HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
APT3 obfuscates files or information to help evade defensive measures.
Technique: T1027: Obfuscated Files or Information
Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Technique: T1136: Create Account
This technique allows them to map network resources and make lateral movements inside the network, landing in the perfect machine to match the attacker’s interest
Technique: T1018: Remote System Discovery
Bankshot decodes embedded XOR strings.
Technique: T1140: Deobfuscate/Decode Files or Information
COM is an inter-process communication  component of the native Windows application programming interface  that enables interaction between software objects, or executable code that implements one or more interfaces.
Technique: T1559: Inter-Process Communication
Attor's dispatcher can inject itself into running processes to gain higher privileges and to evade detection.
Technique: T1055: Process Injection
Upon first execution of TONEDEAF, FireEye identified a callback to the C2 server offlineearthquake[.]com over port 80.
Technique: T1571: Non-Standard Port
Adversaries may perform different forms of active scanning depending on what information they seek to gather.
Technique: T1595: Active Scanning
VaporRage can deobfuscate XOR-encoded shellcode prior to execution.
Technique: T1140: Deobfuscate/Decode Files or Information
KGH_SPY can send a file containing victim system information to C2.
Technique: T1005: Data from Local System
In the event this is successful the malware will use the following path to store any dropped files:  %COMMONPROGRAMFILES%\services\  In the event it is not successful, this alternative path will be used instead:  %APPDATA%\microsoft\mmc\  It proceeds to load and decrypt and embedded bitmap resource file
Technique: T1140: Deobfuscate/Decode Files or Information
Kinsing has used crontab to download and run shell scripts every minute to ensure persistence.
Technique: T1053: Scheduled Task/Job
An adversary can leverage a computer's peripheral devices  or applications  to capture audio recordings for the purpose of listening into sensitive conversations to gather information.
Technique: T1123: Audio Capture
OwaAuth uses incoming HTTP requests with a username keyword and commands and handles them as instructions to perform actions.
Technique: T1071: Application Layer Protocol
T9000 uses the Skype API to record audio and video calls.
Technique: T1123: Audio Capture
Xbash has destroyed Linux-based databases as part of its ransomware capabilities.
Technique: T1485: Data Destruction
TEMP.Veles has used Mimikatz and a custom tool, SecHack, to harvest credentials.
Technique: T1003: OS Credential Dumping
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
Technique: T1505: Server Software Component
Agent Tesla can collect the username from the victim’s machine.
Technique: T1033: System Owner/User Discovery
LoudMiner used SCP to update the miner from the C2.
Technique: T1105: Ingress Tool Transfer
SynAck enumerates Registry keys associated with event logs.
Technique: T1012: Query Registry
Vasport is capable of tunneling though a proxy.
Technique: T1090: Proxy
Zeroaccess is a kernel-mode rootkit.
Technique: T1014: Rootkit
Bazar can also check if the Russian language is installed on the infected machine and terminate if it is found.
Technique: T1082: System Information Discovery
Gathering this information may reveal opportunities for other forms of reconnaissance  or Search Open Websites/Domains, establishing operational resources  or Compromise Accounts, and/or initial access , Drive-by Compromise, or Trusted Relationship.
Technique: T1591: Gather Victim Org Information
Xbash can perform port scanning of TCP and UDP ports.
Technique: T1046: Network Service Scanning
StrongPity can exfiltrate collected documents through C2 channels.
Technique: T1041: Exfiltration Over C2 Channel
Tools used by Gamaredon Group are capable of downloading and executing additional payloads.
Technique: T1105: Ingress Tool Transfer
They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary controlled system.
Technique: T1219: Remote Access Software
Attor can obtain application window titles and then determines which windows to perform Screen Capture on.
Technique: T1010: Application Window Discovery
Password spraying uses one password , or a small list of commonly used passwords, that may match the complexity policy of the domain.
Technique: T1110: Brute Force
S-Type primarily uses port 80 for C2, but falls back to ports 443 or 8080 if initial communication fails.
Technique: T1008: Fallback Channels
Valak has the ability to exfiltrate data over the C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
PlugX has a module to list the processes running on a machine.
Technique: T1057: Process Discovery
Kasidet has the ability to identify any anti-virus installed on the infected system.
Technique: T1518: Software Discovery
APT32 malware has injected a Cobalt Strike beacon into Rundll32.exe.
Technique: T1055: Process Injection
SHARPSTATS has the ability to identify the domain of the compromised host.
Technique: T1016: System Network Configuration Discovery
HyperStack can use default credentials to connect to IPC$ shares on remote machines.
Technique: T1078: Valid Accounts
Group123 Links?  As we explore the Korean malware landscape, we always have burning questions relating to any possible links with Group123
Technique: T1566: Phishing
Maze has used the "WNetOpenEnumW", "WNetEnumResourceW”, “WNetCloseEnum” and “WNetAddConnection2W” functions to enumerate the network resources on the infected machine.
Technique: T1049: System Network Connections Discovery
Bandook has used malicious VBA code against the target system.
Technique: T1059: Command and Scripting Interpreter
SUNSPOT created a copy of the SolarWinds Orion software source file with a .bk extension to backup the original content, wrote SUNBURST using the same filename but with a .tmp extension, and then moved SUNBURST using MoveFileEx to the original filename with a .cs extension so it could be compiled within Orion software.
Technique: T1565: Data Manipulation
Silence has used Winexe to install a service on the remote system.
Technique: T1569: System Services
Cryptoistic can scan a directory to identify files for deletion.
Technique: T1083: File and Directory Discovery
Net can be used to query a remote system for available shared drives using the net view \\\\remotesystem command.
Technique: T1135: Network Share Discovery
According to the server’s code, the default command that it would issue to newly infected systems was a batch script contained in a file named 0000000000.bat
Technique: T1059: Command and Scripting Interpreter
njRAT has added persistence via the Registry key HKCU\Software\Microsoft\CurrentVersion\Run\ and dropped a shortcut in %STARTUP%.
Technique: T1547: Boot or Logon Autostart Execution
The DustySky dropper uses a function to obfuscate the name of functions and other parts of the malware.
Technique: T1027: Obfuscated Files or Information
WinMM uses NetUser-GetInfo to identify that it is running under an “Admin” account on the local system.
Technique: T1033: System Owner/User Discovery
Duqu has used msiexec to execute malicious Windows Installer packages.
Technique: T1218: Signed Binary Proxy Execution
RainyDay can use proxy tools including boost_proxy_client for reverse proxy functionality.
Technique: T1090: Proxy
HARDRAIN opens the Windows Firewall to modify incoming connections.
Technique: T1562: Impair Defenses
64)   u= {B5B70BD7-87FC-499A-B4D1- 98163306F0D8} A GUID   r= 1 Boolean value if the malware is running as injected code   t= 8035187 Number of milliseconds the computer has been running    Table 3
Technique: T1055: Process Injection
Clop can enumerate network shares.
Technique: T1135: Network Share Discovery
PLATINUM has used keyloggers that are also capable of dumping credentials.
Technique: T1003: OS Credential Dumping
If this file is renamed to evil.txt, then when double clicked by a user, it will launch with the default text editing application .
Technique: T1036: Masquerading
ComRAT has used a portable FAT16 partition image placed in %TEMP% as a hidden file system.
Technique: T1564: Hide Artifacts
PlugX adds Run key entries in the Registry to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
CookieMiner has used the curl --upload-file command to exfiltrate data over HTTP.
Technique: T1048: Exfiltration Over Alternative Protocol
Fox Kitten has used cmd.exe likely as a password changing mechanism.
Technique: T1059: Command and Scripting Interpreter
If a match if found, SynAck sleeps for 300 seconds and then exits without encrypting files.
Technique: T1614: System Location Discovery
Bazar has manually loaded ntdll from disk in order to identity and remove API hooks set by security products.
Technique: T1562: Impair Defenses
Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion.
Technique: T1090: Proxy
An adversary may utilize Private Keys to compromise an organization's token-signing certificate to create forged SAML tokens.
Technique: T1606: Forge Web Credentials
The DOC file contains an embedded OLE Object that, upon execution, triggers the download of an additional DOC file from the stored URL (seen in Figure 3)
Technique: T1105: Ingress Tool Transfer
Avenger can identify the domain of the compromised host.
Technique: T1016: System Network Configuration Discovery
FIN4 has used VBA macros to display a dialog box and collect victim credentials.
Technique: T1059: Command and Scripting Interpreter
Adversaries may use traffic duplication in conjunction with Network Sniffing, Input Capture, or Adversary-in-the-Middle depending on the goals and objectives of the adversary.
Technique: T1020: Automated Exfiltration
XTunnel is capable of downloading additional files.
Technique: T1105: Ingress Tool Transfer
Adversaries can use common management tools and protocols, such as Simple Network Management Protocol  and Smart Install , to access network configuration files.
Technique: T1602: Data from Configuration Repository
Anchor has obsuscated code with stack strings and string encryption.
Technique: T1027: Obfuscated Files or Information
Blue Mockingbird has collected hardware details for the victim's system, including CPU and memory information.
Technique: T1082: System Information Discovery
Fox Kitten has exploited known vulnerabilities in remote services including RDP.
Technique: T1210: Exploitation of Remote Services
IIS provides several mechanisms to extend the functionality of the web servers.
Technique: T1505: Server Software Component
In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain.
Technique: T1098: Account Manipulation
Breaching these devices may enable an adversary to bypass restrictions on traffic routing that otherwise separate trusted and untrusted networks.
Technique: T1599: Network Boundary Bridging
StrongPity has used HTTPS over port 1402 in C2 communication.
Technique: T1571: Non-Standard Port
Users typically interact with code repositories through a web application or command-line utilities such as git.
Technique: T1213: Data from Information Repositories
WindTail has the ability to use the macOS built-in zip utility to archive files.
Technique: T1560: Archive Collected Data
Variants of Emissary have used rundll32.exe in Registry values added to establish persistence.
Technique: T1218: Signed Binary Proxy Execution
The malicious modules in regsvr32.exe memory After the Irdsnhrxxxfery98 module is loaded, the malware searches different processes to continue its malicious activity depending on the way Irdsnhrxxxfery64 was loaded
Technique: T1218: Signed Binary Proxy Execution
Kobalos can spawn a new pseudo-terminal and execute arbitrary commands at the command prompt.
Technique: T1059: Command and Scripting Interpreter
Information about network topologies may include a variety of details, including the physical and/or logical arrangement of both external-facing and internal network environments.
Technique: T1590: Gather Victim Network Information
Side-loading takes advantage of the DLL search order used by the loader by positioning both the victim application and malicious payload alongside each other.
Technique: T1574: Hijack Execution Flow
Grandoreiro can use malicious browser extensions to steal cookies and other user information.
Technique: T1176: Browser Extensions
The adversary may reply with their MAC address, thus deceiving the victim by making them believe that they are communicating with the intended networked device.
Technique: T1557: Adversary-in-the-Middle
PS1 is distributed as a set of encrypted files and scripts.
Technique: T1027: Obfuscated Files or Information
Kessel has maliciously altered the OpenSSH binary on targeted systems to create a backdoor.
Technique: T1554: Compromise Client Software Binary
It has also used the Registry entry HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run vpdn “%ALLUSERPROFILE%\%APPDATA%\vpdn\VPDN_LU.exe” to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
TajMahal has the ability to identify running processes and associated plugins on an infected host.
Technique: T1057: Process Discovery
Adversaries may inject dynamic-link libraries  into processes in order to evade process-based defenses as well as possibly elevate privileges.
Technique: T1055: Process Injection
FIN5 has cleared event logs from victims.
Technique: T1070: Indicator Removal on Host
Adversaries may create and cultivate accounts with services that can be used during targeting.
Technique: T1585: Establish Accounts
With most embedded devices, this can be achieved by downloading a copy of the desired version of the operating system file and reconfiguring the device to boot from that file on next system restart.
Technique: T1601: Modify System Image
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities.
Technique: T1560: Archive Collected Data
Stuxnet infects remote servers via network shares and by infecting WinCC database views with malicious code.
Technique: T1080: Taint Shared Content
Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors.
Technique: T1547: Boot or Logon Autostart Execution
An APT28 loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.
Technique: T1218: Signed Binary Proxy Execution
Brave Prince gathers network configuration information as well as the ARP cache.
Technique: T1016: System Network Configuration Discovery
XCSSET adds malicious file paths to the DYLD_FRAMEWORK_PATH and DYLD_LIBRARY_PATH environment variables to execute malicious code.
Technique: T1574: Hijack Execution Flow
With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale Phishing or Distributed Denial of Service .
Technique: T1583: Acquire Infrastructure
Cobian RAT has a feature to perform voice recording on the victim’s machine.
Technique: T1123: Audio Capture
An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds.
Technique: T1030: Data Transfer Size Limits
These events cannot start applications remotely , but they can interact with applications if they're already running remotely.
Technique: T1059: Command and Scripting Interpreter
KillDisk retrieves the hard disk name by calling the CreateFileA to \\.\PHYSICALDRIVE0 API.
Technique: T1082: System Information Discovery
In cloud environments, adversaries may leverage access to delete cloud storage, cloud storage accounts, machine images, and other infrastructure crucial to operations to damage an organization or their customers.
Technique: T1485: Data Destruction
Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware.
Technique: T1587: Develop Capabilities
Sandworm Team added a login to a SQL Server with sp_addlinkedsrvlogin.
Technique: T1136: Create Account
To move laterally on a victim network, FIN6 has used credentials stolen from various systems on which it gathered usernames and password hashes.
Technique: T1078: Valid Accounts
Chimera has used side loading to place malicious DLLs in memory.
Technique: T1574: Hijack Execution Flow
SLOTHFULMEDIA has the capability to start services.
Technique: T1569: System Services
jRAT can capture passwords from common web browsers such as Internet Explorer, Google Chrome, and Firefox.
Technique: T1555: Credentials from Password Stores
Next, it will copy the first stage shellcode in memory and create a new thread with the shellcode running in it, the code responsible for this execution is shown in Figure 1
Technique: T1059: Command and Scripting Interpreter
Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry.
Technique: T1612: Build Image on Host
MacSpy can capture screenshots of the desktop over multiple monitors.
Technique: T1113: Screen Capture
LockerGoga has been observed deleting its original launcher after execution.
Technique: T1070: Indicator Removal on Host
This execution would take place anytime netsh.exe is executed, which could happen automatically, with another persistence technique, or if other software  is present on the system that executes netsh.exe as part of its normal functionality.
Technique: T1546: Event Triggered Execution
PowerDuke has commands to get the current directory name as well as the size of a file.
Technique: T1083: File and Directory Discovery
The config file provides download instructions for the loader
Technique: T1105: Ingress Tool Transfer
The SHAPESHIFT malware is capable of wiping disks, erasing volumes and deleting files, depending on its configuration
Technique: T1070: Indicator Removal on Host
Dridex has encrypted traffic with RC4.
Technique: T1573: Encrypted Channel
Once successfully installed in a system, Trickbot will gather system information such as OS, CPU, and memory information, user accounts, lists of installed programs and services.
Technique: T1082: System Information Discovery
Drovorub can use TCP to communicate between its agent and client modules.
Technique: T1095: Non-Application Layer Protocol
APT32 have replaced Microsoft Outlook's VbaProject.OTM file to install a backdoor macro for persistence.
Technique: T1137: Office Application Startup
Fysbis has used the command ls /etc | egrep -e"fedora\*|debian\*|gentoo\*|mandriva\*|mandrake\*|meego\*|redhat\*|lsb-\*|sun-\*|SUSE\*|release" to determine which Linux OS version is running.
Technique: T1082: System Information Discovery
HAFNIUM has acquired web services for use in C2 and exfiltration.
Technique: T1583: Acquire Infrastructure
It will terminate execution if it detects LANG_RUSSIAN, LANG_BELARUSIAN, LANG_KAZAK, or LANG_UKRAINIAN.
Technique: T1614: System Location Discovery
Encryption can be used to protect transmitted network traffic to maintain its confidentiality  and integrity .
Technique: T1600: Weaken Encryption
Aria-body has used ZIP to compress data gathered on a compromised host.
Technique: T1560: Archive Collected Data
Similar to hijacking SIP’s CryptSIPDllVerifyIndirectData function, this value can be redirected to a suitable exported function from an already present DLL or a maliciously-crafted DLL .
Technique: T1553: Subvert Trust Controls
APT32 has hosted malicious payloads in Dropbox, Amazon S3, and Google Drive for use during targeting.
Technique: T1608: Stage Capabilities
Kimsuky has compromised email accounts to send spearphishing e-mails.
Technique: T1586: Compromise Accounts
Adversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots.
Technique: T1547: Boot or Logon Autostart Execution
Threat actors compromise a website used by their target demographic (e.g., compromising a website specializing in oil and gas industry news when targeting the energy vertical)
Technique: T1189: Drive-by Compromise
TA505 has used msiexec to download and execute malicious Windows Installer files.
Technique: T1218: Signed Binary Proxy Execution
BoxCaon has used DropBox for C2 communications.
Technique: T1102: Web Service
Information about business tempo may also be exposed to adversaries via online or other accessible data sets  or Search Victim-Owned Websites.
Technique: T1591: Gather Victim Org Information
njRAT is capable of logging keystrokes.
Technique: T1056: Input Capture
Common TCP ports 80 and 443 are used to blend in with routine network traffic
Technique: T1571: Non-Standard Port
winlogon
Technique: T1547: Boot or Logon Autostart Execution
admin@338 actors used the following command after exploiting a machine with LOWBALL malware to acquire information about local networks: ipconfig /all >> %temp%\download APT32 used the ipconfig /all command to gather the IP address from the system.
Technique: T1016: System Network Configuration Discovery
Patchwork has used watering holes to deliver files with exploits to initial victims.
Technique: T1189: Drive-by Compromise
Every time a user opens a PowerShell session the modified script will be executed unless the -NoProfile flag is used when it is launched.
Technique: T1546: Event Triggered Execution
What changes in the code can we see in such short time intervals that would not be present in a build tool? In one case, one build was programmed to execute the runmem command for a file named wi.exe while the other was not
Technique: T1036: Masquerading
HAFNIUM has deployed multiple web shells on compromised servers including SIMPLESEESHARP, SPORTSBALL, China Chopper, and ASPXSpy.
Technique: T1505: Server Software Component
A version of KONNI drops a Windows shortcut into the Startup folder to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
ROCKBOOT is a Master Boot Record  bootkit that uses the MBR to establish persistence.
Technique: T1542: Pre-OS Boot
InvisiMole has a command to create, set, copy, or delete a specified Registry key or value.
Technique: T1112: Modify Registry
Grandoreiro has added BMP images to the resources section of its Portable Executable  file increasing each binary to at least 300MB in size.
Technique: T1027: Obfuscated Files or Information
Protocols such as ICMP may be used as a transport.
Technique: T1090: Proxy
The main function performed by the SCT file is to Base64 decode the contents of WindowsDefender.ini file and execute the decoded PowerShell Script using the following command line: powershell.exe -exec Bypass -c iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((get-content C:\\ProgramData\\WindowsDefender.ini) The rest of the malicious activities are performed by the PowerShell Script
Technique: T1546: Event Triggered Execution
Tropic Trooper has started a web service in the target host and wait for the adversary to connect, acting as a web shell.
Technique: T1505: Server Software Component
Process hollowing is commonly performed by creating a process in a suspended state then unmapping/hollowing its memory, which can then be replaced with malicious code.
Technique: T1055: Process Injection
AppleSeed has the ability to communicate with C2 over HTTP.
Technique: T1071: Application Layer Protocol
Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.
Technique: T1055: Process Injection
Ebury has used user mode rootkit techniques to remain hidden on the system.
Technique: T1014: Rootkit
Several Lazarus Group malware samples use a common function to identify target files by their extension.
Technique: T1083: File and Directory Discovery
Or, they may need to build extensive infrastructure if they want to test, communicate, and control other aspects of their activities on their own systems.
Technique: T1583: Acquire Infrastructure
MMC can be used to create, open, and save custom consoles that contain administrative tools created by Microsoft, called snap-ins.
Technique: T1218: Signed Binary Proxy Execution
Bundlore uses HTTP requests for C2.
Technique: T1071: Application Layer Protocol
APT33 has attempted to exploit a known vulnerability in WinRAR , and attempted to gain remote code execution via a security bypass vulnerability .
Technique: T1203: Exploitation for Client Execution
Lokibot has used PowerShell commands embedded inside batch scripts.
Technique: T1059: Command and Scripting Interpreter
Prior to Code Signing, adversaries may develop self-signed code signing certificates for use in operations.
Technique: T1587: Develop Capabilities
Instead of wiping specific disk structures or files, adversaries with destructive intent may wipe arbitrary portions of disk content.
Technique: T1561: Disk Wipe
Linux Rabbit acquires valid SSH accounts through brute force.
Technique: T1078: Valid Accounts
FlawedGrace encrypts its C2 configuration files with AES in CBC mode.
Technique: T1027: Obfuscated Files or Information
Webshell can display the /etc/passwd file on a compromised host.
Technique: T1087: Account Discovery
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
Technique: T1083: File and Directory Discovery
Once decrypted, we are provided with a large list of strings, as seen below (note that the data has been truncated for brevity):  Figure 12 Decrypted strings from embedded BMP file After these strings are decrypted, the malware will load a series of Microsoft Windows API calls to be used later on
Technique: T1140: Deobfuscate/Decode Files or Information
BRONZE BUTLER has used batch scripts and the command-line interface for execution.
Technique: T1059: Command and Scripting Interpreter
Rootkits have been seen for Windows, Linux, and Mac OS X systems.
Technique: T1014: Rootkit
Threat Group-3390 has moved staged encrypted archives to Internet-facing servers that had previously been compromised with China Chopper prior to exfiltration.
Technique: T1074: Data Staged
Cobalt Group has used powershell.exe to download and execute scripts.
Technique: T1059: Command and Scripting Interpreter
Ryuk can use stolen domain admin accounts to move laterally within a victim domain.
Technique: T1078: Valid Accounts
Trojan.Karagany can enumerate files and directories on a compromised host.
Technique: T1083: File and Directory Discovery
TeamTNT has developed custom malware such as Hildegard.
Technique: T1587: Develop Capabilities
SDBbot has the ability to delete files from a compromised host.
Technique: T1070: Indicator Removal on Host
BONDUPDATER is written in PowerShell.
Technique: T1059: Command and Scripting Interpreter
Using a custom User Agent string or the system's User Agent string derived from urlmon.dll   7
Technique: T1543: Create or Modify System Process
OopsIE performs several anti-VM and sandbox checks on the victim's machine.
Technique: T1497: Virtualization/Sandbox Evasion
The encoded payload is then made to look like a URI by having a random number of ‘/’ characters inserted at random locations within the encoded payload
Technique: T1132: Data Encoding
MarkiRAT can use BITS Utility to connect with the C2 server.
Technique: T1197: BITS Jobs
Orz can gather the victim's Internet Explorer version.
Technique: T1518: Software Discovery
Browser bookmarks may also highlight additional targets after an adversary has access to valid credentials, especially Credentials In Files associated with logins cached by a browser.
Technique: T1217: Browser Bookmark Discovery
Ecipekac can use XOR, AES, and DES to encrypt loader shellcode.
Technique: T1027: Obfuscated Files or Information
IIS modules may also be installed to extend IIS web servers.
Technique: T1505: Server Software Component
Variations of this method such as reflective DLL injection  and memory module  overcome the address relocation issue as well as the additional APIs to invoke execution .
Technique: T1055: Process Injection
WindTail has the ability to generate the current date and time.
Technique: T1124: System Time Discovery
BRONZE BUTLER has given malware the same name as an existing file on the file share server to cause users to unwittingly launch and install the malware on additional systems.
Technique: T1036: Masquerading
When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service.
Technique: T1563: Remote Service Session Hijacking
BADNEWS typically loads its DLL file into a legitimate signed Java or VMware executable.
Technique: T1574: Hijack Execution Flow
Stealth Falcon malware gathers the Address Resolution Protocol  table from the victim.
Technique: T1016: System Network Configuration Discovery
Following data collection, FIN6 has compressed log files into a ZIP archive prior to staging and exfiltration.
Technique: T1560: Archive Collected Data
For example, an adversary may add a value to the Windows Registry  or other means that will hide the user “test” from the Windows login screen: reg.exe ADD 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccountsUserList' /v test /t REG_DWORD /d 0 /f.
Technique: T1564: Hide Artifacts
APT28 has used COM hijacking for persistence by replacing the legitimate MMDeviceEnumerator object with a payload.
Technique: T1546: Event Triggered Execution
Bazar can inject into a target process using process doppelgänging.
Technique: T1055: Process Injection
Adversaries may search network shares on computers they have compromised to find files of interest.
Technique: T1039: Data from Network Shared Drive
Turla has used a custom .NET tool to collect documents from an organization's internal central database.
Technique: T1213: Data from Information Repositories
Ryuk can launch icacls <path> /grant Everyone:F /T /C /Q to delete every access-based restrictions on files and directories.
Technique: T1222: File and Directory Permissions Modification
Valak can execute JavaScript containing configuration data for establishing persistence.
Technique: T1059: Command and Scripting Interpreter
MOTW is a NTFS feature and many container files do not support NTFS alternative data streams.
Technique: T1553: Subvert Trust Controls
ADVSTORESHELL encrypts with the 3DES algorithm and a hardcoded key prior to exfiltration.
Technique: T1560: Archive Collected Data
Adversaries may also use time as a metric to detect sandboxes and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time.
Technique: T1497: Virtualization/Sandbox Evasion
NanoCore uses JavaScript files.
Technique: T1059: Command and Scripting Interpreter
Adversaries can use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence.
Technique: T1546: Event Triggered Execution
BADNEWS monitors USB devices and copies files with certain extensions to a predefined directory.
Technique: T1119: Automated Collection
Adversaries may set files and directories to be hidden to evade detection mechanisms.
Technique: T1564: Hide Artifacts
Rocke issued wget requests from infected systems to the C2.
Technique: T1071: Application Layer Protocol
Kobalos has used a compromised SSH client to capture the hostname, port, username and password used to establish an SSH connection from the compromised host.
Technique: T1056: Input Capture
These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions without changing the original library.
Technique: T1574: Hijack Execution Flow
Adversaries may gather credentials by reading files located inside of the Credential Lockers.
Technique: T1555: Credentials from Password Stores
Typically, the resources for a link target will be an HTML page that may include some client-side script such as JavaScript to decide what content to serve to the user.
Technique: T1608: Stage Capabilities
WindTail has the ability to use HTTP for C2 communications.
Technique: T1071: Application Layer Protocol
Carberp has searched the Image File Execution Options registry key for "Debugger" within every subkey.
Technique: T1012: Query Registry
FIN6 has used Registry Run keys to establish persistence for its downloader tools known as HARDTACK and SHIPBREAD.
Technique: T1547: Boot or Logon Autostart Execution
Rising Sun can enumerate information about files from the infected system, including file size, attributes, creation time, last access time, and write time.
Technique: T1083: File and Directory Discovery
There exist a variety of cloud service providers that will sell virtual machines/containers as a service.
Technique: T1583: Acquire Infrastructure
Cloud firewalls are separate from system firewalls that are described in Disable or Modify System Firewall.
Technique: T1562: Impair Defenses
A notable characteristic of CopyKittens is the use of DNS for command and control communication (C&C) and for data exfiltration
Technique: T1132: Data Encoding
Proton removes all files in the /tmp directory.
Technique: T1070: Indicator Removal on Host
Agent.btz attempts to download an encrypted binary from a specified domain.
Technique: T1105: Ingress Tool Transfer
Adversaries may purchase technical information about victims that can be used during targeting.
Technique: T1597: Search Closed Sources
CORESHELL contains unused machine instructions in a likely attempt to hinder analysis.
Technique: T1027: Obfuscated Files or Information
Once Shamoon has access to a network share, it enables the RemoteRegistry service on the target system.
Technique: T1112: Modify Registry
The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs.
Technique: T1033: System Owner/User Discovery
Kimsuky has the ability to enumerate all the drives on an infected system.
Technique: T1083: File and Directory Discovery
While public references of usage by threat actors are scarce, many red teams/penetration testers leverage hardware additions for initial access.
Technique: T1200: Hardware Additions
A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Technique: T1210: Exploitation of Remote Services
Blue Mockingbird has used mofcomp.exe to establish WMI Event Subscription persistence mechanisms configured from a *.mof file.
Technique: T1546: Event Triggered Execution
SUNBURST had commands that allow an attacker to write or delete registry keys, and was observed stopping services by setting their HKLM\SYSTEM\CurrentControlSet\services\\service_name\\Start registry entries to value 4.
Technique: T1112: Modify Registry
Micropsia has keylogging capabilities.
Technique: T1056: Input Capture
The legitimate owaauth.dll file resides in %ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\Auth\ while CTU researchers have observed the backdoor using the same filename in the %ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\bin\ directory
Technique: T1036: Masquerading
Since the XSL file is valid XML, the adversary may call the same XSL file twice.
Technique: T1220: XSL Script Processing
Avenger has the ability to inject shellcode into svchost.exe.
Technique: T1055: Process Injection
Derusbi has used unencrypted HTTP on port 443 for C2.
Technique: T1571: Non-Standard Port
Ke3chang performs local network configuration discovery using ipconfig.
Technique: T1016: System Network Configuration Discovery
The WastedLocker payload includes encrypted strings stored within the .bss section of the binary file.
Technique: T1027: Obfuscated Files or Information
Backdoor.Oldrea collects information about the OS and computer name.
Technique: T1082: System Information Discovery
A good example of this is when malware is detected with a file signature and quarantined by anti-virus software.
Technique: T1027: Obfuscated Files or Information
Environmental keying may be used to deliver an encrypted payload to the target that will use target-specific values to decrypt the payload before execution.
Technique: T1480: Execution Guardrails
StrongPity can determine if a user is logged in by checking to see if explorer.exe is running.
Technique: T1057: Process Discovery
Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges.
Technique: T1546: Event Triggered Execution
Molerats used various implants, including those built with JS, on target machines.
Technique: T1059: Command and Scripting Interpreter
In order for this change to be reflected, the malware also issued killall Terminal.
Technique: T1548: Abuse Elevation Control Mechanism
NanoCore has the capability to edit the Registry.
Technique: T1112: Modify Registry
Threat actors can use online resources and lookup tools to harvest information from these services.
Technique: T1596: Search Open Technical Databases
By modifying the GlobalDotName registry key an adversary can specify an arbitrary location, file name, and file extension to use for the template that will be loaded on application startup.
Technique: T1137: Office Application Startup
During our initial research into the TwoFace++ loader, we were unable to extract the embedded payload using the same brute forcing technique that we used on the initial TwoFace loader samples
Technique: T1110: Brute Force
S-Type uses HTTP for C2.
Technique: T1071: Application Layer Protocol
This activity is distinct from typical Virtualization/Sandbox Evasion.
Technique: T1480: Execution Guardrails
Privileged timers are written to /etc/systemd/system/ and /usr/lib/systemd/system while user level are written to ~/.config/systemd/user/.
Technique: T1053: Scheduled Task/Job
TA505 has also run net group /domain.
Technique: T1069: Permission Groups Discovery
Reaver queries the Registry to determine the correct Startup path to use for persistence.
Technique: T1012: Query Registry
While this is usually done via a Graphical User Interface  on an app-by-app basis, there are property list files  that contain this information as well located at ~/Library/Preferences/com.apple.loginwindow.plist and ~/Library/Preferences/ByHost/com.apple.loginwindow.
Technique: T1547: Boot or Logon Autostart Execution
Figure 14: System shut down upon discovery of security tools  Ability to receive PowerShell script from the C2 server and execute on the machine
Technique: T1518: Software Discovery
It supports searching for directories, creating directories, listing directory contents, reading and writing to files, retrieving file attributes, and retrieving volume information.
Technique: T1083: File and Directory Discovery
MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.
Technique: T1127: Trusted Developer Utilities Proxy Execution
FIN6 has used malicious JavaScript to steal payment card data from e-commerce sites.
Technique: T1059: Command and Scripting Interpreter
AppCertDLL
Technique: T1546: Event Triggered Execution
SQLRat has used a character insertion obfuscation technique, making the script appear to contain Chinese characters.
Technique: T1027: Obfuscated Files or Information
An older version of CHOPSTICK has a module that monitors all mounted volumes for files with the extensions .doc, .docx, .pgp, .gpg, .m2f, or .m2o.
Technique: T1083: File and Directory Discovery
PoetRAT has used a Python tool named klog.exe for keylogging.
Technique: T1056: Input Capture
On Linux and macOS, command history is tracked in a file pointed to by the environment variable HISTFILE.
Technique: T1562: Impair Defenses
Explosive has a function to write itself to Registry values.
Technique: T1112: Modify Registry
Applications often depend on external software to function properly.
Technique: T1195: Supply Chain Compromise
Based on our analysis, financial organizations in Turkey were targeted via spear phishing emails containing a malicious Microsoft Word document
Technique: T1566: Phishing
MechaFlounder has the ability to upload and download files to and from a compromised host.
Technique: T1105: Ingress Tool Transfer
An adversary may monitor exploit provider forums to understand the state of existing, as well as newly discovered, exploits.
Technique: T1588: Obtain Capabilities
SideTwist has used Base64 for encoded C2 traffic.
Technique: T1132: Data Encoding
Cryptoistic can gather data on the user of a compromised host.
Technique: T1033: System Owner/User Discovery
WastedLocker can enumerate files and directories just prior to encryption.
Technique: T1083: File and Directory Discovery
RATANKBA uses the net user command.
Technique: T1087: Account Discovery
It can also upload and download files over HTTP and HTTPS.
Technique: T1105: Ingress Tool Transfer
FinFisher extracts and decrypts stage 3 malware, which is stored in encrypted resources.
Technique: T1140: Deobfuscate/Decode Files or Information
MuddyWater has performed credential dumping with Mimikatz and procdump64.exe.
Technique: T1003: OS Credential Dumping
WellMess can identify domain group membership for the current user.
Technique: T1069: Permission Groups Discovery
Tropic Trooper has created shortcuts in the Startup folder to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
FELIXROOT collects information about the network including the IP address and DHCP server.
Technique: T1016: System Network Configuration Discovery
Direct Network Flood are when one or more systems are used to send a high-volume of network packets towards the targeted service's network.
Technique: T1498: Network Denial of Service
The malware queries the Windows API to get the computer name, user name, volume serial number, Windows version, processor architecture and two additional values, which are “1.3” and “KdfrJKN”
Technique: T1082: System Information Discovery
Adversaries may also leverage Protocol Tunneling in conjunction with Proxy and/or Protocol Impersonation to further conceal C2 communications and infrastructure.
Technique: T1572: Protocol Tunneling
Adversaries may make use of Domain Generation Algorithms  to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains.
Technique: T1568: Dynamic Resolution
ROKRAT leverages legitimate social networking sites and cloud platforms  for C2 communications.
Technique: T1102: Web Service
It can also be used to query shared drives on the local system using net share.
Technique: T1135: Network Share Discovery
Figure 1 – The main code from the .NET wrapper, with the Shellcode array being created and executed in a new thread
Technique: T1140: Deobfuscate/Decode Files or Information
A cloud metadata API has been used in at least one high profile compromise.
Technique: T1552: Unsecured Credentials
APT39 has created scheduled tasks for persistence.
Technique: T1053: Scheduled Task/Job
FYAnti has the ability to decrypt an embedded .NET module.
Technique: T1140: Deobfuscate/Decode Files or Information
Molerats used executables to download malicious files from different sources.
Technique: T1105: Ingress Tool Transfer
Adversaries may install new services, daemons, or agents that can be configured to execute at startup or a repeatable interval in order to establish persistence.
Technique: T1543: Create or Modify System Process
APT29 has used various forms of spearphishing attempting to get a user to click on a malicous link.
Technique: T1204: User Execution
RTM collects data from the clipboard.
Technique: T1115: Clipboard Data
Code signing provides a level of authenticity on a program from a developer and a guarantee that the program has not been tampered with.
Technique: T1553: Subvert Trust Controls
Denis also encodes its payload in Base64.
Technique: T1027: Obfuscated Files or Information
This may include information about the currently logged in user, the hostname, network configuration data, active connections, process information, local and domain administrator accounts, an enumeration of user directories, and other data
Technique: T1087: Account Discovery
whoami 
Technique: T1033: System Owner/User Discovery
njRAT can download files to the victim’s machine.
Technique: T1105: Ingress Tool Transfer
EKANS has been disguised as update.exe to appear as a valid executable.
Technique: T1036: Masquerading
Exploitation for credential access may also result in Privilege Escalation depending on the process targeted or credentials obtained.
Technique: T1212: Exploitation for Credential Access
Fox Kitten has accessed ntuser.dat and UserClass.dat on compromised hosts.
Technique: T1087: Account Discovery
These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material.
Technique: T1003: OS Credential Dumping
When Windows boots up, it starts programs or applications called services that perform background system functions.
Technique: T1543: Create or Modify System Process
Rocke used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining malware.
Technique: T1059: Command and Scripting Interpreter
These requests are encrypted using the RC4 algorithm
Technique: T1027: Obfuscated Files or Information
Andariel has downloaded additional tools and malware onto compromised hosts.
Technique: T1105: Ingress Tool Transfer
An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users.
Technique: T1491: Defacement
Denis enumerates and collects the username from the victim’s machine.
Technique: T1033: System Owner/User Discovery
Grandoreiro can identify installed security tools based on process names.
Technique: T1057: Process Discovery
POWERSTATS can delete all files on the C:\, D:\, E:\ and, F:\ drives using PowerShell Remove-Item commands.
Technique: T1070: Indicator Removal on Host
Lazarus Group has used a custom secure delete function to overwrite file contents with data from heap memory.
Technique: T1485: Data Destruction
CosmicDuke collects user credentials, including passwords, for various programs including Web browsers.
Technique: T1555: Credentials from Password Stores
Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems.
Technique: T1078: Valid Accounts
* Rollback – Undo changes to original executable, effectively removing malicious code from the file system.
Technique: T1055: Process Injection
SUNBURST used VBScripts to initiate the execution of payloads.
Technique: T1059: Command and Scripting Interpreter
ECCENTRICBANDWAGON can delete log files generated from the malware stored at C:\windows\temp\tmp0207.
Technique: T1070: Indicator Removal on Host
Adversaries may interact with the native OS application programming interface  to execute behaviors.
Technique: T1106: Native API
Proxysvc executes a binary on the system and logs the results into a temp file by using: cmd.exe /c "<file_path> > %temp%\PM* .tmp 2>&1".
Technique: T1059: Command and Scripting Interpreter
Encryption ciphers are used to convert a plaintext message to ciphertext and can be computationally intensive to decipher without the associated decryption key.
Technique: T1600: Weaken Encryption
The Cobalt Strike System Profiler can use JavaScript to perform reconnaissance actions.
Technique: T1059: Command and Scripting Interpreter
Okrum's installer can attempt to achieve persistence by creating a scheduled task.
Technique: T1053: Scheduled Task/Job