KJChen/tech2proc huggingface dataset:
Technique:  Credentials from Password Stores:Password Managers
It has used scripts to access credential information from the KeePass database.
It has accessed local password managers and databases to obtain further credentials from a compromised network.
MarkiRAT can gather information from the Keepass password manager.
During Operation Wocao, threat actors accessed and collected credentials from password managers.
Proton gathers credentials in files for 1password.
It obtained a KeePass database from a compromised host.
TrickBot can steal passwords from the KeePass open source password manager.
Technique:  Credentials from Password Stores:Cloud Secrets Management Stores
Pacu can retrieve secrets from the AWS Secrets Manager via the enum_secrets module.
Technique:  Forced Authentication
It used Template Injection to launch an authentication window for users to enter their credentials.
It has gathered hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems.
EnvyScout can use protocol handlers to coax the operating system to send NTLMv2 authentication responses to attacker-controlled infrastructure.
Technique:  Forge Web Credentials:Web Cookies
During the SolarWinds Compromise, It bypassed MFA set on OWA accounts by generating a cookie value from a previously stolen secret key.
Technique:  Forge Web Credentials:SAML Tokens
AADInternals can be used to create SAML tokens using the AD Federated Services token signing certificate.
During the SolarWinds Compromise, It created tokens using compromised SAML signing certificates.
Technique:  Input Capture
It has utilized tools to capture mouse movements.
Chaes has a module to perform any API hooking it desires.
FlawedAmmyy can collect mouse events.
Kobalos has used a compromised SSH client to capture the hostname, port, username and password used to establish an SSH connection from the compromised host.
Mafalda can conduct mouse event logging.
metaMain can log mouse events.
Technique:  Input Capture:GUI Input Capture
Bundlore prompts the user for their credentials.
Calisto presents an input prompt asking for the user's login and password.
Dok prompts the user for credentials.
It has presented victims with spoofed Windows Authentication prompts to collect their credentials.
iKitten prompts the user for their credentials.
Keydnap prompts the users for credentials.
Metamorfo has displayed fake forms on top of banking sites to intercept credentials from victims.
Proton prompts users for their credentials.
SILENTTRINITY's credphisher.py module can prompt a current user for their credentials.
XCSSET prompts the user to input credentials using a native macOS dialog box leveraging the system process /Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment.
Technique:  Input Capture:Web Portal Capture
The IceApple OWA credential logger can monitor for OWA authentication requests and log the credentials.
Technique:  Input Capture:Credential API Hooking
Carberp has hooked several Windows API functions to steal credentials.
Empire contains some modules that leverage API hooking to carry out tasks, such as netripper.
FinFisher hooks processes by modifying IAT pointers to CreateWindowEx.
NOKKI uses the Windows call SetWindowsHookEx and begins injecting it into every GUI process running on the victim's machine.
It is capable of using Windows hook interfaces for information gathering such as credential access.
RDFSNIFFER hooks several Win32 API functions to hijack elements of the remote system management user-interface.
TrickBot has the ability to capture RDP credentials by capturing the CredEnumerateA API
Ursnif has hooked APIs to perform a wide variety of information theft, such as monitoring traffic from browsers.
Zebrocy installs an application-defined Windows hook to get notified when a network drive has been attached, so it can then use the hook to call its RecordToFile file stealing method.
Zeus Panda hooks processes by leveraging its own IAT hooked functions.
ZxShell hooks several API functions to spawn system threads.
Technique:  Multi-Factor Authentication Interception
It has registered alternate phone numbers for compromised users to intercept 2FA codes sent via SMS.
It has used a proprietary tool to intercept one time passwords required for two-factor authentication.
It has replayed stolen session token and passwords to trigger simple-approval MFA prompts in hope of the legitimate user will grant necessary approval.
During Operation Wocao, threat actors used a custom collection method to intercept two-factor authentication soft tokens.
Sykipot is known to contain functionality that enables targeting of smart card technologies to proxy authentication for connections to restricted network resources using detected hardware tokens.
Technique:  Multi-Factor Authentication Request Generation
It has used repeated MFA requests to gain access to victim accounts.
During C0027, It attempted to gain access by continuously sending MFA messages to the victim until they accept the MFA push challenge.
It has spammed target users with MFA prompts in the hope that the legitimate user will grant necessary approval.
It has used multifactor authentication (MFA) fatigue by sending repeated MFA authentication requests to targets.
Technique:  Network Sniffing
During the 2015 Ukraine Electric Power Attack, It used BlackEnergy’s network sniffer module to discover user credentials being sent over the network between the local LAN and the power grid’s industrial control systems.
It deployed the open source tool Responder to conduct NetBIOS Name Service poisoning, which captured usernames and hashed passwords that allowed access to legitimate credentials. It close-access teams have used Wi-Fi pineapples to intercept Wi-Fi signals and user credentials.
It has used SniffPass to collect credentials by sniffing network traffic.
It used network sniffing to obtain login data.
Emotet has been observed to hook network APIs to monitor network traffic.
Empire can be used to conduct packet captures on target hosts.
FoggyWeb can configure custom listeners to passively monitor all incoming HTTP GET and POST requests sent to the AD FS server from the intranet/internet and intercept HTTP requests that match the custom URI patterns defined by the actor.
Impacket can be used to sniff network traffic via an interface or raw socket.
It has used the Nirsoft SniffPass network sniffer to obtain passwords sent over non-secure protocols.
MESSAGETAP uses the libpcap library to listen to all traffic and parses network protocols starting with Ethernet and IP layers. It continues parsing protocol layers including SCTP, SCCP, and TCAP and finally extracts SMS message data and routing metadata.
NBTscan can dump and print whole packet content.
Penquin can sniff network traffic to look for packets matching specific conditions.
PoshC2 contains a module for taking packet captures on compromised hosts.
Regin appears to have functionality to sniff for credentials passed over HTTP, SMTP, and SMB.
Responder captures hashes and credentials that are sent to the system after the name services have been poisoned.
It has used intercepter-NG to sniff passwords in network traffic.
Technique:  OS Credential Dumping
It regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims.
It used GetPassword_x64 to harvest credentials.
It has used different versions of Mimikatz to obtain credentials.
It has been known to dump credentials.
It obtains Windows logon password details.
HOMEFRY can perform credential dumping.
It has used publicly available tools to dump password hashes, including HOMEFRY.
OnionDuke steals credentials from its victims.
PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated many sources such as WinInet Credential Cache, and Lightweight Directory Access Protocol (LDAP).
It conducts credential dumping on victims, with a focus on obtaining credentials belonging to domain and database servers.
Revenge RAT has a plugin for credential harvesting.
It has used credential dumping tools.
It used a signed credential-dumping tool to obtain victim account credentials.
It has used a variety of credential dumping tools.
Trojan.Karagany can dump passwords and save them into \ProgramData\Mail\MailAg\pwds.txt.
Technique:  OS Credential Dumping:Security Account Manager
It has used the reg save command to save registry hives.
During C0017, It copied the SAM and SYSTEM Registry hives for credential harvesting.
Cobalt Strike can recover hashed passwords.
CosmicDuke collects Windows account hashes.
Password stealer and NTLM stealer modules in CozyCar harvest stored credentials from the victim, including credentials used as part of Windows NTLM user authentication.
CrackMapExec can dump usernames and hashed passwords from the SAM.
It has dropped and executed SecretsDump to dump password hashes.
Fgdump can dump Windows password hashes.
It has extracted the SAM and SYSTEM registry hives using the reg.exe binary for obtaining password hashes from a compromised machine.
It used reg commands to dump specific hives from the Windows Registry, such as the SAM hive, and obtain password hashes.
gsecdump can dump Windows password hashes from the SAM.
HOPLIGHT has the capability to harvest credentials and passwords from the SAM database.
IceApple's Credential Dumper module can dump encrypted password hashes from SAM registry keys, including HKLM\SAM\SAM\Domains\Account\F and HKLM\SAM\SAM\Domains\Account\Users\*\V.
SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.
It has dumped credentials, including by using gsecdump.
Koadic can gather hashed passwords by dumping SAM/SECURITY hive.
It has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.
Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the SAM table.
Mivast has the capability to gather NTLM password information.
During Night Dragon, threat actors dumped account hashes using gsecdump.
During Operation CuckooBees, the threat actors leveraged a custom tool to dump OS credentials and used following commands: reg save HKLM\\SYSTEM system.hiv, reg save HKLM\\SAM sam.hiv, and reg save HKLM\\SECURITY security.hiv, to dump SAM, SYSTEM and SECURITY hives.
POWERTON has the ability to dump password hashes.
pwdump can be used to dump credentials from the SAM.
Remsec can dump the SAM database.
It actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.
It has acquired credentials from the SAM/SECURITY registry hives.
Technique:  OS Credential Dumping:NTDS
It has used the ntdsutil.exe utility to export the Active Directory database for credential access.
It has gathered the SYSTEM registry and ntds.dit files from target systems. It specifically has used the NtdsAudit tool to dump the password hashes of domain users via msadcs.exe "NTDS.dit" -s "SYSTEM" -p RecordedTV_pdmp.txt --users-csv RecordedTV_users.csv and used ntdsutil to copy the Active Directory database.
CrackMapExec can dump hashed passwords associated with Active Directory using Windows' Directory Replication Services API (DRSUAPI), or Volume Shadow Copy.
It has dropped and executed SecretsDump to dump password hashes. They also obtained ntds.dit from domain controllers.
esentutl can copy ntds.dit using the Volume Shadow Copy service.
It has harvested the NTDS.DIT file and leveraged the Impacket tool on the compromised domain controller to locally decrypt it.
It has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.
It has used Volume Shadow Copy to access credential information from NTDS.
It has stolen copies of the Active Directory database (NTDS.DIT).
SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information from NTDS.dit.
It has used NTDSDump and other password dumping tools to gather credentials.
Koadic can gather hashed passwords by gathering domain controller hashes from NTDS.
It has used Windows built-in tool ntdsutil to extract the Active Directory (AD) database.
It has used Ntdsutil to dump credentials.
It has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file. It has also used reg save on the SYSTEM file Registry location to help extract the NTDS.dit file.
It has used ntdsutil.exe to back up the Active Directory database, likely for credential access.
It has used ntds.util to create domain controller installation media containing usernames and password hashes.
It has gained access to credentials via exported copies of the ntds.dit Active Directory database. It has also created a volume shadow copy and used a batch script file to collect NTDS.dit with the use of the Windows utility, ntdsutil.
Technique:  OS Credential Dumping:LSA Secrets
AADInternals can dump secrets from the Local Security Authority.
It has used the reg save command to extract LSA secrets offline.
It has used a variety of publicly available tools like LaZagne to gather credentials.
CosmicDuke collects LSA secrets.
CrackMapExec can dump hashed passwords from LSA secrets for the targeted system.
It has dropped and executed SecretsDump to dump password hashes.
gsecdump can dump LSA secrets.
IceApple's Credential Dumper module can dump LSA secrets from registry keys, including: HKLM\SECURITY\Policy\PolEKList\default, HKLM\SECURITY\Policy\Secrets\*\CurrVal, and HKLM\SECURITY\Policy\Secrets\*\OldVal.
SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.
It has dumped credentials, including by using gsecdump.
LaZagne can perform credential dumping from LSA secrets to obtain account and password information.
It used several tools for retrieving login and password information, including LaZagne.
It has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.
Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSA.
It has performed credential dumping with LaZagne.
It has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.
Pupy can use Lazagne for harvesting credentials.
It actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.
Technique:  OS Credential Dumping:Cached Domain Credentials
It has used a variety of publicly available tools like LaZagne to gather credentials.
Cachedump can extract cached password hashes from cache entry information.
LaZagne can perform credential dumping from MSCache to obtain account and password information.
It used several tools for retrieving login and password information, including LaZagne.
It has performed credential dumping with LaZagne.
It has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.
Okrum was seen using modified Quarks PwDump to perform credential dumping.
Pupy can use Lazagne for harvesting credentials.
Technique:  OS Credential Dumping:DCSync
During C0027, It performed domain replication.
It has used a DCSync command with Mimikatz to retrieve credentials from an exploited controller.
It has used DCSync attacks to gather credentials for privilege escalation routines.
Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from DCSync/NetSync.
During Operation Wocao, threat actors used Mimikatz's DCSync to dump credentials from the memory of the targeted system.
During the SolarWinds Compromise, It used privileged accounts to replicate directory service data with domain controllers.
Technique:  OS Credential Dumping:Proc Filesystem
LaZagne can use the <PID>/maps and <PID>/mem files to identify regex patterns to dump cleartext passwords from the browser's process memory.
MimiPenguin can use the <PID>/maps and <PID>/mem file to search for regex patterns and dump the process memory.
Technique:  OS Credential Dumping:
LaZagne can obtain credential information from /etc/shadow using the shadow.py module.
Technique:  Steal Application Access Token
AADInternals can steal users’ access tokens via phishing emails containing malicious links.
It has used several malicious applications to steal user OAuth access tokens including applications masquerading as "Google Defender" "Google Email Protection," and "Google Scanner" for Gmail users. They also targeted Yahoo users with applications masquerading as "Delivery Service" and "McAfee Email Protection".
Peirates gathers Kubernetes service account tokens using a variety of techniques.
Technique:  Steal or Forge Authentication Certificates
AADInternals can create and export various authentication certificates, including those associated with Azure AD joined/registered devices.
It has abused misconfigured AD CS certificate templates to impersonate admin users and create additional authentication certificates.
Mimikatz's CRYPTO module can create and export various types of authentication certificates.
Technique:  Steal or Forge Kerberos Tickets:Golden Ticket
Empire can leverage its implementation of Mimikatz to obtain and use golden tickets.
It has used Mimikatz to generate Kerberos golden tickets.
Mimikatz's kerberos module can create golden tickets.
Rubeus can forge a ticket-granting ticket.
Technique:  Steal or Forge Kerberos Tickets:Silver Ticket
AADInternals can be used to forge Kerberos tickets using the password hash of the AZUREADSSOACC account.
Empire can leverage its implementation of Mimikatz to obtain and use silver tickets.
Mimikatz's kerberos module can create silver tickets.
Rubeus can create silver tickets.
Technique:  Steal or Forge Kerberos Tickets:Kerberoasting
Brute Ratel C4 can decode Kerberos 5 tickets and convert it to hashcat format for subsequent cracking.
Empire uses PowerSploit's Invoke-Kerberoast to request service tickets and return crackable ticket hashes.
It has used Kerberoasting PowerShell commands such as, Invoke-Kerberoast for credential access and to enable lateral movement.
Impacket modules like GetUserSPNs can be used to get Service Principal Names (SPNs) for user accounts. The output is formatted to be compatible with cracking tools like John the Ripper and Hashcat.
During Operation Wocao, threat actors used PowerSploit's Invoke-Kerberoast module to request encrypted service tickets and bruteforce the passwords of Windows service accounts offline.
PowerSploit's Invoke-Kerberoast module can request service tickets and return crackable ticket hashes.
Rubeus can use the KerberosRequestorSecurityToken.GetRequest method to request kerberoastable service tickets.
SILENTTRINITY contains a module to conduct Kerberoasting.
During the SolarWinds Compromise, It obtained Ticket Granting Service (TGS) tickets for Active Directory Service Principle Names to crack offline.
It has used Rubeus, MimiKatz Kerberos module, and the Invoke-Kerberoast cmdlet to steal AES hashes.
Technique:  Steal or Forge Kerberos Tickets:AS-REP Roasting
Rubeus can reveal the credentials of accounts that have Kerberos pre-authentication disabled through AS-REP roasting.
Technique:  Steal Web Session Cookie
BLUELIGHT can harvest cookies from Internet Explorer, Edge, Chrome, and Naver Whale browsers.
Chaes has used a script that extracts the web session cookie and sends it to the C2 server.
CookieMiner can steal Google Chrome and Apple Safari browser cookies from the victim’s machine.
EVILNUM can harvest cookies and upload them to the C2 server.
It can steal cookies and session information from browsers.
Grandoreiro can steal the victim's cookies to use for duplicating the active session from another device.
It has used an unnamed post-exploitation tool to steal cookies from the Chrome browser.
QakBot has the ability to capture web session cookies.
During the SolarWinds Compromise, It stole Chrome browser cookies by copying the Chrome profile directories of targeted users.
TajMahal has the ability to steal web session cookies from Internet Explorer, Netscape Navigator, FireFox and RealNetworks applications.
XCSSET uses scp to access the ~/Library/Cookies/Cookies.binarycookies file.
Technique:  Unsecured Credentials
Astaroth uses an external software known as NetPass to recover passwords.
Pacu can search for sensitive data: for example, in Code Build environment variables, EC2 user data, and Cloud Formation templates.
Technique:  Unsecured Credentials:Credentials In Files
AADInternals can gather unsecured credentials for Azure AD services, such as Azure AD Connect, from a local machine.
Agent Tesla has the ability to extract credentials from configuration or support files.
It has a tool that can locate credentials in files on the file system such as those from Firefox or Chrome.
It has used a variety of publicly available tools like LaZagne to gather credentials.
Azorult can steal credentials in files belonging to common software such as Skype, Telegram, and Steam.
BlackEnergy has used a plug-in to gather credentials stored in files on the host by various software programs, including The Bat! email client, Outlook, and Windows Credential Store.
Emotet has been observed leveraging a module that retrieves passwords stored on a system for the current logged-on user.
Empire can use various modules to search for files containing passwords.
It has obtained administrative credentials by browsing through local files on a compromised machine.
It has accessed files to gain valid credentials.
Hildegard has searched for SSH keys, Docker credentials, and Kubernetes service tokens.
jRAT can capture passwords from common chat applications such as MSN Messenger, AOL, Instant Messenger, and and Google Talk.
It has used tools that are capable of obtaining credentials from saved mail.
LaZagne can obtain credentials from chats, databases, mail, and WiFi.
It used several tools for retrieving login and password information, including LaZagne.
It has run a tool that steals passwords saved in victim email.
It has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.
If an initial connectivity check fails, pngdowner attempts to extract proxy details and credentials from Windows Protected Storage and from the IE Credentials Store. This allows the adversary to use the proxy credentials for subsequent requests if they enable outbound HTTP access.
PoshC2 contains modules for searching for passwords in local and remote files.
Pupy can use Lazagne for harvesting credentials.
Pysa has extracted credentials from the password database before encrypting the files.
QuasarRAT can obtain passwords from FTP clients.
Smoke Loader searches for files named logins.json to parse for credentials.
It has used malware to gather credentials from FTP clients and Outlook.
It has searched for unsecured AWS credentials and Docker API credentials.
TrickBot can obtain passwords stored in files from several applications such as Outlook, Filezilla, OpenSSH, OpenVPN and WinSCP. Additionally, it searches for the ".vnc.lnk" affix to steal VNC credentials.
XTunnel is capable of accessing locally stored passwords on victims.
Technique:  Unsecured Credentials:Credentials in Registry
Agent Tesla has the ability to extract credentials from the Registry.
It used Outlook Credential Dumper to harvest credentials stored in Windows registry.
IceApple can harvest credentials from local and remote host registries.
PowerSploit has several modules that search the Windows Registry for stored credentials: Get-UnattendedInstallFile, Get-Webconfig, Get-ApplicationHost, Get-SiteListPassword, Get-CachedGPPPassword, and Get-RegistryAutoLogon.
Reg may be used to find credentials in the Windows Registry.
TrickBot has retrieved PuTTY credentials by querying the Software\SimonTatham\Putty\Sessions registry key
Valak can use the clientgrabber module to steal e-mail credentials from the Registry.
Technique:  Unsecured Credentials:Bash History
Kinsing has searched bash_history for credentials.
Technique:  Unsecured Credentials:Private Keys
AADInternals can gather encryption keys from Azure AD services such as ADSync and Active Directory Federated Services servers.
Ebury has intercepted unencrypted private keys as well as private key pass-phrases.
Empire can use modules like Invoke-SessionGopher to extract private key and session information.
FoggyWeb can retrieve token signing certificates and token decryption certificates from a compromised AD FS server.
Hildegard has searched for private keys in .ssh.
jRAT can steal keys for VPNs and cryptocurrency wallets.
Kinsing has searched for private keys.
It has scanned and looked for cryptographic keys and certificate file extensions.
Mafalda can collect a Chrome encryption key used to protect browser cookies.
Mimikatz's CRYPTO::Extract module can extract keys by interacting with Windows cryptographic application programming interface (API) functions.
During Operation Wocao, threat actors used Mimikatz to dump certificates and private keys from the Windows certificate store.
It has used SSH private keys on the infected machine to spread its coinminer throughout a network.
During the SolarWinds Compromise, It obtained PKI keys, certificate files, and the private encryption key from an Active Directory Federation Services (AD FS) container to decrypt corresponding SAML signing certificates.
It has searched for unsecured SSH keys.
Technique:  Unsecured Credentials:Cloud Instance Metadata API
Hildegard has queried the Cloud Instance Metadata API for cloud credentials.
Peirates can query the query AWS and GCP metadata APIs for secrets.
It has queried the AWS instance metadata service for credentials.
Technique:  Unsecured Credentials:Group Policy Preferences
It has used a variety of publicly available tools like Gpppassword to gather credentials.
PowerSploit contains a collection of Exfiltration modules that can harvest credentials from Group Policy Preferences.
SILENTTRINITY has a module that can extract cached GPP passwords.
It has used PowerShell cmdlets Get-GPPPassword and Find-GPOPassword to find unsecured credentials in a compromised network group policy.
Technique:  Unsecured Credentials:Container API
Peirates can query the Kubernetes API for secrets.
Technique:  Unsecured Credentials:Chat Messages
It has targeted various collaboration tools like Slack, Teams, JIRA, Confluence, and others to hunt for exposed credentials to support privilege escalation and lateral movement.
Technique:  Account Discovery
It has enumerated all users and their roles from a victim's main treasury system.
ShimRatReporter listed all non-privileged and privileged accounts available on the machine.
During the SolarWinds Compromise, It obtained a list of users and their roles from an Exchange server using Get-ManagementRoleAssignment.
Woody RAT can identify administrator accounts on an infected machine.
XCSSET attempts to discover accounts from various locations such as a user's Evernote, AppleID, Telegram, Skype, and WeChat data.
Technique:  Account Discovery:Email Account
Backdoor.Oldrea collects address book information from Outlook.
BoomBox can execute an LDAP query to discover e-mail accounts for domain users.
During C0027, It accessed Azure AD to identify email addresses.
Emotet has been observed leveraging a module that can scrape email addresses from Outlook.
Grandoreiro can parse Outlook .pst files to extract e-mail addresses.
Lizar can collect email accounts from Microsoft Outlook and Mozilla Thunderbird.
It has used Powershell to discover email accounts.
MailSniper can be used to obtain account names from Exchange and Office 365 using the Get-GlobalAddressList cmdlet.
Ruler can be used to enumerate Exchange users and dump the GAL.
It used malware to enumerate email settings, including usernames and passwords, from the M.E.Doc application.
It has used the tool EmailStealer to steal and send lists of e-mail addresses to a remote server.
TrickBot collects email addresses from Outlook.
Technique:  Account Discovery:Cloud Account
AADInternals can enumerate Azure AD users.
It has conducted enumeration of Azure AD accounts.
During C0027, It accessed Azure AD to download bulk lists of group members and to identify privileged users, along with the email addresses and AD attributes.
Pacu can enumerate IAM users, roles, and groups.
ROADTools can enumerate Azure AD users.
Technique:  Application Window Discovery
Aria-body has the ability to identify the titles of running windows on a compromised host.
Attor can obtain application window titles and then determines which windows to perform Screen Capture on.
Cadelspy has the ability to identify open windows on the compromised host.
Catchamas obtains application windows titles and then determines which windows to perform Screen Capture on.
DarkWatchman reports window names along with keylogger information to provide application context.
The discovery modules used with Duqu can collect information on open windows.
Flagpro can check the name of the window displayed on the system.
FunnyDream has the ability to discover application windows via execution of EnumWindows.
Grandoreiro can identify installed security tools based on window names.
It has used a PowerShell-based keylogging tool to capture the window title.
HotCroissant has the ability to list the names of all open windows on the infected host.
InvisiMole can enumerate windows and child windows on a compromised host.
Kazuar gathers information about opened windows.
It malware IndiaIndia obtains and sends to its C2 server the title of the window for each running process. The KilaAlfa keylogger also reports the title of the window in the foreground.
It saves the window names.
Metamorfo can enumerate all windows on the victim’s machine.
NetTraveler reports window names along with keylogger information to provide application context.
NETWIRE can discover and close windows on controlled systems.
NightClub can use GetForegroundWindow to enumerate the active window.
njRAT gathers information about opened windows during the initial infection.
PLEAD has the ability to list open windows on the compromised host.
PoisonIvy captures window titles.
PowerDuke has a command to get text of the current foreground window.
QakBot has the ability to enumerate windows on a compromised host.
Remexi has a command to capture active windows on the machine and retrieve window titles.
ROKRAT can use  the GetForegroundWindow and GetWindowText APIs to discover where the user is typing.
SILENTTRINITY can enumerate the active Window during keylogging through execution of GetActiveWindowTitle.
SOUNDBITE is capable of enumerating application windows.
Trojan.Karagany can monitor the titles of open windows to identify specific keywords.
WINERACK can enumerate active windows.
Technique:  Browser Information Discovery
It has collected browser bookmark information to learn more about compromised hosts, obtain personal information about users, and acquire details about internal network resources.
Calisto collects information on bookmarks from Google Chrome.
It has used type \\c$\Users\\Favorites\Links\Bookmarks bar\Imported From IE*citrix* for bookmark discovery.
DarkWatchman can retrieve browser history.
Dtrack can retrieve browser history.
Empire has the ability to gather browser data such as bookmarks and visited sites.
It has used Google Chrome bookmarks to identify internal resources and assets.
Lizar can retrieve browser history and database files.
It retrieves the user profile data (e.g., browsers) from Chrome and Firefox browsers.
Mafalda can collect the contents of the %USERPROFILE%\AppData\Local\Google\Chrome\User Data\LocalState file.
MobileOrder has a command to upload to its C2 server victim browser bookmarks.
PowerLess has a browser info stealer module that can read Chrome and Edge browser database files.
SUGARDUMP has collected browser bookmark and history information.
Technique:  Cloud Infrastructure Discovery
Pacu can enumerate AWS infrastructure, such as EC2 instances.
Technique:  Cloud Service Discovery
AADInternals can enumerate information about a variety of cloud services, such as Office 365 and Sharepoint instances or OpenID Configurations.
Pacu can enumerate AWS services, such as CloudTrail and CloudWatch.
ROADTools can enumerate Azure AD applications and service principals.
Technique:  Cloud Storage Object Discovery
Pacu can enumerate AWS storage services, such as S3 buckets and Elastic Block Store volumes.
Peirates can list AWS S3 buckets.
Technique:  Container and Resource Discovery
Hildegard has used masscan to search for kubelets and the kubelet API for additional running containers.
Peirates can enumerate Kubernetes pods in a given namespace.
It has checked for running containers with docker ps and for specific container names with docker inspect. It has also searched for Kubernetes pods running in a local network.
Technique:  Device Driver Discovery
HOPLIGHT can enumerate device drivers located in the registry at HKLM\Software\WBEM\WDM.
Remsec has a plugin to detect active drivers of some security products.
Technique:  Domain Trust Discovery
AdFind can gather information about organizational units (OUs) and domain trusts from Active Directory.
BADHATCH can use nltest.exe /domain_trusts to discover domain trust relationships on a compromised machine.
Bazar can use Nltest tools to obtain information about the domain.
BloodHound has the ability to map domain trusts and identify misconfigurations for potential abuse.
Brute Ratel C4 can use LDAP queries and nltest /domain_trusts for domain trust discovery.
During C0015, the threat actors used the command nltest /domain_trusts /all_trusts to enumerate domain trusts.
It has nltest /domain_trusts to identify domain trust relationships.
dsquery can be used to gather information on domain trusts with dsquery * -filter "(objectClass=trustedDomain)" -attr *.
It has used Nltest to obtain information about domain controllers.
Empire has modules for enumerating domain trusts.
It has retrieved a list of trusted domains by using nltest.exe /domain_trusts.
It has used a web shell to execute nltest /trusted_domains to identify trust relationships.
Nltest may be used to enumerate trusted domains by using commands such as nltest /domain_trusts.
PoshC2 has modules for enumerating domain trusts.
PowerSploit has modules such as Get-NetDomainTrust and Get-NetForestTrust to enumerate domain and forest trusts.
QakBot can run nltest /domain_trusts /all_trusts for domain trust discovery.
Rubeus can gather information about domain trusts.
During the SolarWinds Compromise, It used the Get-AcceptedDomain PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell. They also used AdFind to enumerate domains and to discover trust between federated domains.
TrickBot can gather information about domain trusts by utilizing Nltest.
Technique:  Group Policy Discovery
BloodHound has the ability to collect local admin information via GPO.
Emissary has the capability to execute gpresult.
Empire includes various modules for enumerating Group Policy.
It surveys a system upon check-in to discover Group Policy details using the gpresult command.
Technique:  Log Enumeration
Pacu can collect CloudTrail event histories and CloudWatch logs.
It has used wevtutil.exe and the PowerShell command Get-EventLog security to enumerate Windows logs to search for successful logons.
Technique:  Password Policy Discovery
BloodHound can collect password policy information on the target environment.
It has used the NtdsAudit utility to collect information related to accounts and passwords.
CrackMapExec can discover the password policies applied to the target system.
Kwampirs collects password policy information with the command net accounts.
The net accounts and net accounts /domain commands with Net can be used to obtain password policy information.
It has used net.exe in a script with net accounts /domain to find the password policy of a domain.
During Operation CuckooBees, the threat actors used the net accounts command as part of their advanced reconnaissance.
PoshC2 can use Get-PassPol to enumerate the domain password policy.
It has used net accounts and net accounts /domain to acquire password policy information.
Technique:  Permission Groups Discovery
It has a tool that can enumerate the permissions associated with Windows groups.
Carbon uses the net group command.
It has enumerated all users and roles from a victim's main treasury system.
IcedID has the ability to identify Workgroup membership.
MURKYTOP has the capability to retrieve information about groups.
ShimRatReporter gathered the local privileges for the infected host.
Siloscape checks for Kubernetes node permissions.
During the SolarWinds Compromise, It used the Get-ManagementRoleAssignment PowerShell cmdlet to enumerate Exchange management role assignments through an Exchange Management Shell.
It has used TinyMet to enumerate members of privileged groups. It has also run net group /domain.
TrickBot can identify the groups the user on a compromised host belongs to.
Technique:  Permission Groups Discovery:Local Groups
It actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: net localgroup administrator >> %temp%\download
BloodHound can collect information about local groups and members.
During C0015, the threat actors used the command net localgroup "adminstrator" to identify accounts with local administrator rights.
Caterpillar WebShell can obtain a list of local groups of users from a system.
It has used net localgroup administrators to identify  accounts with local administrative rights.
Cobalt Strike can use net localgroup to list local groups on a system.
Emissary has the capability to execute the command net localgroup administrators.
Epic gathers information on local group names.
Flagpro has been used to execute the net localgroup administrators command on a targeted system.
FlawedAmmyy enumerates the privilege level of the victim during the initial infection.
Helminth has checked the local administrators group.
It has run net localgroup to enumerate local groups.
JPIN can obtain the permissions of the victim user.
Kazuar gathers information about local groups and members.
Kwampirs collects a list of users belonging to the local users and administrators groups with the commands net localgroup administrators and net localgroup users.
Commands such as net group and net localgroup can be used in Net to gather information about and manipulate groups.
It has used net localgroup administrators to find local administrators on compromised systems.
During Operation CuckooBees, the threat actors used the net group command as part of their advanced reconnaissance.
During Operation Wocao, threat actors used the command net localgroup administrators to list all administrators part of a local group.
OSInfo has enumerated the local administrators group.
PoshC2 contains modules, such as Get-LocAdm for enumerating permission groups.
POWRUNER may collect local group information by running net localgroup administrators or a series of other commands on a victim.
QakBot can use net localgroup to enable discovery of local groups.
SILENTTRINITY can obtain a list of local groups and members.
Sys10 collects the group name of the logged-in user and sends it to the C2.
It has used the ShowLocalGroupDetails command to identify administrator, user, and guest accounts on a compromised host.
It has used net localgroup and net localgroup Administrators to enumerate group information, including members of the local administrators group.
It has run net localgroup administrators in compromised environments to enumerate accounts.
Technique:  Permission Groups Discovery:Domain Groups
AdFind can enumerate domain groups.
BADHATCH can use net.exe group "domain admins" /domain to identify Domain Administrators.
BlackCat can determine if a user on a compromised host has domain admin privileges.
BloodHound can collect information about domain groups and members.
Brute Ratel C4 can use net group for discovery on targeted domains.
During C0015, the threat actors use the command net group "domain admins" /dom to enumerate domain groups.
Cobalt Strike can identify targets by querying account groups on a domain contoller.
CrackMapExec can gather the user accounts within domain groups.
It has used batch scripts to enumerate administrators and users in the domain.
dsquery can be used to gather information on permission groups within a domain.
Egregor can conduct Active Directory reconnaissance using tools such as Sharphound or AdFind.
It has used the command net group "domain admins" /domain to enumerate domain groups.
GRIFFON has used a reconnaissance module that can be used to retrieve Windows domain membership information.
Helminth has checked for the domain admin group and Exchange Trusted Subsystem groups using the commands net group Exchange Trusted Subsystem /domain and net group domain admins /domain.
It has used specific malware modules to gather domain membership.
It performs discovery of permission groups net group /domain.
Kwampirs collects a list of domain groups with the command net localgroup /domain.
It has used the AD Explorer tool to enumerate groups on a victim's network.
Commands such as net group /domain can be used in Net to gather information about and manipulate groups.
It has used net group /domain, net group "domain admins" /domain, and net group "Exchange Trusted Subsystem" /domain to find domain group permission settings.
OSInfo specifically looks for Domain Admins and power users within the domain.
POWRUNER may collect domain group information by running net group /domain or a series of other commands on a victim.
REvil can identify the domain membership of a compromised host.
SILENTTRINITY can use System.DirectoryServices namespace to retrieve domain group information.
During the SolarWinds Compromise, It used AdFind to enumerate domain groups.
SoreFang can enumerate domain groups by executing net.exe group /domain.
It has used net group "Domain Admins" /domain to identify domain administrators.
It has run net group in compromised environments to discover domain groups.
WellMess can identify domain group membership for the current user.
Technique:  Permission Groups Discovery:Cloud Groups
AADInternals can enumerate Azure AD groups.
During C0027, It accessed Azure AD to download bulk lists of group members and their Active Directory attributes.
Pacu can enumerate IAM permissions.
ROADTools can enumerate Azure AD groups.
Technique:  System Location Discovery
Amadey does not run any tasks or install additional malware if the victim machine is based in Russia.
Crimson can identify the geographical location of a victim host.
DarkWatchman can identity the OS locale of a compromised host.
GrimAgent can identify the country code on a compromised host.
QuasarRAT can determine the country a victim host is located in.
Before executing malicious code, Ragnar Locker checks the Windows API GetLocaleInfoW and doesn't encrypt files if it finds a former Soviet country.
Saint Bot has conducted system locale checks to see if the compromised host is in Russia, Ukraine, Belarus, Armenia, Kazakhstan, or Moldova.
SDBbot can collected the country code of a compromised machine.
It has identified the country location of a compromised host.
Technique:  System Network Configuration Discovery:Internet Connection Discovery
It has ensured web servers in a victim environment are Internet accessible before copying tools or malware to it.
DarkTortilla can check for internet connectivity by issuing HTTP GET requests.
It has used Ping and tracert for network reconnaissance efforts.
It has used the Ping command to check connectivity to actor-controlled C2 servers.
It has tested connectivity between a compromised machine and a C2 server using  Ping with commands such as CSIDL_SYSTEM\cmd.exe /c ping -n 1.
GoldFinder performed HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request traveled through.
It has checked for network connectivity from a compromised host using ping, including attempts to contact google[.]com.
It has used tools including BITSAdmin to test internet connectivity from compromised hosts.
It has conducted a network call out to a specific website as part of their initial discovery activity.
More_eggs has used HTTP GET requests to check internet connectivity.
Neoichor can check for Internet connectivity by contacting bing[.]com with the request format bing[.]com?id=<GetTickCount>.
During Operation Wocao, threat actors used a Visual Basic script that checked for internet connectivity.
QakBot can measure the download speed on a targeted host.
QuietSieve can check C2 connectivity with a ping to 8.8.8.8 (Google public DNS).
Rising Sun can test a connection to a specified network IP address over a specified port number.
During the SolarWinds Compromise, It used GoldFinder to perform HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request travels through.
SUGARUSH has checked for internet connectivity from an infected host before attempting to establish a new TCP connection.
SysUpdate can contact the DNS server operated by Google as part of its C2 establishment process.
It has run scripts to check internet connectivity from compromised hosts.
It has used tracert to check internet connectivity.
Woody RAT can make Ping GET HTTP requests to its C2 server at regular intervals for network connectivity checks.
Technique:  System Network Configuration Discovery:Wi-Fi Discovery
Agent Tesla can collect names and passwords of all Wi-Fi networks to which a device has previously connected.
Emotet can extract names of all locally reachable Wi-Fi networks and then perform a brute-force attack to spread to new networks.
It has collected names and passwords of all Wi-Fi networks to which a device has previously connected.