquire Infrastructure
Okrum has used a custom implementation of AES encryption to encrypt collected data.
Technique: T1560: Archive Collected Data
By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.
Technique: T1550: Use Alternate Authentication Material
Adversaries may search victim-owned websites to gather actionable information.
Technique: T1594: Search Victim-Owned Websites
Winnti for Linux has used a modified copy of the open-source userland rootkit Azazel, named libxselinux.so, to hide the malware's operations and network activity.
Technique: T1014: Rootkit
Denis compressed collected data using zlib.
Technique: T1560: Archive Collected Data
REvil can connect to and disable the Symantec server on the victim's network.
Technique: T1562: Impair Defenses
By default, /etc/shadow is only readable by the root user.
Technique: T1003: OS Credential Dumping
Additionally, in the event Kaspersky is detected, the malware will immediately run the ‘Conime.lnk’ shortcut file in a new process after it is created
Technique: T1547: Boot or Logon Autostart Execution
Carberp has exfiltrated data via HTTP to already established C2 servers.
Technique: T1041: Exfiltration Over C2 Channel
APT1 has registered hundreds of domains for use in operations.
Technique: T1583: Acquire Infrastructure
Attor has a plugin that enumerates files with specific extensions on all hard disk drives and stores file information in encrypted log files.
Technique: T1083: File and Directory Discovery
BitPaymer can modify the timestamp of an executable so that it can be identified and restored by the decryption tool.
Technique: T1070: Indicator Removal on Host
FrameworkPOS can XOR credit card information before exfiltration.
Technique: T1560: Archive Collected Data
Information about the hardware infrastructure may also be exposed to adversaries via online or other accessible data sets .
Technique: T1592: Gather Victim Host Information
Adversaries may also conduct Change Default File Association and Masquerading to cause a similar effect.
Technique: T1565: Data Manipulation
Crimson contains a command to perform screen captures.
Technique: T1113: Screen Capture
Egregor can inject its payload into iexplore.exe process.
Technique: T1055: Process Injection
Dragonfly dropped and executed Hydra, a password cracker.
Technique: T1110: Brute Force
The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.
Technique: T1068: Exploitation for Privilege Escalation
GoldenSpy can execute remote commands via the command-line interface.
Technique: T1059: Command and Scripting Interpreter
FatDuke can use base64 encoding, string stacking, and opaque predicates for obfuscation.
Technique: T1027: Obfuscated Files or Information
Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files.
Technique: T1218: Signed Binary Proxy Execution
Credential information may also be exposed to adversaries via leaks to online or other accessible data sets , breach dumps, code repositories, etc.. Adversaries may also purchase credentials from dark web or other black-markets.
Technique: T1589: Gather Victim Identity Information
Remsec also searches for custom network encryption software on victims.
Technique: T1083: File and Directory Discovery
The Launch Agent name may be disguised by using a name from the related operating system or benign software.
Technique: T1543: Create or Modify System Process
Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data.
Technique: T1074: Data Staged
Leviathan has sent spearphishing emails with links, often using a fraudulent lookalike domain and stolen branding.
Technique: T1566: Phishing
Use of these infrastructure solutions allows an adversary to stage, launch, and execute an operation.
Technique: T1583: Acquire Infrastructure
Darkhotel malware has employed just-in-time decryption of strings to evade sandbox detection.
Technique: T1497: Virtualization/Sandbox Evasion
An adversary may rely upon specific actions by a user in order to gain execution.
Technique: T1204: User Execution
If running with elevated privileges, OSX/Shlayer uses the spctl command to disable Gatekeeper protection for a downloaded file.
Technique: T1553: Subvert Trust Controls
HyperBro has the ability to run an application  or script/file  via API.
Technique: T1106: Native API
The Cybereason platform was able to detect the malicious injection, identifying Irdsnhrxxxfery64.~, Irdsnhrxxxfery98.~, and module arqueiro.   The downloaded modules found in regsvr32.exe as detected by the Cybereason platform
Technique: T1218: Signed Binary Proxy Execution
ThiefQuest uses the kill_unwanted function to get a list of running processes, compares each process with an encrypted list of “unwanted” security related programs, and kills the processes for security related programs.
Technique: T1518: Software Discovery
The sudo command "allows a system administrator to delegate authority to give certain users  the ability to run some  commands as root or another user while providing an audit trail of the commands and their arguments."
Technique: T1548: Abuse Elevation Control Mechanism
GreyEnergy can securely delete a file by hooking into the DeleteFileA and DeleteFileW functions in the Windows API.
Technique: T1070: Indicator Removal on Host
Orz can gather victim drive information.
Technique: T1083: File and Directory Discovery
Most Sakula samples maintain persistence by setting the Registry Run key SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ in the HKLM or HKCU hive, with the Registry value and file name varying by sample.
Technique: T1547: Boot or Logon Autostart Execution
Rancor has used HTTP for C2.
Technique: T1071: Application Layer Protocol
objectClass=trustedDomain 
Technique: T1482: Domain Trust Discovery
IcedID has used WMI to execute binaries.
Technique: T1047: Windows Management Instrumentation
FIN5 has obtained and used a customized version of PsExec, as well as use other tools such as pwdump, SDelete, and Windows Credential Editor.
Technique: T1588: Obtain Capabilities
Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files.
Technique: T1114: Email Collection
Hydraq creates a backdoor through which remote attackers can retrieve system information, such as CPU speed, from Registry keys.
Technique: T1012: Query Registry
The QakBot dropper can delay dropping the payload to evade detection.
Technique: T1497: Virtualization/Sandbox Evasion
An APT28 loader Trojan adds the Registry key HKCU\Environment\UserInitMprLogonScript to establish persistence.
Technique: T1037: Boot or Logon Initialization Scripts
Kazuar is obfuscated using the open source ConfuserEx protector.
Technique: T1027: Obfuscated Files or Information
Chimera has staged stolen data on designated servers in the target environment.
Technique: T1074: Data Staged
Chaes has used encryption for its C2 channel.
Technique: T1573: Encrypted Channel
Turian has the ability to use Python to spawn a Unix shell.
Technique: T1059: Command and Scripting Interpreter
These layers include the Operating Systems , server applications such as web servers, DNS servers, databases, and the  applications that sit on top of them.
Technique: T1499: Endpoint Denial of Service
Conti can retrieve the ARP cache from the local system by using the GetIpNetTable API call and check to ensure IP addresses it connects to are for local, non-Internet, systems.
Technique: T1016: System Network Configuration Discovery
APT39 has used malware to turn off the RequireSigned feature which ensures only signed DLLs can be run on Windows.
Technique: T1553: Subvert Trust Controls
Ngrok has been used by threat actors to proxy C2 connections to ngrok service subdomains.
Technique: T1102: Web Service
Leviathan has obfuscated code using base64 and gzip compression.
Technique: T1027: Obfuscated Files or Information
Adversaries may also check the network adapters addresses, CPU core count, and available memory/drive size.
Technique: T1497: Virtualization/Sandbox Evasion
Firstly, the reason this has been named MirageFox instead of just Mirage, is because in the Export directory for the modules, the name field is filled with a string MirageFox_Server.dat
Technique: T1036: Masquerading
Windows event logs record user and system activity such as login attempts, process creation, and much more.
Technique: T1562: Impair Defenses
SUNBURST used Rundll32 to execute payloads.
Technique: T1218: Signed Binary Proxy Execution
Bundlore changes the permissions of a payload using the command chmod -R 755.
Technique: T1222: File and Directory Permissions Modification
Figure 11: PowerShell script is XOR encoded using a single byte key After deobfuscating the contents of the PowerShell Script, we can divide it into three sections
Technique: T1546: Event Triggered Execution
query user
Technique: T1033: System Owner/User Discovery
Decrypting the Configuration As previously mentioned, the real configuration data is stored in the first stage shellcode but it is not stored in cleartext, but encrypted and compressed
Technique: T1027: Obfuscated Files or Information
AuditCred is installed as a new service on the system.
Technique: T1543: Create or Modify System Process
Additionally, some implementations can introduce visible artifacts for the user .
Technique: T1553: Subvert Trust Controls
RainyDay can use a file exfiltration tool to collect recently changed files with specific extensions.
Technique: T1083: File and Directory Discovery
“Knock” also appears in several strings inside the code of SpeakUp
Technique: T1140: Deobfuscate/Decode Files or Information
The group also uses a tool to execute commands on remote computers.
Technique: T1059: Command and Scripting Interpreter
Lokibot's second stage DLL has set a timer using “timeSetEvent” to schedule its next execution.
Technique: T1053: Scheduled Task/Job
PowerShell commands/scripts can also be executed without directly invoking the powershell.exe binary through interfaces to PowerShell's underlying System.Management.Automation assembly DLL exposed through the .NET framework and Windows Common Language Interface .
Technique: T1059: Command and Scripting Interpreter
menuPass has searched compromised systems for folders of interest including those related to HR, audit and expense, and meeting memos.
Technique: T1083: File and Directory Discovery
GravityRAT steals files based on an extension list if a USB drive is connected to the system.
Technique: T1025: Data from Removable Media
Trap commands are of the following format trap 'command list' signals where "command list" will be executed when "signals" are received.
Technique: T1546: Event Triggered Execution
On execution, the tool injects itself into lsass.exe and is triggered with the argument “dig”
Technique: T1055: Process Injection
If SSL renegotiation is enabled, a request can be made for renegotiation of the crypto algorithm.
Technique: T1499: Endpoint Denial of Service
NotPetya creates a task to reboot the system one hour after infection.
Technique: T1053: Scheduled Task/Job
Dark Caracal's version of Bandook communicates with their server over a TCP port using HTTP payloads Base64 encoded and suffixed with the string “&&&”.
Technique: T1071: Application Layer Protocol
OSX_OCEANLOTUS.D can create a persistence file in the folder /Library/LaunchAgents.
Technique: T1543: Create or Modify System Process
It is possible to start additional services after a safe mode boot.
Technique: T1562: Impair Defenses
Examples of cloud storage services include Dropbox and Google Docs.
Technique: T1567: Exfiltration Over Web Service
ZxShell can disable the firewall by modifying the registry key HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile.
Technique: T1562: Impair Defenses
LoudMiner used a batch script to run the Linux virtual machine as a service.
Technique: T1059: Command and Scripting Interpreter
LoudMiner has used QEMU and VirtualBox to run a Tiny Core Linux virtual machine, which runs XMRig and makes connections to the C2 server for updates.
Technique: T1564: Hide Artifacts
Many of this APT’s components are signed with phony Intel and AMD digital certificates
Technique: T1553: Subvert Trust Controls
On Linux and macOS, these command histories can be accessed in a few different ways.
Technique: T1070: Indicator Removal on Host
APT39 has utilized AutoIt and custom scripts to perform internal reconnaissance.
Technique: T1059: Command and Scripting Interpreter
APT32 has used macros, COM scriptlets, and VBS scripts.
Technique: T1059: Command and Scripting Interpreter
However, the attacks different stages were hosted on a variety of free sites such as Mailimg, Github, Pastebin, dev-point.co, a.pomf.cat, and upload.cat
Technique: T1102: Web Service
14, 2017, FireEye observed an attacker using an exploit for the Microsoft Office vulnerability to target a government organization in the Middle East
Technique: T1203: Exploitation for Client Execution
Information about assigned IP addresses may also be exposed to adversaries via online or other accessible data sets .
Technique: T1590: Gather Victim Network Information
Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.
Technique: T1132: Data Encoding
Ixeshe can achieve persistence by adding itself to the HKCU\Software\Microsoft\Windows\CurrentVersion\Run Registry key.
Technique: T1547: Boot or Logon Autostart Execution
QakBot can conduct brute force attacks to capture credentials.
Technique: T1110: Brute Force
Bankshot binds and listens on port 1058 for HTTP traffic while also utilizing a FakeTLS method.
Technique: T1571: Non-Standard Port
APT39 has used SQL injection for initial compromise.
Technique: T1190: Exploit Public-Facing Application
The first shellcode decrypts a further shellcode block
Technique: T1140: Deobfuscate/Decode Files or Information
RDAT can take a screenshot on the infected system.
Technique: T1113: Screen Capture
They have also dumped the LSASS process memory using the MiniDump function.
Technique: T1003: OS Credential Dumping
Waterbear can hook the ZwOpenProcess and GetExtendedTcpTable APIs called by the process of a security product to hide PIDs and TCP records from detection.
Technique: T1562: Impair Defenses
The version used here is version 4.1 digitally signed by Notepad++, as shown in Figure 5
Technique: T1553: Subvert Trust Controls
Silence has used scheduled tasks to stage its operation.
Technique: T1053: Scheduled Task/Job
RATANKBA uses cmd.exe to execute commands.
Technique: T1059: Command and Scripting Interpreter
Silent Librarian has established e-mail accounts to receive e-mails forwarded from compromised accounts.
Technique: T1585: Establish Accounts
OopsIE uses WMI to perform discovery techniques.
Technique: T1047: Windows Management Instrumentation
The login shell executes scripts from the system  and the user’s home directory  to configure the environment.
Technique: T1546: Event Triggered Execution
IFEOs are represented as Debugger values in the Registry under HKLM\SOFTWARE{\Wow6432Node}\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<executable> where &lt;executable&gt; is the binary on which the debugger is attached.
Technique: T1546: Event Triggered Execution
For each account found without preauthentication, an adversary may send an AS-REQ message without the encrypted timestamp and receive an AS-REP message with TGT data which may be encrypted with an insecure algorithm such as RC4.
Technique: T1558: Steal or Forge Kerberos Tickets
The headers are XOR encrypted with <hdrXORKey1> and <hdrXORKey2> combined and reversed
Technique: T1027: Obfuscated Files or Information
Mustang Panda has executed HTA files via cmd.exe, and used batch scripts for collection.
Technique: T1059: Command and Scripting Interpreter
Keydnap uses the keychaindump project to read securityd memory.
Technique: T1555: Credentials from Password Stores
Kimsuky has used scripts to download additional tools from compromised domains to victim systems.
Technique: T1105: Ingress Tool Transfer
MarkiRAT can gather information from the Keepass password manager.
Technique: T1555: Credentials from Password Stores
JPIN can use the command-line utility cacls.exe to change file permissions.
Technique: T1059: Command and Scripting Interpreter
APT41 used exploit payloads that initiate download via FTP.
Technique: T1071: Application Layer Protocol
Sowbug identified and extracted all Word documents on a server by using a command containing * .doc and *.docx.
Technique: T1083: File and Directory Discovery
Chimera has encoded PowerShell commands.
Technique: T1027: Obfuscated Files or Information
The Server Message Block  protocol is commonly used in Windows networks for authentication and communication between systems for access to resources and file sharing.
Technique: T1187: Forced Authentication
QakBot has the ability to use HTTP and HTTPS in communication with C2 servers.
Technique: T1071: Application Layer Protocol
Information about identities may include a variety of details, including personal data  as well as sensitive details such as credentials.
Technique: T1589: Gather Victim Identity Information
Babuk can use multiple Windows API calls for actions on compromised hosts including discovery and execution.
Technique: T1106: Native API
StoneDrill can take screenshots.
Technique: T1113: Screen Capture
XAgentOSX contains the showBackupIosFolder function to check for IOS device backups by running ls -la ~/Library/Application\ Support/MobileSync/Backup/.
Technique: T1083: File and Directory Discovery
Through modifying plist files in these locations, adversaries can also execute a malicious dynamic library  by adding a dictionary containing the DYLD_INSERT_LIBRARIES key combined with a path to a malicious dylib under the EnvironmentVariables key in a plist file.
Technique: T1547: Boot or Logon Autostart Execution
APT3 has a tool that can list out currently running processes.
Technique: T1057: Process Discovery
Turian has the ability to take screenshots.
Technique: T1113: Screen Capture
OilRig has abused the Outlook Home Page feature for persistence.
Technique: T1137: Office Application Startup
It encrypted the gathered information from a victim's system and hid it within an image before exfiltrating the image to a C2 server.
Technique: T1027: Obfuscated Files or Information
The diagram in Figure 1 shows the samples, domains, IP addresses and e-mail addresses that we identified during our investigation (See Appendix B for more detail on these.) There is a clear split between Cluster A and Cluster B, with no infrastructure overlap between the two
Technique: T1016: System Network Configuration Discovery
Siloscape has leveraged a vulnerability in Windows containers to perform an Escape to Host.
Technique: T1068: Exploitation for Privilege Escalation
emond
Technique: T1546: Event Triggered Execution
BOOSTWRITE has used a a 32-byte long multi-XOR key to decode data inside its payload.
Technique: T1140: Deobfuscate/Decode Files or Information
Cobalt Group has used public sites such as github.com and sendspace.com to upload files and then download them to victim computers.
Technique: T1105: Ingress Tool Transfer
Anchor has used cmd.exe to run its self deletion routine.
Technique: T1059: Command and Scripting Interpreter
Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks.
Technique: T1553: Subvert Trust Controls
Physical locations of a target organization may also be exposed to adversaries via online or other accessible data sets  or Social Media.
Technique: T1591: Gather Victim Org Information
Reflective code injection is very similar to Process Injection except that the “injection” loads code into the processes’ own memory instead of that of a separate process.
Technique: T1620: Reflective Code Loading
Evilnum has used the malware variant, TerraTV, to load a malicious DLL placed in the TeamViewer directory, instead of the original Windows DLL located in a system folder.
Technique: T1574: Hijack Execution Flow
BackdoorDiplomacy has used SMBTouch, a vulnerability scanner, to determine whether a target is vulnerable to EternalBlue malware.
Technique: T1046: Network Service Scanning
Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence  triggered by Ctrl-Alt-Delete.
Technique: T1547: Boot or Logon Autostart Execution
Operation Wocao has used a VBScript to conduct reconnaissance on targeted systems.
Technique: T1059: Command and Scripting Interpreter
Honeybee drops files with base64-encoded data.
Technique: T1027: Obfuscated Files or Information
In addition to downloading free malware from the internet, adversaries may purchase these capabilities from third-party entities.
Technique: T1588: Obtain Capabilities
Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings.
Technique: T1218: Signed Binary Proxy Execution
Valak can use wmic process call create in a scheduled task to launch plugins and for execution.
Technique: T1047: Windows Management Instrumentation