HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
Once forged, adversaries may use these web credentials to access resources , which may bypass multi-factor and other authentication protection mechanisms.
Technique: T1606: Forge Web Credentials
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Technique: T1547: Boot or Logon Autostart Execution
Dragonfly 2.0 used SMB for C2.
Technique: T1071: Application Layer Protocol
Helminth can use DNS for C2.
Technique: T1071: Application Layer Protocol
Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Technique: T1529: System Shutdown/Reboot
Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic.
Technique: T1071: Application Layer Protocol
The group's JavaScript backdoor is also capable of downloading files.
Technique: T1105: Ingress Tool Transfer
LoadModule() 
Technique: T1106: Native API
These emails included recruitment themed lures and contained links to malicious HTML application (.hta) files
Technique: T1566: Phishing
This private data includes stored passwords, login credential information from Web browsers, and a variety of cryptocurrency wallets
Technique: T1003: OS Credential Dumping
If a smart card is used for two-factor authentication, then a keylogger will need to be used to obtain the password associated with a smart card during normal use.
Technique: T1111: Two-Factor Authentication Interception
MarkiRAT can run the ShellExecuteW API via the Windows Command Shell.
Technique: T1106: Native API
Adversaries may insert, delete, or manipulate data in order to manipulate external outcomes or hide activity.
Technique: T1565: Data Manipulation
HTTPBrowser is capable of listing files, folders, and drives on a victim.
Technique: T1083: File and Directory Discovery
Lucifer can issue shell commands to download and execute additional payloads.
Technique: T1059: Command and Scripting Interpreter
Shamoon creates a new service named “ntssrv” that attempts to appear legitimate; the service's display name is “Microsoft Network Realtime Inspection Service” and its description is “Helps guard against time change attempts targeting known and newly discovered vulnerabilities in network time protocols.” Newer versions create the "MaintenaceSrv" service, which misspells the word "maintenance."
Technique: T1036: Masquerading
ASPXTool web shell
Technique: T1505: Server Software Component
Carbanak may use netsh to add local firewall rule exceptions.
Technique: T1562: Impair Defenses
Other such controls may be disabled by default but are configurable through application controls, such as only allowing signed Dynamic-Link Libraries  to execute on a system.
Technique: T1553: Subvert Trust Controls
Once authenticated, PtH may be used to perform actions on local or remote systems.
Technique: T1550: Use Alternate Authentication Material
One example of this is MS14-068, which targets Kerberos and can be used to forge Kerberos tickets using domain user permissions.
Technique: T1212: Exploitation for Credential Access
Ke3chang has dumped credentials, including by using gsecdump.
Technique: T1003: OS Credential Dumping
APT41 gained access to production environments where they could inject malicious code into legitimate, signed files and widely distribute them to end users.
Technique: T1195: Supply Chain Compromise
This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate, signed Microsoft application.
Technique: T1218: Signed Binary Proxy Execution
Hildegard has searched for SSH keys, Docker credentials, and Kubernetes service tokens.
Technique: T1552: Unsecured Credentials
KGH_SPY can collect credentials from the Windows Credential Manager.
Technique: T1555: Credentials from Password Stores
System file associations are listed under HKEY_CLASSES_ROOT\.extension, for example HKEY_CLASSES_ROOT\.txt.
Technique: T1546: Event Triggered Execution
REvil can identify the domain membership of a compromised host.
Technique: T1069: Permission Groups Discovery
GALLIUM used dumped hashes to authenticate to other machines via pass the hash.
Technique: T1550: Use Alternate Authentication Material
ASPXSpy is a Web shell.
Technique: T1505: Server Software Component
Protocols such as HTTP and HTTPS that carry web traffic may be very common in environments.
Technique: T1071: Application Layer Protocol
TEMP.Veles has modified files based on the open-source project cryptcat in an apparent attempt to decrease AV detection rates.
Technique: T1027: Obfuscated Files or Information
OopsIE stages the output from command execution and collected files in specific folders before exfiltration.
Technique: T1074: Data Staged
Most modern Linux operating systems use a combination of /etc/passwd and /etc/shadow to store user account information including password hashes in /etc/shadow.
Technique: T1003: OS Credential Dumping
BADNEWS encodes C2 traffic with base64.
Technique: T1132: Data Encoding
Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via Accessibility Features, Boot or Logon Initialization Scripts, or tainting/hijacking other instrumental binary/configuration files via Hijack Execution Flow.
Technique: T1222: File and Directory Permissions Modification
Azorult can steal credentials from the victim's browser.
Technique: T1555: Credentials from Password Stores
Zebrocy enumerates information about connected storage devices.
Technique: T1120: Peripheral Device Discovery
Epic uses the nbtstat -n and nbtstat -s commands on the victim’s machine.
Technique: T1016: System Network Configuration Discovery
These require the user to open the document or file for the exploit to run.
Technique: T1203: Exploitation for Client Execution
SIPs are responsible for enabling API functions to create, retrieve, calculate, and verify signatures.
Technique: T1553: Subvert Trust Controls
Turian can retrieve usernames.
Technique: T1033: System Owner/User Discovery
These tools may be used to query specific data from a configuration repository or configure the device to export the configuration for later analysis.
Technique: T1602: Data from Configuration Repository
RATANKBA uploads and downloads information.
Technique: T1105: Ingress Tool Transfer
Tropic Trooper has used known administrator account credentials to execute the backdoor directly.
Technique: T1078: Valid Accounts
Modifications may include changing specific access rights, which may require taking ownership of a file or directory and/or elevated permissions depending on the file or directory’s existing permissions.
Technique: T1222: File and Directory Permissions Modification
FIN8 has used HTTPS for command and control.
Technique: T1071: Application Layer Protocol
Timestomping may be used along with file name Masquerading to hide malware and tools.
Technique: T1070: Indicator Removal on Host
The group also ran a modified version of NBTscan to identify available NetBIOS name servers.
Technique: T1016: System Network Configuration Discovery
It maintains both code and data in the raw, encrypted blobs of data to be decrypted and used at runtime, and hidden functionality that isn’t exposed until runtime
Technique: T1140: Deobfuscate/Decode Files or Information
In one instance, the threat actor gained remote access to a high-value system in a compromised network, ran quser.exe to identify existing RDP sessions on the device, immediately ran a command to compile a RAR archive that specified file types the threat actor did not want, and used a password to encrypt the archive:  YYYY-MM-DD hh:mm:ss     quser YYYY-MM-DD hh:mm:ss     C:\windows\temp\svchost.exe a -m5 -v2000m -hp{password} -inul -r "{destination_file.rar}" "{multiple user directories linked to the victim's projects}" -x*.exe -x*.msi -x*.cab -x*.inc -x*.dll -x*.db -x*.mdb -x*.htm -x*.html -x*.css -x*.jar -x*.js -x*.tmp -x*.bak -x*.dat -x*.log -x*.xml -x*.dmp -x*.dbf -x*.avi -x*.mp3 -x*.mp4 -x*.mpg -x*.mpeg -x*.asp -x*.aspx -x*.gif -x*.jpg -x*.mpp -x*.pst  The threat actors typically rename the encrypted RAR archives
Technique: T1036: Masquerading
Figure 1 XAgent macOS HTTP POST request  Figure 2 XAgent mscOS HTTP GET request The C2 URLs generated by XAgentOSX are very similar to those created by its Windows-based counterpart
Technique: T1071: Application Layer Protocol
Adversaries may enumerate objects in cloud storage infrastructure.
Technique: T1619: Cloud Storage Object Discovery
Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.
Technique: T1573: Encrypted Channel
TEMP.Veles has renamed files to look like legitimate files, such as Windows update files or Schneider Electric application files.
Technique: T1036: Masquerading
DEL Deletes a specified file
Technique: T1070: Indicator Removal on Host
BoomBox can execute an LDAP query to discover e-mail accounts for domain users.
Technique: T1087: Account Discovery
APT28 has used a variety of public exploits, including CVE 2020-0688 and CVE 2020-17144, to gain execution on vulnerable Microsoft Exchange; they have also conducted SQL injection attacks against external websites.
Technique: T1190: Exploit Public-Facing Application
Cobalt Strike has the ability to use AES-256 symmetric encryption in CBC mode with HMAC-SHA-256 to encrypt task commands and XOR to encrypt shell code and configuration data.
Technique: T1573: Encrypted Channel
SombRAT can run upload to decrypt and upload files from storage.
Technique: T1140: Deobfuscate/Decode Files or Information
Skidmap has the ability to set SELinux to permissive mode.
Technique: T1562: Impair Defenses
TA505 has been seen injecting a DLL into winword.exe.
Technique: T1055: Process Injection
CORESHELL is installed via execution of rundll32 with an export named "init" or "InitW."
Technique: T1218: Signed Binary Proxy Execution
AppleSeed has the ability to Base64 encode its payload and custom encrypt API calls.
Technique: T1027: Obfuscated Files or Information
Carbon can use HTTP in C2 communications.
Technique: T1071: Application Layer Protocol
Adversaries may attempt to discover containers and other resources that are available within a containers environment.
Technique: T1613: Container and Resource Discovery
As shown in Figure 12, the script within the dupatechecker.doc file attempts to download another file named dupatechecker.exe from the same server
Technique: T1105: Ingress Tool Transfer
DustySky scans the victim for files that contain certain keywords and document types including PDF, DOC, DOCX, XLS, and XLSX, from a list that is obtained from the C2 as a text file.
Technique: T1083: File and Directory Discovery
Third-party entities can include technology companies that specialize in malware development, criminal marketplaces , or from individuals.
Technique: T1588: Obtain Capabilities
However, execution via process hollowing may also evade detection from security products since the execution is masked under a legitimate process.
Technique: T1055: Process Injection
Higaisa used Base64 encoded compressed payloads.
Technique: T1027: Obfuscated Files or Information
The BITS mechanism has existed since Windows XP up to the current Windows 10 versions and was developed to create download/upload jobs, mostly to update the OS itself
Technique: T1105: Ingress Tool Transfer
Adversaries may use Valid Accounts to log into a service specifically designed to accept remote connections, such as telnet, SSH, and VNC.
Technique: T1021: Remote Services
Lazarus Group has modified registry keys using the reg windows utility for its custom backdoor implants.
Technique: T1112: Modify Registry
NETEAGLE can send process listings over the C2 channel.
Technique: T1057: Process Discovery
GALLIUM has used a variety of widely-available tools, which in some cases they modified to add functionality and/or subvert antimalware solutions.
Technique: T1588: Obtain Capabilities
Leafminer used several tools for retrieving login and password information, including LaZagne.
Technique: T1003: OS Credential Dumping
CosmicDuke uses Windows services typically named "javamtsup" for persistence.
Technique: T1543: Create or Modify System Process
mshta.exe
Technique: T1218: Signed Binary Proxy Execution
Zebrocy creates an entry in a Registry Run key for the malware to execute on startup.
Technique: T1547: Boot or Logon Autostart Execution
TSCookie has the ability to steal saved passwords from the Internet Explorer, Edge, Firefox, and Chrome browsers.
Technique: T1555: Credentials from Password Stores
In Docker, adversaries may specify an entrypoint during container deployment that executes a script or command, or they may use a command such as docker exec to execute a command within a running container.
Technique: T1609: Container Administration Command
ComRAT has used public key cryptography with RSA and AES encrypted email attachments for its Gmail C2 channel.
Technique: T1573: Encrypted Channel
Chimera has encapsulated Cobalt Strike's C2 protocol in DNS and HTTPS.
Technique: T1572: Protocol Tunneling
Chimera has exfiltrated stolen data to OneDrive accounts.
Technique: T1567: Exfiltration Over Web Service
This value can be changed using the AccessTokenLifetime in a LifetimeTokenPolicy.
Technique: T1606: Forge Web Credentials
Dragonfly 2.0 used batch scripts to enumerate administrators and users in the domain.
Technique: T1069: Permission Groups Discovery
Dragonfly 2.0 created accounts on victims, including administrator accounts, some of which appeared to be tailored to each individual staging target.
Technique: T1136: Create Account
Traditional antivirus software and other systems that rely on low-level indicators do not effectively detect and block common and pervasive malware
Technique: T1518: Software Discovery
Mosquito can launch PowerShell Scripts.
Technique: T1059: Command and Scripting Interpreter
No pdb/debug strings are present in the code
Technique: T1140: Deobfuscate/Decode Files or Information
The PipeMon installer has modified the Registry key HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors to install PipeMon as a Print Processor.
Technique: T1547: Boot or Logon Autostart Execution
A service ticket allows for access to a particular resource, whereas a TGT can be used to request service tickets from the Ticket Granting Service  to access any resource the user has privileges to access.
Technique: T1550: Use Alternate Authentication Material
Server Command and control server that communicates via DNS tunneling   Panel Graphical User Interface that allows actors to issue commands, upload and download files to Agents via the Server    Table 2
Technique: T1071: Application Layer Protocol
StrongPity can download files to specified targets.
Technique: T1105: Ingress Tool Transfer
ServHelper contains a module for downloading and executing DLLs that leverages rundll32.exe.
Technique: T1218: Signed Binary Proxy Execution
KeyBoy has a download and upload functionality.
Technique: T1105: Ingress Tool Transfer
A Gamaredon Group file stealer can gather the victim's computer name and drive serial numbers to send to a C2 server.
Technique: T1082: System Information Discovery
ServHelper may download additional files to execute.
Technique: T1105: Ingress Tool Transfer
EvilBunny has executed commands via scheduled tasks.
Technique: T1053: Scheduled Task/Job
Taidoor has the ability to modify the Registry on compromised hosts using RegDeleteValueA and RegCreateKeyExA.
Technique: T1112: Modify Registry
VERMIN collects the OS name, machine name, and architecture information.
Technique: T1082: System Information Discovery
This third-party server is commonly termed a reflector.
Technique: T1498: Network Denial of Service
Calisto's installation file is an unsigned DMG image under the guise of Intego’s security solution for mac.
Technique: T1036: Masquerading
Sandworm Team has used port 6789 to accept connections on the group's SSH server.
Technique: T1571: Non-Standard Port
Grandoreiro can use VBScript to execute malicious code.
Technique: T1059: Command and Scripting Interpreter
GuLoader can establish persistence via the Registry under HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce.
Technique: T1547: Boot or Logon Autostart Execution
Unknown Logger can obtain information about the victim computer name, physical memory, country, and date.
Technique: T1082: System Information Discovery
Indrik Spider has used PowerView to enumerate all Windows Server, Windows Server 2003, and Windows 7 instances in the Active Directory database.
Technique: T1018: Remote System Discovery
By default, the service automatically starts when a system powers on.
Technique: T1562: Impair Defenses
Pay2Key has the ability to gather the hostname of the victim machine.
Technique: T1082: System Information Discovery
CoinTicker decodes the initially-downloaded hidden encoded file using OpenSSL.
Technique: T1140: Deobfuscate/Decode Files or Information
zwShell has deleted itself after creating a service as well as deleted a temporary file when the system reboots.
Technique: T1070: Indicator Removal on Host
UNC2452 developed SUNSPOT, SUNBURST, TEARDROP, and Raindrop; SUNSPOT and SUNBURST were tailored to be incorporated into SolarWind's Orion software library.
Technique: T1587: Develop Capabilities
njRAT can read specific registry values.
Technique: T1012: Query Registry
BoomBox can upload data to dedicated per-victim folders in Dropbox.
Technique: T1567: Exfiltration Over Web Service
Web server software can be attacked through a variety of means, some of which apply generally while others are specific to the software being used to provide the service.
Technique: T1499: Endpoint Denial of Service
Dust Storm has encoded payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key.
Technique: T1027: Obfuscated Files or Information
H1N1 dumps usernames and passwords from Firefox, Internet Explorer, and Outlook.
Technique: T1555: Credentials from Password Stores
Hydraq creates a backdoor through which remote attackers can monitor processes.
Technique: T1057: Process Discovery
HotCroissant has the ability to download files from the infected host to the command and control  server.
Technique: T1041: Exfiltration Over C2 Channel
This prevented the User Access Control window from appearing.
Technique: T1548: Abuse Elevation Control Mechanism
Network protocols that use asymmetric encryption often utilize symmetric encryption once keys are exchanged, but adversaries may opt to manually share keys and implement symmetric cryptographic algorithms  vice using mechanisms that are baked into a protocol.
Technique: T1048: Exfiltration Over Alternative Protocol
EnvyScout has the ability to proxy execution of malicious files with Rundll32.
Technique: T1218: Signed Binary Proxy Execution
Crimson contains a module to steal credentials from Web browsers on the victim machine.
Technique: T1555: Credentials from Password Stores
PipeMon, its installer, and tools are signed with stolen code-signing certificates.
Technique: T1553: Subvert Trust Controls
FIN7 has also digitally signed their phishing documents, backdoors and other staging tools to bypass security controls.
Technique: T1553: Subvert Trust Controls
BlackEnergy can gather very specific information about attached USB devices, to include device instance ID and drive geometry.
Technique: T1120: Peripheral Device Discovery
Fox Kitten has used the Softerra LDAP browser to browse documentation on service accounts.
Technique: T1087: Account Discovery
Gold Dragon terminates anti-malware processes if they’re found running on the system.
Technique: T1562: Impair Defenses
Shamoon has been seen overwriting features of disk structure such as the MBR.
Technique: T1561: Disk Wipe
Win32 API
Technique: T1106: Native API
QakBot can use net config workstation, arp -a, and ipconfig /all to gather network configuration information.
Technique: T1016: System Network Configuration Discovery
Attor has exfiltrated data over the C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
BitPaymer attempts to remove the backup shadow files from the host using vssadmin.exe Delete Shadows /All /Quiet.
Technique: T1490: Inhibit System Recovery
Smoke Loader was distributed through a compromised update to a Tor client with a coin miner payload.
Technique: T1195: Supply Chain Compromise
Since this is a scripting language, it can be used to launch more common techniques as well such as a reverse shell via Python.
Technique: T1059: Command and Scripting Interpreter
Grandoreiro has used malicious links to gain execution on victim machines.
Technique: T1204: User Execution
APT38 has attempted to get detailed information about a compromised host, including the operating system, version, patches, hotfixes, and service packs.
Technique: T1082: System Information Discovery
Adversaries may abuse msiexec.exe to launch local or network accessible MSI files.
Technique: T1218: Signed Binary Proxy Execution
S-Type may create the file %HOMEPATH%\Start Menu\Programs\Startup\Realtek {Unique Identifier}.lnk, which points to the malicious msdtc.exe file already created in the %CommonFiles% directory.
Technique: T1547: Boot or Logon Autostart Execution
Xbash uses HTTP for C2 communications.
Technique: T1071: Application Layer Protocol
Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor, Master Boot Record, or System Firmware.
Technique: T1014: Rootkit
Examples of commands that can modify the code signing policy of a system include bcdedit.exe -set TESTSIGNING ON on Windows and csrutil disable on macOS.
Technique: T1553: Subvert Trust Controls
If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Technique: T1574: Hijack Execution Flow
They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Technique: T1176: Browser Extensions
MoonWind obtains the victim's current time.
Technique: T1124: System Time Discovery
Another interesting characteristic of the malicious documents is that the metadata associated with the document files themselves also matches that found in many of the malicious documents that were previously being used to spread Remcos.Figure 3: Document metadataAdditionally, the creation and modification dates associated with these documents are shortly after we released a detailed analysis of Remcos distribution campaigns that were being observed throughout 2018
Technique: T1566: Phishing
Frankenstein has obtained and used Empire to deploy agents.
Technique: T1588: Obtain Capabilities
Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.
Technique: T1574: Hijack Execution Flow
Epic heavily obfuscates its code to make analysis more difficult.
Technique: T1027: Obfuscated Files or Information
Compromised systems may leverage popular websites and social media to host command and control  instructions.
Technique: T1102: Web Service
FIN6 has used Comodo code-signing certificates.
Technique: T1553: Subvert Trust Controls
OilRig has delivered macro-enabled documents that required targets to click the "enable content" button to execute the payload on the system.
Technique: T1204: User Execution
Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware.
Technique: T1070: Indicator Removal on Host
Anchor can execute payloads via shell scripting.
Technique: T1059: Command and Scripting Interpreter
DarkComet can execute various types of scripts on the victim’s machine.
Technique: T1059: Command and Scripting Interpreter
The primary delivered mechaism for Agent Tesla is through email phishing messages.
Technique: T1566: Phishing
MuddyWater has made use of  legitimate tools ConnectWise and RemoteUtilities for access to target environments.
Technique: T1588: Obtain Capabilities
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model  objects.
Technique: T1546: Event Triggered Execution
ADVSTORESHELL is capable of starting a process using CreateProcess.
Technique: T1106: Native API
Taidoor has used HTTP GET and POST requests for C2.
Technique: T1071: Application Layer Protocol
ZxShell has a command called RunAs, which creates a new process as another user or process context.
Technique: T1134: Access Token Manipulation
Adversaries may abuse these features for Defense Evasion, specifically to perform arbitrary execution while subverting detections and/or mitigation controls  that limit/prevent the usage of cmd or file extensions more commonly associated with malicious payloads.
Technique: T1202: Indirect Command Execution
MarkiRAT can modify the shortcut that launches Telegram by replacing its path with the malicious payload to launch with the legitimate executable.
Technique: T1547: Boot or Logon Autostart Execution
EnvyScout can deobfuscate and write malicious ISO files to disk.
Technique: T1140: Deobfuscate/Decode Files or Information
POWERSTATS can use Mshta.exe to execute additional payloads on compromised hosts.
Technique: T1218: Signed Binary Proxy Execution
GRIFFON is written in and executed as JavaScript.
Technique: T1059: Command and Scripting Interpreter
JHUHUGIT variants have communicated with C2 servers over HTTP and HTTPS.
Technique: T1071: Application Layer Protocol
APT29 changed domain federation trust settings using Azure AD administrative permissions to configure the domain to accept authorization tokens signed by their own SAML signing certificate.
Technique: T1484: Domain Policy Modification
TYPEFRAME can open the Windows Firewall on the victim’s machine to allow incoming connections.
Technique: T1562: Impair Defenses
TajMahal has the ability to identify which anti-virus products, firewalls, and anti-spyware products are in use.
Technique: T1518: Software Discovery
These can be added ad-hoc to the compiled binary as long as adjustments are made to the rest of the fields and dependencies.
Technique: T1546: Event Triggered Execution
TURNEDUP is capable of injecting code into the APC queue of a created Rundll32 process as part of an "Early Bird injection."
Technique: T1055: Process Injection
Ursnif has used an XOR-based algorithm to encrypt Tor clients dropped to disk.
Technique: T1027: Obfuscated Files or Information
Tools can also be staged on web services, such as an adversary controlled GitHub repo.
Technique: T1608: Stage Capabilities
Lazarus Group has used fake job advertisements sent via LinkedIn to spearphish victims.
Technique: T1566: Phishing
ThiefQuest obtains a list of running processes using the function kill_unwanted.
Technique: T1057: Process Discovery
A Destover-like variant used by Lazarus Group also collects disk space information and sends it to its C2 server.. APT18 can collect system information from the victim’s machine.
Technique: T1082: System Information Discovery
Gazer logs its actions into files that are encrypted with 3DES.
Technique: T1027: Obfuscated Files or Information
APT32 has used the WindowStyle parameter to conceal PowerShell windows.
Technique: T1564: Hide Artifacts
The data may also be sent to an alternate network location from the main command and control server.
Technique: T1048: Exfiltration Over Alternative Protocol
Silence has downloaded additional modules and malware to victim’s machines.
Technique: T1105: Ingress Tool Transfer
RTM can obtain the computer name, OS version, and default language identifier.
Technique: T1082: System Information Discovery
Crutch has the ability to persist using scheduled tasks.
Technique: T1053: Scheduled Task/Job
Gazer communicates with its C2 servers over HTTP.
Technique: T1071: Application Layer Protocol
creates a Registry subkey that registers a new system device.
Technique: T1112: Modify Registry
It communicates with ftp.bytehost31[.]org via FTP for command and control (C2)
Technique: T1071: Application Layer Protocol
InvisiMole can register a Windows service named CsPower as part of its execution chain, and a Windows service named clr_optimization_v2.0.51527_X86 to achieve persistence.
Technique: T1543: Create or Modify System Process
Bundlore has leveraged /bin/sh and /bin/bash to execute commands on the victim machine.
Technique: T1059: Command and Scripting Interpreter
FIN10 uses PowerShell for execution as well as PowerShell Empire to establish persistence.
Technique: T1059: Command and Scripting Interpreter
They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key.
Technique: T1486: Data Encrypted for Impact
InvisiMole has deleted files and directories including XML and files successfully uploaded to C2 servers.
Technique: T1070: Indicator Removal on Host
Seth-Locker has the ability to download and execute files on a compromised host.
Technique: T1105: Ingress Tool Transfer
From the fake website, information is gathered in web forms and sent to the attacker.
Technique: T1598: Phishing for Information
ZIRCONIUM has created a Registry Run key named Dropbox Update Setup to establish persistence for a malicious Python binary.
Technique: T1547: Boot or Logon Autostart Execution
The PowerShell script is responsible for downloading the final payload from C2 server to execute it
Technique: T1546: Event Triggered Execution
The command az ad user list will list all users within a domain.
Technique: T1087: Account Discovery
13 Copy file to adbFle.tmp, and upload it to the C2
Technique: T1105: Ingress Tool Transfer
TrickBot collects email addresses from Outlook.
Technique: T1087: Account Discovery
Stuxnet infected WinCC machines via a hardcoded database server password.
Technique: T1078: Valid Accounts
For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\Local\Google\Chrome\User Data\Default\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;.
Technique: T1555: Credentials from Password Stores
Doki has used the dogechain.info API to generate a C2 address.
Technique: T1102: Web Service
Waterbear can query the Registry to retrieve data.
Technique: T1012: Query Registry
Anchor has used ICMP in C2 communications.
Technique: T1095: Non-Application Layer Protocol
Leafminer used a tool called MailSniper to search for files on the desktop and another utility called Sobolsoft to extract attachments from EML files.
Technique: T1083: File and Directory Discovery
APT29 has downloaded additional tools, such as TEARDROP malware and Cobalt Strike, to a compromised host following initial access.
Technique: T1105: Ingress Tool Transfer
In macOS, the Ay MaMi malware uses /usr/bin/security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /path/to/malicious/cert to install a malicious certificate as a trusted root certificate into the system keychain.
Technique: T1553: Subvert Trust Controls
Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation.
Technique: T1218: Signed Binary Proxy Execution
chinapolicyanalysis.org 185.130.212.168 Domain used for spear phish sender e-mail address and to host malicious documents
Technique: T1016: System Network Configuration Discovery
Emotet has used Powershell to retrieve the malicious payload and download additional resources like Mimikatz.
Technique: T1059: Command and Scripting Interpreter
API function names are also reversed, presumably to avoid detection in memory.
Technique: T1027: Obfuscated Files or Information
### Common Third-party Applications
Other applications that are commonly seen or are part of the software deployed in a target network may also be used for exploitation.
Technique: T1203: Exploitation for Client Execution
By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system.
Technique: T1195: Supply Chain Compromise
OSX_OCEANLOTUS.D scrambles and encrypts data using AES256 before sending it to the C2 server.
Technique: T1560: Archive Collected Data
The structure of the domain mimics the Mercator Institute for China Studies (MERICS), whose actual domain is merics.org
Technique: T1016: System Network Configuration Discovery
UNC2452 obtained the private encryption key from an Active Directory Federation Services  container to decrypt corresponding SAML signing certificates.
Technique: T1552: Unsecured Credentials
Modules can be pushed to and executed by Duqu that copy data to a staging area, compress it, and XOR encrypt it.
Technique: T1560: Archive Collected Data
JSS Loader has been delivered by phishing emails containing malicious Microsoft Excel attachments.
Technique: T1566: Phishing
AppleSeed has the ability to create the Registry key name EstsoftAutoUpdate at HKLU\Software\Microsoft/Windows\CurrentVersion\RunOnce to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
(Source: Dell SecureWorks) Both the redirect code on the compromised site and the exploit code appear and disappear, indicating that the adversaries add the code when they want to leverage the SWC and remove the code when it is not in use to limit the visibility of their operations
Technique: T1140: Deobfuscate/Decode Files or Information
jRAT has the capability to log keystrokes from the victim’s machine, both offline and online.
Technique: T1056: Input Capture
XCSSET will upload a private key file to the server to remotely access the host without a password.
Technique: T1098: Account Manipulation
TeamTNT runs netstat -anp to search for rival malware connections.
Technique: T1049: System Network Connections Discovery
ADVSTORESHELL can create a remote shell and run a given command.
Technique: T1059: Command and Scripting Interpreter
Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links , hot data links , and requests for command execution.
Technique: T1559: Inter-Process Communication
HARDRAIN uses the command cmd.exe /c netsh firewall add portopening TCP 443 "adp" and makes the victim machine function as a proxy server.
Technique: T1090: Proxy
BackdoorDiplomacy has obtained a variety of open-source reconnaissance and red team tools for discovery and lateral movement.
Technique: T1588: Obtain Capabilities
File systems provide a structure to store and access data from physical storage.
Technique: T1564: Hide Artifacts
Darkhotel has been known to establish persistence by adding programs to the Run Registry key.
Technique: T1547: Boot or Logon Autostart Execution
This ticket can then be used to perform Pass the Ticket attacks.
Technique: T1550: Use Alternate Authentication Material
Though this is unsophisticated, a remote shell does provide a highly flexible and powerful means of remote access in the hands of a skilled attacker
Technique: T1059: Command and Scripting Interpreter
The SQLRat script is designed to make a direct SQL connection to a Microsoft database controlled by the attackers and execute the contents of various tables
Technique: T1105: Ingress Tool Transfer
TajMahal has the ability to identify the MAC address on an infected host.
Technique: T1016: System Network Configuration Discovery
Year  Country  Industry  Malware  2014  Vietnam  Network Security  WINDSHIELD  2014  Germany  Manufacturing  WINDSHIELD  2015  Vietnam  Media  WINDSHIELD  2016  Philippines  Consumer products  KOMPROGO WINDSHIELD SOUNDBITE BEACON   2016  Vietnam  Banking  WINDSHIELD  2016  Philippines  Technology Infrastructure  WINDSHIELD  2016  China  Hospitality  WINDSHIELD  2016  Vietnam  Media  WINDSHIELD  2016  United States  Consumer Products  WINDSHIELD PHOREAL BEACON SOUNDBITE  Table 1: APT32 Private Sector Targeting Identified by FireEye APT32 Interest in Political Influence and Foreign Governments In addition to focused targeting of the private sector with ties to Vietnam, APT32 has also targeted foreign governments, as well as Vietnamese dissidents and journalists since at least 2013
Technique: T1068: Exploitation for Privilege Escalation
However, it is common for Windows to search in the directory of the initiating program before searching through the Windows system directory.
Technique: T1574: Hijack Execution Flow
Backdoor.Oldrea collects address book information from Outlook.
Technique: T1087: Account Discovery
Adversaries may also steal code signing materials directly from a compromised third-party.
Technique: T1588: Obtain Capabilities
icacls . /grant Everyone:F /T /C /Q
Technique: T1222: File and Directory Permissions Modification
UNC2452 used dynamic DNS resolution to construct and resolve to randomly-generated subdomains for C2.
Technique: T1568: Dynamic Resolution
HOPLIGHT has been observed loading several APIs associated with Pass the Hash.
Technique: T1550: Use Alternate Authentication Material
The Proc filesystem on Linux contains a great deal of information regarding the state of the running operating system.
Technique: T1003: OS Credential Dumping
The Registry key contains entries for the following:
* Local Port
* Standard TCP/IP Port
* USB Monitor
* WSD Port
Adversaries can use this technique to load malicious code at startup that will persist on system reboot and execute as SYSTEM.
Technique: T1547: Boot or Logon Autostart Execution
CHOPSTICK used a proxy server between victims and the C2 server.
Technique: T1090: Proxy
(Source: SecureWorks) In multiple instances, CTU researchers observed artifacts from unsuccessful attempts to create a web shell on web-accessible JBOSS-based service desk software, followed by use of a functional shell to gain access to the environment
Technique: T1505: Server Software Component
APT32 has cleared select event log entries.
Technique: T1070: Indicator Removal on Host
Ramsay has created Registry Run keys to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
HttpBrowser's executable code may be obfuscated through structured exception handling and return-oriented programming
Technique: T1027: Obfuscated Files or Information
POWERSTATS has used get_tasklist to discover processes on the compromised host.
Technique: T1057: Process Discovery
There is a variant of RATANKBA that uses a PowerShell script instead of the traditional PE form.
Technique: T1059: Command and Scripting Interpreter
OilRig has also used CVE-2017-11774 to roll back the initial patch designed to protect against Home Page abuse.
Technique: T1137: Office Application Startup
TA505 has leveraged rundll32.exe to execute malicious DLLs.
Technique: T1218: Signed Binary Proxy Execution
REvil has infected victim machines through compromised websites and exploit kits.
Technique: T1189: Drive-by Compromise
Versions of Babuk have been packed.
Technique: T1027: Obfuscated Files or Information
CosmicDuke steals user files from removable media with file extensions and keywords that match a predefined list.
Technique: T1025: Data from Removable Media
zwShell can browse the file system.
Technique: T1083: File and Directory Discovery
Similar to Domain Accounts, compromise of federated cloud accounts may allow adversaries to more easily move laterally within an environment.
Technique: T1078: Valid Accounts
Register the RUN key in the registry below, so that the VBS file is executed every time the machine starts
Technique: T1547: Boot or Logon Autostart Execution
Zeus Panda checks for the existence of a Registry key and if it contains certain values.
Technique: T1012: Query Registry
Gamaredon Group has also used its backdoors to automatically list interesting files  found on a system.
Technique: T1083: File and Directory Discovery
Table 2 Sandbox evasion checks in the C# variant of RogueRobin Like the original version, the C# variant of RogueRobin uses DNS tunneling to communicate with its C2 server using a variety of different DNS query types
Technique: T1071: Application Layer Protocol
Denis exploits a security vulnerability to load a fake DLL and execute its code.
Technique: T1574: Hijack Execution Flow
Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.
Technique: T1497: Virtualization/Sandbox Evasion
The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key.
Technique: T1555: Credentials from Password Stores
It also has a command to spawn a command shell.
Technique: T1059: Command and Scripting Interpreter
to bypass existing defenses within the environment.
Technique: T1610: Deploy Container
An adversary may access the Docker API to collect logs that contain credentials to cloud, container, and various other resources in the environment.
Technique: T1552: Unsecured Credentials
The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers .
Technique: T1555: Credentials from Password Stores
ComRAT has used HTTP requests for command and control.
Technique: T1071: Application Layer Protocol
The file name refers to an entry in the IMPORT directory or a forwarded EXPORT.
Technique: T1129: Shared Modules
GeminiDuke collects information on running processes and environment variables from the victim.
Technique: T1057: Process Discovery
Sidewinder has used tools to identify the user of a compromised host.
Technique: T1033: System Owner/User Discovery
APT19 launched an HTTP malware variant and a Port 22 malware variant using a legitimate executable that loaded the malicious DLL.
Technique: T1574: Hijack Execution Flow
Emotet has been observed to hook network APIs to monitor network traffic.
Technique: T1040: Network Sniffing
This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Technique: T1001: Data Obfuscation
China Chopper's server component can change the timestamp of files.
Technique: T1070: Indicator Removal on Host
Typically, this file keeps track of the user’s last 500 commands.
Technique: T1552: Unsecured Credentials
NOKKI is written to %LOCALAPPDATA%\MicroSoft Updatea\svServiceUpdate.exe prior being executed in a new process in an apparent attempt to masquerade as a legitimate folder and file.
Technique: T1036: Masquerading
Example of decoded keylogger output
Technique: T1056: Input Capture
UNC2452 has compromised domains to use for C2.
Technique: T1584: Compromise Infrastructure
Unknown Logger can obtain information about the victim usernames.
Technique: T1033: System Owner/User Discovery
Specifically, the following subkeys have been known to be possibly vulnerable to abuse: 
* Winlogon\Notify - points to notification package DLLs that handle Winlogon events
* Winlogon\Userinit - points to userinit.exe, the user initialization program executed when a user logs on
* Winlogon\Shell - points to explorer.exe, the system shell executed when a user logs on
Adversaries may take advantage of these features to repeatedly execute malicious code and establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
zwShell has used SchTasks for execution.
Technique: T1053: Scheduled Task/Job
NanoCore has the capability to download and activate additional modules for execution.
Technique: T1105: Ingress Tool Transfer
LOWBALL command and control occurs via HTTPS over port 443.
Technique: T1071: Application Layer Protocol
With SYSTEM access, the tools/utilities such as Mimikatz, Reg, and secretsdump.py can be used to extract the cached credentials.
Technique: T1003: OS Credential Dumping
SMOKEDHAM has been delivered via malicious links in phishing emails.
Technique: T1598: Phishing for Information
Most strings in USBStealer are encrypted using 3DES and XOR and reversed.
Technique: T1027: Obfuscated Files or Information
Starting with .NET Framework 4, the profiling DLL does not need to be registered as long as the location of the DLL is specified in the COR_PROFILER_PATH environment variable.
Technique: T1574: Hijack Execution Flow
VERMIN gathers the local IP address.
Technique: T1016: System Network Configuration Discovery
Dyre has the ability to directly inject its code into the web browser process.
Technique: T1055: Process Injection
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
Technique: T1036: Masquerading
zwShell has established persistence by adding itself as a new service.
Technique: T1543: Create or Modify System Process
USBferry can use tasklist to gather information about the process running on the infected system.
Technique: T1057: Process Discovery
Silent Librarian has acquired domains to establish credential harvesting pages, often spoofing the target organization and using free top level domains .TK, .ML, .GA, .CF, and .GQ.
Technique: T1583: Acquire Infrastructure
MiniDuke can create a process on a compromised host.
Technique: T1543: Create or Modify System Process
QakBot can use signed loaders to evade detection.
Technique: T1553: Subvert Trust Controls
menuPass has used valid accounts including shared between Managed Service Providers and clients to move between the two environments.
Technique: T1078: Valid Accounts
Orz can download files onto the victim.
Technique: T1105: Ingress Tool Transfer
Operation Wocao has used scheduled tasks to execute malicious PowerShell code on remote systems.
Technique: T1053: Scheduled Task/Job
For example, if there is a Mach-O executable file called evil.bin, when it is double clicked by a user, it will launch Terminal.app and execute.
Technique: T1036: Masquerading
APT12 has used multiple variants of DNS Calculation including multiplying the first two octets of an IP address and adding the third octet to that value in order to get a resulting command and control port.
Technique: T1568: Dynamic Resolution
Kwampirs collects a list of active and listening connections by using the command netstat -nao as well as a list of available network mappings with net use.
Technique: T1049: System Network Connections Discovery
Adversaries may attempt to list ACLs for objects to determine the owner and other accounts with access to the object, for example, via the AWS GetBucketAcl API .
Technique: T1069: Permission Groups Discovery
This may compromise the integrity of security solutions by causing notable events to go unreported.
Technique: T1070: Indicator Removal on Host
Adversaries may duplicate then impersonate another user's token to escalate privileges and bypass access controls.
Technique: T1134: Access Token Manipulation
Otherwise, the implanted code will pass the credentials on for verification of potentially valid credentials.
Technique: T1556: Modify Authentication Process
ps 
Technique: T1057: Process Discovery
Fox Kitten has used sticky keys to launch a command prompt.
Technique: T1546: Event Triggered Execution
Cuba has executed hidden PowerShell windows.
Technique: T1564: Hide Artifacts
When this occurs, the process also takes on the security context associated with the new token.
Technique: T1134: Access Token Manipulation
APT3 enables the Remote Desktop Protocol for persistence.
Technique: T1021: Remote Services
AuditCred can delete files from the system.
Technique: T1070: Indicator Removal on Host
By disabling Windows event logging, adversaries can operate while leaving less evidence of a compromise behind.
Technique: T1562: Impair Defenses
Note that the username could be a small joke on the attackers’ part regarding the attribution to FIN7
Technique: T1033: System Owner/User Discovery
* **Note:** The above hijacks are also possible without modifying the Registry via DLL Search Order Hijacking.
Technique: T1553: Subvert Trust Controls
Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Technique: T1068: Exploitation for Privilege Escalation