HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
Kinsing has used a script to parse files like /etc/hosts and SSH known_hosts to discover remote systems.
Technique: T1018: Remote System Discovery
Similarly, this attribute can be recursively removed from all files in a folder using xattr, sudo xattr -d com.apple.quarantine /path/to/folder.
Technique: T1553: Subvert Trust Controls
Group5 disguised its malicious binaries with several layers of obfuscation, including encrypting the files.
Technique: T1027: Obfuscated Files or Information
RunningRAT gathers the OS version, logical drives information, processor information, and volume information.
Technique: T1082: System Information Discovery
HDoor kills anti-virus found on the victim.
Technique: T1562: Impair Defenses
Adversaries may use VB payloads to execute malicious commands.
Technique: T1059: Command and Scripting Interpreter
It continues parsing protocol layers including SCTP, SCCP, and TCAP and finally extracts SMS message data and routing metadata.
Technique: T1040: Network Sniffing
See the following for more information and examples of false flags being used in cyberattacks: Wave your false flags! …or the Nightmares and Nuances of a Self-Aware Attribution Space OlympicDestroyer is here to trick the industry Malware description The malware was first seen packed with VMProtect; when unpacked the sample didn’t show any similarities with previously known malware
Technique: T1027: Obfuscated Files or Information
The payload then uses the MD5 hash (14331d289e737093994395d3fc412afc) of what appears to be a hardcoded SHA1 hash (B6A75B1EF701710D7AEADE0FE93DE8477F3BD506) as an RC4 key to decrypts the resulting decoded data
Technique: T1140: Deobfuscate/Decode Files or Information
Caterpillar WebShell has a module to use a rootkit on a system.
Technique: T1014: Rootkit
For example, an adversary may abuse these mechanisms to modify HTTP responses in order to distribute malicious commands/content to previously comprised hosts.
Technique: T1505: Server Software Component
XCSSET will compress entire ~/Desktop folders excluding all .git folders, but only if the total data size is under 200MB.
Technique: T1560: Archive Collected Data
C:\Windows\System32\utilman.exe
Technique: T1546: Event Triggered Execution
MegaCortex can stop and disable services on the system.
Technique: T1489: Service Stop
APT28 has deployed malware that has copied itself to the startup directory for persistence.
Technique: T1547: Boot or Logon Autostart Execution
Pillowmint has used a malicious shim database to maintain persistence.
Technique: T1546: Event Triggered Execution
An APT3 downloader uses the Windows command "cmd.exe" /C whoami.
Technique: T1059: Command and Scripting Interpreter
Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Technique: T1005: Data from Local System
Webshell has the ability to list and extract data from SQL databases.
Technique: T1213: Data from Information Repositories
FIN4 has lured victims to launch malicious attachments delivered via spearphishing emails .
Technique: T1204: User Execution
OopsIE compresses collected files with a simple character replacement scheme before sending them to its C2 server.
Technique: T1560: Archive Collected Data
OfficeScan’s Vulnerability Protection shields endpoints from identified and unknown vulnerability exploits even before patches are even deployed. Trend Micro™ Deep Discovery™ provides detection, in-depth analysis, and proactive response to attacks using exploits and other similar threats through specialized engines, custom sandboxing, and seamless correlation across the entire attack lifecycle, allowing it to detect these attacks even without any engine or pattern update
Technique: T1068: Exploitation for Privilege Escalation
This is most likely meant to be a mechanism to update the compromised host with a new version of the LOWBALL malware.
Technique: T1105: Ingress Tool Transfer
OLDBAIT can use SMTP for C2.
Technique: T1071: Application Layer Protocol
UNC2452 used forged SAML tokens that allowed the actors to impersonate users and bypass MFA, enabling UNC2452 to access enterprise cloud applications and services.
Technique: T1550: Use Alternate Authentication Material
Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting.
Technique: T1588: Obtain Capabilities
MoonWind completes network communication via raw sockets.
Technique: T1095: Non-Application Layer Protocol
Waterbear can leverage API functions for execution.
Technique: T1106: Native API
POSHSPY leverages two of the tools the group frequently uses: PowerShell and Windows Management Instrumentation (WMI)
Technique: T1047: Windows Management Instrumentation
Sandworm Team has sent system information to its C2 server using HTTP.
Technique: T1041: Exfiltration Over C2 Channel
Some variants of Emissary use various XOR operations to encrypt C2 data.
Technique: T1573: Encrypted Channel
Anchor can create a scheduled task for persistence.
Technique: T1053: Scheduled Task/Job
The .iqy files take advantage of Excel’s willingness to download and include the contents from a remote server in a spreadsheet
Technique: T1105: Ingress Tool Transfer
Anchor can terminate itself if specific execution flags are not present.
Technique: T1480: Execution Guardrails
PROMETHIUM has created self-signed certificates to sign malicious installers.
Technique: T1587: Develop Capabilities
APT29 has used AdFind to enumerate remote systems.
Technique: T1018: Remote System Discovery
Examples of actions are to run a system command or send an email.
Technique: T1546: Event Triggered Execution
Dtrack’s dropper contains a keylogging executable.
Technique: T1056: Input Capture
Penquin has encrypted strings in the binary for obfuscation.
Technique: T1027: Obfuscated Files or Information
Carberp has captured credentials when a user performs login through a SSL session.
Technique: T1185: Browser Session Hijacking
This allows an adversary to bypass some email restrictions on the work account, and the target is more likely to open the file since it's something they were expecting.
Technique: T1566: Phishing
REvil has used PowerShell to delete volume shadow copies and download files.
Technique: T1059: Command and Scripting Interpreter
Sandworm Team has established social media accounts to disseminate victim internal-only documents and other sensitive data.
Technique: T1585: Establish Accounts
TA459 has attempted to get victims to open malicious Microsoft Word attachment sent via spearphishing.
Technique: T1204: User Execution
iKitten adds an entry to the rc.common file for persistence.
Technique: T1037: Boot or Logon Initialization Scripts
Password hashes for target services may be obtained using OS Credential Dumping or Kerberoasting.
Technique: T1558: Steal or Forge Kerberos Tickets
VERMIN can download and upload files to the victim's machine.
Technique: T1105: Ingress Tool Transfer
Chimera has nltest /domain_trusts to identify domain trust relationships.
Technique: T1482: Domain Trust Discovery
Leafminer used a tool called Total SMB BruteForcer to perform internal password spraying.
Technique: T1110: Brute Force
TrickBot can implant malicious code into a compromised device's firmware.
Technique: T1542: Pre-OS Boot
Bandook can detect USB devices.
Technique: T1120: Peripheral Device Discovery
APT19 used Base64 to obfuscate commands and the payload.
Technique: T1027: Obfuscated Files or Information
Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.
Technique: T1529: System Shutdown/Reboot
Backdoor.Oldrea adds Registry Run keys to achieve persistence.
Technique: T1547: Boot or Logon Autostart Execution
HOPLIGHT can launch cmd.exe to execute commands on the system.
Technique: T1059: Command and Scripting Interpreter
Adversaries may gather information about the victim's host hardware that can be used during targeting.
Technique: T1592: Gather Victim Host Information
These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.
Technique: T1568: Dynamic Resolution
Transparent Tribe has dropped encoded executables on compromised hosts.
Technique: T1027: Obfuscated Files or Information
Exaramel for Windows has a command to execute VBS scripts on the victim’s machine.
Technique: T1059: Command and Scripting Interpreter
China Chopper's client component is packed with UPX.
Technique: T1027: Obfuscated Files or Information
Grandoreiro can determine the IP and physical location of the compromised host via IPinfo.
Technique: T1016: System Network Configuration Discovery
Guardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within.
Technique: T1480: Execution Guardrails
Information about host firmware may only be exposed to adversaries via online or other accessible data sets .
Technique: T1592: Gather Victim Host Information
CostaBricks has the ability to use bytecode to decrypt embedded payloads.
Technique: T1140: Deobfuscate/Decode Files or Information
Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.
Technique: T1573: Encrypted Channel
WellMail can identify the IP address of the victim system.
Technique: T1016: System Network Configuration Discovery
TURNEDUP is capable of writing to a Registry Run key to establish.
Technique: T1547: Boot or Logon Autostart Execution
pngdowner uses HTTP for command and control.
Technique: T1071: Application Layer Protocol
Derivative languages based on VB have also been created, such as Visual Basic for Applications  and VBScript.
Technique: T1059: Command and Scripting Interpreter
Silence has used JS scripts.
Technique: T1059: Command and Scripting Interpreter
Zeus Panda can launch remote scripts on the victim’s machine.
Technique: T1059: Command and Scripting Interpreter
Bazar can identity the current process on a compromised host.
Technique: T1057: Process Discovery
Lokibot will delete its dropped files after bypassing UAC.
Technique: T1070: Indicator Removal on Host
Astaroth spawns a CMD process to execute commands.
Technique: T1059: Command and Scripting Interpreter
Hildegard has started a monero service.
Technique: T1543: Create or Modify System Process
Embedded Trojan This Trojan loaded by the first payload contains several embedded executables that it uses to ultimately download and execute a secondary payload, as well as downloading and opening a decoy document
Technique: T1027: Obfuscated Files or Information
TA551 has used cmd.exe to execute commands.
Technique: T1059: Command and Scripting Interpreter
AppleSeed can exfiltrate files via the C2 channel.
Technique: T1041: Exfiltration Over C2 Channel
APT18 actors deleted tools and batch files from victim systems.
Technique: T1070: Indicator Removal on Host
Common uses include cmd to execute a single command, or abusing cmd interactively with input and output forwarded over a command and control channel.
Technique: T1059: Command and Scripting Interpreter
The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account .
Technique: T1053: Scheduled Task/Job
SUNSPOT was identified on disk with a filename of taskhostsvc.exe and it created an encrypted log file at C:\Windows\Temp\vmware-vmdmp.log.
Technique: T1036: Masquerading
The executable obtains an embedded PowerShell script, decrypts it using RC4, then decompresses it using ZLIB, and saves the cleartext to C:\Users\<username>\AppData\Roaming\Out.jpg
Technique: T1033: System Owner/User Discovery
SeaDuke compressed data with zlib prior to sending it over C2.
Technique: T1560: Archive Collected Data
Frankenstein has used trojanized Microsoft Word documents sent via email, which prompted the victim to enable macros.
Technique: T1204: User Execution
Briba creates run key Registry entries pointing to malicious DLLs dropped to disk.
Technique: T1547: Boot or Logon Autostart Execution
Keydnap uses a copy of tor2web proxy for HTTPS communications.
Technique: T1090: Proxy
Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for.
Technique: T1588: Obtain Capabilities
Kerberos is an authentication protocol widely used in modern Windows domain environments.
Technique: T1558: Steal or Forge Kerberos Tickets
A FinFisher variant uses DLL search order hijacking.
Technique: T1574: Hijack Execution Flow
NETWIRE stores its configuration file within the Registry.
Technique: T1112: Modify Registry
Carberp has collected the operating system version from the infected system.
Technique: T1082: System Information Discovery
After the cookie is obtained through Steal Web Session Cookie or Web Cookies, the adversary may then import the cookie into a browser they control and is then able to use the site or application as the user for as long as the session cookie is active.
Technique: T1550: Use Alternate Authentication Material
Pony has delayed execution using a built-in function to avoid detection and analysis.
Technique: T1497: Virtualization/Sandbox Evasion
The group has also used regsvr32 to run their backdoor.
Technique: T1218: Signed Binary Proxy Execution
HyperBro has the ability to start and stop a specified service.
Technique: T1569: System Services
winrm
Technique: T1021: Remote Services
Carbon uses TCP and UDP for C2.
Technique: T1095: Non-Application Layer Protocol
QakBot has the ability to modify the Registry to add its binaries to the Windows Defender exclusion list.
Technique: T1562: Impair Defenses
Adversaries may spoof the parent process identifier  of a new process to evade process-monitoring defenses or to elevate privileges.
Technique: T1134: Access Token Manipulation
Threat Group-3390 actors have used gsecdump to dump credentials.
Technique: T1003: OS Credential Dumping
Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations.
Technique: T1133: External Remote Services
Whitefly has the ability to download additional tools from the C2.
Technique: T1105: Ingress Tool Transfer
MoonWind saves information from its keylogging routine as a .zip file in the present working directory.
Technique: T1074: Data Staged
APT40 used MURKYSHELL at a compromised victim organization to port scan IP addresses and conduct network enumeration
Technique: T1016: System Network Configuration Discovery
NavRAT can download files remotely.
Technique: T1105: Ingress Tool Transfer
QUADAGENT uses DNS for C2 communications.
Technique: T1071: Application Layer Protocol
Adversaries may perform Endpoint Denial of Service  attacks to degrade or block the availability of services to users.
Technique: T1499: Endpoint Denial of Service
Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server.
Technique: T1057: Process Discovery
Remexi silently executes received commands with cmd.exe.
Technique: T1059: Command and Scripting Interpreter
Figure 8 shows the network communication of the Pause.ps1 download
Technique: T1105: Ingress Tool Transfer
APT39 has used a screen capture utility to take screenshots on a compromised host.
Technique: T1113: Screen Capture
If adversaries have a presence on the running virtual instance, they may query the Instance Metadata API directly to identify credentials that grant access to additional resources.
Technique: T1552: Unsecured Credentials
Microsoft refers to its implementation of the Remote Desktop Protocol  as Remote Desktop Services .
Technique: T1563: Remote Service Session Hijacking
Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system.
Technique: T1553: Subvert Trust Controls
Some SeaDuke samples have a module to extract email from Microsoft Exchange servers using compromised credentials.
Technique: T1114: Email Collection
The C2 server sends back Base64 encoded response
Technique: T1132: Data Encoding
MechaFlounder has been downloaded as a file named lsass.exe, which matches the legitimate Windows file.
Technique: T1036: Masquerading
Operation Wocao can use the ping command to discover remote systems.
Technique: T1018: Remote System Discovery
Windshift has used string encoding with floating point calculations.
Technique: T1027: Obfuscated Files or Information
Commands such as net user /domain and net group /domain of the Net utility, dscacheutil -q groupon macOS, and ldapsearch on Linux can list domain users and groups.
Technique: T1087: Account Discovery
Pay2Key has sent its public key to the C2 server over TCP.
Technique: T1095: Non-Application Layer Protocol
Hildegard has deleted scripts after execution.
Technique: T1070: Indicator Removal on Host
Turla RPC backdoors have also enumerated the IPv4 TCP connection table via the GetTcpTable2 API call.
Technique: T1049: System Network Connections Discovery
Conti can utilize command line options to allow an attacker control over how it scans and encrypts files.
Technique: T1059: Command and Scripting Interpreter
APT-C-36 has downloaded binary data from a specified domain after the malicious document is opened.
Technique: T1105: Ingress Tool Transfer
Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments.
Technique: T1497: Virtualization/Sandbox Evasion
Turian can create a remote shell and execute commands using cmd.
Technique: T1059: Command and Scripting Interpreter
BADNEWS is sometimes signed with an invalid Authenticode certificate in an apparent effort to make it look more legitimate.
Technique: T1036: Masquerading
Bankshot deletes all artifacts associated with the malware from the infected machine.
Technique: T1070: Indicator Removal on Host
The VBScript has a SHA256 has of 649e3922ec53d5b195ed23aac08148faeb561f47e891b1e6ff60a2a9df4fea17, which calls two PowerShell commands to download and execute a payload and downloading and opening of a decoy document
Technique: T1546: Event Triggered Execution
For example, PowerShell versions 5+ includes Script Block Logging  which can record executed script content.
Technique: T1562: Impair Defenses
Stuxnet encodes the payload of system information sent to the command and control servers using a one byte 0xFF XOR key.
Technique: T1573: Encrypted Channel
It downloads the file to the infected machine from the input URL using BITSAdmin, and is called every time the script attempts to download a file
Technique: T1105: Ingress Tool Transfer
MacSpy deletes any temporary files it creates FALLCHILL can delete malware and associated artifacts from the victim.
Technique: T1070: Indicator Removal on Host
NanoCore can access the victim's webcam and capture data.
Technique: T1125: Video Capture
Ptrace system call injection is commonly performed by writing arbitrary code into a running process  then invoking that memory with PTRACE_SETREGS to set the register containing the next instruction to execute.
Technique: T1055: Process Injection
Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system.
Technique: T1137: Office Application Startup
MoonWind encrypts C2 traffic using RC4 with a static key.
Technique: T1573: Encrypted Channel
Agent Tesla exploits CVE-2017-11882 in Microsoft’s Equation Editor to execute a process.
Technique: T1203: Exploitation for Client Execution
When an adversary takes control of such a boundary device, they can bypass its policy enforcement to pass normally prohibited traffic across the trust boundary between the two separated networks without hinderance.
Technique: T1599: Network Boundary Bridging
Data could also be concealed within the transferred files.
Technique: T1071: Application Layer Protocol
BADFLICK has captured victim IP address details.
Technique: T1016: System Network Configuration Discovery
For example, there can be different profiles for PowerShell host programs such as the PowerShell console, PowerShell ISE or Visual Studio Code.
Technique: T1546: Event Triggered Execution
Chimera has has used net user /dom and net user Administrator to enumerate domain accounts including administrator accounts.
Technique: T1087: Account Discovery
TAINTEDSCRIBE can use DirectoryList to enumerate files in a specified directory.
Technique: T1083: File and Directory Discovery
Commonly targeted services include the following:
* SSH 
* Telnet 
* FTP 
* NetBIOS / SMB / Samba 
* LDAP 
* Kerberos 
* RDP / Terminal Services 
* HTTP/HTTP Management Services 
* MSSQL 
* Oracle 
* MySQL 
* VNC 
In addition to management services, adversaries may "target single sign-on  and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.
Technique: T1110: Brute Force
Rising Sun can clear process memory by overwriting it with junk bytes.
Technique: T1070: Indicator Removal on Host
Adversaries will create fake social media accounts and message employees for potential job opportunities.
Technique: T1566: Phishing
Such files often pose as email attachments and allow an adversary to gain Initial Access into a user’s system via Spearphishing Attachment then User Execution.
Technique: T1036: Masquerading
Some Reaver variants use raw TCP for C2.
Technique: T1095: Non-Application Layer Protocol
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle  technique to support follow-on behaviors such as Network Sniffing or Transmitted Data Manipulation.
Technique: T1557: Adversary-in-the-Middle
Industroyer decrypts code to connect to a remote C2 server.
Technique: T1140: Deobfuscate/Decode Files or Information
Astaroth can store C2 information on cloud hosting services such as AWS and CloudFlare and websites like YouTube and Facebook.
Technique: T1102: Web Service
TinyZBot can create a shortcut in the Windows startup folder for persistence.
Technique: T1547: Boot or Logon Autostart Execution
Goopy has the ability to side-load malicious DLLs with legitimate applications from Kaspersky, Microsoft, and Google.
Technique: T1574: Hijack Execution Flow
This may also span both native defenses as well as supplemental capabilities installed by users and administrators.
Technique: T1562: Impair Defenses
An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started.
Technique: T1137: Office Application Startup
Mustang Panda has communicated with its C2 via HTTP POST requests.
Technique: T1071: Application Layer Protocol
Peppy can take screenshots on targeted systems.
Technique: T1113: Screen Capture
WellMail can receive data and executable scripts from C2.
Technique: T1105: Ingress Tool Transfer
PoetRAT used Nmap for remote system discovery.
Technique: T1018: Remote System Discovery
Machete can find, encrypt, and upload files from fixed and removable drives.
Technique: T1025: Data from Removable Media
GrimAgent can enumerate the IP and domain of a target system.
Technique: T1016: System Network Configuration Discovery
Agent.btz drops itself onto removable media devices and creates an autorun.inf file with an instruction to run that file.
Technique: T1091: Replication Through Removable Media
Rocke has extracted tar.gz files after downloading them from a C2 server.
Technique: T1140: Deobfuscate/Decode Files or Information
Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.
Technique: T1480: Execution Guardrails
gh0st RAT can capture the victim’s screen remotely.
Technique: T1113: Screen Capture
Windshift has also attempted to hide executables by changing the file extension to ".scr" to mimic Windows screensavers.
Technique: T1036: Masquerading
Adversaries may inject malicious code into processes via ptrace  system calls in order to evade process-based defenses as well as possibly elevate privileges.
Technique: T1055: Process Injection
Hildegard has used masscan to look for kubelets in the internal Kubernetes network.
Technique: T1046: Network Service Scanning
This is a guest post by independent security researcher James Quinn. This will be Part 1 of a series titled Reversing Gh0stRAT Variants.  As 2018 drew to a close and 2019 took over, I began to see a different behavior from SMB malware authors.  Instead of massive, multi-staged cryptocurrency miners, I began to see more small, covert RATs serving as partial stage1’s.  Of these samples, there was one specific sample that stood out to me.  A Gh0stRAT variant, this sample not only changed the Gh0stRAT header from “Gh0st” to “nbLGX”, it also hid its traffic with an encryption algorithm over the entire TCP segment, in addition to the standard Zlib compression on the Gh0stRAT data.  Some key functionality is below:   Can download more malware   Offline Keylogger   Cleans Event logs
Technique: T1070: Indicator Removal on Host
MoleNet can use PowerShell to set persistence.
Technique: T1059: Command and Scripting Interpreter
POWERSOURCE achieves persistence by setting a Registry Run key, with the path depending on whether the victim account has user or administrator access.
Technique: T1547: Boot or Logon Autostart Execution
SDBbot has the ability to clean up and remove data structures from a compromised host.
Technique: T1070: Indicator Removal on Host
S-Type may save itself as a file named msdtc.exe, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.
Technique: T1036: Masquerading
A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.
Technique: T1609: Container Administration Command
Operation Wocao has used a custom protocol for command and control.
Technique: T1095: Non-Application Layer Protocol
Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders.
Technique: T1137: Office Application Startup
When we analyzed the email headers, we determined that the email was sent from an SMTP server using an IP associated with the Yonsei University network
Technique: T1016: System Network Configuration Discovery
KGH_SPY can exfiltrate collected information from the host to the C2 server.
Technique: T1041: Exfiltration Over C2 Channel
ThiefQuest searches through the /Users/ folder looking for executable files.
Technique: T1554: Compromise Client Software Binary
Appliances that come preset with a username and password combination pose a serious threat to organizations that do not change it post installation, as they are easy targets for an adversary.
Technique: T1078: Valid Accounts
Adversaries may perform Network Denial of Service  attacks to degrade or block the availability of targeted resources to users.
Technique: T1498: Network Denial of Service
But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload.
Technique: T1574: Hijack Execution Flow
The information contained in this data dump include:  Stolen credentials Potential systems to login to using stolen credentials Deployed webshell URLs Backdoor tools Command and control server component of backdoor tools Scripts to perform DNS hijacking Documents identifying specific individual operators Screenshots of OilRig operational systems  The Leak In mid-March 2019, an unknown entity appeared on several hacking forums and Twitter with the user handle @Mr_L4nnist3r claiming they had access to data dumps involving internal tools and data used by the OilRig group
Technique: T1003: OS Credential Dumping
Neither this new domain nor the IP it resolves to have been observed in the past, indicating that the sample in Table 3 may be associated with a newer campaign
Technique: T1016: System Network Configuration Discovery
During privilege escalation, freely available tools such as Mimikatz and Ncrack have been observed, in addition to legitimate tools such as Windows Credential Editor and ProcDump
Technique: T1003: OS Credential Dumping
#NAME?
Technique: T1069: Permission Groups Discovery
Gamaredon Group has used modules that automatically upload gathered documents to the C2 server.
Technique: T1020: Automated Exfiltration
Creating a new instance may allow an adversary to bypass firewall rules and permissions that exist on instances currently residing within an account.
Technique: T1578: Modify Cloud Compute Infrastructure
APC injection is a method of executing arbitrary code in the address space of a separate live process.
Technique: T1055: Process Injection
(Source: Dell SecureWorks) Passwords, like "admin-na-google123!@#" shown in Figure 4, are required to interact with the web shell
Technique: T1505: Server Software Component
Proxysvc collects the network adapter information and domain/username information based on current remote sessions.
Technique: T1016: System Network Configuration Discovery
HyperBro has the ability to delete a specified file.
Technique: T1070: Indicator Removal on Host
APT29 has used Rundll32.exe to execute payloads.
Technique: T1218: Signed Binary Proxy Execution
ProLock can remove files containing its payload after they are executed.
Technique: T1070: Indicator Removal on Host
Users and applications use login items to configure their user environment to launch commonly used services or applications, such as email, chat, and music applications.
Technique: T1547: Boot or Logon Autostart Execution
Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities.
Technique: T1588: Obtain Capabilities
It allows adversaries to bypass the standard authentication system to use a defined password for all accounts authenticating to that domain controller.
Technique: T1556: Modify Authentication Process
Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources.
Technique: T1561: Disk Wipe
While we have not been able to obtain a secondary payload from the Unicorn generated PowerShell script, we believe that this group uses the script to deliver Metasploit’s Meterpreter as a potential payload as well
Technique: T1059: Command and Scripting Interpreter
Blue Mockingbird has used PowerShell reverse TCP shells to issue interactive commands over a network connection.
Technique: T1059: Command and Scripting Interpreter
Maze has used WMI to attempt to delete the shadow volumes on a machine, and to connect a virtual machine to the network domain of the victim organization's network.
Technique: T1047: Windows Management Instrumentation
Volgmer deobfuscates its strings and APIs once its executed.
Technique: T1140: Deobfuscate/Decode Files or Information
Bazar can perform a check to ensure that the operating system's keyboard and language settings are not set to Russian.
Technique: T1614: System Location Discovery
Sidewinder has used JavaScript to drop and execute malware loaders.
Technique: T1059: Command and Scripting Interpreter
Pass the ticket  is a method of authenticating to a system using Kerberos tickets without having access to an account's password.
Technique: T1550: Use Alternate Authentication Material
Adversaries may gather information about the victim's business relationships that can be used during targeting.
Technique: T1591: Gather Victim Org Information
Pillowmint has used multiple native Windows APIs to execute and conduct process injections.
Technique: T1106: Native API
PDB strings containing the 'SyberSpace' username
Technique: T1033: System Owner/User Discovery
Agent Tesla has routines for exfiltration over SMTP, FTP, and HTTP.
Technique: T1048: Exfiltration Over Alternative Protocol
Exaramel uses HTTPS for C2 communications.
Technique: T1071: Application Layer Protocol
Gazer can establish persistence by setting the value “Shell” with “explorer.exe, %malware_pathfile%” under the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.
Technique: T1547: Boot or Logon Autostart Execution
Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments.
Technique: T1482: Domain Trust Discovery
LiteDuke has used image files to hide its loader component.
Technique: T1027: Obfuscated Files or Information
The Carbanak malware communicates to its command server using HTTP with an encrypted payload.
Technique: T1071: Application Layer Protocol
Gamaredon Group has also decoded base64-encoded source code of a downloader.
Technique: T1140: Deobfuscate/Decode Files or Information
net accounts 
Technique: T1201: Password Policy Discovery
After the elapsed time, XCSSET executes additional modules.
Technique: T1497: Virtualization/Sandbox Evasion
Some installers may also require elevated privileges that will result in privilege escalation when executing adversary controlled code.
Technique: T1574: Hijack Execution Flow
APT3 has also interacted with compromised systems to browse and copy files through RDP sessions.
Technique: T1021: Remote Services
OilRig has run net user, net user /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to get account listings on a victim.
Technique: T1087: Account Discovery
Get-LocAdm
Technique: T1069: Permission Groups Discovery
This RAT communicates with 5.189.145.248, a command and control (C2) IP address that this group has used previously with other malware, including DarkComet and NJRAT
Technique: T1102: Web Service
ThiefQuest uses various API functions such as NSCreateObjectFileImageFromMemory to load and link in-memory payloads.
Technique: T1620: Reflective Code Loading
MirageFox can collect CPU and architecture information from the victim’s machine.
Technique: T1082: System Information Discovery
Like other Execution Guardrails, environmental keying can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within.
Technique: T1480: Execution Guardrails
Chimera has harvested data from remote mailboxes including through execution of \\<hostname>\c$\Users\<username>\AppData\Local\Microsoft\Outlook*.ost.
Technique: T1114: Email Collection
Adversaries may abuse CMSTP to proxy execution of malicious code.
Technique: T1218: Signed Binary Proxy Execution
File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions.
Technique: T1222: File and Directory Permissions Modification
Okrum has built-in commands for uploading, downloading, and executing files to the system.
Technique: T1105: Ingress Tool Transfer
Domain trusts can be enumerated using the `DSEnumerateDomainTrusts` Win32 API call, .NET methods, and LDAP.
Technique: T1482: Domain Trust Discovery
Metamorfo has disguised an MSI file as the Adobe Acrobat Reader Installer and has masqueraded payloads as OneDrive, WhatsApp, or Spotify, for example.
Technique: T1036: Masquerading
BitPaymer can use net view to discover remote systems.
Technique: T1018: Remote System Discovery
BlackEnergy has enabled the TESTSIGNING boot configuration option to facilitate loading of a driver component.
Technique: T1553: Subvert Trust Controls
APT37 executes shellcode and a VBA script to decode Base64 strings.
Technique: T1059: Command and Scripting Interpreter
Pay2Key has used RSA encrypted communications with C2.
Technique: T1573: Encrypted Channel
Industroyer’s data wiper module writes zeros into the registry keys in SYSTEM\CurrentControlSet\Services to render a system inoperable.
Technique: T1489: Service Stop
USBStealer sets the timestamps of its dropper files to the last-access and last-write timestamps of a standard Windows library chosen on the system.
Technique: T1070: Indicator Removal on Host
Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info .
Technique: T1594: Search Victim-Owned Websites
When the backdoor establishes a connection to the command and control server, it sets the request period time equal to the specified dwell time for the standby mode
Technique: T1124: System Time Discovery
CookieMiner can steal Google Chrome and Apple Safari browser cookies from the victim’s machine.
Technique: T1539: Steal Web Session Cookie
Sudo creates  a file at /var/db/sudo with a timestamp of when sudo was last run to determine this timeout.
Technique: T1548: Abuse Elevation Control Mechanism
FIN8 has deleted Registry keys during post compromise cleanup activities.
Technique: T1112: Modify Registry
Skidmap is a kernel-mode rootkit that has the ability to hook system calls to hide specific files and fake network and CPU-related statistics to make the CPU load of the infected machine always appear low.
Technique: T1014: Rootkit
Some Daserf samples were signed with a stolen digital certificate.
Technique: T1553: Subvert Trust Controls
DustySky can shutdown the infected machine.
Technique: T1529: System Shutdown/Reboot
APT41 created user accounts and adds them to the User and Admin groups.
Technique: T1136: Create Account
APT28 used other victims as proxies to relay command traffic, for instance using a compromised Georgian military email server as a hop point to NATO victims.
Technique: T1090: Proxy
By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them.
Technique: T1584: Compromise Infrastructure
The built-in history only tracks the commands used in the current session.
Technique: T1070: Indicator Removal on Host
Both types of Outlook data files are typically stored in `C:\Users\<username>\Documents\Outlook Files` or `C:\Users\<username>\AppData\Local\Microsoft\Outlook`.
Technique: T1114: Email Collection
Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or PowerShell Profile, to decode encrypted PowerShell payloads.
Technique: T1140: Deobfuscate/Decode Files or Information
Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration.
Technique: T1074: Data Staged
yty collects files with the following extensions: .ppt, .pptx, .pdf, .doc, .docx, .xls, .xlsx, .docm, .rtf, .inp, .xlsm, .csv, .odt, .pps, .vcf and sends them back to the C2 server.
Technique: T1005: Data from Local System
Clop has used a simple XOR operation to decrypt strings.
Technique: T1140: Deobfuscate/Decode Files or Information
Taidoor has the ability to use native APIs for execution including GetProcessHeap, GetProcAddress, and LoadLibrary.
Technique: T1106: Native API
In cloud environments, storage objects within compromised accounts may also be encrypted.
Technique: T1486: Data Encrypted for Impact
APT29 used scheduler and schtasks to create new tasks on remote hosts as part of lateral movement.
Technique: T1053: Scheduled Task/Job
NOKKI has established persistence by writing the payload to the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
Technique: T1547: Boot or Logon Autostart Execution
Denis replaces the nonexistent Windows DLL "msfte.dll" with its own malicious version, which is loaded by the SearchIndexer.exe and SearchProtocolHost.exe.
Technique: T1574: Hijack Execution Flow
An interesting note on these payloads is that all the Delphi payloads delivered in this campaign were packed with UPX, while none of the other payloads were packed
Technique: T1027: Obfuscated Files or Information
If the OwaAuth web shell is ineffective because the victim uses two-factor authentication for webmail, the adversaries identify other externally accessible servers and deploy ChinaChopper web shells
Technique: T1505: Server Software Component
DustySky can detect connected USB devices.
Technique: T1120: Peripheral Device Discovery
Adversaries may abuse Windows safe mode to disable endpoint defenses.
Technique: T1562: Impair Defenses
Hikit is a Rootkit that has been used by Axiom.
Technique: T1014: Rootkit
ObliqueRAT can capture a screenshot of the current screen.
Technique: T1113: Screen Capture
Such transfers may utilize existing cloud provider APIs and the internal address space of the cloud provider to blend into normal traffic or avoid data transfers over external network interfaces.
Technique: T1537: Transfer Data to Cloud Account
Ryuk has used cmd.exe to create a Registry entry to establish persistence.
Technique: T1059: Command and Scripting Interpreter
For C2 over HTTP, Helminth encodes data with base64 and sends it via the "Cookie" field of HTTP requests.
Technique: T1132: Data Encoding
Egregor has used regsvr32.exe to execute malicious DLLs.
Technique: T1218: Signed Binary Proxy Execution
Wizard Spider has used "ipconfig" to identify the network configuration of a victim machine.
Technique: T1016: System Network Configuration Discovery
Attor has a plugin that collects information about inserted storage devices, modems, and phone devices.
Technique: T1120: Peripheral Device Discovery
StreamEx has the ability to enumerate drive types.
Technique: T1083: File and Directory Discovery
One persistence mechanism used by CozyCar is to set itself to be executed at system startup by adding a Registry value under one of the following Registry keys: <br>HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ <br>HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ <br>HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run <br>HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.
Technique: T1547: Boot or Logon Autostart Execution
To decode this information, BADNEWS takes the following steps:  Base64-decode the string Perform the decoding cipher used in previous versions Base64-decode the result Decrypt the result using the Blowfish algorithm and a static key  A script, which is included in the Appendix, will decrypt data from these dead drop resolvers
Technique: T1140: Deobfuscate/Decode Files or Information
CosmicDuke takes periodic screenshots and exfiltrates them.
Technique: T1113: Screen Capture