HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
Remsec contains a module to move data from airgapped networks to Internet-connected systems by using a removable USB device.
Technique: T1052: Exfiltration Over Physical Medium
Kernel extensions, also called kext, are used for macOS to load functionality onto a system similar to LKMs for Linux.
Technique: T1547: Boot or Logon Autostart Execution
QakBot can capture keystrokes on a compromised host.
Technique: T1056: Input Capture
CookieMiner has retrieved iPhone text messages from iTunes phone backup files.
Technique: T1005: Data from Local System
To ensure data integrity, TxF enables only one transacted handle to write to a file at a given time.
Technique: T1055: Process Injection
An executable dropped onto victims by Putter Panda aims to inject the specified DLL into a process that would normally be accessing the network, including Outlook Express , Outlook , Internet Explorer , and Firefox .
Technique: T1055: Process Injection
Information about network trusts may include a variety of details, including second or third-party organizations/domains  that have connected  network access.
Technique: T1590: Gather Victim Network Information
menuPass has used process hollowing in iexplore.exe to load the RedLeaves implant.
Technique: T1055: Process Injection
Gathering this information may reveal opportunities for other forms of reconnaissance  or Phishing for Information, establishing operational resources , and/or initial access .
Technique: T1589: Gather Victim Identity Information
Activities may include the acquisition of malware, software , exploits, certificates, and information relating to vulnerabilities.
Technique: T1588: Obtain Capabilities
Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems.
Technique: T1059: Command and Scripting Interpreter
ipconfig 
Technique: T1016: System Network Configuration Discovery
DustySky lists all installed software for the infected machine.
Technique: T1518: Software Discovery
Mustang Panda will delete their tools and files, and kill processes after their objectives are reached.
Technique: T1070: Indicator Removal on Host
Poseidon Group tools attempt to spoof anti-virus processes as a means of self-defense.
Technique: T1036: Masquerading
capture screenshot
Technique: T1113: Screen Capture
Examining historical IP resolutions revealed a common IP between the active nameservers, 107.175.75[.]123
Technique: T1016: System Network Configuration Discovery
Remexi takes screenshots of windows of interest.
Technique: T1113: Screen Capture
Stuxnet uses a driver registered as a boot start service as the main load-point.
Technique: T1543: Create or Modify System Process
AuditCred can open a reverse shell on the system to execute commands.
Technique: T1059: Command and Scripting Interpreter
Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution.
Technique: T1203: Exploitation for Client Execution
MirageFox has a function for decrypting data containing C2 configuration information.
Technique: T1140: Deobfuscate/Decode Files or Information
Patchwork ran a reverse shell with Meterpreter.
Technique: T1059: Command and Scripting Interpreter
SQLRat has used SQL to execute JavaScript and VB scripts on the host system.
Technique: T1059: Command and Scripting Interpreter
Bisonal decodes strings in the malware using XOR and RC4.
Technique: T1140: Deobfuscate/Decode Files or Information
Adversaries may abuse the print spooler service by adding print processors that load malicious DLLs at startup.
Technique: T1547: Boot or Logon Autostart Execution
Adversaries may use this information to shape follow-on behaviors, including determining potential attack paths within the target network as well as opportunities to manipulate Group Policy settings  Domain Policy Modification for their benefit.
Technique: T1615: Group Policy Discovery
Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections .
Technique: T1592: Gather Victim Host Information
For example, malware may execute share modules to load additional components or features.
Technique: T1129: Shared Modules
Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel.
Technique: T1048: Exfiltration Over Alternative Protocol
Agent Tesla can add itself to the Registry as a startup program to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
BADCALL disables the Windows firewall before binding to a port.
Technique: T1562: Impair Defenses
Rocke has used SSH private keys on the infected machine to spread its coinminer throughout a network.
Technique: T1552: Unsecured Credentials
Goopy has the ability to enumerate the infected system's user name.
Technique: T1033: System Owner/User Discovery
LoudMiner has obfuscated various scripts and encrypted DMG files.
Technique: T1027: Obfuscated Files or Information
A module in Prikormka collects information from the victim about installed anti-virus software.
Technique: T1518: Software Discovery
KeyBoy has a command to perform screen grabbing.
Technique: T1113: Screen Capture
MiniDuke uses HTTP and HTTPS for command and control.
Technique: T1071: Application Layer Protocol
Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via Unix Shell Configuration Modification or tainting/hijacking other instrumental binary/configuration files via Hijack Execution Flow.
Technique: T1222: File and Directory Permissions Modification
Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via Phishing for Information.
Technique: T1589: Gather Victim Identity Information
Kwampirs copies itself over network shares to move laterally on a victim network.
Technique: T1021: Remote Services
Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.
Technique: T1036: Masquerading
The user may then view it as a benign text file and open it, inadvertently executing the hidden malware.
Technique: T1036: Masquerading
Azorult can encrypt C2 traffic using XOR.
Technique: T1573: Encrypted Channel
Access to Valid Accounts to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network.
Technique: T1133: External Remote Services
Ke3chang performs operating system information discovery using systeminfo.
Technique: T1082: System Information Discovery
Linfo creates a backdoor through which remote attackers can download files onto compromised hosts.
Technique: T1105: Ingress Tool Transfer
Adversaries may inject malicious code into process via Extra Window Memory  in order to evade process-based defenses as well as possibly elevate privileges.
Technique: T1055: Process Injection
The Komplex trojan creates a persistent launch agent called with $HOME/Library/LaunchAgents/com.apple.updates.plist with launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist.
Technique: T1543: Create or Modify System Process
Stuxnet collects the time and date of a system when it is infected.
Technique: T1124: System Time Discovery
McAfee detects these threats as:  RDN/Generic Exploit RDN/Generic.dx Generic PWS.y Generic.hbg Exploit-CVE2018-4878  McAfee customers are also covered by McAfee Global Threat Intelligence Web Reputation classification, which rate these URLs as High Risk
Technique: T1068: Exploitation for Privilege Escalation
Raindrop used steganography to locate the start of its encoded payload within legitimate 7-Zip code.
Technique: T1027: Obfuscated Files or Information
Umbreon provides additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet
Technique: T1205: Traffic Signaling
Magic Hound has used compromised domains to host links targeted to specific phishing victims.
Technique: T1584: Compromise Infrastructure
IPC is typically used by processes to share data, communicate with each other, or synchronize execution.
Technique: T1559: Inter-Process Communication
POWRUNER can use HTTP for C2 communications.
Technique: T1071: Application Layer Protocol
Lokibot has demonstrated the ability to steal credentials from multiple applications and data sources including Safari and the Chromium and Mozilla Firefox-based web browsers.
Technique: T1555: Credentials from Password Stores
Peppy can download and execute remote files.
Technique: T1105: Ingress Tool Transfer
These connections may be direct or may include trying to connect through others.
Technique: T1585: Establish Accounts
The hashes can then in turn be used to create a Golden Ticket for use in Pass the Ticket or change an account's password as noted in Account Manipulation.
Technique: T1003: OS Credential Dumping
FIN6 has used malicious documents to lure victims into allowing execution of PowerShell scripts.
Technique: T1204: User Execution
APT37 has sent spearphishing attachments attempting to get a user to open them.
Technique: T1204: User Execution
The Regin malware platform uses Extended Attributes to store encrypted executables.
Technique: T1564: Hide Artifacts
The number of default cached credentials varies and can be altered per system.
Technique: T1003: OS Credential Dumping
POWERSOURCE uses DNS TXT records for C2.
Technique: T1071: Application Layer Protocol
APT38 has conducted watering holes schemes to gain initial access to victims.
Technique: T1189: Drive-by Compromise
SHA256 Filename PowerShell Filename Variant   5f001f3387ddfc0314446d0c950da2cec4c786e2374d42beb3acce6883bb4e63 <redacted> Technical Services.exe Office365DCOMCheck.ps1 Bat2exe   d948d5b3702e140ef5b9247d26797b6dcdfe4fdb6f367bb217bc6b5fc79df520 tafahom.exe, Sales Modification.exe SystemDiskClean.ps1 .NET    Table 1
Technique: T1036: Masquerading
Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time.
Technique: T1543: Create or Modify System Process
The credentials are stored in the ccache file while they remain valid and generally while a user's session lasts.
Technique: T1558: Steal or Forge Kerberos Tickets
Adversaries may use Valid Accounts to remotely control machines using Virtual Network Computing .
Technique: T1021: Remote Services
Hardware backdoors may be inserted into various devices, such as servers, workstations, network infrastructure, or peripherals.
Technique: T1195: Supply Chain Compromise
BLUELIGHT can collect the username on a compromised host.
Technique: T1033: System Owner/User Discovery
Comnie attempts to detect several anti-virus products.
Technique: T1518: Software Discovery
FIN4 has presented victims with spoofed Windows Authentication prompts to collect their credentials.
Technique: T1056: Input Capture
Sandworm Team has distributed NotPetya by compromising the legitimate Ukrainian accounting software M.E.Doc and replacing a legitimate software update with a malicious one.
Technique: T1195: Supply Chain Compromise
menuPass has used and modified open-source tools like Impacket, Mimikatz, and pwdump.
Technique: T1588: Obtain Capabilities
Rover takes screenshots of the compromised system's desktop and saves them to C:\system\screenshot.bmp for exfiltration every 60 minutes.
Technique: T1113: Screen Capture
Dust Storm has used Android backdoors capable of exfiltrating specific files directly from the infected devices.
Technique: T1005: Data from Local System
It also gathers registered mail, browser, and instant messaging clients from the Registry.
Technique: T1083: File and Directory Discovery
The decoy file, doc.rtf, contains an OLE object that uses Equation Editor to drop the embedded shellcode in %TEMP%
Technique: T1559: Inter-Process Communication
Conti has used API calls during execution.
Technique: T1106: Native API
Daserf uses HTTP for C2.
Technique: T1071: Application Layer Protocol
Skidmap has encrypted it's main payload using 3DES.
Technique: T1027: Obfuscated Files or Information
A PowerShell profile   is a script that runs when PowerShell starts and can be used as a logon script to customize user environments.
Technique: T1546: Event Triggered Execution
Adversaries may do this to hide security alerts, C2 communication, or responses to Internal Spearphishing emails sent from the compromised account.
Technique: T1564: Hide Artifacts
More_eggs has used basE91 encoding, along with encryption, for C2 communication.
Technique: T1132: Data Encoding
Gallmaker sent victims a lure document with a warning that asked victims to “enable content” for execution.
Technique: T1204: User Execution
FLASHFLOOD searches for interesting files  on the local system and removable media.
Technique: T1083: File and Directory Discovery
APT29 used the Get-ManagementRoleAssignment PowerShell cmdlet to enumerate Exchange management role assignments through an Exchange Management Shell.
Technique: T1069: Permission Groups Discovery
To decrease the chance of physically tying back operations to themselves, adversaries may make use of disposable email services.
Technique: T1585: Establish Accounts
These databases can be stored as files on disk.
Technique: T1555: Credentials from Password Stores
Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine.
Technique: T1548: Abuse Elevation Control Mechanism
In infrastructure-as-a-service  environments, after gaining access through Cloud Accounts, adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.
Technique: T1098: Account Manipulation
Once they are deleted by the attackers’ code, there is nothing left to be forensically recovered.
Technique: T1070: Indicator Removal on Host
Metamorfo has automatically collected mouse clicks, continuous screenshots on the machine, and set timers to collect the contents of the clipboard and website browsing.
Technique: T1119: Automated Collection
APT33 has deployed a tool known as DarkComet to the Startup folder of a victim, and used Registry run keys to gain persistence.
Technique: T1547: Boot or Logon Autostart Execution
Configuration Config.ini is the file where the malware stores its encrypted configuration data
Technique: T1027: Obfuscated Files or Information
Bankshot searches for certain Registry keys to be configured before executing the payload.
Technique: T1012: Query Registry
BADCALL communicates on ports 443 and 8000 with a FakeTLS method.
Technique: T1571: Non-Standard Port
Inception has used decoy documents to load malicious remote payloads via HTTP.
Technique: T1221: Template Injection
These resources can be viewed within web applications such as the Kubernetes dashboard or can be queried via the Docker and Kubernetes APIs.
Technique: T1613: Container and Resource Discovery
Recent versions of Cherry Picker delete files and registry keys created by the malware.
Technique: T1070: Indicator Removal on Host
NotPetya determines if specific antivirus programs are running on an infected host machine.
Technique: T1518: Software Discovery
POWRUNER can capture a screenshot from a victim.
Technique: T1113: Screen Capture
Login items are applications, documents, folders, or server connections that are automatically launched when a user logs in.
Technique: T1547: Boot or Logon Autostart Execution
Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.
Technique: T1573: Encrypted Channel
Janicab captured audio and sent it out to a C2 server.
Technique: T1123: Audio Capture
Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Technique: T1071: Application Layer Protocol
ProLock can use BITS jobs to download its malicious payload.
Technique: T1197: BITS Jobs
Other methods may rely on specific user interaction with the system before the malicious code is activated, such as waiting for a document to close before activating a macro  or waiting for a user to double click on an embedded image to activate.
Technique: T1497: Virtualization/Sandbox Evasion
QakBot has the ability to use removable drives to spread through compromised networks.
Technique: T1091: Replication Through Removable Media
Adversaries may search for common password storage locations to obtain user credentials.
Technique: T1555: Credentials from Password Stores
APT38 has used cron to create pre-scheduled and periodic background jobs on a Linux system.
Technique: T1053: Scheduled Task/Job
Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.
Technique: T1555: Credentials from Password Stores
NOKKI can delete files to cover tracks.
Technique: T1070: Indicator Removal on Host
Operation Wocao has used the tasklist command to search for one of its backdoors.
Technique: T1007: System Service Discovery
Stealth Falcon malware gathers data from the local victim system.
Technique: T1005: Data from Local System
Carberp has created a hidden file in the Startup folder of the current user.
Technique: T1564: Hide Artifacts
jRAT’s Java payload is encrypted with AES.
Technique: T1027: Obfuscated Files or Information
Adversaries may install SSL/TLS certificates that can be used during targeting.
Technique: T1608: Stage Capabilities
Lazarus Group has used Powershell to download malicious payloads.
Technique: T1059: Command and Scripting Interpreter
Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications.
Technique: T1600: Weaken Encryption
Adversaries may utilize native support for virtualization  or drop the necessary files to run a virtual instance .
Technique: T1564: Hide Artifacts
Machete has been packed with NSIS.
Technique: T1027: Obfuscated Files or Information
IndigoZebra created Dropbox accounts for their operations.
Technique: T1583: Acquire Infrastructure
* **Import address table  hooking**, which use modifications to a process’s IAT, where pointers to imported API functions are stored.
Technique: T1056: Input Capture
XAgentOSX contains the deletFileFromPath function to delete a specified file using the NSFileManager:removeFileAtPath method.
Technique: T1070: Indicator Removal on Host
Zebrocy gathers the current time zone and date information from the system.
Technique: T1124: System Time Discovery
BlackEnergy has gathered a process list by using Tasklist.exe.
Technique: T1057: Process Discovery
Using a golden ticket, adversaries are then able to request ticket granting service  tickets, which enable access to specific resources.
Technique: T1558: Steal or Forge Kerberos Tickets
The loader may also have backup first-stage callbacks or Fallback Channels in case the original first-stage communication path is discovered and blocked.
Technique: T1104: Multi-Stage Channels
UNC2452 extracted files from compromised networks.
Technique: T1005: Data from Local System
An APT3 downloader creates persistence by creating the following scheduled task: schtasks /create /tn "mysc" /tr C:\Users\Public\test.exe /sc ONLOGON /ru "System".
Technique: T1053: Scheduled Task/Job
S-Type runs the command net start on a victim.
Technique: T1007: System Service Discovery
This does not alter the user's traffic in any way, and the proxy connection can be severed as soon as the browser is closed.
Technique: T1185: Browser Session Hijacking
Gorgon Group attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails.
Technique: T1204: User Execution
Cadelspy has the ability to steal data from the clipboard.
Technique: T1115: Clipboard Data
An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.
Technique: T1003: OS Credential Dumping
Adversaries may abuse system services or daemons to execute commands or programs.
Technique: T1569: System Services
Finally, Reaver.v1 will execute the ‘~WUpdate.lnk’ file in a new process, thus loading the recently dropped malicious CPL file
Technique: T1547: Boot or Logon Autostart Execution
Metamorfo has configured persistence to the Registry ket HKCU\Software\Microsoft\Windows\CurrentVersion\Run, Spotify =% APPDATA%\Spotify\Spotify.exe and used .LNK files in the startup folder to achieve persistence.
Technique: T1547: Boot or Logon Autostart Execution
FIN6 has used tools to exploit Windows vulnerabilities in order to escalate privileges.
Technique: T1068: Exploitation for Privilege Escalation
Patchwork dumped the login data database from \AppData\Local\Google\Chrome\User Data\Default\Login Data.
Technique: T1555: Credentials from Password Stores
Ptrace system call injection may not be possible targeting processes that are non-child processes and/or have higher-privileges.
Technique: T1055: Process Injection
Bundlore uses the curl -s -L -o command to exfiltrate archived data to a URL.
Technique: T1048: Exfiltration Over Alternative Protocol
Tropic Trooper has used a delivered trojan to download additional files.
Technique: T1105: Ingress Tool Transfer
GoldMax has written AES-encrypted and Base64-encoded configuration files to disk.
Technique: T1027: Obfuscated Files or Information
FatDuke can execute via rundll32.
Technique: T1218: Signed Binary Proxy Execution
An adversary may use systemd timers to execute malicious code at system startup or on a scheduled basis for persistence.
Technique: T1053: Scheduled Task/Job
Regin contains a keylogger.
Technique: T1056: Input Capture
There are several well-known vulnerabilities that exist in common services such as SMB  and RDP  as well as applications that may be used within internal networks such as MySQL  and web server services.
Technique: T1210: Exploitation of Remote Services
pngdowner deletes content from C2 communications that was saved to the user's temporary directory.
Technique: T1070: Indicator Removal on Host
Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility.
Technique: T1218: Signed Binary Proxy Execution
Sibot can download and execute a payload onto a compromised system.
Technique: T1105: Ingress Tool Transfer
Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start.
Technique: T1574: Hijack Execution Flow
APT32 has collected e-mail addresses for activists and bloggers in order to target them with spyware.
Technique: T1589: Gather Victim Identity Information
Bazar has been signed with fake certificates including those appearing to be from VB CORPORATE PTY.
Technique: T1553: Subvert Trust Controls
LightNeuron has used filenames associated with Exchange and Outlook for binary and configuration files, such as winmail.dat.
Technique: T1036: Masquerading
Siloscape maps the host’s C drive to the container by creating a global symbolic link to the host through the calling of NtSetInformationSymbolicLink.
Technique: T1611: Escape to Host
Derusbi is capable of performing screen captures.
Technique: T1113: Screen Capture
When dropped onto a second victim, it also enumerates drives connected to the system.
Technique: T1120: Peripheral Device Discovery
ServHelper will attempt to enumerate the username of the victim.
Technique: T1033: System Owner/User Discovery
Adversaries have been observed conducting DoS attacks for political purposes and to support other malicious activities, including distraction, hacktivism, and extortion.
Technique: T1499: Endpoint Denial of Service
* The user may be required to assist in this process by enabling scripting or active website components and ignoring warning dialog boxes.
Technique: T1189: Drive-by Compromise
Explosive has a function to use the OpenClipboard wrapper.
Technique: T1115: Clipboard Data
HiddenWasp uses a script to automate tasks on the victim's machine and to assist in execution.
Technique: T1059: Command and Scripting Interpreter
Adversaries may deliver payloads to victims that bypass security controls through HTML Smuggling by abusing JavaScript Blobs and/or HTML5 download attributes.
Technique: T1027: Obfuscated Files or Information
If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container.
Technique: T1190: Exploit Public-Facing Application
It can also provide a reverse shell.
Technique: T1059: Command and Scripting Interpreter
Kessel has exfiltrated information gathered from the infected system to the C2 server.
Technique: T1041: Exfiltration Over C2 Channel
Hydraq creates a backdoor through which remote attackers can retrieve information such as computer name, OS version, processor speed, memory size, and CPU speed.
Technique: T1082: System Information Discovery
More sophisticated malware samples may also potentially bypass protection mechanisms such as data execution prevention  by triggering a combination of windows procedures and other system functions that will rewrite the malicious payload inside an executable portion of the target process.
Technique: T1055: Process Injection
Group policy allows for centralized management of user and computer settings in Active Directory .
Technique: T1484: Domain Policy Modification
Programs with direct access may read and write files directly from the drive by analyzing file system data structures.
Technique: T1006: Direct Volume Access
Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
Technique: T1489: Service Stop
Pysa has the capability to stop antivirus services and disable Windows Defender.
Technique: T1562: Impair Defenses
Access to remote services may be used as a redundant or persistent access mechanism during an operation.
Technique: T1133: External Remote Services
Rocke used scripts which killed processes and added firewall rules to block traffic related to other cryptominers.
Technique: T1562: Impair Defenses
Use of PowerShell to download additional tools
Technique: T1105: Ingress Tool Transfer
WellMess can encrypt HTTP POST data using RC6 and a dynamically generated AES key encrypted with a hard coded RSA public key.
Technique: T1573: Encrypted Channel
Some network devices are built with a monolithic architecture, where the entire operating system and most of the functionality of the device is contained within a single file.
Technique: T1601: Modify System Image
These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.
Technique: T1106: Native API
Cuba has used several built-in API functions for discovery like GetIpNetTable and NetShareEnum.
Technique: T1106: Native API
USBStealer collects files matching certain criteria from the victim and stores them in a local directory for later exfiltration.
Technique: T1074: Data Staged
JHUHUGIT has registered a Windows shell script under the Registry key HKCU\Environment\UserInitMprLogonScript to establish persistence.
Technique: T1037: Boot or Logon Initialization Scripts
Clop can search for processes with antivirus and antimalware product names.
Technique: T1518: Software Discovery
MoleNet can download additional payloads from the C2.
Technique: T1105: Ingress Tool Transfer
Leviathan has created new email accounts for targeting efforts.
Technique: T1585: Establish Accounts
HAFNIUM has used procdump to dump the LSASS process memory.
Technique: T1003: OS Credential Dumping
Ferocious Kitten has named malicious files update.exe and loaded them into the compromise host's “Public” folder.
Technique: T1036: Masquerading
The different stages will likely be hosted separately with no overlapping infrastructure.
Technique: T1104: Multi-Stage Channels
(To bypass UAC) configurable setting for the process to abuse  Other than these, new coding algorithm has been introduced
Technique: T1548: Abuse Elevation Control Mechanism
A Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.
Technique: T1025: Data from Removable Media
SharpStage can execute arbitrary commands with PowerShell.
Technique: T1059: Command and Scripting Interpreter
Adversaries may perform software packing or virtual machine software protection to conceal their code.
Technique: T1027: Obfuscated Files or Information
They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it.
Technique: T1140: Deobfuscate/Decode Files or Information
PolyglotDuke can write encrypted JSON configuration files to the Registry.
Technique: T1112: Modify Registry
APT28 regularly deploys both publicly available  and custom password retrieval tools on victims.
Technique: T1003: OS Credential Dumping
Files that are tagged with MOTW are protected and cannot perform certain actions.
Technique: T1553: Subvert Trust Controls
Tropic Trooper's backdoor has communicated to the C2 over the DNS protocol.
Technique: T1071: Application Layer Protocol
Taidoor can use GetLocalTime and GetSystemTime to collect system time.
Technique: T1124: System Time Discovery
However, if the file is renamed to evil.txt  , then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed .
Technique: T1036: Masquerading
Derusbi also gathers the username of the victim.
Technique: T1033: System Owner/User Discovery
Traffic mirroring is a native feature for some network devices and used for network analysis and may be configured to duplicate traffic and forward to one or more destinations for analysis by a network analyzer or other monitoring device.
Technique: T1020: Automated Exfiltration
* Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic  with Web Protocols.
Technique: T1608: Stage Capabilities
TA551 has used HTTP for C2 communications.
Technique: T1071: Application Layer Protocol
Firmware is software that is loaded and executed from non-volatile memory on hardware devices in order to initialize and manage device functionality.
Technique: T1495: Firmware Corruption
Dragonfly 2.0 added the registry value ntdll to the Registry Run key to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
Adversaries may acquire user credentials from third-party password managers.
Technique: T1555: Credentials from Password Stores
Adversaries with SYSTEM access to a host may attempt to access Local Security Authority  secrets, which can contain a variety of different credential materials, such as credentials for service accounts.
Technique: T1003: OS Credential Dumping
Stuxnet collects the IP address of a compromised system.
Technique: T1016: System Network Configuration Discovery
One of Dtrack can replace the normal flow of a program execution with malicious code.
Technique: T1574: Hijack Execution Flow
Threat Group-3390 has used DLL side-loading, including by using legitimate Kaspersky antivirus variants in which the DLL acts as a stub loader that loads and executes the shell code.
Technique: T1574: Hijack Execution Flow
Kerrdown has been distributed through malicious e-mail attachments.
Technique: T1566: Phishing
Ramsay can scan for systems that are vulnerable to the EternalBlue exploit.
Technique: T1046: Network Service Scanning
AppleSeed can achieve execution through users running malicious file attachments distributed via email.
Technique: T1204: User Execution
The malware also uses return-oriented programming  technique and single-byte XOR to obfuscate data.
Technique: T1027: Obfuscated Files or Information
Waterbear can find the presence of a specific security software.
Technique: T1518: Software Discovery
CallMe has the capability to download a file to the victim from the C2 server.
Technique: T1105: Ingress Tool Transfer
FinFisher renames one of its .dll files to uxtheme.dll in an apparent attempt to masquerade as a legitimate file.
Technique: T1036: Masquerading
Emissary has the capability to execute ver and systeminfo commands.
Technique: T1082: System Information Discovery
Cobalt Strike can start a VNC-based remote desktop server and tunnel the connection through the already established C2 channel.
Technique: T1021: Remote Services
Adversaries may employ various means to detect and avoid virtualization and analysis environments.
Technique: T1497: Virtualization/Sandbox Evasion
The JavaScript is heavily obfuscated. The first variable—a—is an array of obfuscated values
Technique: T1027: Obfuscated Files or Information
Credentials targeted by PinchDuke include ones associated with many sources such as Netscape Navigator, Mozilla Firefox, Mozilla Thunderbird, and Internet Explorer.
Technique: T1555: Credentials from Password Stores
Leafminer has infected victims using watering holes.
Technique: T1189: Drive-by Compromise
ZLib has the ability to discover and manipulate Windows services.
Technique: T1007: System Service Discovery
An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.
Technique: T1057: Process Discovery
Adversaries may only need a lightweight setup if most of their activities will take place using online infrastructure.
Technique: T1583: Acquire Infrastructure
Information from these sources may reveal opportunities for other forms of reconnaissance  or Search Open Websites/Domains, establishing operational resources  or Compromise Infrastructure, and/or initial access .
Technique: T1596: Search Open Technical Databases
Checks could include generic system properties such as host/domain name and samples of network traffic.
Technique: T1497: Virtualization/Sandbox Evasion
Turla has used VBS scripts throughout its operations.
Technique: T1059: Command and Scripting Interpreter
Aria-body has the ability to decrypt the loader configuration and payload DLL.
Technique: T1140: Deobfuscate/Decode Files or Information
Rancor has attached a malicious document to an email to gain initial access.
Technique: T1566: Phishing
Adversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as Disk Structure Wipe or Inhibit System Recovery, to hasten the intended effects on system availability.
Technique: T1529: System Shutdown/Reboot
On network devices, adversaries may use crafted packets to enable Network Device Authentication for standard services offered by the device such as telnet.
Technique: T1205: Traffic Signaling
A bootkit is a malware variant that modifies the boot sectors of a hard drive, including the Master Boot Record  and Volume Boot Record .
Technique: T1542: Pre-OS Boot
Both variants need to be executed with the command line argument “[2]” to avoid continually attempting to copy and execute the Trojan using the “tmp.vbs” and “tmp1.vbs” files
Technique: T1059: Command and Scripting Interpreter
WannaCry scans its local network segment for remote systems to try to exploit and copy itself to.
Technique: T1018: Remote System Discovery
Adversaries may target the operating system  for a DoS attack, since the  is responsible for managing the finite resources on a system.
Technique: T1499: Endpoint Denial of Service
FIN4 has lured victims to click malicious links delivered via spearphishing emails .
Technique: T1204: User Execution
When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk.
Technique: T1553: Subvert Trust Controls
BACKSPACE allows adversaries to search for files.
Technique: T1083: File and Directory Discovery
Helminth has checked the local administrators group.
Technique: T1069: Permission Groups Discovery
Figure 1: SpeakUp’s Victim Distribution  Figure 2: SpeakUp’s propagation rate per day Infection Vector The initial infection vector is targeting the recently reported vulnerability in ThinkPHP and uses command injection techniques for uploading a PHP shell that serves and executes a Perl backdoor
Technique: T1059: Command and Scripting Interpreter
Operation Wocao has collected clipboard data in plaintext.
Technique: T1115: Clipboard Data
POWERSTATS can use DCOM  to execute additional payloads on compromised hosts.
Technique: T1559: Inter-Process Communication
Adversaries may execute their own malicious payloads by hijacking the binaries used by services.
Technique: T1574: Hijack Execution Flow
Micropsia can download and execute an executable from the C2 server.
Technique: T1105: Ingress Tool Transfer
NotPetya uses rundll32.exe to install itself on remote systems when accessed via PsExec or wmic.
Technique: T1218: Signed Binary Proxy Execution
Sharpshooter has leveraged embedded shellcode to inject a downloader into the memory of Word.
Technique: T1055: Process Injection
A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process.
Technique: T1134: Access Token Manipulation
Using this example, Comnie will then request data to supply to the BAT script, via the following decrypted request: h=HOSTNAME-PC&f=gethostinfo.bat&c=& Based on network traffic witnessed, the remote C2 server was found to respond with the following information:       netstat -ano > %TEMP%\info.datipconfig /all >> %TEMP%\info.datroute PRINT >> %TEMP%\info.datnet view >> %TEMP%\info.dattasklist >> %TEMP%\info.datnet user >> %TEMP%\info.datnet start >> %TEMP%\info.dat       This script is written to a temporary file prior to be executed
Technique: T1007: System Service Discovery
SeaDuke can securely delete files, including deleting itself from the victim.
Technique: T1070: Indicator Removal on Host
One example of this is powershell.exe -WindowStyle Hidden.
Technique: T1564: Hide Artifacts
APT28 has used pass the hash for lateral movement.
Technique: T1550: Use Alternate Authentication Material
Kazuar uses /bin/bash to execute commands on the victim’s machine.
Technique: T1059: Command and Scripting Interpreter
These files are downloaded to a directory (C:\Users\Public\Libraries\tempsys) on the infected machine by Bxaki() and xparis()
Technique: T1083: File and Directory Discovery
SharpStage has decompressed data received from the C2 server.
Technique: T1140: Deobfuscate/Decode Files or Information
Operation Wocao has deleted logs and executable files used during an intrusion.
Technique: T1070: Indicator Removal on Host
Naikon has used schtasks.exe for lateral movement in compromised networks.
Technique: T1053: Scheduled Task/Job
Domain trust details, such as whether or not a domain is federated, allow authentication and authorization properties to apply between domains for the purpose of accessing shared resources.
Technique: T1484: Domain Policy Modification
SynAck parses the export tables of system DLLs to locate and call various Windows API functions.
Technique: T1106: Native API
MobileOrder has a command to download a file from the C2 server to the victim mobile device's SD card.
Technique: T1105: Ingress Tool Transfer
Cannon can gather the username from the system.
Technique: T1033: System Owner/User Discovery
APT32 collected the victim's username and executed the whoami command on the victim's machine.
Technique: T1033: System Owner/User Discovery
Browser pivoting may also bypass security provided by 2-factor authentication.
Technique: T1185: Browser Session Hijacking
APT29 has used the meek domain fronting plugin for Tor to hide the destination of C2 traffic.
Technique: T1090: Proxy
Kivars has the ability to download and execute files.
Technique: T1105: Ingress Tool Transfer
StrongPity can parse the hard drive on a compromised host to identify specific file extensions.
Technique: T1083: File and Directory Discovery
AutoIt backdoor attempts to escalate privileges by bypassing User Access Control.
Technique: T1548: Abuse Elevation Control Mechanism
Stolen Pencil utilized RDP for direct remote point-and-click access.
Technique: T1021: Remote Services
FIN6 has used Pastebin and Google Storage to host content for their operations.
Technique: T1102: Web Service
Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system.
Technique: T1137: Office Application Startup
Bandook has used AES encryption for C2 communication.
Technique: T1573: Encrypted Channel
StoneDrill can wipe the master boot record of an infected computer.
Technique: T1561: Disk Wipe
RDAT has executed commands using cmd.exe /c.
Technique: T1059: Command and Scripting Interpreter
Cloud providers may have different ways in which their virtual networks operate.
Technique: T1049: System Network Connections Discovery
ChChes samples were digitally signed with a certificate originally used by Hacking Team that was later leaked and subsequently revoked.
Technique: T1553: Subvert Trust Controls
OSX_OCEANLOTUS.D has a command to delete a file from the system.
Technique: T1070: Indicator Removal on Host
Lazarus Group has used VBScript to gather information about a victim machine.
Technique: T1059: Command and Scripting Interpreter
ROKRAT gathers the computer name and checks the OS version to ensure it doesn’t run on a Windows XP or Windows Server 2003 systems.
Technique: T1082: System Information Discovery
HiddenWasp creates a user account as a means to provide initial persistence to the compromised machine.
Technique: T1136: Create Account
An adversary may need to enable macros to execute unrestricted depending on the system or enterprise security policy on use of macros.
Technique: T1137: Office Application Startup
gh0st RAT has the capability to list processes.
Technique: T1057: Process Discovery
Information from these sources may reveal opportunities for other forms of reconnaissance  or Search Open Technical Databases, establishing operational resources  or Compromise Accounts, and/or initial access .
Technique: T1593: Search Open Websites/Domains
Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.
Technique: T1555: Credentials from Password Stores
Bisonal can execute ipconfig on the victim’s machine.
Technique: T1016: System Network Configuration Discovery
Cobalt Strike can determine if the user on an infected machine is in the admin or domain admin group.
Technique: T1087: Account Discovery
Cobalt Strike can SSH to a remote service.
Technique: T1021: Remote Services
Okrum was seen using a RAR archiver tool to compress/decompress data.
Technique: T1560: Archive Collected Data
Ursnif has deleted data staged in tmp files after exfiltration.
Technique: T1070: Indicator Removal on Host
APT15 was also observed using Mimikatz to dump credentials and generate Kerberos golden tickets
Technique: T1003: OS Credential Dumping
If so, access is granted.
Technique: T1556: Modify Authentication Process
Some aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure.
Technique: T1587: Develop Capabilities
Pony also obfuscates the memory flow by adding junk instructions when executing to make analysis more difficult.
Technique: T1027: Obfuscated Files or Information
PlugX has a module to enumerate drives and find files recursively.
Technique: T1083: File and Directory Discovery
Blue Mockingbird has used XMRIG to mine cryptocurrency on victim systems.
Technique: T1496: Resource Hijacking
APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
Technique: T1564: Hide Artifacts
Dtrack can remove its persistence and delete itself.
Technique: T1070: Indicator Removal on Host
Adversaries may also name images a certain way to increase the chance of users mistakenly deploying an instance or container from the image .
Technique: T1204: User Execution
Screenshot in leak of administrative panel for an account at DeltaHost If we use the filename of this screenshot and assume that it was taken on March 29, 2019 and subtract 194 days from this date, it is possible that this server had been operational since at least September 16, 2018
Technique: T1113: Screen Capture
Adversaries may abuse TxF to a perform a file-less variation of Process Injection.
Technique: T1055: Process Injection
Avaddon uses registry run keys for persistence.
Technique: T1547: Boot or Logon Autostart Execution
Astaroth has used a DGA in C2 communications.
Technique: T1568: Dynamic Resolution
Emissary has the capability to download files from the C2 server.
Technique: T1105: Ingress Tool Transfer
Stealth Falcon malware gathers system information via Windows Management Instrumentation .
Technique: T1047: Windows Management Instrumentation
PowerShell scripts that perform system reconnaissance and credential theft from Windows Credential Manager and then send this information back to Waterbug C& Cs.
Technique: T1546: Event Triggered Execution
Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references.
Technique: T1560: Archive Collected Data
PUNCHTRACK aggregates collected data in a tmp file.
Technique: T1074: Data Staged
InvisiMole can decrypt, unpack and load a DLL from its resources, or from blobs encrypted with Data Protection API, two-key triple DES, and variations of the XOR cipher.
Technique: T1140: Deobfuscate/Decode Files or Information
In this context the main function is executed."Console": with the argument, a persistence is configured and the malware will be executed at the next reboot ( HKCU\Software\Microsoft\Windows\CurrentVersion\Run\runsample )."Sample": with this argument, the malware executes the console command followed by the help command.The information collected is performed using WMI queries:Additionally the malware lists the running process via the Microsoft Windows API
Technique: T1106: Native API
This behavior is distinct from Data Destruction because sections of the disk are erased instead of individual files.
Technique: T1561: Disk Wipe
A module in Prikormka collects information about the paths, size, and creation time of files with specific file extensions, but not the actual content of the file.
Technique: T1083: File and Directory Discovery
It is the location of the boot loader.
Technique: T1542: Pre-OS Boot
Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts;  however, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications.
Technique: T1095: Non-Application Layer Protocol
OilRig has used keylogging tools called KEYPUNCH and LONGWATCH.
Technique: T1056: Input Capture
Fox Kitten has used Angry IP Scanner to detect remote systems.
Technique: T1018: Remote System Discovery
Magic Hound has created fake LinkedIn and other social media accounts to contact targets and convince them--through messages and voice communications--to open malicious links.
Technique: T1585: Establish Accounts
Writing executables to a randomly-selected directory under Program Files, and naming the EXE to match the chosen directory name, or, if that fails, writing the executable to a system-generated temporary file name, using the EXE extension   3
Technique: T1036: Masquerading
Rocke has modified UPX headers after packing files to break unpackers.
Technique: T1027: Obfuscated Files or Information
* CredSSP:  Provides SSO and Network Level Authentication for Remote Desktop Services.
Technique: T1003: OS Credential Dumping
MuddyWater has used cmd.exe net user /domain to enumerate domain users.
Technique: T1087: Account Discovery
menuPass executes commands using a command-line interface and reverse shell.
Technique: T1059: Command and Scripting Interpreter
These digital certificates are often issued in the name of rogue and legitimate companies to avoid arousing suspicion from researchers and incident responders
Technique: T1036: Masquerading
APT28 has used tools to take screenshots from victims.
Technique: T1113: Screen Capture