KJChen/tech2proc huggingface dataset:
Technique:  Event Triggered Execution:Component Object Model Hijacking
Some variants of ADVSTORESHELL achieve persistence by registering the payload as a Shell Icon Overlay handler COM object.
It has used COM hijacking for persistence by replacing the legitimate MMDeviceEnumerator object with a payload.
BBSRAT has been seen persisting via COM hijacking through replacement of the COM object for MruPidlList {42aedc87-2188-41fd-b9a3-0c966feabec1} or Microsoft WBEM New Event Subsystem {F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} depending on the system's CPU architecture.
ComRAT samples have been seen which hijack COM objects for persistence by replacing the path to shell32.dll in registry location HKCU\Software\Classes\CLSID{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32.
Ferocious can use COM hijacking to establish persistence.
JHUHUGIT has used COM hijacking to establish persistence by hijacking a class named MMDeviceEnumerator and also by registering the payload as a Shell Icon Overlay handler COM object ({3543619C-D563-43f7-95EA-4DA7E1CC396A}).
KONNI has modified ComSysApp service to load the malicious DLL payload.
Mosquito uses COM hijacking as a method of persistence.
PcShare has created the HKCU\\Software\\Classes\\CLSID\\{42aedc87-2188-41fd-b9a3-0c966feabec1}\\InprocServer32 Registry key for persistence.
SILENTTRINITY can add a CLSID key for payload execution through Registry.CurrentUser.CreateSubKey("Software\\Classes\\CLSID\\{" + clsid + "}\\InProcServer32").
SVCReady has created the HKEY_CURRENT_USER\Software\Classes\CLSID\{E6D34FFC-AD32-4d6a-934C-D387FA873A19} Registry key for persistence.
WarzoneRAT  can perform COM hijacking by setting the path to itself to the HKCU\Software\Classes\Folder\shell\open\command key with a DelegateExecute parameter.
Technique:  Event Triggered Execution:Installer Packages
During AppleJeus's installation process, it uses postinstall scripts to extract a hidden plist from the application's /Resources folder and execute the plist file as a Launch Daemon with elevated permissions.
Technique:  Hijack Execution Flow
During C0017, It established persistence by loading malicious libraries via modifications to the Import Address Table (IAT) within legitimate Microsoft binaries.
Denis replaces the nonexistent Windows DLL "msfte.dll" with its own malicious version, which is loaded by the SearchIndexer.exe and SearchProtocolHost.exe.
One of Dtrack can replace the normal flow of a program execution with malicious code.
ShimRat can hijack the cryptbase.dll within migwiz.exe to escalate privileges and bypass UAC controls.
Technique:  Hijack Execution Flow:Dylib Hijacking
Empire has a dylib hijacker module that generates a malicious dylib given the path to a legitimate dylib of a vulnerable application.
Technique:  Hijack Execution Flow:Dynamic Linker Hijacking
It has configured payloads to load via LD_PRELOAD.
Ebury has injected its dynamic library into descendent processes of sshd via LD_PRELOAD.
HiddenWasp adds itself as a shared object to the LD_PRELOAD environment variable.
Hildegard has modified /etc/ld.so.preload to intercept shared library import functions.
It has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.
XCSSET adds malicious file paths to the DYLD_FRAMEWORK_PATH and DYLD_LIBRARY_PATH environment variables to execute malicious code.
Technique:  Hijack Execution Flow:Path Interception by PATH Environment Variable
Empire contains modules that can discover and exploit path interception opportunities in the PATH environment variable.
PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit path interception opportunities in the PATH environment variable.
Technique:  Hijack Execution Flow:Path Interception by Search Order Hijacking
Empire contains modules that can discover and exploit search order hijacking vulnerabilities.
PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit search order hijacking vulnerabilities.
Technique:  Hijack Execution Flow:Path Interception by Unquoted Path
Empire contains modules that can discover and exploit unquoted path vulnerabilities.
PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit unquoted path vulnerabilities.
Technique:  Hijack Execution Flow:Services File Permissions Weakness
One variant of BlackEnergy locates existing driver services that have been disabled and drops its driver component into one of those service's paths, replacing the legitimate executable. The malware then sets the hijacked service to start automatically to establish persistence.
Technique:  Hijack Execution Flow:Services Registry Permissions Weakness
During Operation Honeybee, the threat actors used a batch file that modified the COMSysApp service to load a malicious ipnet.dll payload and to load a DLL into the svchost.exe process.
Technique:  Hijack Execution Flow:COR_PROFILER
It has used wmic.exe and Windows Registry modifications to set the COR_PROFILER environment variable to execute a malicious DLL whenever a process loads the .NET CLR.
DarkTortilla can detect profilers by verifying the COR_ENABLE_PROFILING environment variable is present and active.
Technique:  Hijack Execution Flow:KernelCallbackTable
FinFisher has used the KernelCallbackTable to hijack the execution flow of a process by replacing the __fnDWORD function with the address of a created Asynchronous Procedure Call stub routine.
It has abused the KernelCallbackTable to hijack process control flow and execute shellcode.
Technique:  Modify Authentication Process
Ebury can intercept private keys using a trojanized ssh-add function.
It has replaced legitimate KeePass binaries with trojanized versions to collect passwords from numerous applications.
Kessel has trojanized the ssh_login and user-auth_pubkey functions to steal plaintext credentials.
SILENTTRINITY can create a backdoor in KeePass using a malicious config file and in TortoiseSVN using a registry hook.
Technique:  Modify Authentication Process:Domain Controller Authentication
It's malware has altered the NTLM authentication program on domain controllers to allow It to login without a valid credential.
Skeleton Key is used to patch an enterprise domain controller authentication process with a backdoor password. It allows adversaries to bypass the standard authentication system to use a defined password for all accounts authenticating to that domain controller.
Technique:  Modify Authentication Process:Password Filter DLL
Remsec harvests plain-text credentials as a password filter registered on domain controllers.
It has registered its persistence module on domain controllers as a Windows LSA (Local System Authority) password filter to acquire credentials any time a domain, local user, or administrator logs in or changes a password.
Technique:  Modify Authentication Process:Pluggable Authentication Modules
Ebury can deactivate PAM modules to tamper with the sshd configuration.
Skidmap has the ability to replace the pam_unix.so file on an infected machine with its own malicious version that accepts a specific backdoor password for all users.
Technique:  Modify Authentication Process:Network Device Authentication
SYNful Knock has the capability to add its own custom backdoor password when it modifies the operating system of the affected network device.
Technique:  Modify Authentication Process:Multi-Factor Authentication
The AADInternals Set-AADIntUserMFA command can be used to disable MFA for a specified user.
Technique:  Modify Authentication Process:Hybrid Identity
AADInternals can inject a malicious DLL (PTASpy) into the AzureADConnectAuthenticationAgentService to backdoor Azure AD Pass-Through Authentication.
It has edited the Microsoft.IdentityServer.Servicehost.exe.config file to load a malicious DLL into the AD FS process, thereby enabling persistent access to any service federated with AD FS for a user with a specified User Principal Name.
Technique:  Office Application Startup
It have replaced Microsoft Outlook's VbaProject.OTM file to install a backdoor macro for persistence.
It has inserted malicious macros into existing documents, providing persistence when they are reopened. It has loaded the group's previously delivered VBA project by relaunching Microsoft Outlook with the /altvba option, once the Application.Startup event is received.
Technique:  Office Application Startup:Office Template Macros
BackConfig has the ability to use hidden columns in Excel spreadsheets to store executable files or commands for VBA macros.
Cobalt Strike has the ability to use an Excel Workbook to execute additional code by enabling Office to trust macros and execute code without user permission.
It has used a Word Template, Normal.dotm, for persistence.
Technique:  Office Application Startup:Office Test
It has used the Office Test persistence mechanism within Microsoft Office by adding the Registry key HKCU\Software\Microsoft\Office test\Special\Perf to execute code.
Technique:  Office Application Startup:Outlook Forms
Ruler can be used to automate the abuse of Outlook Forms to establish persistence.
Technique:  Office Application Startup:Outlook Home Page
It has abused the Outlook Home Page feature for persistence. It has also used CVE-2017-11774 to roll back the initial patch designed to protect against Home Page abuse.
Ruler can be used to automate the abuse of Outlook Home Pages to establish persistence.
Technique:  Office Application Startup:Outlook Rules
Ruler can be used to automate the abuse of Outlook Rules to establish persistence.
Technique:  Office Application Startup:Add-ins
Bisonal has been loaded through a .wll extension added to the %APPDATA%\microsoft\word\startup\ repository.
It has used the RoyalRoad exploit builder to drop a second stage loader, intel.wll, into the Word Startup folder on the compromised host.
Technique:  Pre-OS Boot:System Firmware
Hacking Team UEFI Rootkit is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems.
LoJax is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems.
Trojan.Mebromi performs BIOS modification and can download and execute a file as well as protect itself from removal.
Technique:  Pre-OS Boot:Component Firmware
Cyclops Blink has maintained persistence by patching legitimate device firmware when it is downloaded, including that of WatchGuard devices.
It is known to have the capability to overwrite the firmware on hard drives from some manufacturers.
Technique:  Pre-OS Boot:Bootkit
It has deployed a bootkit along with Downdelph to ensure its persistence on the victim. The bootkit shares code with some variants of BlackEnergy.
It deployed Master Boot Record bootkits on Windows systems to hide their malware and maintain persistence on victim systems.
BOOTRASH is a Volume Boot Record (VBR) bootkit that uses the VBR to maintain persistence.
Carberp has installed a bootkit on the system to maintain persistence.
Some FinFisher variants incorporate an MBR rootkit.
It malware WhiskeyAlfa-Three modifies sector 0 of the Master Boot Record (MBR) to ensure that the malware will persist even if a victim machine shuts down.
ROCKBOOT is a Master Boot Record (MBR) bootkit that uses the MBR to establish persistence.
TrickBot can implant malicious code into a compromised device's firmware.
WhisperGate overwrites the MBR with a bootloader component that performs destructive wiping operations on hard drives and displays a fake ransom note when the host boots.
Technique:  Server Software Component:SQL Stored Procedures
During the 2016 Ukraine Electric Power Attack, It used various MS-SQL stored procedures.
Stuxnet used xp_cmdshell to store and execute SQL code.
Technique:  Server Software Component:Transport Agent
LightNeuron has used a malicious Microsoft Exchange transport agent for persistence.
Technique:  Server Software Component:IIS Components
IceApple is an IIS post-exploitation framework, consisting of 18 modules that provide several functionalities.
During Operation Dream Job, It targeted Windows servers running Internet Information Systems (IIS) to install C2 components.
OwaAuth has been loaded onto Exchange servers and disguised as an ISAPI filter (owaauth.dll). The IIS w3wp.exe process then loads the malicious DLL.
RGDoor establishes persistence on webservers as an IIS module.
Technique:  Traffic Signaling
Chaos provides a reverse shell is triggered upon receipt of a packet with a special string, sent to any port.
Kobalos is triggered by an incoming TCP connection to a legitimate service from a specific source port.
Pandora can identify if incoming HTTP traffic contains a token and if so it will intercept the traffic and process the received command.
Penquin will connect to C2 only after sniffing a "magic packet" value in TCP or UDP packets matching specific conditions.
Ryuk has used Wake-on-Lan to power on turned off systems for lateral movement.
SYNful Knock can be sent instructions via special packets to change its functionality. Code for new functionality can be included in these messages.
Umbreon provides additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet.
Uroburos can intercept the first client to server packet in the 3-way TCP handshake to determine if the packet contains the correct unique value for a specific Uroburos implant. If the value does not match, the packet and the rest of the TCP session are passed to the legitimate listening application.
Winnti for Linux has used a passive listener, capable of identifying a specific magic value before executing tasking, as a secondary command and control (C2) mechanism.
Technique:  Traffic Signaling:Port Knocking
Mafalda can use port-knocking to authenticate itself to another implant called Cryshell to establish an indirect connection to the C2 server.
metaMain has authenticated itself to a different implant, Cryshell, through a port knocking and handshake procedure.
It has used a script that configures the knockd service and firewall to only accept C2 connections from systems that use a specified sequence of knock ports.
Technique:  Traffic Signaling:Socket Filters
Penquin installs a TCP and UDP filter on the eth0 interface.
Technique:  Abuse Elevation Control Mechanism:Setuid and Setgid
Exaramel for Linux can execute commands with high privileges via a specific binary with setuid functionality.
Keydnap adds the setuid flag to a binary so it can easily elevate in the future.
Technique:  Abuse Elevation Control Mechanism:Sudo and Sudo Caching
Cobalt Strike can use sudo to run a command.
Dok adds admin  ALL=(ALL) NOPASSWD: ALL to the /etc/sudoers file.
Proton modifies the tty_tickets line in the sudoers file.
Technique:  Abuse Elevation Control Mechanism:Elevated Execution with Prompt
OSX/Shlayer can escalate privileges to root by asking the user for credentials.
Technique:  Access Token Manipulation
AppleSeed can gain system level privilege by passing SeDebugPrivilege to the AdjustTokenPrivilege API.
BlackCat has the ability modify access tokens.
It has used JuicyPotato to abuse the SeImpersonate token privilege to escalate from web application pool accounts to NT Authority\SYSTEM.
During C0017, It used a ConfuserEx obfuscated BADPOTATO exploit to abuse named-pipe impersonation for local NT AUTHORITY\SYSTEM privilege escalation.
Cuba has used SeDebugPrivilege and AdjustTokenPrivileges to elevate privileges.
Duqu examines running system processes for tokens that have specific system privileges. If it finds one, it will copy the token and store it for later use. Eventually it will start new processes with the stored token attached. It can also steal tokens to acquire administrative privileges.
Empire can use PowerSploit's Invoke-TokenManipulation to manipulate access tokens.
It has used has used Metasploit’s named-pipe impersonation technique to escalate privileges.
Gelsemium can use token manipulation to bypass UAC on Windows7 systems.
HermeticWiper can use AdjustTokenPrivileges to grant itself privileges for debugging with SeDebugPrivilege, creating backups with SeBackupPrivilege, loading drivers with SeLoadDriverPrivilege, and shutting down a local system with SeShutdownPrivilege.
Hydraq creates a backdoor through which remote attackers can adjust token privileges.
KillDisk has attempted to get the access token of a process by calling OpenProcessToken. If KillDisk gets the access token, then it attempt to modify the token privileges with AdjustTokenPrivileges.
Mafalda can use AdjustTokenPrivileges() to elevate privileges.
MegaCortex can enable SeDebugPrivilege and adjust token privileges.
PoshC2 can use Invoke-TokenManipulation for manipulating tokens.
PowerSploit's Invoke-TokenManipulation Exfiltration module can be used to manipulate tokens.
Ryuk has attempted to adjust its token privileges to have the SeDebugPrivilege.
Sliver has the ability to manipulate user tokens on targeted Windows systems.
SslMM contains a feature to manipulate process privileges and tokens.
SUNSPOT modified its security token to grants itself debugging privileges by adding SeDebugPrivilege.
Technique:  Access Token Manipulation:Token Impersonation
It has used CVE-2015-1701 to access the SYSTEM token and copy it into the current process as part of privilege escalation.
Aria-body has the ability to duplicate a token from ntprint.exe.
BADHATCH can impersonate a lsass.exe or vmtoolsd.exe token.
BitPaymer can use the tokens of users to create processes on infected systems.
Cobalt Strike can steal access tokens from exiting processes.
Emotet has the ability to duplicate the user’s token.
It has used a malicious framework designed to impersonate the lsass.exe/vmtoolsd.exe token.
FinFisher uses token manipulation with NtFilterToken as part of UAC bypass.
Okrum can impersonate a logged-on user's security context using a call to the ImpersonateLoggedOnUser API.
Pupy can obtain a list of SIDs and provide the option for selecting process tokens to impersonate.
REvil can obtain the token from the user that launched the explorer.exe process to avoid affecting the desktop of the SYSTEM user.
Shamoon can impersonate tokens using LogonUser, ImpersonateLoggedOnUser, and ImpersonateNamedPipeClient.
SILENTTRINITY can find a process owned by a specific user and impersonate the associated token.
Siloscape impersonates the main thread of CExecSvc.exe by calling NtImpersonateThread.
Stuxnet attempts to impersonate an anonymous token to enumerate bindings in the service control manager.
Tarrask leverages token theft to obtain lsass.exe security permissions.
Technique:  Access Token Manipulation:Create Process with Token
Aria-body has the ability to execute a process using runas.
Azorult can call WTSQueryUserToken and CreateProcessAsUser to start a new process with local system privileges.
Bankshot grabs a user token using WTSQueryUserToken and then creates a process by impersonating a logged-on user.
Empire can use Invoke-RunAs to make tokens.
KONNI has duplicated the token of a high integrity process to spawn an instance of cmd.exe under an impersonated user.
It keylogger KiloAlfa obtains user tokens from interactive sessions to execute itself with API call CreateProcessAsUserA under that user's context.
PipeMon can attempt to gain administrative privileges using token impersonation.
PoshC2 can use Invoke-RunAs to make tokens.
REvil can launch an instance of itself with administrative rights using runas.
It RPC backdoors can impersonate or steal process tokens before executing commands.
The WhisperGate third stage can use the AdvancedRun.exe tool to execute commands in the context of the Windows TrustedInstaller group via %TEMP%\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run.
ZxShell has a command called RunAs, which creates a new process as another user or process context.
Technique:  Access Token Manipulation:Make and Impersonate Token
Cobalt Strike can make tokens from known credentials.
It has utilized tools such as Incognito V2 for token manipulation and impersonation.
Mafalda can create a token for a different user.
Technique:  Access Token Manipulation:Parent PID Spoofing
Cobalt Strike can spawn processes with alternate PPIDs.
KONNI has used parent PID spoofing to spawn a new cmd process using CreateProcessW and a handle to Taskmgr.exe.
PipeMon can use parent PID spoofing to elevate privileges.
Technique:  Access Token Manipulation:SID-History Injection
Empire can add a SID-History to a user if on a domain controller.
Mimikatz's MISC::AddSid module can appended any SID or user/group account to a user's SID-History. Mimikatz also utilizes SID-History Injection to expand the scope of other components such as generated Kerberos Golden Tickets and DCSync beyond a single domain.
Technique:  Domain Policy Modification:Group Policy Modification
Egregor can modify the GPO to evade detection.
Empire can use New-GPOImmediateTask to modify a GPO that will install and execute a malicious Scheduled Task/Job.
HermeticWiper has the ability to deploy through an infected system's default domain policy.
It has used Group Policy Objects to deploy batch scripts.
Meteor can use group policy to push a scheduled task from the AD to all network machines.
Prestige has been deployed using the Default Domain Group Policy Object from an Active Directory Domain Controller.
Technique:  Domain Policy Modification:Domain Trust Modification
AADInternals can create a backdoor by converting a domain to a federated domain which will be able to authenticate any user across the tenant. AADInternals can also modify DesktopSSO information.
During the SolarWinds Compromise, It changed domain federation trust settings using Azure AD administrative permissions to configure the domain to accept authorization tokens signed by their own SAML signing certificate.
Technique:  Escape to Host
Doki’s container was configured to bind the host root directory.
Hildegard has used the BOtB tool that can break out of containers.
Peirates can gain a reverse shell on a host node by mounting the Kubernetes hostPath.
Siloscape maps the host’s C drive to the container by creating a global symbolic link to the host through the calling of NtSetInformationSymbolicLink.
It has deployed privileged containers that mount the filesystem of victim machine.
Technique:  Process Injection:Portable Executable Injection
It downloads an executable and injects it directly into a new process.
It malware can download a remote access tool, ShiftyBug, and inject into another process.
GreyEnergy has a module to inject a PE binary into a remote process.
InvisiMole can inject its backdoor as a portable executable into a target process.
Lizar can execute PE files in the address space of the specified process.
It's miner, "TermsHost.exe", evaded defenses by injecting itself into Windows processes, including Notepad.exe.
Zeus Panda checks processes on the system and if they meet the necessary requirements, it injects into that process.
Technique:  Process Injection:Thread Execution Hijacking
Gazer performs thread execution hijacking to inject its orchestrator into a running thread from a remote process.
Trojan.Karagany can inject a suspended thread of its own process into a new process and initiate via the ResumeThread API.
Waterbear can use thread injection to inject shellcode into the process of security software.
Technique:  Process Injection:Asynchronous Procedure Call
Attor performs the injection by attaching its code into the APC queue using NtQueueApcThread API.
BADHATCH can inject itself into a new svchost.exe -k netsvcs process using the asynchronous procedure call (APC) queue.
Bumblebee can use asynchronous procedure call (APC) injection to execute commands received from C2.
Carberp has queued an APC routine to explorer.exe by calling ZwQueueApcThread.
It has injected malicious code into a new svchost.exe process.
IcedID has used ZwQueueApcThread to inject itself into remote processes.
InvisiMole can inject its code into a trusted process via the APC queue.
Pillowmint has used the NtQueueApcThread syscall to inject code into svchost.exe.
Saint Bot has written its payload into a newly-created EhStorAuthn.exe process using ZwWriteVirtualMemory and executed it using NtQueueApcThread and ZwAlertResumeThread.
Sardonic can use the QueueUserAPC API to execute shellcode on a compromised machine.
TURNEDUP is capable of injecting code into the APC queue of a created Rundll32 process as part of an "Early Bird injection."
Technique:  Process Injection:Thread Local Storage
Ursnif has injected code into target processes via thread local storage callbacks.
Technique:  Process Injection:Extra Window Memory Injection
Epic has overwritten the function pointer in the extra window memory of Explorer's Shell_TrayWnd in order to execute malicious code in the context of the explorer.exe process.
Power Loader overwrites Explorer’s Shell_TrayWnd extra window memory to redirect execution to a NTDLL function that is abused to assemble and execute a return-oriented programming (ROP) chain and create a malicious thread within Explorer.exe.
Technique:  Process Injection:Process Hollowing
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code.
Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
Azorult can decrypt the payload into memory, create a new suspended process of itself, then inject a decrypted payload to the new process and resume new process execution.
BADNEWS has a command to download an .exe and use process hollowing to inject it into a new process.
Bandook has been launched by starting iexplore.exe and replacing it with Bandook's payload.
Bazar can inject into a target process including Svchost, Explorer, and cmd using process hollowing.
BBSRAT has been seen loaded into msiexec.exe through process hollowing to hide its execution.
Clambling can execute binaries through process hollowing.
Cobalt Strike can use process hollowing for execution.
Denis performed process hollowing through the API calls CreateRemoteThread, ResumeThread, and Wow64SetThreadContext.
Dtrack has used process hollowing shellcode to target a predefined list of processes from %SYSTEM32%.
Duqu is capable of loading executable code via process hollowing.
It malware can use process hollowing to inject one of its trojans into another process.
ISMInjector hollows out a newly created process RegASM.exe and injects its payload into the hollowed process.
It has used a file injector DLL to spawn a benign process on the victim's system and inject the malicious payload into it via process hollowing.
Lokibot has used process hollowing to inject itself into legitimate Windows process.
It has used process hollowing in iexplore.exe to load the RedLeaves implant.
The NETWIRE payload has been injected into benign Microsoft executables via process hollowing.
Some Orz versions have an embedded DLL known as MockDll that uses process hollowing and Regsvr32 to execute another payload.
A It payload uses process hollowing to hide the UAC bypass vulnerability exploitation inside svchost.exe.
QakBot can use process hollowing to execute its main payload.
RCSession can launch itself from a hollowed svchost.exe process.
The Saint Bot loader has used API calls to spawn MSBuild.exe in a suspended state before injecting the decrypted Saint Bot binary into it.
Smoke Loader spawns a new copy of c:\windows\syswow64\explorer.exe and then replaces the executable code in memory with malware.
Snip3 can use RunPE to execute malicious payloads within a hollowed Windows process.
It has used process hollowing to execute CyberGate malware.
A It tool can spawn svchost.exe and inject the payload into that process.
TrickBot injects into the svchost.exe process.
Ursnif has used process hollowing to inject into child processes.
WhisperGate has the ability to inject its fourth stage into a suspended process created by the legitimate Windows utility InstallUtil.exe.
Woody RAT can create a suspended notepad process and write shellcode to delete a file into the suspended process using NtWriteVirtualMemory.
Technique:  Process Injection:Process Doppelgänging
Bazar can inject into a target process using process doppelgänging.
It has used Process Doppelgänging to evade security software while deploying tools on compromised systems.
SynAck abuses NTFS transactions to launch and conceal malicious processes.
Technique:  Process Injection:ListPlanting
InvisiMole has used ListPlanting to inject code into a trusted process.
Technique:  Debugger Evasion
AsyncRAT can use the CheckRemoteDebuggerPresent function to detect the presence of a debugger.
The Black Basta dropper can check system flags, CPU registers, CPU instructions, process timing, system libraries, and APIs to determine if a debugger is present.
Bumblebee can search for tools used in static analysis.
DarkTortilla can detect debuggers by using functions such as DebuggerIsAttached and DebuggerIsLogging. DarkTortilla can also detect profilers by verifying the COR_ENABLE_PROFILING environment variable is present and active.
DRATzarus can use IsDebuggerPresent to detect whether a debugger is present on a victim.
Mafalda can search for debugging tools on a compromised host.
During Operation Dream Job, It used tools that used the IsDebuggerPresent call to detect debuggers.
ROKRAT can check for debugging tools.
Saint Bot has used is_debugger_present as part of its environmental checks.
ThiefQuest uses a function named is_debugging to perform anti-debugging logic. The function invokes sysctl checking the returned value of P_TRACED. ThiefQuest also calls ptrace with the PTRACE_DENY_ATTACH flag to prevent debugging.
Technique:  Direct Volume Access
esentutl can use the Volume Shadow Copy service to copy locked files such as ntds.dit.
Technique:  Execution Guardrails
Anchor can terminate itself if specific execution flags are not present.
BitPaymer compares file names and paths to a list of excluded names and directory names during encryption.
BoomBox can check its current working directory and for the presence of a specific file and terminate if specific values are not found.
DEADEYE can ensure it executes only on intended systems by identifying the victim's volume serial number, hostname, and/or DNS domain.
EnvyScout can call window.location.pathname to ensure that embedded files are being executed from the C: drive, and will terminate if they are not.
NativeZone can check for the presence of KM.EkeyAlmaz1C.dll and will halt execution unless it is in the same directory as the rest of the malware's components.
Small Sieve can only execute correctly if the word Platypus is passed to it on the command line.
Stuxnet checks for specific operating systems on 32-bit machines, Registry keys, and dates for vulnerabilities, and will exit execution if the values are not met.
SUNSPOT only replaces SolarWinds Orion source code if the MD5 checksums of both the original source code file and backdoored replacement source code match hardcoded values.
Torisma is only delivered to a compromised host if the victim's IP address is on an allow-list.
VaporRage has the ability to check for the presence of a specific DLL and terminate if it is not found.
Technique:  Execution Guardrails:Environmental Keying
It has encrypted payloads using the Data Protection API (DPAPI), which relies on keys tied to specific user accounts on specific machines. It has also environmentally keyed second stage malware with an RC5 key derived in part from the infected system's volume serial number.
It has been observed utilizing environmental keying in payload delivery.
InvisiMole can use Data Protection API to encrypt its components on the victim’s computer, to evade detection, and to make sure the payload can only be decrypted and loaded on one specific compromised computer.
PowerPunch can use the volume serial number from a target host to generate a unique XOR key for the next stage payload.
ROKRAT relies on a specific victim hostname to execute and decrypt important strings.
The Winnti for Windows dropper component can verify the existence of a single command line parameter and either terminate if it is not found or later use it as a decryption key.
Technique:  Exploitation for Defense Evasion
It has used CVE-2015-4902 to bypass security features.
Technique:  File and Directory Permissions Modification:Windows File and Directory Permissions Modification
BitPaymer can use icacls /reset and takeown /F to reset a targeted executable's permissions and then take ownership.
BlackCat can use Windows commands such as fsutil behavior set SymLinkEvaluation R2L:1 to redirect file system access to a different location after gaining access into compromised networks.
CaddyWiper can modify ACL entries to take ownership of files.
Grandoreiro can modify the binary ACL to prevent security tools from running.
JPIN can use the command-line utility cacls.exe to change file permissions.
Ryuk can launch icacls  /grant Everyone:F /T /C /Q to delete every access-based restrictions on files and directories.
WannaCry uses attrib +h and icacls . /grant Everyone:F /T /C /Q to make some of its files hidden and grant all users full access controls.
WastedLocker has a command to take ownership of a file and reset the ACL permissions using the takeown.exe /F filepath command.
It has used the icacls command to modify access control to backup servers, providing them with full control of all the system folders.
Technique:  File and Directory Permissions Modification:Linux and Mac File and Directory Permissions Modification
It's macOS backdoor changes the permission of the file it wants to execute to 755.
The Black Basta binary can use chmod to gain full permissions to targeted files.
Bundlore changes the permissions of a payload using the command chmod -R 755.
Dok gives all users execute permissions for the application using the command chmod +x /Users/Shared/AppStore.app.
Kinsing has used chmod to modify permissions on key files for use.
OSX/Shlayer can use the chmod utility to set a file as executable, such as chmod 777 or chmod +x.
OSX_OCEANLOTUS.D has changed permissions of a second-stage payload to an executable via chmod.
P.A.S. Webshell has the ability to modify file permissions.
Penquin can add the executable flag to a downloaded file.
It has changed file permissions of files so they could not be modified.
It has modified the permissions on binaries with chattr.
XCSSET uses the chmod +x command to grant executable permissions to the malicious file.
Technique:  Hide Artifacts
Bundlore uses the mktemp utility to make unique file and directory names for payloads, such as TMP_DIR=`mktemp -d -t x.
DarkTortilla has used %HiddenReg% and %HiddenKey% as part of its persistence via the Windows registry.
OSX/Shlayer has used the mktemp utility to make random and unique filenames for payloads, such as export tmpDir="$(mktemp -d /tmp/XXXXXXXXXXXX)" or mktemp -t Installer.
Tarrask is able to create "hidden" scheduled tasks by deleting the Security Descriptor (SD) registry value.
WarzoneRAT can masquerade the Process Environment Block on a compromised host to hide it's attempts to elevate privileges through IFileOperation.
Technique:  Hide Artifacts:Hidden Users
It has modified the Registry to hide created user accounts.
It has run reg add ‘HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList’ /v to hide a newly created user.
SMOKEDHAM has modified the Registry to hide created user accounts from the Windows logon screen.
Technique:  Hide Artifacts:NTFS File Attributes
Anchor has used NTFS to hide files.
It used NTFS alternate data streams to hide their payloads.
Astaroth can abuse alternate data streams (ADS) to store content for malicious payloads.
BitPaymer has copied itself to the :bin alternate data stream of a newly created file.
The DEADEYE.EMBED variant of DEADEYE can embed its payload in an alternate data stream of a local file.
esentutl can be used to read and write alternate data streams.
Expand can be used to download or copy a file into an alternate data stream.
Gazer stores configuration items in alternate data streams (ADSs) if the Registry is not accessible.
LoJax has loaded an embedded NTFS DXE driver to be able to access and write to NTFS partitions.
PowerDuke hides many of its backdoor payloads in an alternate data stream (ADS).
If the victim is using PowerShell 3.0 or later, POWERSOURCE writes its decoded payload to an alternate data stream (ADS) named kernel32.dll that is saved in %PROGRAMDATA%\Windows\.
The Regin malware platform uses Extended Attributes to store encrypted executables.
Valak has the ability save and execute files as alternate data streams (ADS).
WastedLocker has the ability to save and execute files as an alternate data stream (ADS).
Some variants of the Zeroaccess Trojan have been known to store data in Extended Attributes.
Technique:  Hide Artifacts:Hidden File System
BOOTRASH has used unallocated disk space between partitions for a hidden file system that stores components of the Nemesis bootkit.
ComRAT has used a portable FAT16 partition image placed in %TEMP% as a hidden file system.
It has used an encrypted virtual file system stored in the Windows Registry.
Regin has used a hidden file system to store some of its components.
It has used a hidden file system that is stored as a file on disk.
Uroburos can use concealed storage mechanisms including an NTFS or FAT-16 filesystem encrypted with CAST-128 in CBC mode.
Technique:  Hide Artifacts:Run Virtual Instance
LoudMiner has used QEMU and VirtualBox to run a Tiny Core Linux virtual machine, which runs XMRig and makes connections to the C2 server for updates.
Maze operators have used VirtualBox and a Windows 7 virtual machine to run the ransomware; the virtual machine's configuration file mapped the shared network drives of the target company, presumably so Maze can encrypt files on the shared drives as well as the local machine.
Ragnar Locker has used VirtualBox and a stripped Windows XP virtual machine to run itself. The use of a shared folder specified in the configuration enables Ragnar Locker to encrypt files on the host operating system, including files on any mapped drives.
Technique:  Hide Artifacts:Email Hiding Rules
It has created rules in victims' Microsoft Outlook accounts to automatically delete emails containing words such as "hacked," "phish," and "malware" in a likely attempt to prevent organizations from communicating about their activities.
Technique:  Hide Artifacts:Resource Forking
Keydnap uses a resource fork to present a macOS JPEG or text file icon rather than the executable's icon assigned by the operating system.
OSX/Shlayer has used a resource fork to hide a compressed binary file of itself from the terminal, Finder, and potentially evade traditional scanners.
Technique:  Hide Artifacts:Process Argument Spoofing
Cobalt Strike can use spoof arguments in spawned processes that execute beacon commands.
SombRAT has the ability to modify its process memory to hide process command-line arguments.
Technique:  Hide Artifacts:Ignore Process Interrupts
The GoldMax Linux variant has been executed with the nohup command to ignore hangup signals and continue to run if the terminal session was terminated.
OSX/Shlayer has used the nohup command to instruct executed payloads to ignore hangup signals.
Technique:  Impair Defenses
It has disabled LSA protection on compromised hosts using "reg" add HKLM\SYSTEM\CurrentControlSet\Control\LSA /v RunAsPPL /t REG_DWORD /d 0 /f.
Stuxnet reduces the integrity level of objects to allow write actions.
Technique:  Impair Defenses:Disable Windows Event Logging
During the 2016 Ukraine Electric Power Attack, It disabled event logging on compromised systems.
It has executed scripts to disable the event log service.
During the SolarWinds Compromise, It, used AUDITPOL to prevent the collection of audit logs.
It has used appcmd.exe to disable logging on a victim server.
Wevtutil can be used to disable specific event logs on the system.
Technique:  Impair Defenses:Impair Command History Logging
It has prepended a space to all of their terminal commands to operate without leaving traces in the HISTCONTROL environment.
SILENTTRINITY can bypass ScriptBlock logging to execute unmanaged PowerShell code from memory.
Technique:  Impair Defenses:Disable or Modify System Firewall
It have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443.
The "ZR" variant of BACKSPACE will check to see if known host-based firewalls are installed on the infected systems. BACKSPACE will attempt to establish a C2 channel, then will examine open windows to identify a pop-up from the firewall software and will simulate a mouse-click to allow the connection to proceed.
BADCALL disables the Windows firewall before binding to a port.
It may use netsh to add local firewall rule exceptions.
CookieMiner has checked for the presence of "Little Snitch", macOS network monitoring and application firewall software, stopping and exiting if it is found.
Cyclops Blink can modify the Linux iptables firewall to enable C2 communication via a stored list of port numbers.
DarkComet can disable Security Center functions like the Windows Firewall.
It has disabled host-based firewalls. The group has also globally opened port 3389.
Grandoreiro can block the Deibold Warsaw GAS Tecnologia security tool at the firewall level.
H1N1 kills and disables services for Windows Firewall.
HARDRAIN opens the Windows Firewall to modify incoming connections.
HOPLIGHT has modified the firewall using netsh.
InvisiMole has a command to disable routing and the Firewall on the victim’s machine.
Kasidet has the ability to change firewall settings to allow a plug-in to be downloaded.
It has been observed disabling the system firewall.
Various It malware modifies the Windows firewall to allow incoming connections or disable it entirely using netsh.
It has added the following rule to a victim's Windows firewall to allow RDP traffic - "netsh" advfirewall firewall add rule name="Terminal Server" dir=in action=allow protocol=TCP localport=3389.
It has used batch scripts that can disable the Windows firewall on specific remote machines.
NanoCore can modify the victim's firewall.
netsh can be used to disable local firewall settings.
njRAT has modified the Windows firewall to allow itself to communicate through the firewall.
During Operation Wocao, threat actors used PowerShell to add and delete rules in the Windows firewall.
PyDCrypt has modified firewall rules to allow incoming SMB, NetBIOS, and RPC connections using netsh.exe on remote machines.
Remsec can add or remove applications or ports on the Windows firewall or disable it entirely.
It used scripts which killed processes and added firewall rules to block traffic related to other cryptominers.
During the SolarWinds Compromise, It used netsh to configure firewall rules that limited certain UDP outbound packets.
It has disabled iptables.
TYPEFRAME can open the Windows Firewall on the victim’s machine to allow incoming connections.
ZxShell can disable the firewall by modifying the registry key HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile.
Technique:  Impair Defenses:Indicator Blocking
Brute Ratel C4 has the ability to hide memory artifacts and to patch Event Tracing for Windows (ETW) and the Anti Malware Scan Interface (AMSI).
Ebury can hook logging functions so that nothing from the backdoor gets sent to the logging facility.
HermeticWiper has the ability to set the HKLM:\SYSTEM\\CurrentControlSet\\Control\\CrashControl\CrashDumpEnabled Registry key to 0 in order to disable crash dumps.
Waterbear can hook the ZwOpenProcess and GetExtendedTcpTable APIs called by the process of a security product to hide PIDs and TCP records from detection.
Woody RAT has suppressed all error reporting by calling SetErrorMode with 0x8007 as a parameter.
Technique:  Impair Defenses:Disable or Modify Cloud Firewall
Pacu can allowlist IP addresses in AWS GuardDuty.
Technique:  Impair Defenses:Disable or Modify Cloud Logs
Pacu can disable or otherwise restrict various AWS logging services, such as AWS CloudTrail and VPC flow logs.
Technique:  Impair Defenses:Safe Mode Boot
AvosLocker can restart a compromised machine in safe mode.
Black Basta can reboot victim machines in safe mode with networking via bcdedit /set safeboot network.
REvil can force a reboot in safe mode with networking.
Technique:  Impersonation
During C0027, It impersonated legitimate IT personnel in phone calls and text messages either to direct victims to a credential harvesting site or getting victims to run commercial remote monitoring and management (RMM) tools.
It has called victims' help desk and impersonated legitimate users with previously gathered information in order to gain access to privileged accounts.
During Operation Dream Job, It impersonated HR hiring personnel through LinkedIn messages and conducted interviews with victims in order to deceive them into downloading malware.
Technique:  Indicator Removal
Bankshot deletes all artifacts associated with the malware from the infected machine.
BlackEnergy has removed the watermark associated with enabling the TESTSIGNING boot configuration option by removing the relevant strings in the user32.dll.mui of the system.
CSPY Downloader has the ability to remove values it writes to the Registry.
DarkWatchman can uninstall malicious components from the Registry, stop processes, and clear the browser history.
Donut can erase file references to payloads in-memory after being reflectively loaded and executed.
EVILNUM has a function called "DeleteLeftovers" to remove certain artifacts of the attack.
Flagpro can close specific Windows Security and Internet Explorer dialog boxes to mask external connections.
FunnyDream has the ability to clean traces of malware deployment.
HermeticWiper can disable pop-up information about folders and desktop items and delete Registry keys to hide malicious services.
It has restored malicious KernelCallbackTable code to its original state after the process execution flow has been hijacked.
Maze has used the "Wow64RevertWow64FsRedirection" function following attempts to delete the shadow volumes, in order to leave the system in the same state as it was prior to redirection.
Metamorfo has a command to delete a Registry key it uses, \Software\Microsoft\Internet Explorer\notes.
Neoichor can clear the browser history on a compromised host by changing the ClearBrowsingHistoryOnExit value to 1 in the HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy Registry key.
Orz can overwrite Registry settings to reduce its visibility on the victim.
Rising Sun can clear a memory blog in the process by overwriting it with junk bytes.
Sardonic has the ability to delete created WMI objects to evade detections.
SDBbot has the ability to clean up and remove data structures from a compromised host.
ShadowPad has deleted arbitrary Registry values.
Sibot will delete an associated registry key if a certain server response is received.
SILENTTRINITY can remove artifacts from the compromised host, including created Registry keys.
During the SolarWinds Compromise, It temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.
Stuxnet can delete OLE Automation and SQL stored procedures used to store malicious payloads.
SUNBURST removed HTTP proxy registry values to clean up traces of execution.