KJChen/tech2proc huggingface dataset:
Technique:  Indicator Removal:Clear Windows Event Logs
It has cleared event logs, including by using the commands wevtutil cl System and wevtutil cl Security.
It has cleared select event log entries.
It clears Window Event logs and Sysmon logs from the system.
It attempted to remove evidence of some of its activity by clearing Windows security and system events.
BlackCat can clear Windows event logs using wevtutil.exe.
The BlackEnergy component KillDisk is capable of deleting Windows Event Logs.
It has cleared event logs on compromised hosts.
It has cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.
It has cleared event logs from victims.
It has cleared logs during post compromise cleanup activities.
FinFisher clears the system event logs using  OpenEventLog/ClearEventLog APIs .
gh0st RAT is able to wipe event logs.
HermeticWiper can overwrite the C:\Windows\System32\winevt\Logs file on a targeted system.
HermeticWizard has the ability to use wevtutil cl system to clear event logs.
Hydraq creates a backdoor through which remote attackers can clear all system event logs.
It has used Cobalt Strike to empty log files.
KillDisk deletes Application, Security, Setup, and System Windows Event Logs.
Lucifer can clear and remove event logs.
Mafalda can delete Windows Event logs by invoking the OpenEventLogW and ClearEventLogW functions.
Meteor can use Wevtutil to remove Security, System and Application Event Viewer logs.
NotPetya uses wevtutil to clear the Windows event logs.
Olympic Destroyer will attempt to clear the System and Security event logs using wevtutil.
During Operation Wocao, the threat actors deleted all Windows system and security event logs using /Q /c wevtutil cl system and /Q /c wevtutil cl security.
Pupy has a module to clear event logs with PowerShell.
RunningRAT contains code to clear event logs.
SynAck clears event logs.
Wevtutil can be used to clear system and security event logs from the system.
ZxShell has a command to clear system event logs.
Technique:  Indicator Removal:Clear Linux or Mac System Logs
MacMa can clear possible malware traces such as application logs.
Proton removes logs from /var/logs and /Library/logs.
It has cleared log files within the /var/log/ folder.
It has removed system logs from /var/log/syslog.
Technique:  Indicator Removal:Clear Command History
It attempted to remove evidence of some of its activity by deleting Bash histories.
Hildegard has used history -c to clear script shell logs.
Kobalos can remove all command history on compromised hosts.
It has routinely deleted log files on a compromised router, including automatic log deletion through the use of the logrotate utility.
It has removed mailbox export requests from compromised Exchange servers.
It has used Wevtutil to remove PowerShell execution logs.
It has cleared command history with history -c.
Technique:  Indicator Removal:Network Share Connection Removal
InvisiMole can disconnect previously connected remote drives.
The net use \system\share /delete command can be used in Net to remove an established connection to a network share.
RobbinHood disconnects all network shares from the computer with the command net use * /DELETE /Y.
It has detached network shares after exfiltrating files, likely to evade detection.
Technique:  Indicator Removal:Clear Network Connection History and Configurations
SUNBURST also removed the firewall rules it created during execution.
It have inspected server logs to remove their IPs.
Technique:  Indicator Removal:Clear Mailbox Data
Goopy has the ability to delete emails used for C2 once the content has been copied.
During the SolarWinds Compromise, It removed evidence of email export requests using Remove-MailboxExportRequest.
Technique:  Indicator Removal:Clear Persistence
Bazar's loader can delete scheduled tasks created by a previous instance of the malware.
GrimAgent can delete previously created tasks on a compromised host.
KOCTOPUS can delete created registry keys used for persistence as part of its cleanup procedure.
MCMD has the ability to remove set Registry Keys, including those used for persistence.
Misdat is capable of deleting Registry keys used for persistence.
njRAT is capable of manipulating and deleting registry keys, including those used for persistence.
Pillowmint can uninstall the malicious service from an infected machine.
It has the ability to remove Registry entries that it created for persistence.
S-Type has deleted accounts it has created.
SUNBURST removed IFEO registry values to clean up traces of persistence.
Technique:  Indirect Command Execution
Forfiles can be used to subvert controls and possibly conceal command execution by not directly invoking cmd.
It persistence mechanisms have used forfiles.exe to execute .htm files.
Revenge RAT uses the Forfiles utility to execute commands on the system.
Technique:  Masquerading:Invalid Code Signature
It has signed its malware with an invalid digital certificates listed as "Tencent Technology (Shenzhen) Company Limited."
BADNEWS is sometimes signed with an invalid Authenticode certificate in an apparent effort to make it look more legitimate.
Gelsemium has used unverified signatures on malicious DLLs.
The NETWIRE client has been signed by fake and invalid digital certificates.
PcShare has used an invalid certificate in attempt to appear legitimate.
Regin stage 1 modules for 64-bit systems have been found to be signed with fake certificates masquerading as originating from Microsoft Corporation and Broadcom Corporation.
It has used revoked certificates to sign malware.
WindTail has been incompletely signed with revoked certificates.
Technique:  Masquerading:Right-to-Left Override
It has used right-to-left-override to obfuscate the filenames of malicious e-mail attachments.
It has used Right-to-Left Override to deceive victims into executing several strains of malware.
It has used right-to-left override to reverse executables’ names to make them appear to have different file extensions, rather than their real ones.
It has used the right-to-left override character in spearphishing attachment names to trick targets into executing .scr and .exe files.
It has used the left-to-right override character in self-extracting RAR archive spearphishing attachment file names.
Technique:  Masquerading:Rename System Utilities
It has moved and renamed pubprn.vbs to a .txt file to avoid detection.
The CozyCar dropper has masqueraded a copy of the infected system's rundll32.exe executable that was moved to the malware's install directory and renamed according to a predefined configuration file.
It used a renamed cmd.exe file to evade detection.
Kevin has renamed an image of cmd.exe with a random name followed by a .tmpl extension.
It has renamed system utilities such as wscript.exe and mshta.exe.
It has renamed certutil and moved it to a different location on the system to avoid detection based on use of the tool.
Technique:  Masquerading:Space after Filename
Keydnap puts a space after a false .jpg extension so that execution actually goes through the Terminal.app program.
Technique:  Masquerading:Double File Extension
The Bazar loader has used dual-extension executable files such as PreviewReport.DOC.exe.
Milan has used an executable named companycatalog.exe.config to appear benign.
It has used an additional filename extension to hide the true file type.
Technique:  Masquerading:Masquerade File Type
During the 2016 Ukraine Electric Power Attack, It masqueraded executables as .txt files.
ANDROMEDA has been delivered through a LNK file disguised as a folder.
AvosLocker has been disguised as a .jpg file.
Brute Ratel C4 has used Microsoft Word icons to hide malicious LNK files.
During Operation Dream Job, It disguised malicious template files as JPEG files to avoid detection.
OSX_OCEANLOTUS.D has disguised it's true file structure as an application bundle by adding special characters to the filename and using the icon for legitimate Word documents.
The QakBot payload has been disguised as a PNG file and hidden within LNK files using a Microsoft File Explorer icon.
It has appended copies of the ntds.dit database with a .gif file extension.
Technique:  Modify Cloud Compute Infrastructure:Create Snapshot
Pacu can create snapshots of EBS volumes and RDS instances.
Technique:  Modify Cloud Compute Infrastructure:Create Cloud Instance
During C0027, It used access to the victim's Azure tenant to create Azure VMs.
It has created new virtual machines within the target's cloud environment after leveraging credential access to cloud assets.
Technique:  Modify Cloud Compute Infrastructure:Delete Cloud Instance
It has deleted the target's systems and resources in the cloud to trigger the organization's incident and crisis response process.
Technique:  Modify System Image:Patch System Image
SYNful Knock is malware that is inserted into a network device by patching the operating system image.
Technique:  Obfuscated Files or Information:Steganography
ABK can extract a malicious Portable Executable (PE) from a photo.
It has hidden malicious executables within PNG files.
It uses steganography to send images to users that are embedded with shellcode.
Avenger can extract backdoor malware from downloaded images.
Bandook has used .PNG images within a zip file to build the executable.
BBK can extract a malicious Portable Executable (PE) from a photo.
It has used steganography in multiple operations to conceal malicious payloads.
build_downer can extract malware from a downloaded JPEG.
Diavol has obfuscated its main code routines within bitmap images as part of its anti-analysis techniques.
It has used steganography to hide shellcode in a BMP image file.
IcedID has embedded binaries within RC4 encrypted .png files.
Invoke-PSImage can be used to embed a PowerShell script within the pixels of a PNG file.
It has used steganography to hide stolen data inside other files stored on Github.
LiteDuke has used image files to hide its loader component.
It has stored obfuscated JavaScript code in an image file named temp.jpg.
ObliqueRAT can hide its payload in BMP images hosted on compromised websites.
Okrum's payload is encrypted and embedded within its loader, or within a legitimate PNG file.
During Operation Ghost, It used steganography to hide payloads inside valid images.
For Operation Spalax, the threat actors used packers that read pixel data from images contained in PE files' resource sections and build the next layer of execution from the data.
PolyglotDuke can use steganography to hide C2 information in images.
PowerDuke uses steganography to hide backdoors in PNG files, which are also encrypted using the Tiny Encryption Algorithm (TEA).
ProLock can use .jpg and .bmp files to store its payload.
Raindrop used steganography to locate the start of its encoded payload within legitimate 7-Zip code.
Ramsay has PE data embedded within JPEG files contained within Word documents.
RDAT can also embed data within a BMP image prior to exfiltration.
RegDuke can hide data in images, including use of the Least Significant Bit (LSB).
It has hidden encoded data for malware DLLs in a PNG.
It has used JPG files with encrypted payloads to mask their backdoor routines and evade detection.
Technique:  Obfuscated Files or Information:Compile After Delivery
Cardinal RAT and its watchdog component are compiled and executed after being delivered to victims as embedded, uncompiled source code.
DarkWatchman has used the csc.exe tool to compile a C# executable.
FoggyWeb can compile and execute source code sent to the compromised AD FS server via a specific HTTP POST.
It has compiled the source code for a downloader directly on the infected system using the built-in Microsoft.CSharp.CSharpCodeProvider class.
It has used the .NET csc.exe tool to compile executables from downloaded C# code.
njRAT has used AutoIt to compile the payload and main script into a single executable after delivery.
It has compiled malware, delivered to victims as .c files, with the GNU Compiler Collection (GCC).
Technique:  Obfuscated Files or Information:Indicator Removal from Tools
It has been known to remove indicators of compromise from tools.
Cobalt Strike includes a capability to modify the Beacon payload to eliminate known signatures or unpacking methods.
Analysis of Daserf has shown that it regularly undergoes technical improvements to evade anti-virus detection.
It has updated and modified its malware, resulting in different hash values that evade detection.
It ensured each payload had a unique hash, including by using different types of packers.
The author of GravityRAT submitted samples to VirusTotal for testing, showing that the author modified the code to try to hide the DDE object in a different part of the document.
InvisiMole has undergone regular technical improvements in an attempt to evade detection.
It has tested malware samples to determine AV detection and subsequently modified the samples to ensure AV evasion.
During Operation Wocao, threat actors edited variable names within the Impacket suite to avoid automated detection.
It apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.
Penquin can remove strings from binaries.
PowerSploit's Find-AVSignature AntivirusBypass module can be used to locate single byte anti-virus signatures.
QakBot can make small changes to itself in order to change its checksum and hash value.
SUNBURST source code used generic variable names and pre-obfuscated strings, and was likely sanitized of developer comments before being added to SUNSPOT.
It has modified files based on the open-source project cryptcat in an apparent attempt to decrease AV detection rates.
Based on comparison of Gazer versions, It made an effort to obfuscate strings in the malware that could be used as IoCs, including the mutex name and named pipe.
Waterbear can scramble functions not to be executed again with random values.
Technique:  Obfuscated Files or Information:HTML Smuggling
It has embedded an ISO file within an HTML attachment that contained JavaScript code to initiate malware execution.
EnvyScout contains JavaScript code that can extract an encoded blob from its HTML body and write it to disk.
QakBot has been delivered in ZIP files via HTML smuggling.
Technique:  Obfuscated Files or Information:Dynamic API Resolution
AvosLocker has used obfuscated API calls that are retrieved by their checksums.
Bazar can hash then resolve API calls at runtime.
Brute Ratel C4 can call and dynamically resolve hashed APIs.
It has used a custom hashing method to resolve APIs used in shellcode.
Pteranodon can use a dynamic Windows hashing algorithm to map API components.
Technique:  Obfuscated Files or Information:Stripped Payloads
macOS.OSAMiner has used run-only Applescripts, a compiled and stripped version of AppleScript, to remove human readable indicators to evade detection.
Technique:  Obfuscated Files or Information:Embedded Payloads
BADHATCH has an embedded second stage DLL payload within the first stage of the malware.
For C0021, the threat actors embedded a base64-encoded payload within a LNK file.
ComRAT has embedded a XOR encrypted communications module inside the orchestrator module.
The DEADEYE.EMBED variant of DEADEYE has the ability to embed payloads inside of a compiled binary.
Dtrack has used a dropper that embeds an encrypted payload as extra data.
Emotet has dropped an embedded executable at %Temp%\setup.exe.
Invoke-PSImage can be used to embed payload data within a new image file.
macOS.OSAMiner has embedded Stripped Payloads within another run-only Stripped Payloads.
Netwalker's DLL has been embedded within the PowerShell script in hex format.
The SMOKEDHAM source code is embedded in the dropper as an encrypted string.
The Uroburos Queue file contains embedded executable files along with key material, communication channels, and modes of operation.
Technique:  Plist File Modification
XCSSET uses the plutil command to modify the LSUIElement, DFBundleDisplayName, and CFBundleIdentifier keys in the /Contents/Info.plist file to change how XCSSET is visible on the system.
Technique:  Reflective Code Loading
BADHATCH can copy a large byte array of 64-bit shellcode into process memory and execute it with a call to CreateThread.
Brute Ratel C4 has used reflective loading to execute malicious DLLs.
Cobalt Strike's execute-assembly command can run a .NET executable within the memory of a sacrificial process by loading the CLR.
Cuba loaded the payload into memory using PowerShell.
Donut can generate code modules that enable in-memory execution of VBScript, JScript, EXE, DLL, and dotNET payloads.
Emotet has reflectively loaded payloads into memory.
FoggyWeb's loader has reflectively loaded .NET-based assembly/payloads into memory.
Gelsemium can use custom shellcode to map embedded DLLs into memory.
IceApple can use reflective code loading to load .NET assemblies into MSExchangeOWAAppPool on targeted Exchange servers.
It has changed memory protection permissions then overwritten in memory DLL function code with shellcode, which was later executed via KernelCallbackTable hijacking. It has also used shellcode within macros to decrypt and manually map DLLs into memory at runtime.
Lokibot has reflectively loaded the decoded DLL into memory.
metaMain has reflectively loaded a DLL to read, decrypt, and load an orchestrator file.
PowerSploit reflectively loads a Windows PE file into a process.
Sardonic has a plugin system that can load specially made DLLs into memory and execute their functions.
ThiefQuest uses various API functions such as NSCreateObjectFileImageFromMemory to load and link in-memory payloads.
Uroburos has the ability to load new modules directly into memory using its Load Modules Mem command.
WhisperGate's downloader can reverse its third stage file bytes and reflectively load the file as a .NET assembly.
Technique:  Rogue Domain Controller
Mimikatz’s LSADUMP::DCShadow module can be used to make AD updates by temporarily setting a computer to be a DC.
Technique:  Rootkit
It has used a UEFI (Unified Extensible Firmware Interface) rootkit known as LoJax.
It deployed rootkits on Linux systems.
Carberp has used user mode rootkit techniques to remain hidden on the system.
Caterpillar WebShell has a module to use a rootkit on a system.
Drovorub has used a kernel module rootkit to hide processes, files, executables, and network artifacts from user space view.
Ebury has used user mode rootkit techniques to remain hidden on the system.
Hacking Team UEFI Rootkit is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems.
HiddenWasp uses a rootkit to hook and implement functions on the system.
HIDEDRV is a rootkit that hides certain operating system artifacts.
Hikit is a Rootkit that has been used by It.
Hildegard has modified /etc/ld.so.preload to overwrite readdir() and readdir64().
HTRAN can install a rootkit to hide network connections from the host OS.
LoJax is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems.
PoisonIvy starts a rootkit from a malicious file dropped to disk.
Ramsay has included a rootkit to evade defenses.
It has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.
Skidmap is a kernel-mode rootkit that has the ability to hook system calls to hide specific files and fake network and CPU-related statistics to make the CPU load of the infected machine always appear low.
Stuxnet uses a Windows rootkit to mask its binaries and other relevant files.
It has used rootkits such as the open-source Diamorphine rootkit and their custom bots to hide cryptocurrency mining activities on the machine.
Umbreon hides from defenders by hooking libc function calls, hiding artifacts that would reveal its presence, such as the user account it creates to provide access and undermining strace, a tool often used to identify malware.
Uroburos can use its kernel module to prevent its host components from being listed by the targeted system's OS and to mediate requests between user mode and concealed components.
WarzoneRAT can include a rootkit to hide processes, files, and startup.
Winnti for Linux has used a modified copy of the open-source userland rootkit Azazel, named libxselinux.so, to hide the malware's operations and network activity.
It used a rootkit to modify typical server functionality.
Zeroaccess is a kernel-mode rootkit.
Technique:  Subvert Trust Controls
It has used digital certificates to deliver malware.
Technique:  Subvert Trust Controls:Gatekeeper Bypass
CoinTicker downloads the EggShell mach-o binary using curl, which does not set the quarantine flag.
MacMa has removed the com.apple.quarantineattribute from the dropped file, $TMPDIR/airportpaird.
If running with elevated privileges, OSX/Shlayer has used the spctl command to disable Gatekeeper protection for a downloaded file. OSX/Shlayer can also leverage system links pointing to bash scripts in the downloaded DMG file to bypass Gatekeeper, a flaw patched in macOS 11.3 and later versions. OSX/Shlayer has been Notarized by Apple, resulting in successful passing of additional Gatekeeper checks.
OSX_OCEANLOTUS.D uses the command xattr -d com.apple.quarantine to remove the quarantine file attribute used by Gatekeeper.
XCSSET has dropped a malicious applet into an app's .../Contents/MacOS/ folder of a previously launched app to bypass Gatekeeper's security checks on first launch apps (prior to macOS 13).
Technique:  Subvert Trust Controls:Install Root Certificate
certutil can be used to install browser root certificates as a precursor to performing Adversary-in-the-Middle between connections to banking websites. Example command: certutil -addstore -f -user ROOT ProgramData\cert512121.der.
Dok installs a root certificate to aid in Adversary-in-the-Middle actions using the command add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /tmp/filename.
Hikit uses certmgr.exe -add GlobalSign.cer -c -s -r localMachine Root and certmgr.exe -add GlobalSign.cer -c -s -r localMachineTrustedPublisher to install a self-generated certificate to the local trust store as a root CA and Trusted Publisher.
It can add a certificate to the Windows store.
Technique:  Subvert Trust Controls:Mark-of-the-Web Bypass
Amadey has modified the :Zone.Identifier in the ADS area to zero.
It has embedded ISO images and VHDX files in HTML to evade Mark-of-the-Web.
QakBot has been packaged in ISO files in order to bypass Mark of the Web (MOTW) security measures.
It has used .iso files to deploy malicious .lnk files.
Technique:  Subvert Trust Controls:Code Signing Policy Modification
It has used malware to turn off the RequireSigned feature which ensures only signed DLLs can be run on Windows.
BlackEnergy has enabled the TESTSIGNING boot configuration option to facilitate loading of a driver component.
Hikit has attempted to disable driver signing verification by tampering with several Registry keys prior to the loading of a rootkit driver component.
Pandora can use CVE-2017-15303 to disable Windows Driver Signature Enforcement (DSE) protection and load its driver.
It has modified variables in kernel memory to turn off Driver Signature Enforcement after exploiting vulnerabilities that obtained kernel mode privileges.
Technique:  System Binary Proxy Execution
It lnk files used for persistence have abused the Windows Update Client (wuauclt.exe) to execute a malicious DLL.
Technique:  System Binary Proxy Execution:Compiled HTML File
It has used CHM files to move concealed payloads.
It used compiled HTML (.chm) files for targeting.
Astaroth uses ActiveX objects for file execution and manipulation.
It leveraged a compiled HTML file that contained a command to download and run an executable.
It has used a CHM payload to load and execute another malicious file once delivered to a victim.
It has weaponized CHM files in their phishing campaigns.
Technique:  System Binary Proxy Execution:Control Panel
It has used control panel files (CPL), delivered via e-mail, for execution.
InvisiMole can register itself for execution and persistence via the Control Panel.
Reaver drops and executes a malicious CPL file as its payload.
Technique:  System Binary Proxy Execution:CMSTP
It has used the command cmstp.exe /s /ns C:\Users\ADMINI~W\AppData\Local\Temp\XKNqbpzl.txt to bypass AppLocker and launch a malicious script.
It has used CMSTP.exe and a malicious INF to execute its POWERSTATS payload.
Technique:  System Binary Proxy Execution:InstallUtil
Chaes has used Installutill to download content.
It has used InstallUtil.exe to execute malicious software.
It has used InstallUtil.exe to execute a malicious Beacon stager.
Saint Bot had used InstallUtil.exe to download and deploy executables.
WhisperGate has used InstallUtil.exe as part of its process to disable Windows Defender.
Technique:  System Binary Proxy Execution:Mshta
It has use mshta to execute malicious scripts on a compromised host.
It has used mshta.exe for code execution.
BabyShark has used mshta.exe to download and execute applications from a remote server.
During C0015, the threat actors used mshta to execute DLLs.
It has used mshta.exe to execute malicious VBScript.
It has used mshta.exe to load an HTA script within a malicious .LNK file.
It has used mshta.exe to execute VBScript to execute malicious code on victim systems.
It has used mshta.exe to execute malicious HTA files.
It has used malicious HTA files to drop and execute malware.
It has used mshta.exe to run malicious scripts on the system.
Koadic can use mshta to serve additional payloads and to help schedule tasks for persistence.
It has used mshta.exe to execute HTML pages downloaded by initial access documents.
It has used mshta.exe to execute Koadic stagers.
Metamorfo has used mshta.exe to execute a HTA payload.
It has used mshta.exe to execute its POWERSTATS payload and to pass a PowerShell one-liner for execution.
It has used mshta.exe to launch collection scripts.
NanHaiShu uses mshta.exe to load its program and files.
During Operation Dust Storm, the threat actors executed JavaScript code via mshta.exe.
POWERSTATS can use Mshta.exe to execute additional payloads on compromised hosts.
Pteranodon can use mshta.exe to execute an HTA file hosted on a remote server.
Revenge RAT uses mshta.exe to run malicious scripts on the system.
Sibot has been executed via MSHTA application.
It has utilized mshta.exe to execute a malicious hta file.
It has used mshta.exe to execute malicious payloads.
It has used mshta to execute scripts including VBS.
It has used mshta.exe to execute malicious payloads.
Xbash can use mshta for executing scripts.
Technique:  System Binary Proxy Execution:Msiexec
AppleJeus has been installed via MSI installer.
Chaes has used .MSI files as an initial way to start the infection chain.
Clop can use msiexec.exe to disable security tools on the system.
DEADEYE can use msiexec.exe for execution of malicious DLL.
Duqu has used msiexec to execute malicious Windows Installer packages. Additionally, a PROPERTY=VALUE pair containing a 56-bit encryption key has been used to decrypt the main payload from the installer packages.
FlawedAmmyy has been installed via msiexec.exe.
Grandoreiro can use MSI files to execute DLLs.
IcedID can inject itself into a suspended msiexec.exe process to send beacons to C2 while appearing as a normal msi application.
Javali has used the MSI installer to download and execute malicious payloads.
LoudMiner used an MSI installer to install the virtualization software.
It has used msiexec to install the It malware.
Maze has delivered components for its ransomware attacks using MSI files, some of which have been executed from the command-line using msiexec.
Melcoz can use MSI files with embedded VBScript for execution.
Metamorfo has used MsiExec.exe to automatically execute files.
It has used msiexec.exe to execute an MSI payload.
QakBot can use MSIExec to spawn multiple cmd.exe processes.
Ragnar Locker has been delivered as an unsigned MSI package that was executed with msiexec.exe.
It has used msiexec to download and execute malicious installer files over HTTP.
RCSession has the ability to execute inside the msiexec.exe process.
RemoteUtilities can use Msiexec to install a service.
It has used msiexec to download and execute malicious Windows Installer files.
ItM has used the msiexec.exe command-line utility to download and execute malicious MSI files.
Technique:  System Binary Proxy Execution:Odbcconf
Bumblebee can use odbcconf.exe to run DLLs on targeted hosts.
It has used odbcconf to proxy the execution of malicious DLL files.
Technique:  System Binary Proxy Execution:Regsvcs
Agent Tesla has dropped RegAsm.exe onto systems for performing malicious activity.
Technique:  System Binary Proxy Execution:Regsvr32
AppleSeed can call regsvr32.exe for execution.
It used Regsvr32 to bypass application control techniques.
It created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory. The group has also used regsvr32 to run their backdoor.
Astaroth can be loaded through regsvr32.exe.
It has executed custom-compiled XMRIG miner DLLs using regsvr32.exe.
During C0015, the threat actors employed code that used regsvr32 for execution.
It has used regsvr32.exe to execute scripts.
It has used regsvr32.exe to execute a server variant of Derusbi in victim networks.
Derusbi variants have been seen that use Registry persistence to proxy execution through regsvr32.exe.
Dridex can use regsvr32.exe to initiate malicious code.
Egregor has used regsvr32.exe to execute malicious DLLs.
EVILNUM can run a remote scriptlet that drops a file and executes it via regsvr32.exe.
HermeticWizard has used regsvr32.exe /s /i to execute malicious payloads.
Hi-Zor executes using regsvr32.exe called from the Registry Run Keys / Startup Folder persistence mechanism.
It has ensured persistence at system boot by setting the value regsvr32 %path%\ctfmonrn.dll /s.
It has executed malware with regsvr32s.
Koadic can use Regsvr32 to execute additional payloads.
It has used regsvr32 for execution.
More_eggs has used regsvr32.exe to execute the malicious DLL.
Mori can use regsvr32.exe for DLL execution.
During Operation Dream Job, It used regsvr32 to execute malware.
Some Orz versions have an embedded DLL known as MockDll that uses Process Hollowing and regsvr32 to execute another payload.
QakBot can use Regsvr32 to execute malicious DLLs.
Ragnar Locker has used regsvr32.exe to execute components of VirtualBox.
RogueRobin uses regsvr32.exe to run a .sct file for execution.
Saint Bot has used regsvr32 to execute scripts.
Squirrelwaffle has been executed using regsvr32.exe.
It has used regsvr32.exe to load malicious DLLs.
Valak has used regsvr32.exe to launch malicious DLLs.
It has used regsvr32.exe to trigger the execution of a malicious script.
Xbash can use regsvr32 for executing scripts.
Technique:  System Binary Proxy Execution:Verclsid
Hancitor has used verclsid.exe to download and execute a malicious script.
Technique:  System Script Proxy Execution:PubPrn
It has used PubPrn.vbs within execution scripts to execute malware, possibly bypassing defenses.
Technique:  Template Injection
It used weaponized Microsoft Word documents abusing the remote template function to retrieve a malicious macro.
Chaes changed the template target of the settings.xml file embedded in the Word document and populated that field with the downloaded URL of the next payload.
It has used a weaponized Microsoft Word document with an embedded RTF exploit.
It used an open-source tool, Phishery, to inject malicious remote template URLs into Microsoft Word documents and then sent them to victims to enable Forced Authentication.
It has injected SMB URLs into malicious Word spearphishing attachments to initiate Forced Authentication.
During Frankenstein, the threat actors used trojanized documents that retrieved remote templates from an adversary-controlled website.
It has used DOCX files to download malicious DOT document templates and has used RTF template injection to download malicious payloads. It can also inject malicious macros or remote templates into documents already present on compromised systems.
It has used decoy documents to load malicious remote payloads via HTTP.
During Operation Dream Job, It used DOCX files to retrieve a malicious document template/DOTM file.
It delivered malicious documents with the XLSX extension, typically used by OpenXML documents, but the file itself was actually an OLE (XLS) document.
WarzoneRAT has been install via template injection through a malicious DLL embedded within a template RTF in a Word document.
Technique:  Trusted Developer Utilities Proxy Execution:MSBuild
Empire can use built-in modules to abuse trusted utilities like MSBuild.exe.
During Frankenstein, the threat actors used MSbuild to execute an actor-created file.
A version of PlugX loads as shellcode within a .NET Framework project using msbuild.exe, presumably to bypass application control techniques.
Technique:  Use Alternate Authentication Material
FoggyWeb can allow abuse of a compromised AD FS server's SAML token.
During the SolarWinds Compromise, It used forged SAML tokens that allowed the actors to impersonate users and bypass MFA, enabling It to access enterprise cloud applications and services.
Technique:  Use Alternate Authentication Material:Application Access Token
It has used several malicious applications that abused OAuth access tokens to gain access to target email accounts, including Gmail and Yahoo Mail.
CreepyDrive can use legitimate OAuth refresh tokens to authenticate with OneDrive.
Peirates can use stolen service account tokens to perform its operations. It also enables adversaries to switch between valid service accounts.
During the SolarWinds Compromise, It used compromised service principals to make changes to the Office 365 environment.
Technique:  Use Alternate Authentication Material:Pass the Hash
The It group is known to have used pass the hash.
It has used pass the hash for lateral movement.
It has used pass the hash for lateral movement.
BADHATCH can perform pass the hash on compromised machines with x64 versions.
It has dumped password hashes for use in pass the hash authentication attacks.
Cobalt Strike can perform pass the hash.
CrackMapExec can pass the hash to authenticate via SMB.
Empire can perform pass the hash attacks.
It has used the PowerShell utility Invoke-SMBExec to execute the pass the hash method for lateral movement within an compromised environment.
It used dumped hashes to authenticate to other machines via pass the hash.
HOPLIGHT has been observed loading several APIs associated with Pass the Hash.
It has used pass the hash for authentication to remote access software used in C2.
Mimikatz's SEKURLSA::Pth module can impersonate a user, with only a password hash, to execute arbitrary commands.
During Night Dragon, threat actors used pass-the-hash tools to obtain authenticated access to sensitive internal desktops and servers.
Pass-The-Hash Toolkit can perform pass the hash.
PoshC2 has a number of modules that leverage pass the hash for lateral movement.
It has used the Invoke-SMBExec PowerShell cmdlet to execute the pass-the-hash technique and utilized stolen password hashes to move laterally.
Technique:  Use Alternate Authentication Material:Pass the Ticket
It used Kerberos ticket attacks for lateral movement.
It successfully gained remote access by using pass the ticket.
It has created forged Kerberos Ticket Granting Ticket (TGT) and Ticket Granting Service (TGS) tickets to maintain administrative access.
Mimikatz’s LSADUMP::DCSync and KERBEROS::PTT modules implement the three steps required to extract the krbtgt account hash and create/use Kerberos tickets.
Pupy can also perform pass-the-ticket.
Some SeaDuke samples have a module to use pass the ticket with Kerberos for authentication.
Technique:  Use Alternate Authentication Material:Web Session Cookie
During the SolarWinds Compromise, It used stolen cookies to access cloud resources and a forged duo-sid cookie to bypass MFA set on an email account.
Technique:  XSL Script Processing
Astaroth executes embedded JScript or VBScript in an XSL stylesheet located on a remote domain.
It used msxsl.exe to bypass AppLocker and to invoke Jscript code from an XSL file.
It used an XSL file to run VBScript code.
During Operation Dream Job, It used a remote XSL script to download a Base64-encoded DLL custom downloader.
Technique:  Adversary-in-the-Middle
Dok proxies web traffic to potentially monitor and alter victim HTTP(S) traffic.
It has used modified versions of PHProxy to examine web traffic between the victim and the accessed website.
Technique:  Adversary-in-the-Middle:LLMNR
Empire can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks.
Impacket modules like ntlmrelayx and smbrelayx can be used in conjunction with Network Sniffing and LLMNR/NBT-NS Poisoning and SMB Relay to gather NetNTLM credentials for Brute Force or relay attacks that can gain code execution.
It executed Responder using the command [Responder file path] -i [IP address] -rPv on a compromised host to harvest credentials and move laterally.
PoshC2 can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks.
Pupy can sniff plaintext network credentials and use NBNS Spoofing to poison name services.
Responder is used to poison name services to gather hashes and credentials from systems within a local network.
It has used the Invoke-Inveigh PowerShell cmdlets, likely for name service poisoning.
Technique:  Adversary-in-the-Middle:ARP Cache Poisoning
It has used custom tools to facilitate ARP cache poisoning.
It has used ARP spoofing to redirect a compromised machine to an actor-controlled website.
Technique:  Brute Force
During the 2016 Ukraine Electric Power Attack, It used a script to attempt RPC authentication against a number of hosts.
It can perform brute force attacks to obtain credentials.
It has used brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable.
It has used Ncrack to reveal credentials.
Caterpillar WebShell has a module to perform brute force attacks on a system.
Chaos conducts brute force attacks against SSH services to gain initial access.
CrackMapExec can brute force supplied user credentials across a network range.
It used brute-force attack to obtain login data.
It has attempted to brute force credentials to gain access.
It has has used the tool GET2 Penetrator to look for remote login and hard-coded credentials.
It has brute forced RDP credentials.
It has used brute force attacks to compromise valid credentials.
Kinsing has attempted to brute force hosts over SSH.
It has used brute force techniques to obtain credentials.
During Operation Dream Job, It performed brute force attacks against administrator accounts.
PoshC2 has modules for brute forcing local administrator and AD user accounts.
Pysa has used brute force attempts against a central management console, as well as some Active Directory accounts.
QakBot can conduct brute force attacks to capture credentials.
It may attempt to connect to systems within a victim's network using net use commands and a predefined list or collection of passwords.
Technique:  Brute Force:Password Guessing
It has used a brute-force/password-spray tooling that operated in two modes: in brute-force mode it typically sent over 300 authentication attempts per hour per targeted account over the course of several hours or days. It has also used a Kubernetes cluster to conduct distributed, large-scale password guessing attacks.
It has successfully conducted password guessing attacks against a list of mailboxes.
China Chopper's server component can perform brute force password guessing against authentication portals.
CrackMapExec can brute force passwords for a specified user on a single target system or across an entire network.
Emotet has been observed using a hard coded list of passwords to brute force user accounts.
HermeticWizard can use a list of hardcoded credentials in attempt to authenticate to SMB shares.
Lucifer has attempted to brute force TCP ports 135 (RPC) and 1433 (MSSQL) with the default username or list of usernames and    passwords.
P.A.S. Webshell can use predefined users and passwords to execute brute force attacks against SSH, FTP, POP3, MySQL, MSSQL, and PostgreSQL services.
Pony has used a small dictionary of common passwords against a collected list of local accounts.
SpeakUp can perform brute forcing using a pre-defined list of usernames and passwords in an attempt to log in to administrative panels.
Xbash can obtain a list of weak passwords from the C2 server to use for brute forcing as well as attempt to brute force services with open ports.
Technique:  Brute Force:Password Cracking
It has been known to brute force password hashes to be able to leverage plain text credentials.
It performed password brute-force attacks on the local admin account.
It has dropped and executed tools used for password cracking, including Hydra and CrackMapExec.
It has extracted password hashes from ntds.dit to crack offline.
Net Crawler uses a list of known credentials gathered through credential dumping to guess passwords to accounts as it spreads throughout a network.
During Night Dragon, threat actors used Cain & Abel to crack password hashes.
Technique:  Brute Force:Password Spraying
It has used a brute-force/password-spray tooling that operated in two modes: in password-spraying mode it conducted approximately four authentication attempts per hour per targeted account over the course of several days or weeks. It has also used a Kubernetes cluster to conduct distributed, large-scale password spray attacks.
It has conducted brute force password spray attacks.
It has used password spraying to gain access to target systems.
Bad Rabbit’s infpub.dat file uses NTLM login credentials to brute force Windows machines.
It has used multiple password spraying attacks against victim's remote services to obtain valid user and administrator accounts.
CrackMapExec can brute force credential authentication by using a supplied list of usernames and a single password.
It has used password spraying attacks to obtain valid credentials.
It malware attempts to connect to Windows shares for lateral movement by using a generated list of usernames, which center around permutations of the username Administrator, and weak passwords.
It used a tool called Total SMB BruteForcer to perform internal password spraying.
Linux Rabbit brute forces SSH passwords in order to attempt to gain access and install its malware onto the server.
MailSniper can be used for password spraying against Exchange and Office 365.
It has used collected lists of names and e-mail accounts to use in password spraying attacks against private sector targets.
Technique:  Brute Force:Credential Stuffing
It has used credential stuffing against victim's remote services to obtain valid accounts.
TrickBot uses brute-force attack against RDP with rdpscanDll module.
Technique:  Credentials from Password Stores
Agent Tesla has the ability to steal credentials from FTP clients and wireless profiles.
It has used a variety of publicly available tools like LaZagne to gather credentials.
It has used the Smartftp Password Decryptor tool to decrypt FTP passwords.
Astaroth uses an external software known as NetPass to recover passwords.
Carberp's passw.plug plugin can gather account information from multiple instant messaging, email, and social media services, as well as FTP, VNC, and VPN clients.
CosmicDuke collects user credentials, including passwords, for various programs including popular instant messaging applications and email clients as well as WLAN keys.
It can collect email credentials from victims.
It has used the Stealer One credential stealer to target e-mail and file transfer utilities including FTP.
It has run cmdkey on victim machines to identify stored credentials.
KGH_SPY can collect credentials from WINSCP.
LaZagne can obtain credentials from databases, mail, and WiFi across multiple platforms.
It used several tools for retrieving login and password information, including LaZagne.
Lokibot has stolen credentials from multiple applications and data sources including Windows OS credentials, email clients, FTP, and SFTP clients.
Matryoshka is capable of stealing Outlook passwords.
Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the credential vault and DPAPI.
It has performed credential dumping with LaZagne and other tools, including by dumping passwords saved in victim email.
NETWIRE can retrieve passwords from messaging and mail client applications.
It has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.
OLDBAIT collects credentials from several email clients.
PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated with many sources such as The Bat!, Yahoo!, Mail.ru, Passport.Net, Google Talk, and Microsoft Outlook.
PLEAD has the ability to steal saved passwords from Microsoft Outlook.
PoshC2 can decrypt passwords stored in the RDCMan configuration file.
A module in Prikormka collects passwords stored in applications installed on the victim.
Pupy can use Lazagne for harvesting credentials.
QuasarRAT can obtain passwords from common FTP clients.
During the SolarWinds Compromise, It used account credentials they obtained to attempt access to Group Managed Service Account (gMSA) passwords.
It malware gathers passwords from multiple sources, including Windows Credential Vault and Outlook.
It has attempted to obtain credentials from OpenSSH, realvnc, and PuTTY.
Technique:  Credentials from Password Stores:Keychain
Calisto collects Keychain storage data and copies those passwords/tokens to a file.
Green Lambert can use Keychain Services API functions to find and collect passwords, such as SecKeychainFindInternetPassword and SecKeychainItemCopyAttributesAndData.
iKitten collects the keychains on the system.
LaZagne can obtain credentials from macOS Keychains.
MacMa can dump credentials from the macOS keychain.
Proton gathers credentials in files for keychains.
Technique:  Credentials from Password Stores:Securityd Memory
Keydnap uses the keychaindump project to read securityd memory.
Technique:  Credentials from Password Stores:Windows Credential Manager
KGH_SPY can collect credentials from the Windows Credential Manager.
LaZagne can obtain credentials from Vault files.
Lizar has a plugin that can retrieve credentials from Internet Explorer and Microsoft Edge using vaultcmd.exe and another that can collect RDP access credentials using the CredEnumerateW function.
Mimikatz contains functionality to acquire credentials from the Windows Credential Manager.
It has used credential dumping tool named VALUEVAULT to steal credentials from the Windows Credential Manager.
PowerSploit contains a collection of Exfiltration modules that can harvest credentials from Windows vault credential objects.
RainyDay can use the QuarksPwDump tool to obtain local passwords and domain cached credentials.
ROKRAT can steal credentials by leveraging the Windows Vault mechanism.
SILENTTRINITY can gather Windows Vault credentials.
It malware gathers passwords from the Windows Credential Vault.
It has gathered credentials from the Windows Credential Manager tool.
Valak can use a .NET compiled module named exchgrabber to enumerate credentials from the Credential Manager.
It has used PowerShell cmdlet Invoke-WCMDump to enumerate Windows credentials in the Credential Manager in a compromised network.