HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
FBI has high confidence that HIDDEN COBRA actors are using the IP addresses for further network exploitation.This alert includes technical indicators related to specific North Korean government cyber operations and provides suggested response actions to those indicators, recommended mitigation techniques, and information on reporting incidents to the U.S
Technique: T1016: System Network Configuration Discovery
SNUGRIDE is capable of executing commands and spawning a reverse shell.
Technique: T1059: Command and Scripting Interpreter
Malicious files or data can be obfuscated and hidden inside of HTML files through Data URLs and/or JavaScript Blobs and can be deobfuscated when they reach the victim  Deobfuscate/Decode Files or Information, potentially bypassing content filters.
Technique: T1027: Obfuscated Files or Information
A RedLeaves configuration file is encrypted with a simple XOR key, 0x53.
Technique: T1027: Obfuscated Files or Information
Okrum mimics HTTP protocol for C2 communication, while hiding the actual messages in the Cookie and Set-Cookie headers of the HTTP requests.
Technique: T1001: Data Obfuscation
TSCookie has the ability to discover drive information on the infected host.
Technique: T1083: File and Directory Discovery
LightNeuron can collect files from a local system.
Technique: T1005: Data from Local System
UNC2452 used PowerShell to create new tasks on remote machines, identify configuration settings, exfiltrate data, and to execute other commands.
Technique: T1059: Command and Scripting Interpreter
SodaMaster has the ability to download additional payloads from C2 to the targeted system.
Technique: T1105: Ingress Tool Transfer
Adversaries may deploy a container into an environment to facilitate execution or evade defenses.
Technique: T1610: Deploy Container
Windshift has used Visual Basic 6  payloads.
Technique: T1059: Command and Scripting Interpreter
Elise can download additional files from the C2 server for execution.
Technique: T1105: Ingress Tool Transfer
Pony has attempted to lure targets into clicking links in spoofed emails from legitimate banks.
Technique: T1204: User Execution
Conficker variants spread through NetBIOS share propagation.
Technique: T1021: Remote Services
Infected computers become part of a P2P botnet that can relay C2 traffic to other infected peers.
Technique: T1090: Proxy
ADVSTORESHELL stores output from command execution in a .dat file in the %TEMP% directory.
Technique: T1074: Data Staged
PoetRAT checked the size of the hard drive to determine if it was being run in a sandbox environment.
Technique: T1497: Virtualization/Sandbox Evasion
The LNK file is moved to the startup directory
Technique: T1547: Boot or Logon Autostart Execution
BabyShark has executed the ver command.
Technique: T1082: System Information Discovery
Sykipot may use net view /domain to display hostnames of available systems on a network.
Technique: T1018: Remote System Discovery
APT34 has used WMI for execution.
Technique: T1047: Windows Management Instrumentation
Data captured by RawPOS is placed in a temporary file under a directory named "memdump".
Technique: T1074: Data Staged
Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
Technique: T1037: Boot or Logon Initialization Scripts
PolyglotDuke can use Twitter, Reddit, Imgur and other websites to get a C2 URL.
Technique: T1102: Web Service
Examples have been found in the wild and there are some open source projects.
Technique: T1547: Boot or Logon Autostart Execution
OSX_OCEANLOTUS.D sets the main loader file’s attributes to hidden.
Technique: T1564: Hide Artifacts
Gazer can establish persistence by creating a .lnk file in the Start menu or by modifying existing .lnk files to execute the malware through cmd.exe.
Technique: T1547: Boot or Logon Autostart Execution
IcedID has packed and encrypted its loader module.
Technique: T1027: Obfuscated Files or Information
The print spooler service runs under SYSTEM level permissions, therefore print processors installed by an adversary may run under elevated privileges.
Technique: T1547: Boot or Logon Autostart Execution
Kazuar gathers information about opened windows.
Technique: T1010: Application Window Discovery
Clipboard stealer 
Technique: T1115: Clipboard Data
Login items can be added via a shared file list or Service Management Framework.
Technique: T1547: Boot or Logon Autostart Execution
Valak has returned C2 data as encoded ASCII.
Technique: T1132: Data Encoding
(Source: SecureWorks)  China Chopper web shell — This web-based executable script communicates with a full-featured user interface to allow threat actors to transfer and create files, open a command terminal, and interact with database servers
Technique: T1505: Server Software Component
gh0st RAT can create a new service to establish persistence.
Technique: T1543: Create or Modify System Process
LightNeuron encrypts its configuration files with AES-256.
Technique: T1027: Obfuscated Files or Information
After initial installation, Raindrop runs a computation to delay execution.
Technique: T1497: Virtualization/Sandbox Evasion
Code repositories are tools/services that store source code and automate software builds.
Technique: T1213: Data from Information Repositories
Nibatad is also a loader that leverages search order hijacking, and downloads an encrypted payload to the infected computer.
Technique: T1574: Hijack Execution Flow
Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well.
Technique: T1046: Network Service Scanning
For example, "example.exe" runs "cmd.exe" with the command-line argument net user.
Technique: T1574: Hijack Execution Flow
Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation.
Technique: T1036: Masquerading
TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge, sometimes using esentutl.
Technique: T1555: Credentials from Password Stores
Bonadan can use the ps command to discover other cryptocurrency miners active on the system.
Technique: T1057: Process Discovery
SpyNote RAT captured the device’s screen activities along with audio using the  MediaProjectionCallback functionality (available with Lollipop, the Android 5.0 release, and later) and saved the output in a file named "video.mp4" as shown in the following screenshot:          Figure 5 : Output File     SMS stealing  SpyNote RAT was also observed stealing SMS messages from the affected devices, as shown in screenshot below:          Figure 6: Reading SMS messages     Stealing contacts The ability to steal contacts is a favorite feature for spyware developers, as the stolen contacts can be used to further spread the spyware
Technique: T1113: Screen Capture
Nerex drops a signed Microsoft DLL to disk.
Technique: T1553: Subvert Trust Controls
CHM execution may also bypass application application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe.
Technique: T1218: Signed Binary Proxy Execution
TajMahal has the ability to index and compress files into a send queue for exfiltration.
Technique: T1119: Automated Collection
In addition to Dynamic-link Library Injection, Mavinject.exe can also be abused to perform import descriptor injection via its  /HMODULE command-line parameter .
Technique: T1218: Signed Binary Proxy Execution
Penquin can execute the command code do_upload to send files to C2.
Technique: T1041: Exfiltration Over C2 Channel
NETWIRE has used a custom encryption algorithm to encrypt collected data.
Technique: T1560: Archive Collected Data
Bandook can upload files from a victim's machine over the C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features.
Technique: T1546: Event Triggered Execution
Messages are encrypted using AES with a static key
Technique: T1027: Obfuscated Files or Information
Services, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges.
Technique: T1543: Create or Modify System Process
Azorult uses an XOR key to decrypt content and uses Base64 to decode the C2 address.
Technique: T1140: Deobfuscate/Decode Files or Information
APT28 can exfiltrate data over Google Drive.
Technique: T1567: Exfiltration Over Web Service
The data above contains the hostname (‘HOSTNAME-PC’) of the victim machine, as well as an instruction
Technique: T1082: System Information Discovery
These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely.
Technique: T1059: Command and Scripting Interpreter
SOUNDBITE is capable of modifying the Registry.
Technique: T1112: Modify Registry
Some TrickBot samples have used HTTP over ports 447 and 8082 for C2.
Technique: T1571: Non-Standard Port
Kimsuky has used mshta.exe to run malicious scripts on the system.
Technique: T1218: Signed Binary Proxy Execution
TinyZBot can disable Avira anti-virus.
Technique: T1562: Impair Defenses
SUNBURST created an Image File Execution Options  Debugger registry value for the process dllhost.exe to trigger the installation of Cobalt Strike.
Technique: T1546: Event Triggered Execution
Execution via Thread Execution Hijacking may also evade detection from security products since the execution is masked under a legitimate process.
Technique: T1055: Process Injection
Once the user clicks on the fake Adobe Flash Player installer, it will extract/create the following malicious payload into the Startup directory to maintain its persistence:
Technique: T1547: Boot or Logon Autostart Execution
ShimRat can list directories.
Technique: T1083: File and Directory Discovery
SQLRat can make a direct SQL connection to a Microsoft database controlled by the attackers, retrieve an item from the bindata table, then write and execute the file on disk.
Technique: T1105: Ingress Tool Transfer
APT29 has used HTTP for C2 and data exfiltration.
Technique: T1071: Application Layer Protocol
Pasam establishes by infecting the Security Accounts Manager  DLL to load a malicious DLL dropped to disk.
Technique: T1547: Boot or Logon Autostart Execution
SpeakUp attempts to exploit the following vulnerabilities in order to execute its malicious script: CVE-2012-0874, CVE-2010-1871, CVE-2017-10271, CVE-2018-2894, CVE-2016-3088, JBoss AS 3/4/5/6, and the Hadoop YARN ResourceManager.
Technique: T1203: Exploitation for Client Execution
ShadowPad has collected the domain name of the victim system.
Technique: T1016: System Network Configuration Discovery
Variable Name Description   gdu Google Drive URL for downloading files to the Google Drive account   gduu Google Drive URL for uploading files to the Google Drive account   gdue Google Drive URL for updating a file on the Google Drive account   gdo2t Google Drive URL used to get the OAUTH access_token   client_id The client_id for the OAUTH application   cs The client_secret for OAUTH   r_t The refresh_token for OAUTH    Table 6 Variables used to store settings needed to use Google Drive as a C2 To obtain an OAUTH access token to authenticate to the actor provided Google account, the Trojan sends an HTTP POST request to a URL stored in the gdo2t variable with grant_type, client_id, client_secret, and refresh_token fields added to the HTTP header and in the POST data
Technique: T1102: Web Service
Via WMI (winmgmt), the JavaScript or VBscript code in the SCT file spawns a PowerShell one-liner which finally consumes the text file
Technique: T1059: Command and Scripting Interpreter
FatDuke can call ShellExecuteW to open the default browser on the URL localhost.
Technique: T1106: Native API
APT39 has used SMB for lateral movement.
Technique: T1021: Remote Services
PUNCHBUGGY can delete files written to disk.
Technique: T1070: Indicator Removal on Host
The Windows Time service  enables time synchronization across and within domains.
Technique: T1547: Boot or Logon Autostart Execution
MESSAGETAP uses the libpcap library to listen to all traffic and parses network protocols starting with Ethernet and IP layers.
Technique: T1040: Network Sniffing
Ramsay has included embedded Visual Basic scripts in malicious documents.
Technique: T1059: Command and Scripting Interpreter
After the Registry is modified, pressing the appropriate key combination at the login screen while at the keyboard or when connected with Remote Desktop Protocol will cause the "debugger" program to be executed with SYSTEM privileges.
Technique: T1546: Event Triggered Execution
Checks for the presence of security tools (detailed in the Appendix) and if any of these security tools are discovered, then the system will be shut down, as shown in Figure 14
Technique: T1518: Software Discovery
An adversary with sufficient permissions, such as via a pod's service account, may also use the Kubernetes API to retrieve credentials from the Kubernetes API server.
Technique: T1552: Unsecured Credentials
Proxysvc can delete files indicated by the attacker and remove itself from disk using a batch file.
Technique: T1070: Indicator Removal on Host
BitPaymer can enumerate existing Windows services on the host that are configured to run as LocalSystem.
Technique: T1007: System Service Discovery
The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the ~/.bash_history file when a user logs out.
Technique: T1562: Impair Defenses
Turian has the ability to use a XOR decryption key to extract C2 server domains and IP addresses.
Technique: T1140: Deobfuscate/Decode Files or Information
REvil can decode encrypted strings to enable execution of commands and payloads.
Technique: T1140: Deobfuscate/Decode Files or Information
For example, starting in MS Office 10, if a MS Office file has the MOTW, it will open in Protected View.
Technique: T1553: Subvert Trust Controls
RDAT has used DNS to communicate with the C2.
Technique: T1071: Application Layer Protocol
Bonadan can find the external IP address of the infected host.
Technique: T1016: System Network Configuration Discovery
Microsoft Office documents can be poisoned with DDE commands  , directly or through embedded files , and used to deliver execution via Phishing campaigns or hosted Web content, avoiding the use of Visual Basic for Applications  macros.
Technique: T1559: Inter-Process Communication
Adversaries may also add the Parameters key, which stores driver-specific data, or other custom subkeys for their malicious services to establish persistence or enable other malicious activities.
Technique: T1574: Hijack Execution Flow
Similar to Process Hollowing, proc memory injection may target child processes .
Technique: T1055: Process Injection
Turla has gathered credentials from the Windows Credential Manager tool.
Technique: T1555: Credentials from Password Stores
After the second DLL is loaded into memory, the first DLL overwrites the IP address for the control server, effectively changing the address the malware will communicate with
Technique: T1016: System Network Configuration Discovery
Adversaries can use the network CLI to change how network devices behave and operate.
Technique: T1059: Command and Scripting Interpreter
APT29 has used GoldFinder to perform HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request travels through.
Technique: T1016: System Network Configuration Discovery
Adversaries can hide a program's true filetype by changing the extension of a file.
Technique: T1036: Masquerading
The file appears to have been compiled using a bat2exe tool, which will take batch files (.bat) and convert them to PE (.exe) files
Technique: T1083: File and Directory Discovery
Microsoft SQL Server can enable common language runtime  integration.
Technique: T1505: Server Software Component
Instead of setting up their own DNS servers, adversaries may compromise third-party DNS servers in support of operations.
Technique: T1584: Compromise Infrastructure
This may be done to evade some defenses, such as static indicator scanning tools and anti-virus.
Technique: T1564: Hide Artifacts
DownPaper uses the command line.
Technique: T1059: Command and Scripting Interpreter
Cobalt Strike can exploit Oracle Java vulnerabilities for execution, including CVE-2011-3544, CVE-2013-2465, CVE-2012-4681, and CVE-2013-2460.
Technique: T1203: Exploitation for Client Execution
PLEAD has the ability to steal saved credentials from web browsers.
Technique: T1555: Credentials from Password Stores
The Citrix executable was dropped along with BBSRAT by the dropper.
Technique: T1574: Hijack Execution Flow
APT39 has used the post exploitation tool CrackMapExec to enumerate network shares.
Technique: T1135: Network Share Discovery
Ursnif droppers have used WMI classes to execute PowerShell commands.
Technique: T1047: Windows Management Instrumentation
Lokibot has the ability to initiate contact with command and control  to exfiltrate stolen data.
Technique: T1041: Exfiltration Over C2 Channel
For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443.
Technique: T1571: Non-Standard Port
Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.
Technique: T1016: System Network Configuration Discovery
TrickBot uses vncDll module to remote control the victim machine.
Technique: T1219: Remote Access Software
APT38 uses a tool called CLEANTOAD that has the capability to modify Registry keys.
Technique: T1112: Modify Registry
Goopy has used a polymorphic decryptor to decrypt itself at runtime.
Technique: T1140: Deobfuscate/Decode Files or Information
Darkhotel has sent spearphishing emails in an attempt to lure users into clicking on a malicious attachments.
Technique: T1204: User Execution
CosmicDuke contains a custom version of the RC4 algorithm that includes a programming error.
Technique: T1573: Encrypted Channel
Sidewinder has used tools to obtain the current system time.
Technique: T1124: System Time Discovery
The key can be hardcoded or negotiated with the C2 server in the registration phase.
Technique: T1573: Encrypted Channel
File systems can also contain other structures, such as the Volume Boot Record  and Master File Table  in NTFS.
Technique: T1564: Hide Artifacts
The script self-scheduling, as well as the scheduling of a script that repeatedly attempts to download and execute the Revenge RAT binary, significantly contribute to the persistence of this infection
Technique: T1105: Ingress Tool Transfer
FruitFly has the ability to list processes on the system.
Technique: T1057: Process Discovery
This information could be useful for performing other techniques, such as executing a file with a Scheduled Task/Job , or to discover locality information based on time zone to assist in victim targeting  System Location Discovery.
Technique: T1124: System Time Discovery
A Network DoS will occur when the bandwidth capacity of the network connection to a system is exhausted due to the volume of malicious traffic directed at the resource or the network connections and network devices the resource relies on.
Technique: T1498: Network Denial of Service
When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list  file found in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents.
Technique: T1543: Create or Modify System Process
!CMD  Trojan executes a command prompt command
Technique: T1059: Command and Scripting Interpreter
LONGWATCH is a keylogger that outputs keystrokes to a log.txt file in the Window’s temp folder.
Technique: T1056: Input Capture
SHA256  a77f9e441415dbc8a20ad66d4d00ae606faab370ffaee5604e93ed484983d3ff   MD5 1ff40e79d673461cd33bd8b68f8bb5b8   Compiled 2017.08.06 11:32:36 (GMT), 2.22   Type I386 Windows Console EXE   Size 101 888    Instead of implementing this auxiliary module in the form of a dynamic linked library with its corresponding exported functions, the developers decided to use a standalone executable started by events.exe with the following parameters:    Parameter Description   -scr Screenshot file name to save in Cache006 subdirectory, zipped with password from configuration
Technique: T1036: Masquerading
GreyEnergy uses PsExec locally in order to execute rundll32.exe at the highest privileges .
Technique: T1218: Signed Binary Proxy Execution
Cobalt Strike can use known credentials to run commands and spawn processes as a domain user account.
Technique: T1078: Valid Accounts
Kwampirs collects OS version information such as registered owner details, manufacturer details, processor type, available storage, installed patches, hostname, version info, system date, and other system information by using the commands systeminfo, net config workstation, hostname, ver, set, and date /t.
Technique: T1082: System Information Discovery
UNC2452 renamed a version of AdFind to sqlceip.exe or csrss.exe in an attempt to appear as the SQL Server Telemetry Client or Client Service Runtime Process, respectively.
Technique: T1036: Masquerading
The KDC service runs all on domain controllers that are part of an Active Directory domain.
Technique: T1558: Steal or Forge Kerberos Tickets
Equation has been observed utilizing environmental keying in payload delivery.
Technique: T1480: Execution Guardrails
GoldMax appeared as a scheduled task impersonating systems management software within the corresponding ProgramData subfolder.
Technique: T1036: Masquerading
jRAT can be configured to reconnect at certain intervals.
Technique: T1029: Scheduled Transfer
PLAINTEE encodes C2 beacons using XOR.
Technique: T1573: Encrypted Channel
SideTwist can collect the username on a targeted system.
Technique: T1033: System Owner/User Discovery
Some methods include:
* Hooking API callbacks used for processing keystrokes.
Technique: T1056: Input Capture
They are known for “living off the land,” meaning they use already available tools and software installed on the computer to operate, and once inside a target network, they will tailor their malware specifically to the target
Technique: T1518: Software Discovery
This information can then be transmitted to the attacker using protocols such as FTP, HTTP, and SMTP
Technique: T1071: Application Layer Protocol
Mofang's spearphishing emails required a user to click the link to connect to a compromised website.
Technique: T1204: User Execution
Frankenstein has deobfuscated base64-encoded commands following the execution of a malicious script, which revealed a small script designed to obtain an additional payload.
Technique: T1140: Deobfuscate/Decode Files or Information
Alarmingly, the detection score on VirusTotal for all of the documents continues to be 0/56 from the time the first documents were uploaded (1.6.2017) up until the date of this publication
Technique: T1124: System Time Discovery
These profilers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR.
Technique: T1574: Hijack Execution Flow
Carbanak has a command to create a reverse shell.
Technique: T1059: Command and Scripting Interpreter
Rancor has used VBS scripts as well as embedded macros for execution.
Technique: T1059: Command and Scripting Interpreter
Drovorub can use the WebSocket protocol and has initiated communication with C2 servers with an HTTP Upgrade request.
Technique: T1071: Application Layer Protocol
In addition, although the 2017 campaign has been documented, during our research regarding MirageFox, we found a recently uploaded binary (6/8/2018) from the 2017 campaign, pretty much identical to a RAT mentioned in their RoyalAPT report, barely detected with only 7/66 detections on VirusTotal.  APT15 Code Reuse We found the new version of the RAT on VirusTotal hunting, by a YARA signature we created based off code only found in Mirage and Reaver, both attributed to Chinese government affiliated groups
Technique: T1571: Non-Standard Port
Nebulae can use DLL side-loading to gain execution.
Technique: T1574: Hijack Execution Flow
JavaScript for Automation  is a macOS scripting language based on JavaScript, included as part of Apple’s Open Scripting Architecture , that was introduced in OSX 10.10.
Technique: T1059: Command and Scripting Interpreter
APT19 sent spearphishing emails with malicious attachments in RTF and XLSM formats to deliver initial exploits.
Technique: T1566: Phishing
APT41 has used DGAs to change their C2 servers monthly.
Technique: T1568: Dynamic Resolution
navlu.dll is also the name of a legitimate Symantec DLL.
Technique: T1036: Masquerading
Emissary has the capability to execute the command net start to interact with services.
Technique: T1007: System Service Discovery
FELIXROOT has also used WMI to query the Windows Registry.
Technique: T1012: Query Registry
Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service.
Technique: T1567: Exfiltration Over Web Service
3PARA RAT has a command to set certain attributes such as creation/modification timestamps on files.
Technique: T1070: Indicator Removal on Host
MoleNet can execute commands via the command line utility.
Technique: T1059: Command and Scripting Interpreter
Shamoon will reboot the infected system once the wiping functionality has been completed.
Technique: T1529: System Shutdown/Reboot
An adversary may hide malicious VBA code by overwriting the VBA source code location with zero’s, benign code, or random bytes while leaving the previously compiled malicious p-code.
Technique: T1564: Hide Artifacts
Operation Wocao has used the net command to retrieve information about domain accounts.
Technique: T1087: Account Discovery
Chimera has renamed malware to GoogleUpdate.exe and WinRAR to jucheck.exe, RecordedTV.ms, teredo.tmp, update.exe, and msadcs1.exe.
Technique: T1036: Masquerading
LookBack can take desktop screenshots.
Technique: T1113: Screen Capture
Ebury has used DNS requests over UDP port 53 for C2.
Technique: T1071: Application Layer Protocol
Chimera has used direct Windows system calls by leveraging Dumpert.
Technique: T1106: Native API
ABK has the ability to inject shellcode into svchost.exe.
Technique: T1055: Process Injection
When we converted the dates in the file strings from the Solar Hijri calendar to the Gregorian one, we found that they were close to the compilation times of the executables and also close to when Cadelle’s targets were initially compromised
Technique: T1027: Obfuscated Files or Information
Proton gathers credentials for Google Chrome.
Technique: T1555: Credentials from Password Stores
Packing an executable changes the file signature in an attempt to avoid signature-based detection.
Technique: T1027: Obfuscated Files or Information
Sidewinder has used tools to identify running processes on the victim's machine.
Technique: T1057: Process Discovery
APT33 has sent spearphishing emails containing links to .hta files.
Technique: T1566: Phishing
The certificates used during an operation may be created, acquired, or stolen by the adversary.
Technique: T1553: Subvert Trust Controls
Epic uses HTTP and HTTPS for C2 communications.
Technique: T1071: Application Layer Protocol
Adversaries may modify code signing policies in a number of ways, including through use of command-line or GUI utilities, Modify Registry, rebooting the computer in a debug/recovery mode, or by altering the value of variables in kernel memory.
Technique: T1553: Subvert Trust Controls
Blue Mockingbird has used Remote Desktop to log on to servers interactively and manually copy files to remote hosts.
Technique: T1021: Remote Services
FIN8 has used remote code execution to download subsequent payloads.
Technique: T1105: Ingress Tool Transfer
OilRig has used reg query “HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default” on a victim to query the Registry.
Technique: T1012: Query Registry
Adversaries can modify these values to continually execute arbitrary commands.
Technique: T1546: Event Triggered Execution
This attribute, also known as a quarantine flag, is read by Apple's Gatekeeper defense program when the file is run and provides a prompt to the user to allow or deny execution.
Technique: T1553: Subvert Trust Controls
POST /api/osx/started HTTP/1.1Host: r2elajikcosf7zee.onion.toAccept: */*Content-Length: 233Content-Type: application/x-www-form-urlencodedbot_id=9a8965ba04e72909f36c8d16aa801794c6d905d045c2b704e8f0a9bbb97d3eb8&amp;data=psX0DKYB0u...5TximyY%2BQY%3D     Figure 10: Malware sending initial information       &gt; rc4decrypt(base64decode("psX0DKYB0u...5TximyY+QY="), "u2RLhh+!LGd9p8!ZtuKcN")device_model=MacBookPro9,2bot_version=1.3.5build_name=elitef*ckos_version=15.5.0ip_address=4.5.6.7has_root=0     Figure 11: Decoded data sent to C&C The bot_id is constructed by hashing the following values with SHA-256:  The hardware UUID (IOPlatformUUID) The system serial number (IOPlatformSerialNumber) The model identifier of the Mac (e.g.: MacBookPro9,2)  Most actions are self-explanatory
Technique: T1082: System Information Discovery
Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.
Technique: T1547: Boot or Logon Autostart Execution
The loader component is executed via RUNDLL32.EXE
Technique: T1218: Signed Binary Proxy Execution
EVILNUM can search for anti-virus products on the system.
Technique: T1518: Software Discovery
These services are more likely to have a less-strict security policy than an enterprise.
Technique: T1598: Phishing for Information
MuddyWater has used a PowerShell backdoor to check for Skype connections on the target machine.
Technique: T1049: System Network Connections Discovery
Fox Kitten has downloaded additional tools including PsExec directly to endpoints.
Technique: T1105: Ingress Tool Transfer
APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.
Technique: T1112: Modify Registry
The OopsIE payload checks to see if the result of this query as more than 0 elements to determine if it is running on a virtual machine
Technique: T1497: Virtualization/Sandbox Evasion
CARROTBAT has the ability to download a base64 encoded payload and execute obfuscated commands on the infected host.
Technique: T1027: Obfuscated Files or Information
Ragnar Locker has used VirtualBox and a stripped Windows XP virtual machine to run itself.
Technique: T1564: Hide Artifacts
Dark Caracal has used UPX to pack Bandook.
Technique: T1027: Obfuscated Files or Information
COM payloads executed by verclsid.exe may be able to perform various malicious actions, such as loading and executing COM scriptlets  from remote servers .
Technique: T1218: Signed Binary Proxy Execution
The Bazar loader has used dual-extension executable files such as PreviewReport.DOC.exe.
Technique: T1036: Masquerading
A menuPass macro deletes files after it has decoded and decompressed them.
Technique: T1070: Indicator Removal on Host
TrickBot can Base64-encode C2 commands.
Technique: T1132: Data Encoding
Subsequently, pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over Remote Desktop Protocol will cause the replaced file to be executed with SYSTEM privileges.
Technique: T1546: Event Triggered Execution
In another case the attackers use another code snippet borrowed from the SubTee GitHub project, this time filling in a fully templated .NET application whitelist bypass file: SHA256: 3e9136f95fa55852993cd15b82fe6ec54f78f34584f7689b512a46f0a22907f2: This time the attacker didn’t have to write any of their own code, instead they were simply able to paste their shellcode directly into a template, in order to launch PlugX as a child process of a trusted application
Technique: T1124: System Time Discovery
Figure 2 SYSCON network traffic witnessed during execution   Pivoting on the domain hosting the SYSCON sample, 881.000webhostapp[.]com, revealed a number of additional samples, including a sample of the KONNI malware family, and four 64-bit executable files belonging to the CARROTBAT malware family
Technique: T1105: Ingress Tool Transfer
This ID is sent to the CnC with each request for commands to execute
Technique: T1059: Command and Scripting Interpreter
This time, weaponized lure documents claiming to contain seminar information on environmental protection were observed exploiting known Microsoft Office vulnerabilities CVE-2017-0199 and CVE-2017-11882 to drop and execute the backdoor binary on the victim’s machine
Technique: T1203: Exploitation for Client Execution
Similar to Trusted Developer Utilities Proxy Execution, the Microsoft common line transformation utility binary   can be installed and used to execute malicious JavaScript embedded within local or remote  XSL files.
Technique: T1220: XSL Script Processing
Maze has created scheduled tasks using name variants such as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update", to launch Maze at a specific time.
Technique: T1053: Scheduled Task/Job
Services or processes may not allow for modification of their data stores while running.
Technique: T1489: Service Stop
Dtrack can collect a variety of information from victim machines.
Technique: T1005: Data from Local System
Agent Tesla has the ability to extract credentials from the Registry.
Technique: T1552: Unsecured Credentials
APT28 has used a modified and obfuscated version of the reGeorg web shell to maintain persistence on a target's Outlook Web Access  server.
Technique: T1505: Server Software Component
Kazuar can accept multiple URLs for C2 servers.
Technique: T1008: Fallback Channels
MuddyWater has used a legitimate application, ScreenConnect, to manage systems remotely and move laterally.
Technique: T1219: Remote Access Software
LookBack executes the cmd.exe command.
Technique: T1059: Command and Scripting Interpreter
FruitFly takes screenshots of the user's desktop.
Technique: T1113: Screen Capture
Section 1 The first section of the PowerShell script is responsible for setting different key variables that are used by the remaining sections of the PowerShell script, especially the following variables:  TEMpPAtH = "C:\ProgramData\" (the path used for storing the temp files) Get_vAlIdIP = https://api.ipify.org/ (used to get the public IP address of the machine) FIlENAmePATHP = WindowsDefender.ini (file used to store Powershell code) PRIVAtE = Private Key exponents PUbLIc = Public Key exponents Hklm = "HKLM:\Software\" Hkcu = "HKCU:\Software\" ValuE = "kaspersky" SYSID DrAGon_MidDLe = [array of proxy URLs]  Among those variables, there is one variable of particular interest, DrAGon_MidDLe, which stores the list of proxy URLs (detailed at the end of the blog in the Network Indicators portion of the Indicators of Compromise section) that will be used to interact with the C2 server, as shown in Figure 12
Technique: T1546: Event Triggered Execution
Agent Tesla has the ability to decrypt strings encrypted with the Rijndael symmetric encryption algorithm.
Technique: T1140: Deobfuscate/Decode Files or Information
KGH_SPY has the ability to download and execute code from remote servers.
Technique: T1105: Ingress Tool Transfer
GALLIUM has used VPN services, including SoftEther VPN, to access and maintain persistence in victim environments.
Technique: T1133: External Remote Services
Pony can download additional files onto the infected system.
Technique: T1105: Ingress Tool Transfer
Commands that may obtain information about services using operating system utilities are "sc," "tasklist /svc" using Tasklist, and "net start" using Net, but adversaries may also use other tools as well.
Technique: T1007: System Service Discovery
Nebulae can achieve persistence through a Registry Run key.
Technique: T1547: Boot or Logon Autostart Execution
Conti can enumerate through all open processes to search for any that have the string “sql” in their process name.
Technique: T1057: Process Discovery
There have been numerous incidents where cloud storage has been improperly secured , allowing open access to credit cards, personally identifiable information, medical records, and other sensitive information.
Technique: T1530: Data from Cloud Storage Object
HOPLIGHT has modified Managed Object Format  files within the Registry to run specific commands and create persistence on the system.
Technique: T1112: Modify Registry
Webshell has the ability to create reverse shells with Perl scripts.
Technique: T1059: Command and Scripting Interpreter
An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence.
Technique: T1578: Modify Cloud Compute Infrastructure
Mustang Panda's PlugX variant has created a hidden folder on USB drives named RECYCLE.BIN to store malicious executables and collected data.
Technique: T1564: Hide Artifacts
BlackEnergy has used a plug-in to gather credentials stored in files on the host by various software programs, including The Bat!
Technique: T1552: Unsecured Credentials
Another Lazarus Group malware sample also performs exfiltration over the C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
InvisiMole avoids analysis by encrypting all strings, internal files, configuration data and by using a custom executable format.
Technique: T1027: Obfuscated Files or Information
Leviathan has used an uploader known as LUNCHMONEY that can exfiltrate files to Dropbox.
Technique: T1567: Exfiltration Over Web Service
Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket.
Technique: T1558: Steal or Forge Kerberos Tickets
Variants of Emissary encrypt payloads using various XOR ciphers, as well as a custom algorithm that uses the "srand" and "rand" functions.
Technique: T1027: Obfuscated Files or Information
If an adversary is able to obtain root access, then hijacking SSH sessions is likely trivial.
Technique: T1563: Remote Service Session Hijacking
APT37 has created scheduled tasks to run malicious scripts on a compromised host.
Technique: T1053: Scheduled Task/Job
APT32 ran legitimately-signed executables from Symantec and McAfee which load a malicious DLL.
Technique: T1574: Hijack Execution Flow
Specific checks will vary based on the target and/or adversary, but may involve behaviors such as Query Registry and calls to Native API functions.
Technique: T1614: System Location Discovery
Lazarus Group has stopped the MSExchangeIS service to render Exchange contents inaccessible to users.
Technique: T1489: Service Stop
REvil can check the system language using GetUserDefaultUILanguage and GetSystemDefaultUILanguage.
Technique: T1614: System Location Discovery
TRITON’s TsLow python module pings controllers over the TriStation protocol.
Technique: T1018: Remote System Discovery
Ursnif has used process hollowing to inject into child processes.
Technique: T1055: Process Injection
These files are stored within an 217kb encrypted cab file in the dropper’s resources under the name “A”
Technique: T1027: Obfuscated Files or Information
menuPass has used several tools to scan for open NetBIOS nameservers and enumerate NetBIOS sessions.
Technique: T1016: System Network Configuration Discovery
Sibot has retrieved a GUID associated with a present LAN connection on a compromised machine.
Technique: T1049: System Network Connections Discovery
StrongPity has a file searcher component that can automatically collect and archive files based on a predefined list of file extensions.
Technique: T1119: Automated Collection
Wizard Spider obtained a code signing certificate signed by Digicert for some of its malware.
Technique: T1588: Obtain Capabilities
Evilnum can steal cookies and session information from browsers.
Technique: T1539: Steal Web Session Cookie
gh0st RAT	operators have used dynamic DNS to mask the true location of their C2 behind rapidly changing IP addresses.
Technique: T1568: Dynamic Resolution
The Trojan accesses two resources, named Sch and VBS that contains obfuscated strings that contain the command to create the scheduled task and the VBScript to run
Technique: T1027: Obfuscated Files or Information
Kazuar downloads additional plug-ins to load on the victim’s machine, including the ability to upgrade and replace its own binary.
Technique: T1105: Ingress Tool Transfer
Machete captures screenshots.
Technique: T1113: Screen Capture
down_new has the ability to AES encrypt C2 communications.
Technique: T1573: Encrypted Channel
ThiefQuest prepends a copy of itself to the beginning of an executable file while maintaining the name of the executable.
Technique: T1036: Masquerading
Adversaries may leverage the SharePoint repository as a source to mine valuable information.
Technique: T1213: Data from Information Repositories
Protocols such as SMTP/S, POP3/S, and IMAP that carry electronic mail may be very common in environments.
Technique: T1071: Application Layer Protocol
Adversaries may employ various time-based evasions, such as delaying malware functionality upon initial execution using programmatic sleep commands or native system scheduling functionality .
Technique: T1497: Virtualization/Sandbox Evasion
nltest /domain_trusts 
Technique: T1482: Domain Trust Discovery
The Maze encryption process has used batch scripts with various commands.
Technique: T1059: Command and Scripting Interpreter
Daserf uses file and folder names related to legitimate programs in order to blend in, such as HP, Intel, Adobe, and perflogs.
Technique: T1036: Masquerading
The Exaramel for Windows dropper creates and starts a Windows service named wsmprovav with the description “Windows Check AV” in an apparent attempt to masquerade as a legitimate service.
Technique: T1036: Masquerading
KONNI can steal profiles  from Firefox, Chrome, and Opera.
Technique: T1555: Credentials from Password Stores
Keydnap uses Python for scripting to execute additional commands.
Technique: T1059: Command and Scripting Interpreter
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
Technique: T1485: Data Destruction
ShadowPad has deleted arbitrary Registry values.
Technique: T1070: Indicator Removal on Host
The malware supports several capabilities, such as injecting and executing arbitrary code, uploading and downloading files, and executing shell commands
Technique: T1059: Command and Scripting Interpreter
IcedID can use a self signed TLS certificate in connection with the spoofed site and simultaneously maintains a live connection with the legitimate site to display the correct URL and certificates in the browser.
Technique: T1185: Browser Session Hijacking
After decrypting itself in memory, RARSTONE downloads a DLL file from its C2 server and loads it in the memory space of a hidden Internet Explorer process.
Technique: T1055: Process Injection
Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.
Technique: T1566: Phishing
We would like to thank White-Hat, Tom Lancaster of Palo Alto Networks, Michael Yip of Stroz Friedberg, security researcher Marcus, and other security researchers and organizations who shared information and provided feedback
Technique: T1518: Software Discovery
Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
Technique: T1135: Network Share Discovery
Prior to Drive-by Compromise, adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site.
Technique: T1608: Stage Capabilities
POWERSTATS has used useless code blocks to counter analysis.
Technique: T1027: Obfuscated Files or Information
Leafminer used a tool called Imecab to set up a persistent remote access account on the victim machine.
Technique: T1136: Create Account
Hancitor has used verclsid.exe to download and execute a malicious script.
Technique: T1218: Signed Binary Proxy Execution
Adversaries may create cloud instances in unused geographic service regions in order to evade detection.
Technique: T1535: Unused/Unsupported Cloud Regions
Gamaredon Group has used various batch scripts to establish C2 and download additional files.
Technique: T1059: Command and Scripting Interpreter
USBStealer exfiltrates collected files via removable media from air-gapped victims.
Technique: T1052: Exfiltration Over Physical Medium
Extensions and filters are deployed as DLL files that export three functions: Get{Extension/Filter}Version, Http{Extension/Filter}Proc, and  Terminate{Extension/Filter}.
Technique: T1505: Server Software Component
Goopy has the ability to communicate with its C2 over HTTP.
Technique: T1071: Application Layer Protocol
Depending on the implementation, successful modification of a signing policy may require reboot of the compromised system.
Technique: T1553: Subvert Trust Controls
NBNS Spoofing 
Technique: T1557: Adversary-in-the-Middle
APT39 has installed ANTAK and ASPXSPY web shells.
Technique: T1505: Server Software Component
Examples include creating a container configured to mount the host’s filesystem using the bind parameter, which allows the adversary to drop payloads and execute control utilities such as cron on the host, or utilizing a privileged container to run commands on the underlying host.
Technique: T1611: Escape to Host
These group policies are stored in SYSVOL on a domain controller.
Technique: T1552: Unsecured Credentials
Tonto Team has delivered payloads via spearphishing attachments.
Technique: T1566: Phishing
Naid creates a new service to establish.
Technique: T1543: Create or Modify System Process
Mustang Panda has used mshta.exe to launch collection scripts.
Technique: T1218: Signed Binary Proxy Execution
Mustang Panda used custom batch scripts to collect files automatically from a targeted system.
Technique: T1119: Automated Collection
Patchwork encrypted the collected files' path with AES and then encoded them with base64.
Technique: T1560: Archive Collected Data
Gorgon Group malware can use PowerShell commands to download and execute a payload and open a decoy document on the victim’s machine.
Technique: T1059: Command and Scripting Interpreter
Once FT learned of the attack and began warning employees of the threat, the SEA sent phishing emails mimicking the Financial Times IT department and were able to compromise even more users.
Technique: T1534: Internal Spearphishing
Third-party security software such as endpoint detection and response  tools may not start after booting Windows in safe mode.
Technique: T1562: Impair Defenses
Nebulae has the capability to upload collected files to C2.
Technique: T1005: Data from Local System
Bad Rabbit’s infpub.dat file creates a scheduled task to launch a malicious executable.
Technique: T1053: Scheduled Task/Job
APT32's macOS backdoor changes the permission of the file it wants to execute to 755.
Technique: T1222: File and Directory Permissions Modification
Information about business relationships may also be exposed to adversaries via online or other accessible data sets  or Search Victim-Owned Websites.
Technique: T1591: Gather Victim Org Information
Adversaries may plant trojan dynamic-link library files  in a directory that will be searched before the location of a legitimate library that will be requested by a program, causing Windows to load their malicious library when it is called for by the victim program.
Technique: T1574: Hijack Execution Flow
Sandworm Team has used various MS-SQL stored procedures.
Technique: T1505: Server Software Component
TEMP.Veles has used Virtual Private Server  infrastructure.
Technique: T1583: Acquire Infrastructure
AppleSeed can pull a timestamp from the victim's machine.
Technique: T1124: System Time Discovery
OSX_OCEANLOTUS.D uses a shell script as the main executable inside an app bundle and drops an embedded base64-encoded payload to the /tmp folder.
Technique: T1059: Command and Scripting Interpreter
ROKRAT uses a keylogger to capture keystrokes and location of where the user is typing.
Technique: T1056: Input Capture