KJChen/tech2proc huggingface dataset:
Technique:  Command and Scripting Interpreter:Unix Shell
Anchor can execute payloads via shell scripting.
AppleJeus has used shell scripts to execute commands after installation and set persistence mechanisms.
It executed file /bin/pwd in activity exploiting CVE-2019-19781 against Citrix devices.
Bundlore has leveraged /bin/sh and /bin/bash to execute commands on the victim machine.
CallMe has the capability to create a reverse shell on victims.
Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.
CoinTicker executes a bash script to establish a reverse shell.
CookieMiner has used a Unix shell script to run a series of commands targeting macOS.
Derusbi is capable of creating a remote Bash shell and executing commands.
Doki has executed shell scripts with /bin/sh.
Drovorub can execute arbitrary commands as root on a compromised system.
Exaramel for Linux has a command to execute a shell command on the system.
Fysbis has the ability to create and execute commands in a remote shell for CLI.
Green Lambert can use shell scripts for execution, such as /bin/sh -c.
Hildegard has used shell scripts for execution.
Kazuar uses /bin/bash to execute commands on the victim’s machine.
Kinsing has used Unix shell scripts to execute commands in the victim environment.
Kobalos can spawn a new pseudo-terminal and execute arbitrary commands at the command prompt.
LoudMiner used shell scripts to launch various services and to start/stop the QEMU virtualization.
MacMa can execute supplied shell commands and uses bash scripts to perform additional actions.
NETWIRE has the ability to use /bin/bash and /bin/sh to execute commands.
OSX/Shlayer can use bash scripts to check the macOS version, download payloads, and extract bytes from files. OSX/Shlayer uses the command sh -c tail -c +1381... to extract bytes at an offset from a specified file. OSX/Shlayer uses the curl -fsL "$url" >$tmp_path command to download malicious payloads into a temporary directory.
OSX_OCEANLOTUS.D uses a shell script as the main executable inside an app bundle and drops an embedded base64-encoded payload to the /tmp folder.
Penquin can execute remote commands using bash scripts.
Proton uses macOS' .command file type to script actions.
It used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining malware.
Skidmap has used pm.sh to download and install its main payload.
It has used shell scripts for execution.
Turian has the ability to use /bin/sh to execute commands.
WindTail can use the open command to execute an application.
XCSSET uses a shell script to execute Mach-o files and osacompile commands such as, osacompile -x -o xcode.app main.applescript.
Technique:  Command and Scripting Interpreter:Python
It has developed malware variants written in Python.
It has used Python scripts to execute payloads.
It has used a command line utility and a network scanner written in python.
Bandook can support commands to execute Python-based payloads.
It has made use of Python-based remote access tools.
Bundlore has used Python scripts to execute payloads.
Chaes has used Python scripts for execution and the installation of additional files.
Cobalt Strike can use Python to perform execution.
CoinTicker executes a Python script to download its second stage.
CookieMiner has used python scripts on the user’s system, as well as the Python variant of the Empire agent, EmPyre.
Donut can generate shellcode outputs that execute via Python.
It has used various types of scripting to perform operations, including Python scripts. The group was observed installing Python 2.7 on a victim.
DropBook is a Python-based backdoor compiled with PyInstaller.
It used Python scripts for port scanning or building reverse shells.
Ebury has used Python to implement its DGA.
IronNetInjector can use IronPython scripts to load payloads with the help of a .NET injector.
KeyBoy uses Python scripts for installing files and performing execution.
Keydnap uses Python for scripting to execute additional commands.
It has used a macOS Python implant to gather data as well as MailFetcher.py code to automatically collect email data.
It is written in Python and is used in conjunction with additional Python scripts.
It used multiple compiled Python scripts on the victim’s system. It's main backdoor It is also written in Python.
MechaFlounder uses a python-based payload.
It has used developed tools in Python including Out1.
During Operation Wocao, threat actors' backdoors were written in Python and compiled with py2exe.
PoetRAT was executed with a Python script and worked in conjunction with additional Python-based post-exploitation tools.
PUNCHBUGGY has used python scripts.
Pupy can use an add on feature when creating payloads that allows you to create custom Python scripts ("scriptlets") to perform tasks offline (without requiring a session) such as sandbox detection, adding persistence, etc.
PyDCrypt, along with its functions, is written in Python.
Pysa has used Python scripts to deploy ransomware.
Remcos uses Python scripts.
It has used Python-based malware to install and spread their coinminer.
SILENTTRINITY is written in Python and can use multiple Python scripts for execution on targeted systems.
Small Sieve can use Python scripts to execute commands.
SpeakUp uses Python scripts.
It has used Python-based tools for execution.
Turian has the ability to use Python to spawn a Unix shell.
It has used IronPython scripts as part of the IronNetInjector toolchain to drop payloads.
ItM has used Python-based implants to interact with compromised hosts.
Technique:  Command and Scripting Interpreter:JavaScript
AppleSeed has the ability to use JavaScript to execute PowerShell.
It has used JavaScript for drive-by downloads and C2 communications.
Astaroth uses JavaScript to perform its core functionalities.
Avaddon has been executed through a malicious JScript downloader.
Bundlore can execute JavaScript by injecting it into the victim's browser.
During C0015, the threat actors used a malicious HTA file that contained a mix of encoded HTML and JavaScript/VBScript code.
During C0017, It deployed JScript web shells on compromised systems.
Chaes has used JavaScript and Node.Js information stealer script that exfiltrates data using the node process.
It has executed JavaScript scriptlets on the victim's machine.
The Cobalt Strike System Profiler can use JavaScript to perform reconnaissance actions.
DarkWatchman uses JavaScript to perform its core functionalities.
Donut can generate shellcode outputs that execute via JavaScript or JScript.
It has manipulated legitimate websites to inject malicious JavaScript code as part of their watering hole operations.
It has used JavaScript to execute malicious code on a victim's machine.
EnvyScout can write files to disk with JavaScript using a modified version of the open-source tool FileSaver.
It has used malicious JavaScript files on the victim's machine.
It has used malicious JavaScript to steal payment card data from e-commerce sites.
It used JavaScript scripts to help perform tasks on the victim's machine.
GRIFFON is written in and executed as JavaScript.
It used JavaScript to execute additional files.
It has used malicious JavaScript files for several components of their attack.
InvisiMole can use a JavaScript file as part of its execution chain.
jRAT has been distributed as HTA files with JScript.
JSS Loader can download and execute JavaScript files.
It has used JScript for logging and downloading additional tools.
KONNI has executed malicious JavaScript code.
KOPILUWAK had used Javascript to perform its core functions.
It has used JavaScript in its attacks.
It infected victims using JavaScript code.
Metamorfo includes payloads written in JavaScript.
It used various implants, including those built with JS, on target machines.
It has used JavaScript to deliver malware hosted on HTML pages.
It has used JavaScript files to execute its POWERSTATS payload.
NanHaiShu executes additional Jscript code on the victim's machine.
During Operation Dust Storm, the threat actors used JavaScript code.
POWERSTATS can use JavaScript code for execution.
The QakBot web inject module can inject Java Script into web banking pages visited by the victim.
It has used JavaScript to drop and execute malware loaders.
It has used JS scripts.
SpicyOmelette has the ability to execute arbitrary JavaScript code on a compromised host.
It has used JavaScript for code execution.
It has used various JavaScript-based backdoors.
Valak can execute JavaScript containing configuration data for establishing persistence.
Xbash can execute malicious JavaScript payloads on the victim’s machine.
Technique:  Command and Scripting Interpreter:Cloud API
It has leveraged the Microsoft Graph API to perform various actions across Azure and M365 environments. They have also utilized AADInternals PowerShell Modules to access the API
Pacu leverages the AWS CLI for its operations.
It has leveraged AWS CLI to enumerate cloud environments with compromised credentials.
Technique:  Container Administration Command
Hildegard was executed through the kubelet API run command and by executing commands on running containers.
Kinsing was executed with an Ubuntu container entry point that runs shell scripts.
Peirates can use kubectl or the Kubernetes API to run commands.
Siloscape can send kubectl commands to victim clusters through an IRC channel and can run kubectl locally to spread once within a victim cluster.
It executed Hildegard through the kubelet API run command and by executing commands on running containers.
Technique:  Deploy Container
Doki was run through a deployed container.
Kinsing was run through a deployed Ubuntu container.
Peirates can deploy a pod that mounts its node’s root file system, then execute a command to create a reverse shell on the node.
It has deployed different types of containers into victim environments to facilitate execution. It has also transferred cryptocurrency mining software to Kubernetes clusters discovered within local IP address ranges.
Technique:  Inter-Process Communication
Cyclops Blink has the ability to create a pipe to enable inter-process communication.
HyperStack can connect to the IPC$ share on remote machines.
When executing with non-root permissions, RotaJakiro uses the the shmget API to create shared memory between other known RotaJakiro processes. This allows processes to communicate with each other and share their PID.
Uroburos has the ability to move data between its kernel and user mode components, generally using named pipes.
Technique:  Inter-Process Communication:Component Object Model
Bumblebee can use a COM object to execute queries to gather system information.
DarkTortilla has used the WshShortcut COM object to create a .lnk shortcut file in the Windows startup folder.
FunnyDream can use com objects identified with CLSID_ShellLink(IShellLink and IPersistFile) and WScript.Shell(RegWrite method) to enable persistence mechanisms.
It malware can insert malicious macros into documents using a Microsoft.Office.Interop object.
Gelsemium can use the IARPUinstallerStringLauncher COM interface are part of its UAC bypass process.
HermeticWizard can execute files on remote machines using DCOM.
InvisiMole can use the ITaskService, ITaskDefinition and ITaskSettings COM interfaces to schedule a task.
Milan can use a COM component to generate scheduled tasks.
It has used malware that has the capability to execute malicious code via COM, DCOM, and Outlook.
Neoichor can use the Internet Explorer (IE) COM interface to connect and receive commands from C2.
POWERSTATS can use DCOM (targeting the 127.0.0.1 loopback address) to execute additional payloads on compromised hosts.
Ramsay can use the Windows COM API to schedule tasks and maintain persistence.
TrickBot used COM to setup scheduled task for persistence.
Ursnif droppers have used COM objects to execute the malware's full executable payload.
Technique:  Inter-Process Communication:Dynamic Data Exchange
It has delivered JHUHUGIT and Koadic by executing PowerShell commands through DDE in Word documents.
It has used Windows DDE for execution of commands and a malicious VBS.
It has executed OLE objects using Microsoft It Editor to download and run malicious payloads.
It has sent malicious Word OLE compound documents to victims.
It spear phishing campaigns have included malicious Word documents with DDE execution.
It attempted to exploit Microsoft’s DDE protocol in order to gain access to victim machines and for execution.
GravityRAT has been delivered via Word documents using DDE for execution.
HAWKBALL has used an OLE object that uses It Editor to drop the embedded shellcode.
KeyBoy uses the Dynamic Data Exchange (DDE) protocol to download remote payloads.
It has utilized OLE as a method to insert malicious content inside various phishing documents.
It has used malware that can execute PowerShell scripts via DDE.
During Operation Sharpshooter, threat actors sent malicious Word OLE documents to victims.
It leveraged the DDE protocol to deliver their malware.
PoetRAT was delivered with documents using DDE to execute malicious code.
POWERSTATS can use DDE to execute additional payloads on compromised hosts.
Ramsay has been delivered using OLE objects in malicious documents.
It can search for specific strings within browser tabs using a Dynamic Data Exchange mechanism.
It has used the ActiveXObject utility to create OLE objects to obtain execution through Internet Explorer.
It has leveraged malicious Word documents that abused DDE.
Valak can execute tasks via OLE.
Technique:  Serverless Execution
Pacu can create malicious Lambda functions.
Technique:  Shared Modules
Astaroth uses the LoadLibraryExW() function to load additional modules.
Attor's dispatcher can execute additional plugins by loading the respective DLLs.
BLINDINGCAN has loaded and executed DLLs in memory during runtime on a victim machine.
BOOSTWRITE has used the DWriteCreateFactory() function to load additional modules.
Bumblebee can use LoadLibrary to attempt to execute GdiPlus.dll.
DarkWatchman can load DLLs.
Dtrack contains a function that calls LoadLibrary and GetProcAddress.
FoggyWeb's loader can call the load() function to load the FoggyWeb dll into an Application Domain on a compromised AD FS server.
gh0st RAT can load DLLs into memory.
Hydraq creates a backdoor through which remote attackers can load and call DLL functions.
KillDisk loads and executes functions from a DLL.
Metamorfo had used AutoIt to load and execute the DLL payload.
For network communications, OSX_OCEANLOTUS.D loads a dynamic library (.dylib file) using dlopen() and obtains a function pointer to execute within that shared library using dlsym().
PipeMon has used call to LoadLibrary to load its installer. PipeMon loads its modules using reflective loading or custom shellcode.
PUNCHBUGGY can load a DLL using the LoadLibrary API.
RotaJakiro uses dynamically linked shared libraries (.so files) to execute additional functionality using dlopen() and dlsym().
Stuxnet calls LoadLibrary then executes exports from a DLL.
TajMahal has the ability to inject the LoadLibrary call template DLL into running processes.
Technique:  Software Deployment Tools
It compromised McAfee ePO to move laterally by distributing malware as a software deployment task.
During C0018, the threat actors used PDQ Deploy to move AvosLocker and tools across the network.
It has used the commercially available tool RemoteExec for agentless remote code execution.
It has used RAdmin, a remote software tool used to remotely control workstations and ATMs.
It actors used a victim's endpoint management platform, Altiris, for lateral movement.
It is believed that a patch management system for an anti-virus product commonly installed among targeted companies was used to distribute the Wiper malware.
Technique:  System Services
It has created system services to execute cryptocurrency mining software.
Technique:  System Services:Launchctl
AppleJeus has loaded a plist file using the launchctl command.
Calisto uses launchctl to enable screen sharing on the victim’s machine.
LoudMiner launched the QEMU services in the /Library/LaunchDaemons/ folder using launchctl. It also uses launchctl to unload all Launch Daemons when updating to a newer version of LoudMiner.
macOS.OSAMiner has used launchctl to restart the Launch Agent.
XCSSET loads a system level launchdaemon using the launchctl load -w command from /System/Librarby/LaunchDaemons/ssh.plist.
Technique:  User Execution
It has recruited target organization employees or contractors who provide credentials and approve an associated MFA prompt, or install remote management software onto a corporate workstation, allowing It to take control of an authenticated system.
Technique:  User Execution:Malicious Image
It has relied on users to download and execute malicious Docker images.
Technique:  Account Manipulation
During the 2016 Ukraine Electric Power Attack, It used the sp_addlinkedsrvlogin command in MS-SQL to create a link between a created account and other servers in the network.
It has been known to add created accounts to local admin groups to maintain elevated access.
It has added user accounts to the User and Admin groups.
Calisto adds permissions and remote logins to all users.
It has added newly created accounts to the administrators group to maintain elevated access.
It has assigned newly created accounts the sysadmin role to maintain persistence.
It has granted privileges to domain accounts.
It has added accounts to specific groups with net localgroup.
It malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.
It has added a user named DefaultAccount to the Administrators and Remote Desktop Users groups.
The Mimikatz credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality. The LSADUMP::ChangeNTLM and LSADUMP::SetNTLM modules can also manipulate the password hash of an account without knowing the clear text value.
ServHelper has added a user named "supportaccount" to the Remote Desktop Users and Administrators groups.
SMOKEDHAM has added user accounts to local Admin groups.
Technique:  Account Manipulation:Additional Cloud Credentials
During C0027, It used aws_consoler  to create temporary federated credentials for fake users in order to obfuscate which AWS credential is compromised and enable pivoting from the AWS CLI to console sessions without MFA.
Pacu can generate SSH and API keys for AWS infrastructure and additional API keys for other IAM users.
During the SolarWinds Compromise, It added credentials to OAuth Applications and Service Principals.
Technique:  Account Manipulation:Additional Email Delegate Permissions
It has used a Powershell cmdlet to grant the ApplicationImpersonation role to a compromised account.
It has used a compromised global administrator account in Azure AD to backdoor a service principal with ApplicationImpersonation rights to start collecting emails from targeted mailboxes; It has also used compromised accounts holding ApplicationImpersonation rights in Exchange to collect emails.
It granted compromised email accounts read access to the email boxes of additional targeted accounts. The group then was able to authenticate to the intended victim's OWA (Outlook Web Access) portal and read hundreds of email communications for information on Middle East organizations.
During the SolarWinds Compromise, It added their own devices as allowed IDs for active sync using Set-CASMailbox, allowing it to obtain copies of victim mailboxes. It also added additional permissions (such as Mail.Read and Mail.ReadWrite) to compromised Application or Service Principals.
Technique:  Account Manipulation:Additional Cloud Roles
During C0027, It used IAM manipulation to gain persistence and to assume or elevate privileges.
It has added the global admin role to accounts they have created in the targeted organization's cloud instances.
During the SolarWinds Compromise, It granted company administrator privileges to a newly created service principle.
Technique:  Account Manipulation:SSH Authorized Keys
Bundlore creates a new key pair with ssh-keygen and drops the newly created user key in authorized_keys to enable remote login.
It has dropped an SSH-authorized key in the /root/.ssh folder in order to access a compromised server with SSH.
Skidmap has the ability to add the public key of its handlers to the authorized_keys file to maintain persistence on an infected host.
It has added RSA keys in authorized_keys.
XCSSET will create an ssh key if necessary with the ssh-keygen -t rsa -f $HOME/.ssh/id_rsa -P command. XCSSET will upload a private key file to the server to remotely access the host without a password.
Technique:  Account Manipulation:Device Registration
AADInternals can register a device to Azure AD.
It has enrolled a device in MFA to an Azure AD environment following a successful password guessing attack against a dormant account.
During C0027, It registered devices for MFA to maintain persistence through victims' VPN.
During the SolarWinds Compromise, It registered devices in order to enable mailbox syncing via the Set-CASMailbox command.
Technique:  BITS Jobs
It has used the BITS protocol to exfiltrate stolen data from a compromised host.
It used BITSAdmin to download and install payloads.
Bazar has been downloaded via Windows BITS functionality.
BITSAdmin can be used to create BITS Jobs to launch a malicious process.
Cobalt Strike can download a hosted "beacon" payload using BITSAdmin.
Egregor has used BITSadmin to download and execute malicious DLLs.
A JPIN variant downloads the backdoor payload via the BITS service.
It has used BITSAdmin to download additional tools.
MarkiRAT can use BITS Utility to connect with the C2 server.
It has used BITS jobs to download malicious payloads.
ProLock can use BITS jobs to download its malicious payload.
UBoatRAT takes advantage of the /SetNotifyCmdLine option in BITSAdmin to ensure it stays running on a system to maintain persistence.
It has used batch scripts that utilizes WMIC to execute a BITSAdmin transfer of a ransomware payload to each compromised machine.
Technique:  Boot or Logon Autostart Execution
BoxCaon established persistence by setting the HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load registry key to point to its executable.
Dtrack’s RAT makes a persistent target file with auto execution on the host start.
Mis-Type has created registry keys for persistence, including HKCU\Software\bkfouerioyou, HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{6afa8072-b2b1-31a8-b5c1-{Unique Identifier}, and HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{3BF41072-B2B1-31A8-B5C1-{Unique Identifier}.
Misdat has created registry keys for persistence, including HKCU\Software\dnimtsoleht\StubPath, HKCU\Software\snimtsOleht\StubPath, HKCU\Software\Backtsaleht\StubPath, HKLM\SOFTWARE\Microsoft\Active Setup\Installed. Components\{3bf41072-b2b1-21c8-b5c1-bd56d32fbda7}, and HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{3ef41072-a2f1-21c8-c5c1-70c2c3bc7905}.
xCaon has added persistence via the Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load which causes the malware to run each time any user logs in.
Technique:  Boot or Logon Autostart Execution:Authentication Package
Flame can use Windows Authentication Packages for persistence.
Technique:  Boot or Logon Autostart Execution:Winlogon Helper DLL
Bazar can use Winlogon Helper DLL to establish persistence.
Cannon adds the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon to establish persistence.
DarkTortilla has established persistence via the Software\Microsoft\Windows NT\CurrentVersion\Winlogon registry key.
A Dipsind variant registers as a Winlogon Event Notify DLL to establish persistence.
Gazer can establish persistence by setting the value "Shell" with "explorer.exe, %malware_pathfile%" under the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.
KeyBoy issues the command reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" to achieve persistence.
Remexi achieves persistence using Userinit by adding the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit.
Revenge RAT creates a Registry key at HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell to survive a system reboot.
It has created the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell and sets the value to establish persistence.
It established persistence by adding a Shell value under the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.
It has established persistence using Userinit by adding the Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.
Technique:  Boot or Logon Autostart Execution:Security Support Provider
Empire can enumerate Security Support Providers (SSPs) as well as utilize PowerSploit's Install-SSP and Invoke-Mimikatz to install malicious SSPs and log authentication events.
The Mimikatz credential dumper contains an implementation of an SSP.
PowerSploit's Install-SSP Persistence module can be used to establish by installing a SSP DLL.
Technique:  Boot or Logon Autostart Execution:Kernel Modules and Extensions
Drovorub can use kernel modules to establish persistence.
During Operation CuckooBees, attackers used a signed kernel rootkit to establish additional persistence.
Skidmap has the ability to install several loadable kernel modules (LKMs) on infected machines.
Technique:  Boot or Logon Autostart Execution:LSASS Driver
Pasam establishes by infecting the Security Accounts Manager (SAM) DLL to load a malicious DLL dropped to disk.
Wingbird drops a malicious file (sspisrv.dll) alongside a copy of lsass.exe, which is used to register a service that loads sspisrv.dll as a driver. The payload of the malicious driver (located in its entry-point function) is executed when loaded by lsass.exe before the spoofed service becomes unstable and crashes.
Technique:  Boot or Logon Autostart Execution:Shortcut Modification
It has modified LNK shortcuts.
Astaroth's initial payload is a malicious .LNK file.
BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.
Bazar can establish persistence by writing shortcuts to the Windows Startup folder.
The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.
Comnie establishes persistence via a .lnk file in the victim’s startup path.
Empire can persist by modifying a .LNK file to include a backdoor.
FELIXROOT creates a .LNK file for persistence.
Gazer can establish persistence by creating a .lnk file in the Start menu or by modifying existing .lnk files to execute the malware through cmd.exe.
It malware can create a .lnk file and add a Registry Run key to establish persistence.
Grandoreiro can write or modify browser shortcuts to enable launching of malicious browser extensions.
Helminth establishes persistence by creating a shortcut.
InvisiMole can use a .lnk shortcut for the Control Panel to establish persistence.
Kazuar adds a .lnk file to the Windows startup folder.
A version of KONNI drops a Windows shortcut on the victim’s machine to establish persistence.
It malware has maintained persistence on a system by creating a LNK shortcut in the user’s Startup folder.
It has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.
MarkiRAT can modify the shortcut that launches Telegram by replacing its path with the malicious payload to launch with the legitimate executable.
Micropsia creates a shortcut to maintain persistence.
Okrum can establish persistence by creating a .lnk shortcut to itself in the Startup folder.
Reaver creates a shortcut file and saves it in a Startup folder to establish persistence.
RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence.
RogueRobin establishes persistence by creating a shortcut (.LNK file) in the Windows startup folder to run a script each time the user logs in.
S-Type may create the file %HOMEPATH%\Start Menu\Programs\Startup\Realtek {Unique Identifier}.lnk, which points to the malicious msdtc.exe file already created in the %CommonFiles% directory.
SeaDuke is capable of persisting via a .lnk file stored in the Startup directory.
SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.
SPACESHIP achieves persistence by creating a shortcut in the current user's Startup folder.
To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an "Office Start," "Yahoo Talk," "MSN Gaming Z0ne," or "MSN Talk" shortcut.
TinyZBot can create a shortcut in the Windows startup folder for persistence.
Technique:  Boot or Logon Autostart Execution:Print Processors
It has added the Registry key HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Print Processors\UDPrint" /v Driver /d "spool.dll /f to load malware as a Print Processor.
Gelsemium can drop itself in C:\Windows\System32\spool\prtprocs\x64\winprint.dll to be loaded automatically by the spoolsv Windows service.
The PipeMon installer has modified the Registry key HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors to install PipeMon as a Print Processor.
Technique:  Boot or Logon Autostart Execution:XDG Autostart Entries
CrossRAT can use an XDG Autostart to establish persistence.
If executing without root privileges, Fysbis adds a .desktop configuration file to the user's ~/.config/autostart directory.
NETWIRE can use XDG Autostart Entries to establish persistence on Linux systems.
Pupy can use an XDG Autostart to establish persistence.
When executing with user-level permissions, RotaJakiro can install persistence using a .desktop file under the $HOME/.config/autostart/ folder.
Technique:  Boot or Logon Autostart Execution:Active Setup
PoisonIvy creates a Registry key in the Active Setup pointing to a malicious executable.
Technique:  Boot or Logon Autostart Execution:Login Items
Dok uses AppleScript to install a login Item by sending Apple events to the System Events process.
Green Lambert can add Login Items to establish persistence.
NETWIRE can persist via startup options for Login items.
Technique:  Boot or Logon Initialization Scripts
It has hijacked legitimate application-specific startup scripts to enable malware to execute on system startup.
It has installed an "init.d" startup script to maintain persistence.
Depending on the Linux distribution and when executing with root permissions, RotaJakiro may install persistence using a .conf file in the /etc/init/ folder.
Technique:  Boot or Logon Initialization Scripts:Logon Script (Windows)
An It loader Trojan adds the Registry key HKCU\Environment\UserInitMprLogonScript to establish persistence.
Attor's dispatcher can establish persistence via adding a Registry key with a logon script HKEY_CURRENT_USER\Environment "UserInitMprLogonScript" .
It has added persistence by registering the file name for the next stage malware under HKCU\Environment\UserInitMprLogonScript.
JHUHUGIT has registered a Windows shell script under the Registry key HKCU\Environment\UserInitMprLogonScript to establish persistence.
KGH_SPY has the ability to set the HKCU\Environment\UserInitMprLogonScript Registry key to execute logon scripts.
Zebrocy performs persistence with a logon script via adding to the Registry key HKCU\Environment\UserInitMprLogonScript.
Technique:  Boot or Logon Initialization Scripts:RC Scripts
It has installed a run command on a compromised system to enable malware execution on system startup.
Cyclops Blink has the ability to execute on device startup, using a modified RC script named S51armled.
Green Lambert can add init.d and rc.d files in the /etc folder to establish persistence.
HiddenWasp installs reboot persistence by adding itself to /etc/rc.local.
iKitten adds an entry to the rc.common file for persistence.
Technique:  Boot or Logon Initialization Scripts:Startup Items
jRAT can list and manage startup entries.
Technique:  Browser Extensions
Bundlore can install malicious browser extensions that are used to hijack user searches.
Grandoreiro can use malicious browser extensions to steal cookies and other user information.
It has used Google Chrome browser extensions to infect victims and to steal passwords and cookies.
OSX/Shlayer can install malicious Safari browser extensions to serve ads.
Technique:  Compromise Client Software Binary
During the 2016 Ukraine Electric Power Attack, It used a trojanized version of Windows Notepad to add a layer of persistence for Industroyer.
Bonadan has maliciously altered the OpenSSH binary on targeted systems to create a backdoor.
Ebury has been embedded into modified OpenSSH binaries to gain persistent access to SSH credential information.
Industroyer has used a Trojanized version of the Windows Notepad application for an additional backdoor persistence mechanism.
Kessel has maliciously altered the OpenSSH binary on targeted systems to create a backdoor.
Kobalos replaced the SSH client with a trojanized SSH client to steal credentials on compromised systems.
ThiefQuest searches through the /Users/ folder looking for executable files. For each executable, ThiefQuest prepends a copy of itself to the beginning of the file. When the file is executed, the ThiefQuest code is executed first. ThiefQuest creates a hidden file, copies the original target executable to the file, then executes the new hidden file to maintain the appearance of normal behavior.
XCSSET uses a malicious browser application to replace the legitimate browser in order to continuously capture credentials, monitor web traffic, and download additional modules.
Technique:  Create Account
During the 2016 Ukraine Electric Power Attack, It added a login to a SQL Server with sp_addlinkedsrvlogin.
It used wmic.exe to add a new user to the system.
Technique:  Create Account:Local Account
It has been known to create or enable accounts, such as support_388945a0.
It has created accounts on multiple compromised hosts to perform actions within the network.
It has created user accounts.
Calisto has the capability to add its own account to the victim's machine.
It can create a Windows account.
It has created accounts on victims, including administrator accounts, some of which appeared to be tailored to each individual staging target.
Empire has a module for creating a local user if permissions allow.
It has created MS-SQL local accounts in a compromised network.
Flame can create backdoor accounts with login "HelpAssistant" on domain connected systems if appropriate rights are available.
It has created a local user account with administrator privileges.
GoldenSpy can create new users on an infected system.
HiddenWasp creates a user account as a means to provide initial persistence to the compromised machine.
Hildegard has created a user named "monerodaemon".
It has created accounts with net user.
It used a tool called Imecab to set up a persistent remote access account on the victim machine.
It has created local accounts named help and DefaultAccount on compromised machines.
Mis-Type may create a temporary user on the system named Lost_{Unique Identifier}.
The net user username \password commands in Net can be used to create a local account.
Pupy can user PowerView to execute "net user" commands and create local system accounts.
S-Type may create a temporary user on the system named Lost_{Unique Identifier} with the password pond~!@6"{Unique Identifier}.
ServHelper has created a new user named "supportaccount".
SMOKEDHAM has created user accounts.
It has created local privileged users on victim machines.
It has created local administrator accounts to maintain persistence in compromised networks.
ZxShell has a feature to create local user accounts.
Technique:  Create Account:Domain Account
During the 2015 Ukraine Electric Power Attack, It created privileged domain accounts to be used for further exploitation and lateral movement.
During the 2016 Ukraine Electric Power Attack, It created two new accounts, "admin" and "система" (System). The accounts were then assigned to a domain matching local operation and were delegated new privileges.
Empire has a module for creating a new domain user if permissions allow.
It created high-privileged domain user accounts to maintain access to victim networks.
It has created domain accounts.
The net user username \password \domain commands in Net can be used to create a domain account.
PsExec has the ability to remotely create accounts on target systems.
Pupy can user PowerView to execute "net user" commands and create domain accounts.
It has created and used new accounts within a victim's Active Directory environment to maintain persistence.
Technique:  Create Account:Cloud Account
AADInternals can create new Azure AD users.
It can create new users through Azure AD.
It has created global admin accounts in the targeted organization's cloud instances to gain persistence.
Technique:  Create or Modify System Process
Exaramel for Linux has a hardcoded location that it uses to achieve persistence if the startup system is Upstart or System V and it is running as root.
Technique:  Create or Modify System Process:Launch Agent
Bundlore can persist via a LaunchAgent.
Calisto adds a .plist file to the /Library/LaunchAgents folder to maintain persistence.
CoinTicker creates user launch agents named .espl.plist and com.apple.[random string].plist to establish persistence.
CookieMiner has installed multiple new Launch Agents in order to maintain persistence for cryptocurrency mining software.
CrossRAT creates a Launch Agent on macOS.
Dacls can establish persistence via a LaunchAgent.
Dok installs two LaunchAgents to redirect all network traffic with a randomly generated name for each plist file maintaining the format com.random.name.plist.
FruitFly persists via a Launch Agent.
Green Lambert can create a Launch Agent with the RunAtLoad key-value pair set to true, ensuring the com.apple.GrowlHelper.plist file runs every time a user logs in.
Keydnap uses a Launch Agent to persist.
The Komplex trojan creates a persistent launch agent called with $HOME/Library/LaunchAgents/com.apple.updates.plist with launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist.
MacMa installs a com.apple.softwareupdate.plist file in the /LaunchAgents folder with the RunAtLoad value set to true. Upon user login, MacMa is executed from /var/root/.local/softwareupdate with root privileges. Some variations also include the LimitLoadToSessionType key with the value Aqua, ensuring the MacMa only runs when there is a logged in GUI user.
macOS.OSAMiner has placed a Stripped Payloads with a plist extension in the Launch Agent's folder.
MacSpy persists via a Launch Agent.
NETWIRE can use launch agents for persistence.
OSX_OCEANLOTUS.D can create a persistence file in the folder /Library/LaunchAgents.
Proton persists via Launch Agent.
ThiefQuest installs a launch item using an embedded encrypted launch agent property list template. The plist file is installed in the ~/Library/LaunchAgents/ folder and configured with the path to the persistent binary located in the ~/Library/ folder.
Technique:  Create or Modify System Process:Systemd Service
Exaramel for Linux has a hardcoded location under systemd that it uses to achieve persistence if it is running as root.
Fysbis has established persistence using a systemd service.
Hildegard has started a monero service.
Pupy can be used to establish persistence using a systemd service.
It has installed a systemd service script to maintain persistence.
Depending on the Linux distribution and when executing with root permissions, RotaJakiro may install persistence using a .service file under the /lib/systemd/system/ folder.
SysUpdate can copy a script to the user owned /usr/lib/systemd/system/ directory with a symlink mapped to a root owned directory, /etc/ystem/system, in the unit configuration file's ExecStart directive to establish persistence and elevate privileges.
It has established persistence through the creation of a cryptocurrency mining system service using systemctl.
Technique:  Create or Modify System Process:Launch Daemon
AppleJeus has placed a plist file within the LaunchDaemons folder and launched it manually.
Bundlore can persist via a LaunchDaemon.
Dacls can establish persistence via a Launch Daemon.
Green Lambert can add a plist file in the Library/LaunchDaemons to establish persistence.
LoudMiner adds plist files with the naming format com.[random_name].plist in the /Library/LaunchDaemons folder with the RunAtLoad and KeepAlive keys set to true.
If running with root permissions, OSX_OCEANLOTUS.D can create a persistence file in the folder /Library/LaunchDaemons.
When running with root privileges after a Launch Agent is installed, ThiefQuest installs a plist file to the /Library/LaunchDaemons/ folder with the RunAtLoad key set to true establishing persistence as a Launch Daemon.
XCSSET uses the ssh launchdaemon to elevate privileges, bypass system controls, and enable remote access to the victim.
Technique:  Event Triggered Execution
Pacu can set up S3 bucket notifications to trigger a malicious Lambda function when a CloudFormation template is uploaded to the bucket. It can also create Lambda functions that trigger upon the creation of users, roles, and groups.
Technique:  Event Triggered Execution:Change Default File Association
It has a HWP document stealer module which changes the default program association in the registry to open HWP documents.
SILENTTRINITY can conduct an image hijack of an .msc file extension as part of its UAC bypass process.
Technique:  Event Triggered Execution:Screensaver
Gazer can establish persistence through the system screensaver by configuring it to execute the malware.
Technique:  Event Triggered Execution:Windows Management Instrumentation Event Subscription
adbupd can use a WMI script to achieve persistence.
It has used WMI event subscriptions for persistence.
It has attempted to use WMI event subscriptions to establish persistence on compromised hosts.
BADHATCH can use WMI event subscriptions for persistence.
It has used mofcomp.exe to establish WMI Event Subscription persistence mechanisms configured from a *.mof file.
It has used WMI event subscriptions for persistence.
It has used WMI for persistence.
It has established persistence through the use of a WMI event subscription combined with unusual living-off-the-land binaries such as cdb.exe.
metaMain registered a WMI event subscription consumer called "hard_disk_stat" to establish persistence.
It's custom ORat tool uses a WMI event consumer to maintain persistence.
During Operation Ghost, It used WMI event subscriptions to establish persistence for malware.
PoshC2 has the ability to persist on a system using WMI events.
POSHSPY uses a WMI event subscription to establish persistence.
POWERTON can use WMI for persistence.
RegDuke can persist using a WMI consumer that is launched every time a process named WINWORD.EXE is started.
Sardonic can use a WMI event filter to invoke a command-line event consumer to gain persistence.
SeaDuke uses an event filter in WMI code to execute a previously dropped executable shortly after system startup.
SILENTTRINITY can create a WMI Event to execute a payload for persistence.
During the SolarWinds Compromise, It used a WMI event filter to invoke a command-line event consumer at system boot time to launch a backdoor with rundll32.exe.
TrailBlazer has the ability to use WMI for persistence.
It has used WMI event filters and consumers to establish persistence.
Technique:  Event Triggered Execution:Unix Shell Configuration Modification
Green Lambert can establish persistence on a compromised host through modifying the profile, login, and run command (rc) files associated with the bash, csh, and tcsh shells.
Linux Rabbit maintains persistence on an infected machine through rc.local and .bashrc files.
When executing with non-root level permissions, RotaJakiro can install persistence by adding a command to the .bashrc file that executes a binary in the  ${HOME}/.gvfsd/.profile/ folder.
Technique:  Event Triggered Execution:Netsh Helper DLL
netsh can be used as a persistence proxy technique to execute a helper DLL when netsh.exe is executed.
Technique:  Event Triggered Execution:Accessibility Features
It used sticky-keys to obtain unauthenticated, privileged console access.
It replaces the Sticky Keys binary C:\Windows\System32\sethc.exe for persistence.
It leveraged sticky keys to establish persistence.
It actors have been known to use the Sticky Keys replacement within RDP sessions to obtain persistence.
It has used the sticky-keys technique to bypass the RDP login screen on remote systems during intrusions.
Empire can leverage WMI debugging to remotely replace binaries like sethc.exe, Utilman.exe, and Magnify.exe with cmd.exe.
It has used sticky keys to launch a command prompt.
Technique:  Event Triggered Execution:AppCert DLLs
PUNCHBUGGY can establish using a AppCertDLLs Registry key.
Technique:  Event Triggered Execution:AppInit DLLs
It has used malware to set LoadAppInit_DLLs in the Registry key SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows in order to establish persistence.
Some variants of Cherry Picker use AppInit_DLLs to achieve persistence by creating the following Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows "AppInit_DLLs"="pserver32.dll"
Ramsay can insert itself into the address space of other applications using the AppInit DLL Registry key.
If a victim meets certain criteria, T9000 uses the AppInit_DLL functionality to achieve persistence by ensuring that every user mode process that is spawned will load its malicious DLL, ResN32.dll. It does this by creating the following Registry keys: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs – %APPDATA%\Intel\ResN32.dll and HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs – 0x1.
Technique:  Event Triggered Execution:Application Shimming
It has used application shim databases for persistence.
Pillowmint has used a malicious shim database to maintain persistence.
SDBbot has the ability to use application shimming for persistence if it detects it is running as admin on Windows XP or 7, by creating a shim database to patch services.exe.
ShimRat has installed shim databases in the AppPatch folder.
Technique:  Event Triggered Execution:Image File Execution Options Injection
SDBbot has the ability to use image file execution options for persistence if it detects it is running with admin privileges on a Windows version newer than Windows 7.
SUNBURST created an Image File Execution Options (IFEO) Debugger registry value for the process dllhost.exe to trigger the installation of Cobalt Strike.
It has modified and added entries within HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options to maintain persistence.
Technique:  Event Triggered Execution:PowerShell Profile
It has used PowerShell profiles to maintain persistence on an infected machine.