HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
Winnti for Linux has used HTTP in outbound communications.
Technique: T1071: Application Layer Protocol
Kwampirs creates a new service named WmiApSrvEx to establish persistence.
Technique: T1543: Create or Modify System Process
Machete hijacks the clipboard data by creating an overlapped window that listens to keyboard events.
Technique: T1115: Clipboard Data
UNC2452 used the service control manager on a remote system to disable services associated with security monitoring products.
Technique: T1562: Impair Defenses
PoetRAT has used spearphishing attachments to infect victims.
Technique: T1204: User Execution
NanHaiShu collects the username from the victim.
Technique: T1033: System Owner/User Discovery
Internal web servers are often not configured with the same security controls as public-facing counterparts, making them more vulnerable to exploitation by APT40 and similarly sophisticated groups
Technique: T1505: Server Software Component
DropBook can download and execute additional files.
Technique: T1105: Ingress Tool Transfer
OopsIE checks to see if the system is configured with "Daylight" time and checks for a specific region to be set for the timezone.
Technique: T1124: System Time Discovery
QakBot can delete folders and files including overwriting its executable with legitimate programs.
Technique: T1070: Indicator Removal on Host
PoetRAT has the ability to compress files with zip.
Technique: T1560: Archive Collected Data
APT39 has used various tools to steal files from the compromised host.
Technique: T1005: Data from Local System
Avaddon looks for and attempts to stop anti-malware solutions.
Technique: T1562: Impair Defenses
Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems.
Technique: T1602: Data from Configuration Repository
There are many ways an adversary can hijack DLL loads.
Technique: T1574: Hijack Execution Flow
BitPaymer can suppress UAC prompts by setting the HKCU\Software\Classes\ms-settings\shell\open\command registry key on Windows 10 or HKCU\Software\Classes\mscfile\shell\open\command on Windows 7 and launching the eventvwr.msc process, which launches BitPaymer with elevated privileges.
Technique: T1548: Abuse Elevation Control Mechanism
Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules.
Technique: T1562: Impair Defenses
This is encrypted by RC4, using the key {0xb5, 0x78, 0x62, 0x52, 0x98, 0x3e, 0x24, 0xd7, 0x3b, 0xc6, 0xee, 0x7c, 0xb9, 0xed, 0x91, 0x62}
Technique: T1027: Obfuscated Files or Information
Stuxnet uses the SetSecurityDescriptorDacl API to reduce object integrity levels.
Technique: T1106: Native API
ObliqueRAT can hide its payload in BMP images hosted on compromised websites.
Technique: T1027: Obfuscated Files or Information
Grandoreiro can block the Deibold Warsaw GAS Tecnologia security tool at the firewall level.
Technique: T1562: Impair Defenses
Bash keeps track of the commands users type on the command-line with the "history" utility.
Technique: T1552: Unsecured Credentials
Turla has created web accounts including Dropbox and GitHub for C2 and document exfiltration.
Technique: T1583: Acquire Infrastructure
Machete has also used some visual obfuscation techniques by naming variables as combinations of letters to hinder analysis.
Technique: T1027: Obfuscated Files or Information
Exaramel for Linux can decrypt its configuration file.
Technique: T1140: Deobfuscate/Decode Files or Information
DarkVishnya used DameWare Mini Remote Control for lateral movement.
Technique: T1219: Remote Access Software
RainyDay can use a file exfiltration tool to upload specific files to Dropbox.
Technique: T1567: Exfiltration Over Web Service
RegDuke can persist using a WMI consumer that is launched every time a process named WINWORD.EXE is started.
Technique: T1546: Event Triggered Execution
yty collects screenshots of the victim machine.
Technique: T1113: Screen Capture
CreateProcess 
Technique: T1106: Native API
IMAP accounts in Outlook 2013  and POP accounts use Outlook Data Files  as opposed to .ost, whereas IMAP accounts in Outlook 2016  use .ost files.
Technique: T1114: Email Collection
Ebury can list directory entries.
Technique: T1083: File and Directory Discovery
Remexi is a basic back door Trojan that allows attackers to open a remote shell on the computer and execute commands
Technique: T1059: Command and Scripting Interpreter
Machete captures audio from the computer’s microphone.
Technique: T1123: Audio Capture
Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using regsvr32.exe.
Technique: T1218: Signed Binary Proxy Execution
The malware can exfiltrate keystrokes, screenshots, browser-related data like cookies and history, decrypted when possible
Technique: T1113: Screen Capture
Cobalt Strike's Beacon payload is capable of capturing screenshots.
Technique: T1113: Screen Capture
Once a file is uploaded, Machete will delete it from the machine.
Technique: T1070: Indicator Removal on Host
VaporRage can use HTTP to download shellcode from compromised websites.
Technique: T1071: Application Layer Protocol
njRAT is capable of deleting objects related to itself  on the victim.
Technique: T1070: Indicator Removal on Host
Pillowmint has also obfuscated the AES key used for encryption.
Technique: T1027: Obfuscated Files or Information
Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser.
Technique: T1608: Stage Capabilities
Kazuar can install itself as a new service.
Technique: T1543: Create or Modify System Process
KillDisk attempts to reboot the machine by terminating specific processes.
Technique: T1529: System Shutdown/Reboot
Rocke's miner connects to a C2 server using port 51640.
Technique: T1571: Non-Standard Port
APT19 used an HTTP malware variant and a Port 22 malware variant to collect the MAC address and IP address from the victim’s machine.
Technique: T1016: System Network Configuration Discovery
When the service starts or is restarted, then the adversary-controlled program will execute, allowing the adversary to establish persistence and/or privilege escalation to the account context the service is set to execute under .
Technique: T1574: Hijack Execution Flow
Tonto Team has used PowerShell to download additional payloads.
Technique: T1059: Command and Scripting Interpreter
Kerrdown can decode, decrypt, and decompress multiple layers of shellcode.
Technique: T1140: Deobfuscate/Decode Files or Information
Sandworm Team has tricked unwitting recipients into clicking on spearphishing attachments and enabling malicious macros embedded within files.
Technique: T1204: User Execution
OilRig has used the Plink utility and other tools to create tunnels to C2 servers.
Technique: T1572: Protocol Tunneling
After the print processors are installed, the print spooler service, which starts during boot, must be restarted in order for them to run.
Technique: T1547: Boot or Logon Autostart Execution
BoomBox can downloaded files from Dropbox using a hardcoded access token.
Technique: T1102: Web Service
Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes.
Technique: T1056: Input Capture
Silence has used port 444 when sending data about the system from the client to the server.
Technique: T1571: Non-Standard Port
Zebrocy's Delphi variant was packed with UPX.
Technique: T1027: Obfuscated Files or Information
xCaon has leveraged native OS function calls to retrieve  victim's network adapter's  information using GetAdapterInfo API.
Technique: T1106: Native API
OilRig has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.
Technique: T1046: Network Service Scanning
NETWIRE can capture the victim's screen.
Technique: T1113: Screen Capture
Adversaries may search DNS data to gather actionable information.
Technique: T1596: Search Open Technical Databases
Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors .
Technique: T1199: Trusted Relationship
Cobalt Group has created new services to establish persistence.
Technique: T1543: Create or Modify System Process
ComRAT has used a scheduled task to launch its PowerShell loader.
Technique: T1053: Scheduled Task/Job
Bundlore has been spread through malicious advertisements on websites.
Technique: T1189: Drive-by Compromise
On Windows Vista and newer, the hash format is DCC2  hash, also known as MS-Cache v2 hash.
Technique: T1003: OS Credential Dumping
PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware .
Technique: T1555: Credentials from Password Stores
Javali can download payloads from remote C2 servers.
Technique: T1105: Ingress Tool Transfer
Metamorfo has digitally signed executables using AVAST Software certificates.
Technique: T1553: Subvert Trust Controls
APT12 has used RIPTIDE, a RAT that uses HTTP to communicate.
Technique: T1071: Application Layer Protocol
Higaisa named a shellcode loader binary svchast.exe to spoof the legitimate svchost.exe.
Technique: T1036: Masquerading
2
Technique: T1189: Drive-by Compromise
FatDuke can used pipes to connect machines with restricted internet access to remote machines via other infected hosts.
Technique: T1090: Proxy
APT33 has used base64 to encode payloads.
Technique: T1027: Obfuscated Files or Information
Grandoreiro can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.
Technique: T1185: Browser Session Hijacking
Ursnif droppers have also been delivered as password-protected zip files that execute base64 encoded PowerShell commands.
Technique: T1027: Obfuscated Files or Information
Kobalos can record the IP address of the target machine.
Technique: T1016: System Network Configuration Discovery
The CozyCar dropper has masqueraded a copy of the infected system's rundll32.exe executable that was moved to the malware's install directory and renamed according to a predefined configuration file.
Technique: T1036: Masquerading
Emissary injects its DLL file into a newly spawned Internet Explorer process.
Technique: T1055: Process Injection
ComRAT has checked the victim system's date and time to perform tasks during business hours .
Technique: T1124: System Time Discovery
TrickBot leverages a custom packer to obfuscate its functionality.
Technique: T1027: Obfuscated Files or Information
External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors.
Technique: T1090: Proxy
POWERSTATS encoded C2 traffic with base64.
Technique: T1001: Data Obfuscation
Crimson has the ability to delete files from a compromised host.
Technique: T1070: Indicator Removal on Host
Wingbird checks for the presence of Bitdefender security software.
Technique: T1518: Software Discovery
The group has also set a Startup path to launch the PowerShell shell command and download Cobalt Strike.
Technique: T1547: Boot or Logon Autostart Execution
Servers and cloud-based systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for Resource Hijacking and cryptocurrency mining.
Technique: T1496: Resource Hijacking
certutil is a WIndows component that can download external content to the computer. In a typical attack, the criminals follow this paradigm
Technique: T1105: Ingress Tool Transfer
Inception has used a reconnaissance module to gather information about the operating system and hardware on the infected host.
Technique: T1082: System Information Discovery
Adversaries may have prior knowledge through reconnaissance that security software exists within an environment or they may perform checks during or shortly after the system is compromised for Security Software Discovery.
Technique: T1211: Exploitation for Defense Evasion
Daserf leverages Mimikatz and Windows Credential Editor to steal credentials.
Technique: T1003: OS Credential Dumping
SMOKEDHAM has used a fronted domain to obfuscate its hard-coded C2 server domain.
Technique: T1090: Proxy
record audio
Technique: T1123: Audio Capture
Direct API access through a token negates the effectiveness of a second authentication factor and may be immune to intuitive countermeasures like changing passwords.
Technique: T1550: Use Alternate Authentication Material
Dacls can establish persistence via a Launch Daemon.
Technique: T1543: Create or Modify System Process
With authenticated access there are several tools that can be used to find accounts.
Technique: T1087: Account Discovery
If so, the shim database uses hooking to redirect the code as necessary in order to communicate with the OS.
Technique: T1546: Event Triggered Execution
The command az ad user get-member-groups will list groups associated to a user account for Azure while the API endpoint GET https://cloudidentity.googleapis.com/v1/groups lists group resources available to a user for Google .
Technique: T1069: Permission Groups Discovery
FlawedAmmyy has used SEAL encryption during the initial C2 handshake.
Technique: T1573: Encrypted Channel
Those assignments were not likely arbitrary, as this group had developed BlackEnergy2 for several years in a professional and organized style:  Config with a similar set of plugins for different architectures Here is the list of retrieved files and related functionality:    weap DDoS Attack (various types)   ps password stealer handling a variety of network protocols (SMTP, POP3, IMAP, HTTP, FTP, Telnet)   nm scans ports, stores banners   snif logs IP source and destination, TCP/UDP ports   hook main module: CnC communication, config parser, plugins loader   uper rewrites hook module with a new version and launches it     Weap, Snif, Nm plugin grammar mistakes and mis-spellings The developers’ coding style differed across the ‘Hook’ main module, the plugins, and the Windows main.dll
Technique: T1046: Network Service Scanning
Agent Tesla has used HTTP for C2 communications.
Technique: T1071: Application Layer Protocol
FIVEHANDS can use WMI to delete files on a  target machine.
Technique: T1047: Windows Management Instrumentation
OilRig has used batch scripts.
Technique: T1059: Command and Scripting Interpreter
Grandoreiro can use MSI files to execute DLLs.
Technique: T1218: Signed Binary Proxy Execution
Adversaries may target these repositories in order to collect large quantities of sensitive system administration data.
Technique: T1602: Data from Configuration Repository
Adversaries may modify visual content available internally or externally to an enterprise network.
Technique: T1491: Defacement
Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency .
Technique: T1102: Web Service
If an adversary creates resources in an unused region, they may be able to operate undetected.
Technique: T1535: Unused/Unsupported Cloud Regions
APT1 has used RAR to compress files before moving them outside of the victim network.
Technique: T1560: Archive Collected Data
DropBook has used legitimate web services to exfiltrate data.
Technique: T1567: Exfiltration Over Web Service
XCSSET has used a zero-day exploit in the ssh launchdaemon to elevate privileges and bypass SIP.
Technique: T1068: Exploitation for Privilege Escalation
Epic searches for anti-malware services running on the victim’s machine and terminates itself if it finds them.
Technique: T1518: Software Discovery
QUADAGENT uses AES and a preshared key to decrypt the custom Base64 routine used to encode strings and scripts.
Technique: T1140: Deobfuscate/Decode Files or Information
Adversaries may abuse any alias in Windows Management Instrumentation provided they utilize the /FORMAT switch.
Technique: T1220: XSL Script Processing
Dynamic-link libraries  that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll.
Technique: T1546: Event Triggered Execution
Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment.
Technique: T1090: Proxy
More_eggs has used regsvr32.exe to execute the malicious DLL.
Technique: T1218: Signed Binary Proxy Execution
HAWKBALL has exploited Microsoft Office vulnerabilities CVE-2017-11882 and CVE-2018-0802 to deliver the payload.
Technique: T1203: Exploitation for Client Execution
If the UAC protection level of a computer is set to anything but the highest level, certain Windows programs can elevate privileges or execute some elevated Component Object Model objects without prompting the user through the UAC notification box.
Technique: T1548: Abuse Elevation Control Mechanism
RobbinHood will search for Windows services that are associated with antivirus software on the system and kill the process.
Technique: T1562: Impair Defenses
Threat actors can use online resources and lookup tools to harvest information about certificates.
Technique: T1596: Search Open Technical Databases
This is followed by a number of Linux shell command style commands related to the malware establishing persistence
Technique: T1059: Command and Scripting Interpreter
Lazarus Group has targeted victims with spearphishing emails containing malicious Microsoft Word documents.
Technique: T1566: Phishing
Seth-Locker can execute commands via the command line shell.
Technique: T1059: Command and Scripting Interpreter
FIN7 has used WMI to install malware on targeted systems.
Technique: T1047: Windows Management Instrumentation
Xbash can collect IP addresses and local intranet information from a victim’s machine.
Technique: T1016: System Network Configuration Discovery
SMOKEDHAM has used Powershell to download UltraVNC and Ngrok from third-party file sharing sites.
Technique: T1105: Ingress Tool Transfer
The entire command structure gets compressed with zlib and then encrypted using a custom stream cipher.
Technique: T1560: Archive Collected Data
Indicators of compromise MITRE ATT&CK techniques  Modify existing service Code signing File deletion Deobfuscate/decode files or information System information discovery Process discovery Service execution RunDLL32 Scripting Command-line Interface Data from local system Automated exfiltration Data encrypted Commonly used port Bypass user account control  Hashes  fe32d29fa16b1b71cd27b23a78ee9f6b7791bff3 f684e15dd2e84bac49ea9b89f9b2646dc32a2477 1d280a77595a2d2bbd36b9b5d958f99be20f8e06 19d9573f0b2c2100accd562cc82d57adb12a57ec f90a2155ac492c3c2d5e1d83e384e1a734e59cc0 9b832dda912cce6b23da8abf3881fcf4d2b7ce09 f3b62fea38cb44e15984d941445d24e6b309bc7b 66d2cea01b46c3353f4339a986a97b24ed89ee18 7113aaab61cacb6086c5531a453adf82ca7e7d03 d41daba0ebfa55d0c769ccfc03dbf6a5221e006a 25f4819e7948086d46df8de2eeeaa2b9ec6eca8c 35ab747c15c20da29a14e8b46c07c0448cef4999 e87de3747d7c12c1eea9e73d3c2fb085b5ae8b42 0e4a7c0242b98723dc2b8cce1fbf1a43dd025cf0 bca861a46d60831a3101c50f80a6d626fa99bf16 01530adb3f947fabebae5d9c04fb69f9000c3cef 4229896d61a5ad57ed5c247228606ce62c7032d0 4c7e975f95ebc47423923b855a7530af52977f57 5a6ad7a1c566204a92dd269312d1156d51e61dc4 1dc50bfcab2bc80587ac900c03e23afcbe243f64 003e21b02be3248ff72cc2bfcd05bb161b6a2356 9b7c3c48bcef6330e3086de592b3223eb198744a 85e2453b37602429596c9681a8c58a5c6faf8d0c  Domains  ftp.byethost31.com ftp.byethost11.com 1113427185.ifastnet.org navermail.byethost3.com nihon.byethost3.com
Technique: T1048: Exfiltration Over Alternative Protocol
Cleaver has created fake LinkedIn profiles that included profile photos, details, and connections.
Technique: T1585: Establish Accounts
Chimera has used HTTPS for C2 communications.
Technique: T1071: Application Layer Protocol
Felismus collects the system information, including hostname and OS version, and sends it to the C2 server.
Technique: T1082: System Information Discovery
TrickBot has the ability to capture RDP credentials by capturing the CredEnumerateA API  Ursnif has hooked APIs to perform a wide variety of information theft, such as monitoring traffic from browsers.
Technique: T1056: Input Capture
The use of cloud infrastructure can also make it easier for adversaries to rapidly provision, modify, and shut down their infrastructure.
Technique: T1583: Acquire Infrastructure
Its presence on a compromised system allows a threat actor to execute a wide variety of commands, including uploading and downloading files, and spawning a reverse shell
Technique: T1059: Command and Scripting Interpreter
SslMM sends the logged-on username to its hard-coded C2.
Technique: T1033: System Owner/User Discovery
If exploitation is successful, then it will give the adversary code execution on the user's system unless other protections are in place.
Technique: T1189: Drive-by Compromise
Nomadic Octopus has used malicious macros to download additional files to the victim's machine.
Technique: T1105: Ingress Tool Transfer
For legacy programs, macOS executes /etc/bashrc on startup.
Technique: T1546: Event Triggered Execution
USBferry can use netstat and nbtstat to detect active network connections.
Technique: T1049: System Network Connections Discovery
FIN5 has has used the tool GET2 Penetrator to look for remote login and hard-coded credentials.
Technique: T1110: Brute Force
Pillowmint has used a PowerShell script to install a shim database.
Technique: T1059: Command and Scripting Interpreter
Bad Rabbit can enumerate all running processes to compare hashes.
Technique: T1057: Process Discovery
ZxShell can set up an HTTP or SOCKS proxy.
Technique: T1090: Proxy
Adversaries may gather the victim's IP addresses that can be used during targeting.
Technique: T1590: Gather Victim Network Information
Hikit has used DLL Search Order Hijacking to load oci.dll as a persistence mechanism.
Technique: T1574: Hijack Execution Flow
SideTwist has exfiltrated data over its C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
PowerShower has collected system information on the infected host.
Technique: T1082: System Information Discovery
SLOTHFULMEDIA has the capability to stop processes and services.
Technique: T1489: Service Stop
Ngrok can be used to proxy connections to machines located behind NAT or firewalls.
Technique: T1090: Proxy
Stuxnet also uses a 31-byte long static byte string to XOR data sent to command and control servers.
Technique: T1573: Encrypted Channel
Cobalt Group has injected code into trusted processes.
Technique: T1055: Process Injection
POSHSPY uploads data in 2048-byte chunks.
Technique: T1030: Data Transfer Size Limits
Ramsay can use ipconfig and Arp to collect network configuration information, including routing information and ARP tables.
Technique: T1016: System Network Configuration Discovery
Magic Hound used various social media channels  as well as messaging services  to spearphish victims.
Technique: T1566: Phishing
Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS.
Technique: T1542: Pre-OS Boot
BADFLICK has delayed communication to the actor-controlled IP address by 5 minutes.
Technique: T1497: Virtualization/Sandbox Evasion
Paths to dylibs may be prefixed with @rpath, which allows developers to use relative paths to specify an array of search paths used at runtime based on the location of the executable.
Technique: T1574: Hijack Execution Flow
Machete created their own directories to drop files into.
Technique: T1074: Data Staged
HyperStack can use Windows API's ConnectNamedPipe and WNetAddConnection2 to detect incoming connections and connect to remote shares.
Technique: T1106: Native API
Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.
Technique: T1070: Indicator Removal on Host
Credential stuffing is a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies.
Technique: T1110: Brute Force
Cadelspy has the ability to record audio from the compromised host.
Technique: T1123: Audio Capture
PLEAD has the ability to list open windows on the compromised host.
Technique: T1010: Application Window Discovery
Adversaries may compromise VPSs purchased by third-party entities.
Technique: T1584: Compromise Infrastructure
Crutch can exfiltrate data over the primary C2 channel .
Technique: T1041: Exfiltration Over C2 Channel
Wiarp creates a backdoor through which remote attackers can inject files into running processes.
Technique: T1055: Process Injection
TEMP.Veles has modified and added entries within HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options to maintain persistence.
Technique: T1546: Event Triggered Execution
FIN4 has used HTTP POST requests to transmit data.
Technique: T1071: Application Layer Protocol
This ensures that an adversary possessing the corresponding private key may log in as an existing user via SSH.
Technique: T1098: Account Manipulation
Silence has deleted artifacts, including scheduled tasks, communicates files from the C2 and other logs.
Technique: T1070: Indicator Removal on Host
Windows allows logon scripts to be run whenever a specific user or group of users log into a system.
Technique: T1037: Boot or Logon Initialization Scripts
Bundlore can download and execute new versions of itself.
Technique: T1105: Ingress Tool Transfer
PipeMon can send time zone information from a compromised host to C2.
Technique: T1124: System Time Discovery
Adversaries may hide malicious Visual Basic for Applications  payloads embedded within MS Office documents by replacing the VBA source code with benign data.
Technique: T1564: Hide Artifacts
Vasport can download files.
Technique: T1105: Ingress Tool Transfer
By default all user accounts in the domain have permission to read GPOs.
Technique: T1484: Domain Policy Modification
Many methods have been discovered to bypass UAC.
Technique: T1548: Abuse Elevation Control Mechanism
The state command sets a global variable containing a series of Boolean values represented as ASCII values ‘0’ or ‘1’ and also adds itself to the configuration file
Technique: T1140: Deobfuscate/Decode Files or Information
POWRUNER may collect information about the currently logged in user by running whoami on a victim.
Technique: T1033: System Owner/User Discovery
While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it.
Technique: T1204: User Execution
Following successful infiltration, the malware persists through registry: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run The command line execution leads to PowerShell code executed from a different registry value .
Technique: T1546: Event Triggered Execution
Proxysvc performs data exfiltration over the control server channel using a custom protocol.
Technique: T1041: Exfiltration Over C2 Channel
Rocke has changed the time stamp of certain files.
Technique: T1070: Indicator Removal on Host
Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run.
Technique: T1027: Obfuscated Files or Information
Turla has infected victims using watering holes.
Technique: T1189: Drive-by Compromise
These programs will be executed under the context of the user and will have the account's associated permissions level.
Technique: T1547: Boot or Logon Autostart Execution
Adversary tools have been discovered that search compromised systems for file extensions relating to cryptographic keys and certificates.
Technique: T1552: Unsecured Credentials
ZeroT shellcode decrypts and decompresses its RC4-encrypted payload.
Technique: T1140: Deobfuscate/Decode Files or Information
If so, NETEAGLE will send beacons via an HTTP POST request.
Technique: T1071: Application Layer Protocol
Smoke Loader searches for files named logins.json to parse for credentials.
Technique: T1552: Unsecured Credentials
Operation Wocao has gained initial access via vulnerable webservers.
Technique: T1190: Exploit Public-Facing Application
Leviathan has used multi-hop proxies to disguise the source of their malicious traffic.
Technique: T1090: Proxy
Turian has the ability to use /bin/sh to execute commands.
Technique: T1059: Command and Scripting Interpreter
Ixeshe sets its own executable file's attributes to hidden.
Technique: T1564: Hide Artifacts
This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates.
Technique: T1587: Develop Capabilities
Lazarus Group has used CHM files to move concealed payloads.
Technique: T1218: Signed Binary Proxy Execution
Metamorfo has searched the compromised system for banking applications.
Technique: T1518: Software Discovery
bootkit
Technique: T1542: Pre-OS Boot
Cobalt Group has used regsvr32.exe to execute scripts.
Technique: T1218: Signed Binary Proxy Execution
Inception has exploited CVE-2012-0158, CVE-2014-1761, CVE-2017-11882 and CVE-2018-0802 for execution.
Technique: T1203: Exploitation for Client Execution
njRAT has included a base64 encoded executable.
Technique: T1027: Obfuscated Files or Information
Adversaries may do this using a Command and Scripting Interpreter, such as cmd, which has functionality to interact with the file system to gather information.
Technique: T1005: Data from Local System
APT39 leveraged spearphishing emails with malicious links to initially compromise victims.
Technique: T1566: Phishing
PowerDuke has a command to write random data across a file and delete it.
Technique: T1485: Data Destruction
Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries  or executables .
Technique: T1021: Remote Services
Ke3chang has dumped credentials, including by using Mimikatz.
Technique: T1003: OS Credential Dumping
FIN6 has targeted victims with e-mails containing malicious attachments.
Technique: T1566: Phishing
ChChes communicates to its C2 server over HTTP and embeds data within the Cookie HTTP header.
Technique: T1071: Application Layer Protocol
UNC2452 used the Get-AcceptedDomain PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell.
Technique: T1482: Domain Trust Discovery
This technique may bypass system logging and security monitors such as security information and event management  products .
Technique: T1207: Rogue Domain Controller
Attor's installer plugin can schedule rundll32.exe to load the dispatcher.
Technique: T1218: Signed Binary Proxy Execution
Dyre has the ability to identify the users on a compromised host.
Technique: T1033: System Owner/User Discovery
Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment.
Technique: T1615: Group Policy Discovery
A module in Prikormka collects information from the victim about its IP addresses and MAC addresses.
Technique: T1016: System Network Configuration Discovery
CosmicDuke collects user credentials, including passwords, for various programs including popular instant messaging applications and email clients as well as WLAN keys.
Technique: T1555: Credentials from Password Stores
The p-code is executed when the MS Office version specified in the _VBA_PROJECT stream  matches the version of the host MS Office application.
Technique: T1564: Hide Artifacts
Melcoz can monitor content saved to the clipboard.
Technique: T1115: Clipboard Data
QakBot has the ability to download additional components and malware.
Technique: T1105: Ingress Tool Transfer
POORAIM has used AOL Instant Messenger for C2.
Technique: T1102: Web Service
ComRAT has used a task name associated with Windows SQM Consolidator.
Technique: T1036: Masquerading
The MSIL file contains the packed core payload in its .Net resource section
Technique: T1027: Obfuscated Files or Information
Note: The at.exe command line utility has been deprecated in current versions of Windows in favor of schtasks.
Technique: T1053: Scheduled Task/Job
This change is because Group 123 did not target South Korea during this campaign and Microsoft Office is standard in the rest of the world.Infection VectorsThe attackers exploited CVE-2017-0199 in order to download and execute a malicious HTA document inside of Microsoft Office
Technique: T1203: Exploitation for Client Execution
APT38 is characterized by long planning, extended periods of access to compromised victim environments preceding any attempts to steal money, fluency across mixed operating system environments, the use of custom developed tools, and a constant effort to thwart investigations capped with a willingness to completely destroy compromised machines afterwards
Technique: T1533: nan
Properties within parts may reference shared public resources accessed via online URLs.
Technique: T1221: Template Injection
NotPetya's initial infection vector for the June 27, 2017 compromise was a backdoor in the Ukrainian tax accounting software M.E.Doc.
Technique: T1195: Supply Chain Compromise
Hancitor has also delivered compressed payloads in ZIP files to victims.
Technique: T1027: Obfuscated Files or Information
Cleaver has been known to dump credentials using Mimikatz and Windows Credential Editor.
Technique: T1003: OS Credential Dumping
Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting.
Technique: T1598: Phishing for Information
WastedLocker can modify registry values within the Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap registry key.
Technique: T1112: Modify Registry
Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS  before later being compiled into a proper executable binary with a bundled compiler and execution framework.
Technique: T1027: Obfuscated Files or Information
Kobalos's post-authentication communication channel uses a 32-byte-long password with RC4 for inbound and outbound traffic.
Technique: T1573: Encrypted Channel
Tonto Team has used EternalBlue exploits for lateral movement.
Technique: T1210: Exploitation of Remote Services
Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment.
Technique: T1562: Impair Defenses
PLATINUM has used several different keyloggers.
Technique: T1056: Input Capture
Libraries specified by LD_PRELOAD are loaded and mapped into memory by dlopen and mmap respectively.
Technique: T1574: Hijack Execution Flow
This traffic can be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS .
Technique: T1498: Network Denial of Service
PowerShower has the ability to remove all files created during the dropper process.
Technique: T1070: Indicator Removal on Host
One such example is use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file.
Technique: T1140: Deobfuscate/Decode Files or Information
CVE-2014-4113 is a privilege escalation vulnerability that was disclosed publicly on 2014-10-14
Technique: T1068: Exploitation for Privilege Escalation
Patchwork also enumerated all available drives on the victim's machine.
Technique: T1082: System Information Discovery
Lazarus Group malware SierraCharlie uses RDP for propagation.
Technique: T1021: Remote Services
Tool Type Internal Name Industry Name   Backdoor Poison Frog BONDUPDATER   Backdoor Glimpse Updated BONDUPDATER   Webshell HyperShell TwoFace loader   Webshell HighShell TwoFace payload   Webshell Minion TwoFace payload variant   DNS Hijacking Toolkit webmask Related to DNSpionage     Table 1
Technique: T1027: Obfuscated Files or Information
Try to exploit the following Remote Code Execution vulnerabilities in the targeted servers:  a) CVE-2012-0874: JBoss Enterprise Application Platform Multiple Security Bypass Vulnerabilities b) CVE-2010-1871: JBoss Seam Framework remote code execution c) JBoss AS 3/4/5/6: Remote Command Execution (exploit) d) CVE-2017-10271: Oracle WebLogic wls-wsat Component Deserialization RCE e) CVE-2018-2894: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware
Technique: T1203: Exploitation for Client Execution
Penquin can delete downloaded executables after running them.
Technique: T1070: Indicator Removal on Host
The systemd service manager is commonly used for managing background daemon processes  and other system resources.
Technique: T1543: Create or Modify System Process
Babuk can stop anti-virus services on a compromised host.
Technique: T1562: Impair Defenses
APT28 has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.
Technique: T1204: User Execution
BlackTech has used DLL side loading by giving DLLs hardcoded names and placing them in searched directories.
Technique: T1574: Hijack Execution Flow
2 Downloads a file to the system
Technique: T1105: Ingress Tool Transfer
Remexi executes received commands with wmic.exe .
Technique: T1047: Windows Management Instrumentation
Online news outlets and general websites were breached and weaponized as a vehicle for watering hole attacks
Technique: T1189: Drive-by Compromise
Dark Caracal makes their malware look like Flash Player, Office, or PDF documents in order to entice a user to click on it.
Technique: T1204: User Execution
Cobalt Group has used exploits to increase their levels of rights and privileges.
Technique: T1068: Exploitation for Privilege Escalation
Examples for both Word and Excel have been discovered and published.
Technique: T1137: Office Application Startup
ABK has the ability to identify the installed anti-virus product on the compromised host.
Technique: T1518: Software Discovery
The malware basically provides a remote CMD/PowerShell terminal for the attackers, enabling them to execute scripts/commands and receive the results via HTTP requests
Technique: T1059: Command and Scripting Interpreter
Ebury has used Python to implement its DGA.
Technique: T1059: Command and Scripting Interpreter
Dragonfly 2.0 collected data from local victim systems.
Technique: T1005: Data from Local System
DRIVE Lists the logical drives and the type, as well the total/free space of the fixed devices
Technique: T1083: File and Directory Discovery
TEARDROP created and read from a file with a fake JPG header, and its payload was encrypted with a simple rotating XOR cipher.
Technique: T1027: Obfuscated Files or Information
For example, adversaries may perform SSH tunneling , which involves forwarding arbitrary data over an encrypted SSH tunnel.
Technique: T1572: Protocol Tunneling
reg query HKCU /f password /t REG_SZ /s 
Technique: T1552: Unsecured Credentials
Tools CTU researchers observed BRONZE UNION using the following tools in intrusions since the 2015 analysis, but clients should assume that the threat group still has access to the previously reported tools
Technique: T1518: Software Discovery
MegaCortex has used a Base64 key to decode its components.
Technique: T1140: Deobfuscate/Decode Files or Information
OwaAuth uses the filename owaauth.dll, which is a legitimate file that normally resides in %ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\Auth\; the malicious file by the same name is saved in %ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\bin\.
Technique: T1036: Masquerading
Hydraq creates a Registry subkey to register its created service, and can also uninstall itself later by deleting this value.
Technique: T1112: Modify Registry
GRIFFON has used a reconnaissance module that can be used to retrieve the date and time of the system.
Technique: T1124: System Time Discovery
Siloscape can run cmd through an IRC channel.
Technique: T1059: Command and Scripting Interpreter
FIN6 has encoded data gathered from the victim with a simple substitution cipher and single-byte XOR using the 0xAA key, and Base64 with character permutation.
Technique: T1560: Archive Collected Data
Trojan.Karagany can take a desktop screenshot and save the file into \ProgramData\Mail\MailAg\shot.png.
Technique: T1113: Screen Capture
Zeus Panda uses HTTP for C2 communications.
Technique: T1071: Application Layer Protocol
Note that the libraries are different from the utilities.
Technique: T1560: Archive Collected Data
RedLeaves can gather browser usernames and passwords.
Technique: T1555: Credentials from Password Stores
ServHelper may attempt to establish persistence via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ run key.
Technique: T1547: Boot or Logon Autostart Execution
OpenClipboard()  
Technique: T1115: Clipboard Data
BendyBear has used byte randomization to obscure its behavior.
Technique: T1001: Data Obfuscation
Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence.
Technique: T1037: Boot or Logon Initialization Scripts
Attor's installer plugin can schedule a new task that loads the dispatcher on boot/logon.
Technique: T1053: Scheduled Task/Job
PowerDuke has a command to get the victim's domain and NetBIOS name.
Technique: T1016: System Network Configuration Discovery
Video or image files may be written to disk and exfiltrated later.
Technique: T1125: Video Capture
PowerStallion modifies the MAC times of its local log files to match that of the victim's desktop.ini file.
Technique: T1070: Indicator Removal on Host
NETWIRE can implement use of proxies to pivot traffic.
Technique: T1090: Proxy
The files uploaded to this webshell included the same compiled python script that would scan remote systems that were vulnerable to CVE-2017-0144 (EternalBlue) that we saw uploaded to the other errr.aspx webshell.
Technique: T1059: Command and Scripting Interpreter
InvisiMole samples were timestomped by the authors by setting the PE timestamps to all zero values.
Technique: T1070: Indicator Removal on Host
Attackers can therefore give a malicious DLL the same name as a legitimate DLL but place it ahead of the legitimate version in the search order so that it will be loaded when Windows searches for it.
Technique: T1574: Hijack Execution Flow
Python is a very popular scripting/programming language, with capabilities to perform many functions.
Technique: T1059: Command and Scripting Interpreter
APT32 enumerated administrative users and DC servers using the commands net localgroup administrators and net group "Domain Controllers" /domain.
Technique: T1087: Account Discovery
Rundll32.exe is used as a way of executing Flame at the command-line.
Technique: T1218: Signed Binary Proxy Execution
Umbreon provides access to the system via SSH or any other protocol that uses PAM to authenticate.
Technique: T1095: Non-Application Layer Protocol
FIN7 captured screenshots and desktop video recordings.
Technique: T1113: Screen Capture
ADVSTORESHELL can list files and directories.
Technique: T1083: File and Directory Discovery
Mustang Panda has used spearphishing attachments to deliver initial access payloads.
Technique: T1566: Phishing
Carberp's passw.plug plugin can gather passwords saved in Opera, Internet Explorer, Safari, Firefox, and Chrome.
Technique: T1555: Credentials from Password Stores
APT-C-36 has prompted victims to accept macros in order to execute the subsequent payload.
Technique: T1204: User Execution
ZxShell has used HTTP for C2 connections.
Technique: T1071: Application Layer Protocol
Octopus has stored collected information in the Application Data directory on a compromised host.
Technique: T1074: Data Staged
Wizard Spider has shut down or uninstalled security applications on victim systems that might prevent ransomware from executing.
Technique: T1562: Impair Defenses
In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center .
Technique: T1558: Steal or Forge Kerberos Tickets
SpeakUp deletes files to remove evidence on the machine.
Technique: T1070: Indicator Removal on Host
APT29 renamed software and DLL's with legitimate names to appear benign.
Technique: T1036: Masquerading
UNC2452 used scheduler and schtasks to create new tasks on remote hosts as part of lateral movement.
Technique: T1053: Scheduled Task/Job
Both responses instruct the malware to download and load a remote plugin
Technique: T1105: Ingress Tool Transfer
The PSReadLine command history tracks the commands used in all PowerShell sessions and writes them to a file .
Technique: T1070: Indicator Removal on Host
Similarly, adversaries may modify existing services, daemons, or agents to achieve the same effect.
Technique: T1543: Create or Modify System Process
Misdat is capable of running commands to obtain a list of files and directories, as well as enumerating logical drives.
Technique: T1083: File and Directory Discovery
A variant of ADVSTORESHELL encrypts some C2 with 3DES.
Technique: T1573: Encrypted Channel
Matryoshka uses DNS for C2.
Technique: T1071: Application Layer Protocol
Turian can scan for removable media to collect data.
Technique: T1120: Peripheral Device Discovery
PS1 can utilize a PowerShell loader.
Technique: T1059: Command and Scripting Interpreter
Bazar can collect the IP address and NetBIOS name of an infected machine.
Technique: T1016: System Network Configuration Discovery
APT37 has a function in the initial dropper to bypass Windows UAC in order to execute the next payload with higher privileges.
Technique: T1548: Abuse Elevation Control Mechanism
TA505 has downloaded additional malware to execute on victim systems.
Technique: T1105: Ingress Tool Transfer
UBoatRAT has used HTTP for C2 communications.
Technique: T1071: Application Layer Protocol
APT38 has used web shells for persistence or to ensure redundant access.
Technique: T1505: Server Software Component
Crutch can use Dropbox to receive commands and upload stolen data.
Technique: T1102: Web Service
REvil can enumerate active services.
Technique: T1007: System Service Discovery
Tool acquisition can involve the procurement of commercial software licenses, including for red teaming tools such as Cobalt Strike.
Technique: T1588: Obtain Capabilities
PHOTO: a DLL backdoor also reported publicly as “Derusbi”, capable of obtaining directory, file, and drive listing; creating a reverse shell; performing screen captures; recording video and audio; listing, terminating, and creating processes; enumerating, starting, and deleting registry keys and values; logging keystrokes, returning usernames and passwords from protected storage; and renaming, deleting, copying, moving, reading, and writing to files
Technique: T1083: File and Directory Discovery
Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols.
Technique: T1588: Obtain Capabilities
Adversaries may also use Masquerading to make XDG autostart entries look as if they are associated with legitimate programs.
Technique: T1547: Boot or Logon Autostart Execution
WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system .
Technique: T1021: Remote Services
Gamaredon Group macros can scan for Microsoft Word and Excel files to inject with additional malicious macros.
Technique: T1083: File and Directory Discovery
Adversaries may register for web services that can be used during targeting.
Technique: T1583: Acquire Infrastructure
In many payment card data breaches, a point-of-sale (POS) system is infected with malware that searches for specific processes in memory known to store card data in plain text
Technique: T1533: nan
Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility.
Technique: T1127: Trusted Developer Utilities Proxy Execution
SDBbot has used a packed installer file.
Technique: T1027: Obfuscated Files or Information
OSX/Shlayer uses the command appDir="$" and $" to construct installation paths.
Technique: T1083: File and Directory Discovery