HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
Downdelph inserts pseudo-random characters between each original character during encoding of C2 network requests, making it difficult to write signatures on them.
Technique: T1001: Data Obfuscation
menuPass has sent malicious Office documents via email as part of spearphishing campaigns as well as executables disguised as documents.
Technique: T1566: Phishing
PowerShell 
Technique: T1059: Command and Scripting Interpreter
Malicious .lnk files contain a link to a URL (instead of the expected local URI) to grab the next payload
Technique: T1547: Boot or Logon Autostart Execution
Machete used multiple compiled Python scripts on the victim’s system.
Technique: T1059: Command and Scripting Interpreter
NetTraveler contains a keylogger.
Technique: T1056: Input Capture
Rocke has used uname -m to collect the name and information about the infected system's kernel.
Technique: T1082: System Information Discovery
Adversaries may implant cloud or container images with malicious code to establish persistence after gaining access to an environment.
Technique: T1525: Implant Internal Image
Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries.
Technique: T1574: Hijack Execution Flow
GoldMax has impersonated systems management software to avoid detection.
Technique: T1036: Masquerading
BRONZE BUTLER compromised three Japanese websites using a Flash exploit to perform watering hole attacks.
Technique: T1189: Drive-by Compromise
Use of a contractor may be considered an extension of that adversary's exploit development capabilities, provided the adversary plays a role in shaping requirements and maintains an initial degree of exclusivity to the exploit.
Technique: T1587: Develop Capabilities
These actions may interfere with event collection, reporting, or other notifications used to detect intrusion activity.
Technique: T1070: Indicator Removal on Host
APT29 obtained PKI keys, certificate files and the private encryption key from an Active Directory Federation Services  container to decrypt corresponding SAML signing certificates.
Technique: T1552: Unsecured Credentials
EVILNUM can obtain the computer name from the victim's system.
Technique: T1082: System Information Discovery
Application and network credentials are stored in the Windows Credentials locker.
Technique: T1555: Credentials from Password Stores
Sykipot may use net start to display running services.
Technique: T1007: System Service Discovery
Adversaries may abuse AppleScript for execution.
Technique: T1059: Command and Scripting Interpreter
BISCUIT has a command to collect the processor type, operation system, computer name, uptime, and whether the system is a laptop or PC.
Technique: T1082: System Information Discovery
Ixeshe can list running services.
Technique: T1007: System Service Discovery
RDAT can also embed additional messages within BMP images to communicate with the RDAT operator.
Technique: T1001: Data Obfuscation
Kasidet has the ability to initiate keylogging.
Technique: T1056: Input Capture
The script will send the specified number of DNS queries using the following format, each of which the C2 will respond with an IPv6 address that the script will treat as a string of data:   www.<sequence number>.<same random number between 100000 and 999999>.<c2 domain name>   The payload will treat the data provided by the C2 as a message, which will have the following structure:   hello<char uuid[35]><char type[1]><data>   The message will start with the string hello followed by a 35-character UUID string
Technique: T1573: Encrypted Channel
Gallmaker sent emails with malicious Microsoft Office documents attached.
Technique: T1566: Phishing
Lazarus Group has obtained SSL certificates for their C2 domains.
Technique: T1588: Obtain Capabilities
menuPass has collected data from remote systems by mounting network shares with net use and using Robocopy to transfer data.
Technique: T1039: Data from Network Shared Drive
Octopus can capture screenshots of the victims’ machine.
Technique: T1113: Screen Capture
This technique is similar to ROMMONkit and may result in the network device running a modified image.
Technique: T1542: Pre-OS Boot
SYSCON has the ability to execute commands through cmd on a compromised host.
Technique: T1059: Command and Scripting Interpreter
vaultcmd.exe is a native Windows executable that can be used to enumerate credentials stored in the Credential Locker through a command-line interface.
Technique: T1555: Credentials from Password Stores
Sakula uses single-byte XOR obfuscation to obfuscate many of its files.
Technique: T1027: Obfuscated Files or Information
Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly changing IP addresses linked to a single domain resolution.
Technique: T1568: Dynamic Resolution
Malware Delivery Method  In all emails sent to these government officials, the actor used the same attachment: a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload
Technique: T1566: Phishing
Example network shares include `C$`, `ADMIN$`, and `IPC$`.
Technique: T1021: Remote Services
Turla surveys a system upon check-in to discover information in the Windows Registry with the reg query command.
Technique: T1012: Query Registry
For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files.
Technique: T1204: User Execution
Zeus Panda queries the system's keyboard mapping to determine the language used on the system.
Technique: T1614: System Location Discovery
[9] “HKU concern group raises proxy fears in key vote.” EIJ Insight
Technique: T1090: Proxy
Deep Panda uses the Microsoft Tasklist utility to list processes running on systems.
Technique: T1057: Process Discovery
CookieMiner has used python scripts on the user’s system, as well as the Python variant of the Empire agent, EmPyre.
Technique: T1059: Command and Scripting Interpreter
This is very similar to Process Hollowing but targets an existing process rather than creating a process in a suspended state.
Technique: T1055: Process Injection
Credential Harvesting Attack On June 24, 2018, Unit 42 observed DarkHydrus carrying out a credential harvesting attack on an educational institution in the Middle East
Technique: T1003: OS Credential Dumping
Sowbug listed remote shared drives that were accessible from a victim.
Technique: T1135: Network Share Discovery
For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Technique: T1565: Data Manipulation
Similar to PtH, this involves using a password hash to authenticate as a user but also uses the password hash to create a valid Kerberos ticket.
Technique: T1550: Use Alternate Authentication Material
Some APT40 malware tools can evade typical network detectiona by leveraging legitimate websites, such as GitHub, Google, and Pastebin for initial C2 communications
Technique: T1102: Web Service
NativeZone has, upon execution, displayed a message box that appears to be related to a Ukrainian electronic document management system.
Technique: T1036: Masquerading
SQLRat has scripts that are responsible for deobfuscating additional scripts.
Technique: T1140: Deobfuscate/Decode Files or Information
Cardinal RAT can log keystrokes.
Technique: T1056: Input Capture
Evilnum has used PowerShell to bypass UAC.
Technique: T1548: Abuse Elevation Control Mechanism
WINERACK can enumerate services.
Technique: T1007: System Service Discovery
Calisto presents an input prompt asking for the user's login and password.
Technique: T1056: Input Capture
Silent Librarian has used links in e-mails to direct victims to credential harvesting websites designed to appear like the targeted organization's login page.
Technique: T1598: Phishing for Information
On the next step this file is executed by rundll32.exe via the KlpSvc export
Technique: T1218: Signed Binary Proxy Execution
RATANKBA runs the net view /domain and net view commands.
Technique: T1018: Remote System Discovery
ZeroT has used RC4 to encrypt C2 traffic.
Technique: T1573: Encrypted Channel
APT29 used the service control manager on a remote system to disable services associated with security monitoring products.
Technique: T1562: Impair Defenses
CostaBricks has been used to load SombRAT onto a compromised host.
Technique: T1105: Ingress Tool Transfer
Access abuse over an API channel can be difficult to detect even from the service provider end, as the access can still align well with a legitimate workflow.
Technique: T1550: Use Alternate Authentication Material
APT19 collected system architecture information.
Technique: T1082: System Information Discovery
If an attacker has access to a compromised AWS instance, and permissions to list the available container images, they may implant a backdoor such as a Web Shell.
Technique: T1525: Implant Internal Image
Frankenstein has used Word documents that prompts the victim to enable macros and run a Visual Basic script.
Technique: T1059: Command and Scripting Interpreter
* RID 501 is the guest account.
Technique: T1003: OS Credential Dumping
Anchor can download additional payloads.
Technique: T1105: Ingress Tool Transfer
Spark has encoded communications with the C2 server with base64.
Technique: T1132: Data Encoding
In Mac and Linux, this is accomplished with the ps command.
Technique: T1057: Process Discovery
Maze has issued a shutdown command on a victim machine that, upon reboot, will run the ransomware within a VM.
Technique: T1529: System Shutdown/Reboot
Cryptoistic has the ability to send and receive files.
Technique: T1105: Ingress Tool Transfer
SMOKEDHAM has communicated with its C2 servers via HTTPS and HTTP POST requests.
Technique: T1071: Application Layer Protocol
Pteranodon exfiltrates screenshot files to its C2 server.
Technique: T1041: Exfiltration Over C2 Channel
After Comnie collects the remote C2 information, it will communicate with these remote servers using HTTP requests
Technique: T1071: Application Layer Protocol
Briba installs a service pointing to a malicious DLL dropped to disk.
Technique: T1543: Create or Modify System Process
Axiom has been known to dump credentials.
Technique: T1003: OS Credential Dumping
Shamoon obtains the victim's operating system version and keyboard layout and sends the information to the C2 server.
Technique: T1082: System Information Discovery
WannaCry attempts to kill processes associated with Exchange, Microsoft SQL Server, and MySQL to make it possible to encrypt their data stores.
Technique: T1489: Service Stop
This will commonly give an adversary access to systems on the internal network instead of external systems that may be in a DMZ.
Technique: T1189: Drive-by Compromise
KONNI can take screenshots of the victim’s machine.
Technique: T1113: Screen Capture
Silence has weaponized CHM files in their phishing campaigns.
Technique: T1218: Signed Binary Proxy Execution
SeaDuke uses an event filter in WMI code to execute a previously dropped executable shortly after system startup.
Technique: T1546: Event Triggered Execution
Any standard user can use the runas command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account.
Technique: T1134: Access Token Manipulation
Adversaries may supply CMSTP.exe with INF files infected with malicious commands.
Technique: T1218: Signed Binary Proxy Execution
Linux desktop environments that are XDG compliant implement functionality for XDG autostart entries.
Technique: T1547: Boot or Logon Autostart Execution
ABK can extract a malicious Portable Executable  from a photo.
Technique: T1027: Obfuscated Files or Information
TAINTEDSCRIBE can delete files from a compromised host.
Technique: T1070: Indicator Removal on Host
Initial Attack On December 13, 2017, a spear phishing email was sent from the email address of yuri.sidorav@yandex[.]ru to a high ranking individual within a British government agency
Technique: T1566: Phishing
BabyShark has encoded data using certutil before exfiltration.
Technique: T1132: Data Encoding
NOKKI uses a unique, custom de-obfuscation technique.
Technique: T1140: Deobfuscate/Decode Files or Information
Threat actors can use online resources or command-line utilities to pillage through WHOIS data for information about potential victims.
Technique: T1596: Search Open Technical Databases
To enable or disable a specified setting or audit category, adversaries may use the /success or /failure parameters.
Technique: T1562: Impair Defenses
XTunnel relays traffic between a C2 server and a victim.
Technique: T1090: Proxy
Shamoon copies an executable payload to the target system by using SMB/Windows Admin Shares and then scheduling an unnamed task to execute the malware.
Technique: T1053: Scheduled Task/Job
The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Technique: T1120: Peripheral Device Discovery
An adversary may attempt to enumerate the cloud services running on a system after gaining access.
Technique: T1526: Cloud Service Discovery
This technique can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.
Technique: T1574: Hijack Execution Flow
The SP variable is a string containing the victim's username
Technique: T1033: System Owner/User Discovery
Once the extension is installed, it can browse to websites in the background, steal all information that a user enters into a browser  and be used as an installer for a RAT for persistence.
Technique: T1176: Browser Extensions
Bisonal variants reported on in 2014 and 2015 used a simple XOR cipher for C2.
Technique: T1573: Encrypted Channel
Every New Technology File System  formatted partition contains a Master File Table  that maintains a record for every file/directory on the partition.
Technique: T1564: Hide Artifacts
/grant Everyone:F /T /C /Q to make some of its files hidden and grant all users full access controls.
Technique: T1222: File and Directory Permissions Modification
Hi-Zor deletes its RAT installer file as it executes its DLL payload file.
Technique: T1070: Indicator Removal on Host
Pupy can communicate using multiple transports, migrate into processes using reflective injection, and load remote python code, python packages and python C-extensions from memory
Technique: T1055: Process Injection
Gorgon Group malware can deactivate security mechanisms in Microsoft Office by editing several keys and values under HKCU\Software\Microsoft\Office\.
Technique: T1112: Modify Registry
ShimRat has installed a registry based start-up key HKCU\Software\microsoft\windows\CurrentVersion\Run to maintain persistence should other methods fail.
Technique: T1547: Boot or Logon Autostart Execution
Darkhotel has used malware that searched for files with specific patterns.
Technique: T1083: File and Directory Discovery
Therefore, devices may wrongly add or update the MAC address of the IP address in their ARP cache.
Technique: T1557: Adversary-in-the-Middle
APT-C-36 has disguised its scheduled tasks as those used by Google.
Technique: T1036: Masquerading
Drovorub can execute arbitrary commands as root on a compromised system.
Technique: T1059: Command and Scripting Interpreter
Processes running with root privileges can use this facility to scrape live memory of other running programs.
Technique: T1003: OS Credential Dumping
So this method uses psexec itself to copy the payload over the network, overwrite earlier versions (if found), and run it without waiting for any response. They use batch files that leverage psexec , again, to push PowerShell loader scripts out to machines the network scanner finds on the internal network.
Technique: T1059: Command and Scripting Interpreter
RGDoor executes the whoami on the victim’s machine.
Technique: T1033: System Owner/User Discovery
LiteDuke can create persistence by adding a shortcut in the CurrentVersion\Run Registry key.
Technique: T1547: Boot or Logon Autostart Execution
When contact is lost with the primary command and control server malware may employ a DGA as a means to reestablishing command and control.
Technique: T1568: Dynamic Resolution
Truvasys adds a Registry Run key to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
APT29 has used encoded PowerShell commands.
Technique: T1027: Obfuscated Files or Information
Javali has used embedded VBScript to download malicious payloads from C2.
Technique: T1059: Command and Scripting Interpreter
This is attack vector presents interesting problems, as blocking or restricting the use of WMIC may not be a feasible solution for some administrators
Technique: T1047: Windows Management Instrumentation
Valak can execute tasks via OLE.
Technique: T1559: Inter-Process Communication
capture keystrokes
Technique: T1056: Input Capture
WellMail can use TCP for C2 communications.
Technique: T1095: Non-Application Layer Protocol
DustySky contains a keylogger.
Technique: T1056: Input Capture
Silent Librarian has used compromised credentials to obtain unauthorized access to online accounts.
Technique: T1078: Valid Accounts
Remote access tools may be established and used post-compromise as alternate communications channel for redundant access or as a way to establish an interactive remote desktop session with the target system.
Technique: T1219: Remote Access Software
Turla has used WMI event filters and consumers to establish persistence.
Technique: T1546: Event Triggered Execution
Patchwork used Visual Basic Scripts  on victim machines.
Technique: T1059: Command and Scripting Interpreter
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code.
Technique: T1055: Process Injection
APT18 actors leverage legitimate credentials to log into external remote services.
Technique: T1133: External Remote Services
Credentials targeted by PinchDuke include ones associated many sources such as WinInet Credential Cache, and Lightweight Directory Access Protocol .
Technique: T1003: OS Credential Dumping
Metamorfo collects a list of installed antivirus software from the victim’s system.
Technique: T1518: Software Discovery
LoadLibraryExW()
Technique: T1129: Shared Modules
Gold Dragon can download additional components from the C2 server.
Technique: T1105: Ingress Tool Transfer
Also, the x command will delete the generated registry key and the Office365DCOMCheck/SystemDiskClean scheduled task
Technique: T1070: Indicator Removal on Host
Turla has also retrieved PowerShell payloads hidden in Registry keys as well as checking keys associated with null session named pipes .
Technique: T1012: Query Registry
JPIN contains a custom keylogger.
Technique: T1056: Input Capture
Information from these sources may reveal opportunities for other forms of reconnaissance  or Search Open Websites/Domains, establishing operational resources  or Obtain Capabilities, and/or initial access  or Valid Accounts.
Technique: T1597: Search Closed Sources
menuPass has used legitimate access granted to Managed Service Providers in order to access victims of interest.
Technique: T1199: Trusted Relationship
FIN6 has extracted password hashes from ntds.dit to crack offline.
Technique: T1110: Brute Force
Comnie achieves persistence by adding a shortcut of itself to the startup path in the Registry.
Technique: T1547: Boot or Logon Autostart Execution
Maze has decrypted strings and other important information during the encryption process.
Technique: T1027: Obfuscated Files or Information
The decrypted code resolves the necessary API functions, decompresses the embedded PE file with RtlCompressBuffer() using LZNT1 and maps it into memory
Technique: T1140: Deobfuscate/Decode Files or Information
SDBbot has the ability to download a DLL from C2 to a compromised host.
Technique: T1105: Ingress Tool Transfer
Adversaries may execute their own malicious payloads by side-loading DLLs.
Technique: T1574: Hijack Execution Flow
Hildegard has queried the Cloud Instance Metadata API for cloud credentials.
Technique: T1552: Unsecured Credentials
DEL-TEMP Deletes all files in the “AppData/Local/Temp” path
Technique: T1070: Indicator Removal on Host
Filename SHA256 Description   7za.exe dd6d7af00ef4ca89a319a230cdd094275c3a1d365807fe5b34133324bdaa0229 7-Zip 17.01 beta    nbt.exe c9d5dc956841e000bfd8762e2f0b48b66c79b79500e894b4efa7fb9ba17e4e9e nbtscan 1.0.35    rx.exe a6a0fbfee08367046d3d26fb4b4cf7779f7fb6eaf7e60e1d9b6bf31c5be5b63e IntelliAdmin Remote Execute v1.0    Table 5
Technique: T1036: Masquerading
For operations incorporating social engineering, the utilization of a persona on social media may be important.
Technique: T1585: Establish Accounts
GALLIUM has used Taiwan-based servers that appear to be exclusive to GALLIUM.
Technique: T1583: Acquire Infrastructure
Zebrocy executes the reg query command to obtain information in the Registry.
Technique: T1012: Query Registry
BBSRAT can query service configuration information.
Technique: T1007: System Service Discovery
If the adversary has sufficient permissions to establish a new federation trust with their own Active Directory Federation Services  server, they may instead generate their own trusted token-signing certificate.
Technique: T1606: Forge Web Credentials
One variant of CloudDuke uses HTTP and HTTPS for C2.
Technique: T1071: Application Layer Protocol
This may be performed during automated discovery and can be accomplished in numerous ways such as using Ping, tracert, and GET requests to websites.
Technique: T1016: System Network Configuration Discovery
Ursnif has used Registry Run keys to establish automatic execution at system startup.
Technique: T1547: Boot or Logon Autostart Execution
Goopy has the ability to maintain persistence by creating scheduled tasks set to run every hour.
Technique: T1053: Scheduled Task/Job
GoldenSpy constantly attempts to download and execute files from the remote C2, including GoldenSpy itself if not found on the system.
Technique: T1105: Ingress Tool Transfer
BLUELIGHT can harvest cookies from Internet Explorer, Edge, Chrome, and Naver Whale browsers.
Technique: T1539: Steal Web Session Cookie
GRIFFON has used a reconnaissance module that can be used to retrieve information about a victim's computer, including the resolution of the workstation .
Technique: T1082: System Information Discovery
Maintain Presence APT40 primarily uses backdoors, including web shells, to maintain presence within a victim environment
Technique: T1505: Server Software Component
Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions.
Technique: T1104: Multi-Stage Channels
REvil can use WMI to monitor for and kill specific processes listed in its configuration file.
Technique: T1047: Windows Management Instrumentation
Adversaries may search the bash command history on compromised systems for insecurely stored credentials.
Technique: T1552: Unsecured Credentials
For example, in the previous variant of BADNEWS, the victim’s unique identifier was stored under a variable named ‘uid’, the username was stored in a variable named ‘u’, etc
Technique: T1033: System Owner/User Discovery
OilRig has run whoami on a victim.
Technique: T1033: System Owner/User Discovery
HyperBro has used a legitimate application to sideload a DLL to decrypt, decompress, and run a payload.
Technique: T1574: Hijack Execution Flow
LookBack has a function that decrypts malicious data.
Technique: T1140: Deobfuscate/Decode Files or Information
The screenshot also shows the Glimpse server receiving the results of the whoami command executed by the agent
Technique: T1033: System Owner/User Discovery
GravityRAT has a feature to list the available services on the system.
Technique: T1007: System Service Discovery
Also known as public-key cryptography, this requires pairs of cryptographic keys that can encrypt/decrypt data from the corresponding key.
Technique: T1048: Exfiltration Over Alternative Protocol
APT1 has sent spearphishing emails containing malicious attachments.
Technique: T1566: Phishing
UNC2452 used 7-Zip to decode its Raindrop malware.
Technique: T1140: Deobfuscate/Decode Files or Information
By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.
Technique: T1090: Proxy
FakeRun’s PDB string (D:\Work\Project\VS\house\Apple\Apple_20180115\Release\FakeRun.pdb) indicates the loader will execute dllhost.exe and inject one malicious DLL file, which is the backdoor, into this process
Technique: T1055: Process Injection
Cobalt Group used a JavaScript backdoor that is capable of collecting a list of the security solutions installed on the victim's machine.
Technique: T1518: Software Discovery
Adversaries may search websites owned by the victim for information that can be used during targeting.
Technique: T1594: Search Victim-Owned Websites
This malicious code in the bootloader provides the capability of direct memory manipulation to the adversary, allowing them to patch the live operating system during runtime.
Technique: T1601: Modify System Image
For instance, the downloader will first attempt to communicate with its C2 server using an HTTPS request
Technique: T1071: Application Layer Protocol
Process doppelgänging's use of TxF also avoids the use of highly-monitored API functions such as NtUnmapViewOfSection, VirtualProtectEx, and SetThreadContext.
Technique: T1055: Process Injection
Pysa has deleted batch files after execution.
Technique: T1070: Indicator Removal on Host
InvisiMole has used rundll32.exe for execution.
Technique: T1218: Signed Binary Proxy Execution
APT41 used the WMIEXEC utility to execute whoami commands on remote machines.
Technique: T1033: System Owner/User Discovery
APT39 used secure shell  to move laterally among their targets.
Technique: T1021: Remote Services
Cardinal RAT can communicate over multiple C2 host and port combinations.
Technique: T1008: Fallback Channels
gh0st RAT can load DLLs into memory.
Technique: T1129: Shared Modules
Lazarus Group has rebooted systems after destroying files and wiping the MBR on infected systems.
Technique: T1529: System Shutdown/Reboot
Chimera has used PowerShell scripts to execute malicious payloads and the DSInternals PowerShell module to make use of Active Directory features.
Technique: T1059: Command and Scripting Interpreter
Adversaries may abuse a container administration service to execute commands within a container.
Technique: T1609: Container Administration Command
APT32 used the net view command to show all shares available, including the administrative shares such as C$ and ADMIN$.
Technique: T1135: Network Share Discovery
High Commissioner of Bangladesh Pakistan eying Sukhoi-35 fighter planes as part of defense deal from Russia 2018.143 PG COURSE IN 2018-2021 BATCH India Bangladesh and Pakistan Press Release on Observance of Historic Mujibnogor Dibosh by Pakistan Mission on 17 April 2018 Afghan Bomb Blast report by ISI USAJOBS Daily Saved Search Results for New GS15 for 3/30/2018 How Rigging take place in Senate Elections in Pakistan Afghan Terrorist group details ISI Restricted113 1971 Liberation War Freedom Fighters in Pakistan Army Custody Database  Additionally, the following filenames were witnessed in these attacks (spelling and grammar mistakes included):  Liberation Freedom Fighter.xlam NSC details of participants.xlam Raw Sect Vikram report on Pak Army Confidential.doc USA Immagration Policy for Families.ppam doc CV FM.doc doc Sukhoi35 deal report.doc Nominal Roll.doc Press Release 17 April.doc Afghan Blast report by ISI.doc Rigging in Pakistan Senate.doc Afghan Terrorist group report.doc    The payloads for these attacks varied in malware family
Technique: T1083: File and Directory Discovery
TeamTNT has used SSH to connect back to victim machines.
Technique: T1021: Remote Services
RTM has the capability to download a VNC module from command and control .
Technique: T1219: Remote Access Software
Stuxnet uses a driver to scan for specific filesystem driver objects.
Technique: T1083: File and Directory Discovery
When a program is executed, the shim cache is referenced to determine if the program requires the use of the shim database .
Technique: T1546: Event Triggered Execution
Command-line examples:
* msxsl.exe customers.xml script.xsl
* msxsl.exe script.xsl script.xsl
* msxsl.exe script.jpeg script.jpeg
Another variation of this technique, dubbed “Squiblytwo”, involves using Windows Management Instrumentation to invoke JScript or VBScript within an XSL file.
Technique: T1220: XSL Script Processing
Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona.
Technique: T1586: Compromise Accounts
PoetRAT has used HTTP and HTTPs for C2 communications.
Technique: T1071: Application Layer Protocol
Adversaries attempt to take advantage of a trusted internal account to increase the likelihood of tricking the target into falling for the phish attempt.
Technique: T1534: Internal Spearphishing
Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise.
Technique: T1195: Supply Chain Compromise
APT32 has deployed tools after moving laterally using administrative accounts.
Technique: T1570: Lateral Tool Transfer
Bazar can implement DGA using the current date as a seed variable.
Technique: T1568: Dynamic Resolution
load additional modules
Technique: T1129: Shared Modules
APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.
Technique: T1560: Archive Collected Data
Cobalt Strike can use a custom command and control protocol that can be encapsulated in HTTP or HTTPS.
Technique: T1071: Application Layer Protocol
In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Technique: T1091: Replication Through Removable Media
Kimsuky has staged collected data files under C:\Program Files\Common Files\System\Ole DB\.
Technique: T1074: Data Staged
Chimera has used Google Cloud's appspot service to host C2 servers.
Technique: T1102: Web Service
Gathering this information may reveal opportunities for other forms of reconnaissance  or Search Open Technical Databases, establishing operational resources  or Obtain Capabilities, and/or initial access  or Exploit Public-Facing Application.
Technique: T1592: Gather Victim Host Information
Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors , packers, C2 protocols, and the creation of infected removable media.
Technique: T1587: Develop Capabilities
For example, an adversary may send 10Gbps of traffic to a server that is hosted by a network with a 1Gbps connection to the internet.
Technique: T1498: Network Denial of Service
System owners are also advised to run the YARA tool on any system they suspect to have been targeted by HIDDEN COBRA actors
Technique: T1082: System Information Discovery
SLOTHFULMEDIA has downloaded files onto a victim machine.
Technique: T1105: Ingress Tool Transfer
Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables.
Technique: T1547: Boot or Logon Autostart Execution
MarkiRAT can search for different processes on a system.
Technique: T1057: Process Discovery
RainyDay can download files to a compromised host.
Technique: T1105: Ingress Tool Transfer
Crimson contains a command to collect the victim PC name, disk drive information, and operating system.
Technique: T1082: System Information Discovery
It then reads and decrypts the content between these values to yield an IP address as shown below:       ---- BEGIN SSH2 PUBLIC KEY ----Comment: "rsa-key"AAAAB3NzaC1yc2EAAAABJQAAAQEAhLxZe4Qli9xt/WknQK9CDLWubpgknZ0HIHSd8uV/TJvLsRkjpV+U/tMiMxjDwLAHVtNcww2h8bXTtw387M2Iv/mJjQ9Lv3BdNiM3/KvmlpeJZrrFu2n5UC9=DZKSDAAADOECEDFDOCCDEDIDOCIDEDOCHDDZJS=oT+Ps8wD4f0NBUtDdEdXhWp3nxv/mJjQ9Lv3BCFDBd09UZzLrfBO1S0nxrHsxlJ+bPaJE2Q/oxLXTrpeJ6AHyLyeUaBha3q9niJ=---- END SSH2 PUBLIC KEY ----     A Python script to decode strings encrypted with this technique is given in Appendix B – Python Scripts
Technique: T1140: Deobfuscate/Decode Files or Information
UPPERCUT has the capability to gather the victim's current directory.
Technique: T1083: File and Directory Discovery
FIN8's malicious spearphishing payloads use WMI to launch malware and spawn cmd.exe execution.
Technique: T1047: Windows Management Instrumentation
Metamorfo has been delivered to victims via emails with malicious HTML attachments.
Technique: T1566: Phishing
Metamorfo has collected the hostname and operating system version from the compromised host.
Technique: T1082: System Information Discovery
Turla attempted to trick targets into clicking on a link featuring a seemingly legitimate domain from Adobe.com to download their malware and gain initial access.
Technique: T1566: Phishing
Adversaries may also use information from previous reconnaissance efforts  or Search Victim-Owned Websites to craft persuasive and believable lures.
Technique: T1598: Phishing for Information
Molerats has created scheduled tasks to persistently run VBScripts.
Technique: T1053: Scheduled Task/Job
Malicious Macro Analysis When the victim opens the ThreeDollars document they are presented with the lure image and prompted to click on the “Enable Content” button
Technique: T1204: User Execution
APT-C-36 has used ConfuserEx to obfuscate its variant of Imminent Monitor, compressed payload and RAT packages, and password protected encrypted email attachments to avoid detection.
Technique: T1027: Obfuscated Files or Information
The PowerShell script with the RogueRobin payload was obfuscated using the COMPRESS technique in Invoke-Obfuscation.
Technique: T1027: Obfuscated Files or Information
Dragonfly 2.0 used various types of scripting to perform operations, including Python scripts.
Technique: T1059: Command and Scripting Interpreter
A version of PlugX loads as shellcode within a .NET Framework project using msbuild.exe, presumably to bypass application whitelisting techniques.
Technique: T1127: Trusted Developer Utilities Proxy Execution
Leviathan has used BITSAdmin to download additional tools.
Technique: T1197: BITS Jobs
Ryuk has used the C$ network share for lateral movement.
Technique: T1021: Remote Services
SID-History 
Technique: T1134: Access Token Manipulation
RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence.
Technique: T1547: Boot or Logon Autostart Execution
TA551 has used obfuscated variable names in a JavaScript configuration file.
Technique: T1027: Obfuscated Files or Information
In one example, BRONZE UNION actors leveraged initial web shell access on Internet-facing systems to conduct internal reconnaissance, including domain enumeration and network state, via ipconfig, net use, net user, and net view commands
Technique: T1018: Remote System Discovery
Emotet has been observed using a hard coded list of passwords to brute force user accounts.
Technique: T1110: Brute Force
Xbash can execute malicious JavaScript payloads on the victim’s machine.
Technique: T1059: Command and Scripting Interpreter
ADVSTORESHELL collects, compresses, encrypts, and exfiltrates data to the C2 server every 10 minutes.
Technique: T1029: Scheduled Transfer
APT29 has used various forms of spearphishing attempting to get a user to open attachments, including, but not limited to, malicious Microsoft Word documents, .pdf, and .lnk files.
Technique: T1204: User Execution
Adversaries may seek information about their already identified targets, or use these datasets to discover opportunities for successful breaches.
Technique: T1596: Search Open Technical Databases
Cobian RAT has a feature to access the webcam on the victim’s machine.
Technique: T1125: Video Capture
Zeus Panda checks to see if anti-virus, anti-spyware, or firewall products are installed in the victim’s environment.
Technique: T1518: Software Discovery
Loadable Kernel Modules  are pieces of code that can be loaded and unloaded into the kernel upon demand.
Technique: T1547: Boot or Logon Autostart Execution
Rancor has used msiexec to download and execute malicious installer files over HTTP.
Technique: T1218: Signed Binary Proxy Execution
The actors have made some small changes, such as altering the variable names to avoid Yara detection
Technique: T1027: Obfuscated Files or Information
Pteranodon can execute commands on the victim.
Technique: T1059: Command and Scripting Interpreter
There are multiple ways to access the Task Scheduler in Windows.
Technique: T1053: Scheduled Task/Job
FIN8 has also used PowerShell for lateral movement and credential access.
Technique: T1059: Command and Scripting Interpreter
COM is a system within Windows to enable interaction between software components through the operating system.
Technique: T1546: Event Triggered Execution
Fox Kitten has used the open source reverse proxy tools including FRPC and Go Proxy to establish connections from C2 to local servers.
Technique: T1090: Proxy
Hardware checks, such as the presence of the fan, temperature, and audio devices, could also be used to gather evidence that can be indicative a virtual environment.
Technique: T1497: Virtualization/Sandbox Evasion
njRAT gathers information about opened windows during the initial infection.
Technique: T1010: Application Window Discovery
Clop can use cmd.exe to help execute commands on the system.
Technique: T1059: Command and Scripting Interpreter
Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.
Technique: T1584: Compromise Infrastructure
Metamorfo has written process names to the Registry, disabled IE browser features, deleted Registry keys, and changed the ExtendedUIHoverTime key.
Technique: T1112: Modify Registry
HotCroissant has the ability to list running processes on the infected host.
Technique: T1057: Process Discovery
The PCODE of the virtual machine is packed with the aplib packer
Technique: T1027: Obfuscated Files or Information
Adversaries may list credentials managed by the Windows Credential Manager through several mechanisms.
Technique: T1555: Credentials from Password Stores
Astaroth uses JavaScript to perform its core functionalities.
Technique: T1059: Command and Scripting Interpreter
To obtain strings to treat as commands, the payload will issue a series of DNS queries to resolve domains with the following structure: <system id>-<job ID>-<offset data specific to job>.<c2 domain> The C2 server will provide responses to these queries that contain answers in IPv4 or IPv6 addresses depending on the type of DNS query the payload uses to communicate with its C2 server
Technique: T1071: Application Layer Protocol
Avaddon has enumerated shared folders and mapped volumes.
Technique: T1135: Network Share Discovery
FIN7 has performed C2 using DNS via A, OPT, and TXT records.
Technique: T1071: Application Layer Protocol
By modifying an authentication process, an adversary may be able to authenticate to a service or system without using Valid Accounts.
Technique: T1556: Modify Authentication Process
When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history.
Technique: T1070: Indicator Removal on Host
Amazon Web Services  Amazon Machine Images , Google Cloud Platform  Images, and Azure Images as well as popular container runtimes such as Docker can be implanted or backdoored.
Technique: T1525: Implant Internal Image
TSCookie has the ability to list processes on the infected host.
Technique: T1057: Process Discovery
BRONZE BUTLER has used VBS and VBE scripts for execution.
Technique: T1059: Command and Scripting Interpreter
XAgentOSX contains the readFiles function to return a detailed listing  of a specified directory.
Technique: T1083: File and Directory Discovery
Chimera has used a valid account to maintain persistence via scheduled task.
Technique: T1078: Valid Accounts
APT18 can list files information for specific directories.
Technique: T1083: File and Directory Discovery
Frankenstein has used WMI queries to check if various security applications were running, as well as the operating system version.
Technique: T1047: Windows Management Instrumentation
IcedID has the ability to download additional modules and a configuration file from C2.
Technique: T1105: Ingress Tool Transfer
EnvyScout contains JavaScript code that can extract an encoded blob from its HTML body and write it to disk.
Technique: T1027: Obfuscated Files or Information
Dtrack’s RAT makes a persistent target file with auto execution on the host start.
Technique: T1547: Boot or Logon Autostart Execution
Prikormka contains a module that captures screenshots of the victim's desktop.
Technique: T1113: Screen Capture
As we can see, the following information is present within this configuration:  Remote Command and Control (C2) server Remote port Sleep timer  Reaver continues to collect various information from the victim machine, including the following:  CPU speed Computer name Username IP Address Microsoft Windows version Physical and virtual memory information  The malware proceeds to communicate with the remote server via HTTP GET and POST requests
Technique: T1082: System Information Discovery
To decrypt the commands, an investigator would need access to the intended malware sample, the day's tweet, and the image file containing the command.
Technique: T1573: Encrypted Channel
Cobalt Strike can query shared drives on the local system.
Technique: T1135: Network Share Discovery
In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server  Web shell client.
Technique: T1505: Server Software Component
Patchwork has used spearphishing with an attachment to deliver files with exploits to initial victims.
Technique: T1566: Phishing
Kimsuky has used a Mac OS Python implant to gather data.
Technique: T1059: Command and Scripting Interpreter
Ferocious Kitten has obtained open source tools for its operations, including JsonCPP and Psiphon.
Technique: T1588: Obtain Capabilities
Agent.btz saves system information into an XML file that is then XOR-encoded.
Technique: T1560: Archive Collected Data
Mis-Type network traffic can communicate over a raw socket.
Technique: T1095: Non-Application Layer Protocol
China Chopper's server component can download remote files.
Technique: T1105: Ingress Tool Transfer
TrickBot uses HTTPS to communicate with its C2 servers, to get malware updates, modules that perform most of the malware logic and various configuration files.
Technique: T1071: Application Layer Protocol
A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.
Technique: T1059: Command and Scripting Interpreter
Derusbi is capable of deleting files.
Technique: T1070: Indicator Removal on Host
This means that, for example, the sudo timeout of one tty will not affect another tty .
Technique: T1548: Abuse Elevation Control Mechanism
Security audit policy settings can be changed by running secpol.msc, then navigating to Security Settings\Local Policies\Audit Policy for basic audit policy settings or Security Settings\Advanced Audit Policy Configuration for advanced audit policy settings.
Technique: T1562: Impair Defenses
A Patchwork file stealer can run a TaskScheduler DLL to add persistence.
Technique: T1053: Scheduled Task/Job
BLINDINGCAN has collected the victim machine's local IP address information and MAC address.
Technique: T1016: System Network Configuration Discovery
APT32 has used PubPrn.vbs within execution scripts to execute malware, possibly bypassing defenses.
Technique: T1216: Signed Script Proxy Execution
Adversaries may gather information about the victim's business tempo that can be used during targeting.
Technique: T1591: Gather Victim Org Information
This function is able to obfuscate code so that every iteration of the code is presented differently
Technique: T1140: Deobfuscate/Decode Files or Information
Fox Kitten has used prodump to dump credentials from LSASS.
Technique: T1003: OS Credential Dumping
A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, etc.
Technique: T1584: Compromise Infrastructure
UNC2452 added credentials to OAuth Applications and Service Principals.
Technique: T1098: Account Manipulation
Honeybee uses FTP for command and control.
Technique: T1071: Application Layer Protocol
Indrik Spider used PsExec to leverage Windows Defender to disable scanning of all downloaded files and to restrict real-time monitoring.
Technique: T1562: Impair Defenses
APT29 then created a WMI event subscription in order to execute the backdoor
Technique: T1047: Windows Management Instrumentation
Nebulae can discover logical drive information including the drive type, free space, and volume information.
Technique: T1082: System Information Discovery
FIN7's Harpy backdoor malware can use DNS as a backup channel for C2 if HTTP fails.
Technique: T1008: Fallback Channels
RegDuke can download files from C2.
Technique: T1105: Ingress Tool Transfer
ShadowPad uses a DGA that is based on the day of the month for C2 servers.
Technique: T1568: Dynamic Resolution
Night Dragon has used several remote administration tools as persistent infiltration channels.
Technique: T1219: Remote Access Software
SMOKEDHAM has used the systeminfo command on a compromised host.
Technique: T1082: System Information Discovery
InvisiMole can disconnect previously connected remote drives.
Technique: T1070: Indicator Removal on Host
RegDuke can use control-flow flattening or the commercially available .NET Reactor for obfuscation.
Technique: T1027: Obfuscated Files or Information
TeamTNT has queried the AWS instance metadata service for credentials.
Technique: T1552: Unsecured Credentials
QakBot can use PowerShell to download and execute payloads.
Technique: T1059: Command and Scripting Interpreter
After obtaining a digital certificate, an adversary may then install that certificate  on infrastructure under their control.
Technique: T1588: Obtain Capabilities
It is capable of the following functions:  Collect file/folder/drive information Download files and additional malware Launch/terminate/enumerate process Update configuration data Delete files Inject code from files to other running process Utilize proxy Open reverse shell Run in passive mode — instead of actively connecting to the command and control (C&C) server, the backdoor will open and listen to a port then receive commands through it  Once the backdoor is loaded, it will then load the encrypted configuration file Auditcred.dll.mui/rOptimizer.dll.mui to extract the C&C information and connect to it
Technique: T1055: Process Injection
Turla RPC backdoors can upload files from victim machines.
Technique: T1005: Data from Local System
VNC 
Technique: T1219: Remote Access Software
Attor can set attributes of log files and directories to HIDDEN, SYSTEM, ARCHIVE, or a combination of those.
Technique: T1564: Hide Artifacts
PlugX can be added as a service to establish persistence.
Technique: T1543: Create or Modify System Process
Agent Tesla has used wmi queries to gather information from the system.
Technique: T1047: Windows Management Instrumentation
SombRAT can SSL encrypt C2 traffic.
Technique: T1573: Encrypted Channel
Darkhotel has used code-signing certificates on its malware that are either forged due to weak keys or stolen.
Technique: T1553: Subvert Trust Controls
BlackEnergy has gathered information about network IP configurations using ipconfig.exe and about routing tables using route.exe.
Technique: T1016: System Network Configuration Discovery
PittyTiger has obtained and used tools such as Mimikatz and gsecdump.
Technique: T1588: Obtain Capabilities
FatDuke has used HKLM\SOFTWARE\Microsoft\CurrentVersion\Run to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
AuditCred can download files and additional malware.
Technique: T1105: Ingress Tool Transfer