KJChen/tech2proc huggingface dataset:
Technique:  Exploitation of Remote Services
It exploited a Windows SMB Remote Code Execution Vulnerability to conduct lateral movement.
Bad Rabbit used the EternalRomance SMB exploit to spread through victim networks.
Conficker exploited the MS08-067 Windows vulnerability for remote code execution through a crafted RPC request.
It has exploited a Windows Netlogon vulnerability (CVE-2020-1472) to obtain access to Windows Active Directory servers.
It has used Mimikatz to exploit a domain controller via the ZeroLogon exploit (CVE-2020-1472).
Emotet has been seen exploiting SMB via a vulnerability exploit like EternalBlue (MS17-010) to achieve lateral movement and propagation.
Empire has a limited number of built-in modules for exploiting remote SMB, JBoss, and Jenkins servers.
It has exploited ZeroLogon (CVE-2020-1472) against vulnerable domain controllers.
Flame can use MS10-061 to exploit a print spooler vulnerability in a remote system with a shared printer in order to move laterally.
It has exploited known vulnerabilities in remote services including RDP.
InvisiMole can spread within a network via the BlueKeep (CVE-2019-0708) and EternalBlue (CVE-2017-0144) vulnerabilities in RDP and SMB respectively.
Lucifer can exploit multiple vulnerabilities including EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0144).
It has used tools to exploit the ZeroLogon vulnerability (CVE-2020-1472).
It has exploited the Microsoft Netlogon vulnerability (CVE-2020-1472).
NotPetya can use two exploits in SMBv1, EternalBlue and EternalRomance, to spread itself to other remote systems on the network.
PoshC2 contains a module for exploiting SMB via EternalBlue.
QakBot can move laterally using worm-like functionality through exploitation of SMB.
Stuxnet propagates using the MS10-061 Print Spooler and MS08-067 Windows Server Service vulnerabilities.
It has exploited MS17-010 to move laterally to other systems on the network.
It has used EternalBlue exploits for lateral movement.
TrickBot utilizes EternalBlue and EternalRomance exploits for lateral movement in the modules wormwinDll, wormDll, mwormDll, nwormDll, tabDll.
WannaCry uses an exploit in SMBv1 to spread itself to other remote systems on a network.
It has exploited or attempted to exploit Zerologon (CVE-2020-1472) and EternalBlue (MS17-010) vulnerabilities.
Technique:  Internal Spearphishing
It has used an Outlook VBA module on infected systems to send phishing emails with malicious attachments to other employees within the organization.
It has conducted internal spearphishing attacks against executives, HR, and IT personnel to gain information and access.
It has sent internal spearphishing emails for lateral movement after stealing victim information.
It has conducted internal spearphishing within the victim's environment for lateral movement.
During Operation Dream Job, It conducted internal spearphishing from within a compromised organization.
Technique:  Lateral Tool Transfer
During the 2015 Ukraine Electric Power Attack, It moved their tools laterally within the corporate network and between the ICS and corporate network.
During the 2016 Ukraine Electric Power Attack, It used move to transfer files to a network share.
It has spread malware in target networks by copying modules to folders masquerading as removable devices.
It has deployed tools after moving laterally using administrative accounts.
BITSAdmin can be used to create BITS Jobs to upload and/or download files from SMB file servers.
BlackCat can replicate itself across connected servers via psexec.
During C0015, the threat actors used WMI to load Cobalt Strike onto additional hosts within a compromised network.
During C0018, the threat actors transferred the SoftPerfect Network Scanner and other tools to machines in the network using AnyDesk and PDQ Deploy.
It has copied tools between compromised hosts using SMB.
cmd can be used to copy files to/from a remotely connected internal system.
DustySky searches for network drives and removable media and duplicates itself onto them.
Emotet has copied itself to remote systems using the service.exe filename.
esentutl can be used to copy files to/from a remote share.
Expand can be used to download or upload a file over a network share.
It has deployed Meterpreter stagers and SplinterRAT instances in the victim network after moving laterally.
ftp may be abused by adversaries to transfer tools or files between systems within a compromised environment.
It has used PsExec to move laterally between hosts in the target network.
HermeticWizard can copy files to other machines on a compromised network.
LockerGoga has been observed moving around the victim network via SMB, indicating the actors behind this ransomware are manually copying files form computer to computer instead of self-propagating.
Lucifer can use certutil for propagation on Windows hosts within intranets.
It has copied tools within a compromised network using RDP.
Operators deploying Netwalker have used psexec to copy the Netwalker payload across accessible systems.
Olympic Destroyer attempts to copy itself to remote machines on the network.
During Operation Wocao, threat actors used SMB to copy files to and from target systems.
PsExec can be used to download or upload a file over a network share.
It has used move to transfer files to a network share and has copied payloads--such as Prestige ransomware--to an Active Directory Domain Controller and distributed via the Default Domain Group Policy Object.
Shamoon attempts to copy itself to remote machines on the network.
Stuxnet uses an RPC server that contains a file dropping routine and support for payload version updates for P2P communications within a victim network.
It RPC backdoors can be used to transfer files to/from victim machines on the local network.
It has copied web shells between servers in targeted environments.
WannaCry attempts to copy itself to remote computers after gaining access via an SMB exploit.
It has used stolen credentials to copy tools into the %TEMP% directory of domain controllers.
Technique:  Remote Service Session Hijacking:RDP Hijacking
It has targeted victims with remote administration tools including RDP.
WannaCry enumerates current remote desktop sessions and tries to execute the malware on each session.
Technique:  Remote Services
Brute Ratel C4 has the ability to use RPC for lateral movement.
Kivars has the ability to remotely trigger keyboard input and mouse clicks.
MacMa can manage remote screen sessions.
Stuxnet can propagate via peer-to-peer communication and updates using RPC.
It has used the WebDAV protocol to execute Ryuk payloads hosted on network file shares.
Technique:  Remote Services:Distributed Component Object Model
Cobalt Strike can deliver Beacon payloads for lateral movement by leveraging remote COM execution.
Empire can utilize Invoke-DCOM to leverage remote COM execution for lateral movement.
SILENTTRINITY can use System namespace methods to execute lateral movement using DCOM.
Technique:  Remote Services:SSH
It used secure shell (SSH) to move laterally among their targets.
It has used Putty for remote access.
Cobalt Strike can SSH to a remote service.
Empire contains modules for executing commands over SSH as well as in-memory VNC agent injection.
It has remotely accessed compromised environments via secure shell (SSH) for lateral movement.
It has used SSH to move laterally through victim environments.
It has used the PuTTY and Plink tools for lateral movement.
It uses Putty for lateral movement.
Kinsing has used SSH for lateral movement.
It used SSH and the PuTTy PSCP utility to gain access to a restricted segment of a compromised network.
It used ssh for internal reconnaissance.
It has used Putty Secure Copy Client (PSCP) to transfer data.
It has used Putty to access compromised systems.
It has spread its coinminer via SSH.
It has used SSH to connect back to victim machines. It has also used SSH to transfer tools and payloads onto victim hosts and execute them.
It has relied on encrypted SSH-based tunnels to transfer tools and for remote command/program execution.
Technique:  Remote Services:VNC
Carberp can start a remote VNC session by downloading a new plugin.
DanBot can use VNC for remote access to targeted systems.
It has used TightVNC to control compromised hosts.
It has installed TightVNC server and client on compromised servers and endpoints for lateral movement.
It has used VNC tools, including UltraVNC, to remotely interact with compromised hosts.
It uses VNC for lateral movement.
Proton uses VNC to connect into systems.
TrickBot has used a VNC module to monitor the victim and collect information to pivot to valuable systems on the network
WarzoneRAT has the ability of performing remote desktop access via a VNC console.
ZxShell supports functionality for VNC sessions.
Technique:  Remote Services:Windows Remote Management
Brute Ratel C4 can use WinRM for pivoting.
It has used WinRM for lateral movement.
Cobalt Strike can use WinRM to execute a payload on a remote host.
It has leveraged WMI to move laterally within a compromised network via application servers and SQL servers.
SILENTTRINITY tracks TrustedHosts and can move laterally to these targets via WinRM.
During the SolarWinds Compromise, It used WinRM via PowerShell to execute commands and payloads on remote hosts.
It has used WinRM to enable remote execution.
It has used Window Remote Management to move laterally through a victim network.
Technique:  Remote Services:Cloud Services
It has leveraged compromised high-privileged on-premises accounts synced to Office 365 to move laterally into a cloud environment, including through the use of Azure AD PowerShell.
During C0027, It used compromised Azure credentials for credential theft activity and lateral movement to on-premises systems.
Technique:  Taint Shared Content
It has placed malware on file shares and given it the same name as legitimate documents on the share.
Conti can spread itself by infecting other remote machines via network shared drives.
It used a virus that propagates by infecting executables stored on shared drives.
It has injected malicious macros into all Word and Excel documents on mapped network drives.
H1N1 has functionality to copy itself to network shares.
InvisiMole can replace legitimate software or documents in the compromised network with their trojanized versions, in an attempt to propagate itself within the network.
Miner-C copies itself into the public folder of Network Attached Storage (NAS) devices and infects new victims who open the file.
Ramsay can spread itself by infecting other portable executable files on networks shared drives.
Stuxnet infects remote servers via network shares and by infecting WinCC database views with malicious code.
Ursnif has copied itself to and infected files in network drives for propagation.
Technique:  Archive Collected Data:Archive via Library
BADFLICK has compressed data using the aPLib compression library.
BBSRAT can compress data with ZLIB prior to sending it back to the C2 server.
Cardinal RAT applies compression to C2 traffic using the ZLIB library.
Denis compressed collected data using zlib.
Epic compresses the collected data with bzip2 before sending it to the C2 server.
FoggyWeb can invoke the Common.Compress method to compress data with the C# GZipStream compression class.
FunnyDream has compressed collected files with zLib.
InvisiMole can use zlib to compress and decompress data.
It malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.
OSX_OCEANLOTUS.D scrambles and encrypts data using AES256 before sending it to the C2 server.
SeaDuke compressed data with zlib prior to sending it over C2.
TajMahal has the ability to use the open source libraries XZip/Xunzip and zlib to compress files.
It has used RAR to compress, encrypt, and password-protect files prior to exfiltration.
The ZLib backdoor compresses communications using the standard Zlib compression library.
Technique:  Audio Capture
It has used an audio capturing utility known as SOUNDWAVE that captures microphone input.
Attor's has a plugin that is capable of recording audio using available input sound devices.
Bandook has modules that are capable of capturing audio.
Cadelspy has the ability to record audio from the compromised host.
Cobian RAT has a feature to perform voice recording on the victim’s machine.
Crimson can perform audio surveillance using microphones.
DarkComet can listen in to victims' conversations through the system’s microphone.
Derusbi is capable of performing audio captures.
DOGCALL can capture microphone data from the victim's machine.
EvilGrab has the capability to capture audio from a victim machine.
Flame can record audio using any existing hardware recording devices.
Imminent Monitor has a remote microphone monitoring capability.
InvisiMole can record sound using input audio devices.
Janicab captured audio and sent it out to a C2 server.
jRAT can capture microphone recordings.
It captures audio from the computer’s microphone.
MacMa has the ability to record audio.
MacSpy can record the sounds from microphones on a computer.
Micropsia can perform microphone recording.
NanoCore can capture audio feeds from the system.
NightClub can load a module to leverage the LAME encoder and mciSendStringW to control and capture audio.
PowerSploit's Get-MicrophoneAudio Exfiltration module can record system microphone audio.
Pupy can record sound with the microphone.
Remcos can capture data from the system’s microphone.
Revenge RAT has a plugin for microphone interception.
ROKRAT has an audio capture and eavesdropping module.
T9000 uses the Skype API to record audio and video calls. It writes encrypted data to %APPDATA%\Intel\Skype.
TajMahal has the ability to capture VoiceIP application audio on an infected host.
VERMIN can perform audio capture.
Technique:  Browser Session Hijacking
Agent Tesla has the ability to use form-grabbing to extract data from web data forms.
Carberp has captured credentials when a user performs login through a SSL session.
Chaes has used the Puppeteer module to hook and monitor the Chrome web browser to collect user information from infected hosts.
Cobalt Strike can perform browser pivoting and inject into a user's browser to inherit cookies, authenticated HTTP sessions, and client SSL certificates.
Dridex can perform browser attacks via web injects to steal information such as credentials, certificates, and cookies.
Grandoreiro can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.
IcedID has used web injection attacks to redirect victims to spoofed sites designed to harvest banking and other credentials.  IcedID can use a self signed TLS certificate in connection with the spoofed site and simultaneously maintains a live connection with the legitimate site to display the correct URL and certificates in the browser.
Melcoz can monitor the victim's browser for online banking sessions and display an overlay window to manipulate the session in the background.
QakBot can use advanced web injects to steal web banking credentials.
TrickBot uses web injects and browser redirection to trick the user into providing their login credentials on a fake or modified web page.
Ursnif has injected HTML codes into banking sites to steal sensitive online banking information (ex: usernames and passwords).
Technique:  Clipboard Data
Agent Tesla can steal data from the victim’s clipboard.
It used a Trojan called KEYLIME to collect data from the clipboard.
It has used tools capable of stealing contents of the clipboard.
Astaroth collects information from the clipboard by using the OpenClipboard() and GetClipboardData() libraries.
Attor has a plugin that collects data stored in the Windows clipboard by using the OpenClipboard and GetClipboardData APIs.
Cadelspy has the ability to steal data from the clipboard.
Catchamas steals data stored in the clipboard.
Clambling has the ability to capture and store clipboard data.
CosmicDuke copies and exfiltrates the clipboard contents every 30 seconds.
DarkComet can steal data from the clipboard.
DarkTortilla can download a clipboard information stealer module.
Empire can harvest clipboard data on both Windows and macOS systems.
Explosive has a function to use the OpenClipboard wrapper.
FlawedAmmyy can collect clipboard data.
Grandoreiro can capture clipboard data from a compromised host.
The executable version of Helminth has a module to log clipboard contents.
A JHUHUGIT variant accesses a screenshot saved in the clipboard and converts it to a JPG image.
jRAT can capture clipboard data.
Koadic can retrieve the current content of the user clipboard.
KONNI had a feature to steal data from the clipboard.
It hijacks the clipboard data by creating an overlapped window that listens to keyboard events.
MacSpy can steal clipboard contents.
MarkiRAT can capture clipboard content.
Melcoz can monitor content saved to the clipboard.
Metamorfo has a function to hijack data from the clipboard by monitoring the contents of the clipboard and replacing the cryptocurrency wallet with the attacker's.
During Operation Wocao, threat actors collected clipboard data in plaintext.
Remcos steals and modifies data from the clipboard.
Remexi collects text from the clipboard.
ROKRAT can extract clipboard data from a compromised host.
It collects data from the clipboard.
RunningRAT contains code to open and copy data from the clipboard.
TajMahal has the ability to steal data from the clipboard of an infected host.
TinyZBot contains functionality to collect information from the clipboard.
VERMIN collects data stored in the clipboard.
Zeus Panda can hook GetClipboardData function to watch for clipboard pastes to collect.
Technique:  Data from Cloud Storage
AADInternals can collect files from a user’s OneDrive.
During C0027, It accessed victim OneDrive environments to search for VPN and MFA enrollment information, help desk instructions, and new hire guides.
It has obtained files from the victim's cloud storage instances.
Pacu can enumerate and download files stored in AWS storage services, such as S3 buckets.
Peirates can dump the contents of AWS S3 buckets. It can also retrieve service account tokens from kOps buckets in Google Cloud Storage or S3.
Technique:  Data from Information Repositories
It has collected files from various information repositories.
It has collected schemas and user accounts from systems running SQL Server.
It has accessed victim security and IT environments and Microsoft Teams to mine valuable information.
It has searched a victim's network for organization collaboration channels like MS Teams or Slack to discover further high-privilege account credentials.
P.A.S. Webshell has the ability to list and extract data from SQL databases.
During the SolarWinds Compromise, It accessed victims' internal knowledge repositories (wikis) to view sensitive corporate information on products, services, and internal business operations.
It has used a custom .NET tool to collect documents from an organization's internal central database.
Technique:  Data from Information Repositories:Confluence
It has searched a victim's network for collaboration platforms like Confluence and JIRA to discover further high-privilege account credentials.
Technique:  Data from Information Repositories:Sharepoint
It has collected information from Microsoft SharePoint services within target networks.
During C0027, It accessed victim SharePoint environments to search for VPN and MFA enrollment information, help desk instructions, and new hire guides.
It has collected documents from the victim's SharePoint.
It used a SharePoint enumeration and data dumping tool known as spwebmember.
It has searched a victim's network for collaboration platforms like SharePoint to discover further high-privilege account credentials.
spwebmember is used to enumerate and dump information from Microsoft SharePoint.
Technique:  Data from Information Repositories:Code Repositories
It has searched a victim's network for code repositories like GitLab and GitHub to discover further high-privilege account credentials.
During the SolarWinds Compromise, It downloaded source code from code repositories.
Technique:  Data from Network Shared Drive
It has collected files from network shared drives.
When it first starts, BADNEWS crawls the victim's mapped drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.
It has exfiltrated files stolen from file shares.
During C0015, the threat actors collected files from network shared drives prior to network encryption.
It has collected data of interest from network shares.
CosmicDuke steals user files from network shared drives with file extensions and keywords that match a predefined list.
Egregor can collect any files found in the enumerated drivers before sending it to its C2 channel.
It has searched network shares to access sensitive documents.
It malware has collected Microsoft Office documents from mapped network drives.
It has collected data from remote systems by mounting network shares with net use and using Robocopy to transfer data.
Ramsay can collect data from network drives and stage it for exfiltration.
It extracted Word documents from a file server on a victim network.
Technique:  Data from Removable Media
AppleSeed can find and collect data from removable media devices.
An It backdoor may collect the entire contents of an inserted USB device.
Aria-body has the ability to collect data from USB devices.
BADNEWS copies files with certain extensions from USB devices toa predefined directory.
CosmicDuke steals user files from removable media with file extensions and keywords that match a predefined list.
Crimson contains a module to collect data from removable drives.
Crutch can monitor removable drives and exfiltrate files matching a given extension list.
Explosive can scan all .exe files located in the USB drive.
FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on removable media and copies them to a staging area. The default file types copied would include data copied to the drive by SPACESHIP.
The FunnyDream FilePakMonitor component has the ability to collect files from removable devices.
A It file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.
GravityRAT steals files based on an extension list if a USB drive is connected to the system.
InvisiMole can collect jpeg files from connected MTP devices.
It can find, encrypt, and upload files from fixed and removable drives.
ObliqueRAT has the ability to extract data from removable devices connected to the endpoint.
Prikormka contains a module that collects documents with certain extensions from removable media or fixed drives connected via USB.
Ramsay can collect data from removable media and stage it for exfiltration.
Remsec has a package that collects documents from any inserted USB sticks.
Rover searches for files on attached removable drives based on a predefined list of file extensions every five seconds.
TajMahal has the ability to steal written CD images and files of interest from previously connected removable drives when they become available again.
It RPC backdoors can collect files from USB thumb drives.
Once a removable media device is inserted back into the first victim, USBStealer collects data from it that was exfiltrated from a second victim.
Technique:  Data Staged
Kevin can create directories to store logs and other collected data.
Kobalos can write captured SSH connection credentials to a file under the /var/run directory with a .pid extension for exfiltration.
QUIETCANARY has the ability to stage data prior to exfiltration.
Shark has stored information in folders named U1 and U2 prior to exfiltration.
It has staged collected data in password-protected archives.
It has collected and staged credentials and network enumeration information, using  the networkdll and psfin TrickBot modules.
Technique:  Data Staged:Remote Data Staging
It has staged archives of collected data on a target's Outlook Web Access (OWA) server.
ccf32 has copied files to a remote machine infected with Chinoxy or another backdoor.
It has staged stolen data on designated servers in the target environment.
It actors have compressed data from remote systems and moved it to another staging system before exfiltration.
It aggregates staged data from a network into a single location.
It has staged data remotely prior to exfiltration.
It has staged data on remote MSP systems or other victim networks prior to exfiltration.
It has used plugins to save captured screenshots to .\AActdata\ on an SMB share.
During Night Dragon, threat actors copied files to company web servers and subsequently downloaded them.
During the SolarWinds Compromise, It staged data and files in password-protected archives on a victim's OWA server.
It has moved staged encrypted archives to Internet-facing servers that had previously been compromised with China Chopper prior to exfiltration.
Technique:  Email Collection
Emotet has been observed leveraging a module that can scrape email addresses from Outlook.
It has compromised email credentials in order to steal sensitive data.
It has exfiltrated entire mailboxes from compromised accounts.
Technique:  Email Collection:Local Email Collection
It uses two utilities, GETMAIL and MAPIGET, to steal email. GETMAIL extracts emails from archived Outlook .pst files.
It searches recursively for Outlook personal storage tables (PST) files within user directories and sends them back to the C2 server.
It has harvested data from victim's e-mail including through execution of wmic /node: process call create "cmd /c copy c:\Users\\\backup.pst c:\windows\temp\backup.pst" copy "i:\\\My Documents\.pst"copy.
CosmicDuke searches for Microsoft Outlook data files with extensions .pst and .ost for collection and exfiltration.
Crimson contains a command to collect and exfiltrate emails from Outlook.
Emotet has been observed leveraging a module that scrapes email data from Outlook.
Empire has the ability to collect emails on a target system.
KGH_SPY can harvest data from mail clients.
It has collected .PST archives.
During Night Dragon, threat actors used RAT malware to exfiltrate email archives.
Out1 can parse e-mails on a target machine.
Pupy can interact with a victim’s Outlook session and look through folders and emails.
QakBot can target and steal locally stored emails to support thread hijacking phishing campaigns.
Smoke Loader searches through Outlook files and directories (e.g., inbox, sent, templates, drafts, archives, etc.).
Technique:  Email Collection:Remote Email Collection
It uses two utilities, GETMAIL and MAPIGET, to steal email. MAPIGET steals email still on Exchange servers that has not yet been archived.
It has collected emails from victim Microsoft Exchange servers.
It has collected emails from targeted mailboxes within a compromised Azure AD tenant and compromised Exchange servers, including via Exchange Web Services (EWS) API requests.
It has harvested data from remote mailboxes including through execution of \\c$\Users\\AppData\Local\Microsoft\Outlook*.ost.
It has accessed email accounts using Outlook Web Access.
It has accessed and hijacked online email communications using stolen credentials.
It has used web shells to export mailbox data.
It has used compromised credentials and a .NET tool to dump data from Microsoft Exchange mailboxes.
It has used tools such as the MailFetch mail crawler to collect victim emails (excluding spam) from online services via IMAP.
It used a tool called MailSniper to search through the Exchange server mailboxes for keywords.
LightNeuron collects Exchange emails matching rules specified in its configuration.
It has exported emails from compromised Exchange servers including through use of the cmdlet New-MailboxExportRequest.
MailSniper can be used for searching through email in Exchange and Office 365 environments.
Some SeaDuke samples have a module to extract email from Microsoft Exchange servers using compromised credentials.
During the SolarWinds Compromise, It collected emails from specific individuals, such as executives and IT staff, using New-MailboxExportRequest followed by Get-MailboxExportRequest.
Valak can collect sensitive mailing information from Exchange servers, including credentials and the domain certificate of an enterprise.
Technique:  Email Collection:Email Forwarding Rule
It has set auto-forward rules on victim's e-mail accounts.
It has set an Office 365 tenant level mail transport rule to send all mail in and out of the targeted organization to the newly created account.
It has set up auto forwarding rules on compromised e-mail accounts.
Technique:  Video Capture
Agent Tesla can access the victim’s webcam and record video.
AsyncRAT can record screen content on targeted systems.
Bandook has modules that are capable of capturing video from a victim's webcam.
Clambling can record screen content in AVI format.
Cobian RAT has a feature to access the webcam on the victim’s machine.
ConnectWise can record video on remote hosts.
Crimson can capture webcam video on targeted systems.
DarkComet can access the victim’s webcam to take pictures.
Derusbi is capable of capturing video.
Empire can capture webcam data on Windows and macOS systems.
EvilGrab has the capability to capture video from a victim machine.
It created a custom video recording capability that could be used to monitor operations in the victim's environment.
Imminent Monitor has a remote webcam monitoring capability.
InvisiMole can remotely activate the victim’s webcam to capture content.
jRAT has the capability to capture video from a webcam.
Kazuar captures images from the webcam.
It takes photos from the computer’s web camera.
NanoCore can access the victim's webcam and capture data.
njRAT can access the victim's webcam.
ObliqueRAT can capture images from webcams on compromised hosts.
PcShare can capture camera video as part of its collection process.
PoetRAT has used a Python tool named Bewmac to record the webcam on compromised hosts.
Pupy can access a connected webcam and capture pictures.
QuasarRAT can perform webcam viewing.
Remcos can access a system’s webcam and take pictures.
Revenge RAT has the ability to access the webcam.
SDBbot has the ability to record video on a compromised host.
It has been observed making videos of victims to observe bank employees day to day activities.
T9000 uses the Skype API to record audio and video calls. It writes encrypted data to %APPDATA%\Intel\Skype.
TajMahal has the ability to capture webcam video.
WarzoneRAT can access the webcam on a victim's machine.
ZxShell has a command to perform video device spying.
Technique:  Application Layer Protocol
Clambling has the ability to use Telnet for communication.
Duqu uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols.
Hildegard has used an IRC channel for C2 communications.
Lucifer can use the Stratum protocol on port 10001 for communication between the cryptojacking bot and the mining server.
It malware has used IRC for C2.
Adversaries can also use NETEAGLE to establish an RDP connection with a controller over TCP/7519.
QUIETEXIT can use an inverse negotiated SSH connection as part of its C2.
It issued wget requests from infected systems to the C2.
Siloscape connects to an IRC server for C2.
It has used an IRC bot for C2 communications.
Technique:  Application Layer Protocol:File Transfer Protocols
It used exploit payloads that initiate download via ftp.
Attor has used FTP protocol for C2 communication.
BADHATCH can emulate an FTP server to connect to actor-controlled C2 servers.
CARROTBALL has the ability to use FTP in C2 communications.
Cobalt Strike can conduct peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.
Disco can use SMB to transfer files.
It has used SMB for C2.
JPIN can communicate over FTP.
Kazuar uses FTP and FTPS to communicate with the C2 server.
It has used FTP to download additional malware to the target machine.
It uses FTP for Command & Control.
Mythic supports SMB-based peer-to-peer C2 profiles.
NOKKI has used FTP for C2 communications.
During Operation Honeybee, the threat actors had the ability to use FTP for C2.
PoetRAT has used FTP for C2 communications.
The Regin malware platform supports many standard protocols, including SMB.
ShadowPad has used FTP for C2 communications.
SharpDisco has the ability to transfer data between SMB shares.
It uses FTP for C2 communications.
SYSCON has the ability to use FTP in C2 communications.
XAgentOSX contains the ftpUpload function to use the FTPManager:uploadFile method to upload files from the target system.
ZxShell has used FTP for C2 connections.
Technique:  Application Layer Protocol:Mail Protocols
Agent Tesla has used SMTP for C2 communications.
It has used IMAP, POP3, and SMTP for a communication channel in various implants, including using self-registered Google Mail accounts and later compromised email servers of its victims.
It has used email for C2 via an Office macro.
BadPatch uses SMTP for C2.
Cannon uses SMTP/S and POP3/S for C2 communications by sending and receiving emails.
Various implementations of CHOPSTICK communicate with C2 over SMTP and POP3.
ComRAT can use email attachments for command and control.
CORESHELL can communicate over SMTP and POP3 for C2.
Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.
JPIN can send email over SMTP.
It has used e-mail to send exfiltrated data to C2 servers.
LightNeuron uses SMTP for C2.
NavRAT uses the email platform, Naver, for C2 communications, leveraging SMTP.
NightClub can use emails for C2 communications.
OLDBAIT can use SMTP for C2.
RDAT can use email attachments for C2 communications.
Remsec is capable of using SMTP for C2.
It uses SMTP for C2 communications.
A SUGARDUMP variant used SMTP for C2.
It has used multiple backdoors which communicate with a C2 server via email attachments.
Uroburos can use custom communications protocols that ride over SMTP.
Zebrocy uses SMTP and POP3 for C2.
Technique:  Communication Through Removable Media
It uses a tool that captures information from air-gapped computers via an infected USB and transfers it to network-connected computer when the USB is inserted.
Part of It's operation involved using CHOPSTICK modules to copy itself to air-gapped machines, using files written to USB sticks to transfer data and command traffic.
USBStealer drops commands for a second victim onto a removable media drive inserted into the first victim, and commands are executed when the drive is inserted into the second victim.
Technique:  Data Encoding
After encrypting C2 data, BADNEWS converts it into a hexadecimal representation and then encodes it into base64.
H1N1 obfuscates C2 traffic with an altered version of base64.
Linux Rabbit sends the payload from the C2 server as an encoded URL parameter.
Mythic provides various transform functions to encode and/or randomize C2 data.
Ursnif has used encoded data in HTTP URLs for C2.
Technique:  Data Encoding:Non-Standard Encoding
Newer variants of BACKSPACE will encode C2 communications with a custom system.
Bankshot encodes commands from the control server using a range of characters and gzip.
Cyclops Blink can use a custom binary scheme to encode messages with specific commands and parameters to be executed.
InvisiMole can use a modified base32 encoding to encode data within the subdomain of C2 requests.
NightClub has used a non-standard encoding in DNS tunneling removing any = from the result of base64 encoding, and replacing / characters with -s and + characters with -p.
OceanSalt can encode data with a NOT operation before sending the data to the control server.
PowGoop can use a modified Base64 encoding mechanism to send data to and from the C2 server.
RDAT can communicate with the C2 via subdomains that utilize base64 with character substitutions.
ShadowPad has encoded data as readable Latin characters.
Small Sieve can use a custom hex byte swapping encoding scheme to obfuscate tasking traffic.
Uroburos can use a custom base62 and a de-facto base32 encoding that uses digits 0-9 and lowercase letters a-z in C2 communications.
Technique:  Data Obfuscation
FlawedAmmyy may obfuscate portions of the initial C2 handshake.
FunnyDream can send compressed and obfuscated packets to C2.
During Operation Wocao, threat actors encrypted IP addresses used for "Agent" proxy hops with RC4.
RDAT has used encoded data within subdomains as AES ciphertext to communicate from the host to the C2.
SideTwist can embed C2 responses in the source code of a fake Flickr webpage.
SLOTHFULMEDIA has hashed a string containing system information prior to exfiltration via POST requests.
TrailBlazer can masquerade its C2 traffic as legitimate Google Notifications HTTP requests.
Technique:  Data Obfuscation:Junk Data
It added "junk data" to each encoded string, preventing trivial decoding without knowledge of the junk removal algorithm. Each implant was given a "junk length" value when created, tracked by the controller software to allow seamless communication but prevent analysis of the command protocol on the wire.
BendyBear has used byte randomization to obscure its behavior.
Downdelph inserts pseudo-random characters between each original character during encoding of C2 network requests, making it difficult to write signatures on them.
GoldMax has used decoy traffic to surround its malicious network traffic to avoid detection.
GrimAgent  can pad C2 messages with random generated values.
Kevin can generate a sequence of dummy HTTP C2 requests to obscure traffic.
Mori has obfuscated the FML.dll with 200MB of junk data.
P2P ZeuS added junk data to outgoing UDP packets to peer implants.
P8RAT can send randomly-generated data as part of its C2 communication.
PLEAD samples were found to be highly obfuscated with junk code.
SUNBURST added junk bytes to its C2 over HTTP.
TrailBlazer has used random identifier strings to obscure its C2 operations and result codes.
Turian can insert pseudo-random characters into its network encryption setup.
Uroburos can add extra characters in encoded strings to help mimic DNS legitimate requests.
WellMess can use junk data in the Base64 string for additional obfuscation.
Technique:  Data Obfuscation:Steganography
It has used steganography to hide its C2 communications.
Daserf can use steganography to hide malicious code downloaded to the victim.
When the Duqu command and control is operating over HTTP or HTTPS, Duqu uploads data to its controller by appending it to a blank JPG file.
HAMMERTOSS is controlled via commands that are appended to image files.
LightNeuron is controlled via commands that are embedded into PDFs and JPGs using steganographic methods.
During Operation Ghost, It used steganography to hide the communications between the implants and their C&C servers.
RDAT can process steganographic images attached to email messages to send and receive C2 commands. RDAT can also embed additional messages within BMP images to communicate with the RDAT operator.
Sliver can encode binary data into a .PNG file for C2 communication.
SUNBURST C2 data attempted to appear as benign XML related to .NET assemblies or as a faux JSON blob.
ZeroT has retrieved stage 2 payloads as Bitmap images that use Least Significant Bit (LSB) steganography.
Zox has used the .PNG file format for C2 communications.
Technique:  Data Obfuscation:Protocol Impersonation
BADCALL uses a FakeTLS method during C2.
Bankshot generates a false TLS handshake using a public certificate to disguise C2 network communications.
During C0017, It frequently configured the URL endpoints of their stealthy passive backdoor LOWKEY.PASSIVE to masquerade as normal web application traffic on an infected server.
Cobalt Strike can mimic the HTTP protocol for C2 communication, while hiding the actual data in either an HTTP header, URI parameter, the transaction body, or appending it to the URI.
FakeM C2 traffic attempts to evade detection by resembling data generated by legitimate messenger applications, such as MSN and Yahoo! messengers. Additionally, some variants of FakeM use modified SSL code for communications back to C2 servers, making SSL decryption ineffective.
FALLCHILL uses fake Transport Layer Security (TLS) to communicate with its C2 server.
HARDRAIN uses FakeTLS to communicate with its C2 server.
It used a FakeTLS session for C2 communications.
InvisiMole can mimic HTTP protocol with custom HTTP "verbs" HIDE, ZVVP, and NOP.
KeyBoy uses custom SSL libraries to impersonate SSL in C2 traffic.
It malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, potentially evading SSL traffic inspection/decryption.
Okrum mimics HTTP protocol for C2 communication, while hiding the actual messages in the Cookie and Set-Cookie headers of the HTTP requests.
SUNBURST masqueraded its network traffic as the Orion Improvement Program (OIP) protocol.
TAINTEDSCRIBE has used FakeTLS for session authentication.
Uroburos can use custom communication methodologies that ride over common  protocols including TCP, UDP, HTTP, SMTP, and DNS in order to blend with normal network traffic.
Technique:  Dynamic Resolution
It has used Dynamic DNS providers for their malware C2 infrastructure.
AsyncRAT can be configured to use dynamic DNS.
Bisonal has used a dynamic DNS service for C2.
It has used DDNS for C2 communications.
During C0026, the threat actors re-registered a ClouDNS dynamic DNS subdomain which was previously used by ANDROMEDA.
It has incorporated dynamic DNS domains in its infrastructure.
Gelsemium can use dynamic DNS domain names in C2.
Maze has forged POST strings with a random choice from a list of possibilities including "forum", "php", "view", etc. while making connection with the C2, hindering detection efforts.
NETEAGLE can use HTTP to download resources that contain an IP address and port number pair to connect to for C2.
During Night Dragon, threat actors used dynamic DNS services for C2.
For Operation Dust Storm, the threat actors used dynamic DNS domains from a variety of free providers, including No-IP, Oray, and 3322.
For Operation Spalax, the threat actors used dynamic DNS services, including Duck DNS and DNS Exit, as part of their C2 infrastructure.
It has resolved Pony C2 server IP addresses by either converting Bitcoin blockchain transaction data to specific octets, or accessing IP addresses directly within the Namecoin blockchain.
During the SolarWinds Compromise, It used dynamic DNS resolution to construct and resolve to randomly-generated subdomains for C2.
SUNBURST dynamically resolved C2 infrastructure for randomly-generated subdomains within a parent domain.
It has used dynamic DNS services for C2 infrastructure.
Tomiris has connected to a signalization server that provides a URL and port, and then Tomiris sends a GET request to that URL to establish C2.
It has used dynamic DNS services to set up C2.
Technique:  Dynamic Resolution:Fast Flux DNS
Amadey has used fast flux DNS for its C2.
gh0st RAT operators have used dynamic DNS to mask the true location of their C2 behind rapidly changing IP addresses.
It has used dynamic DNS service providers to host malicious domains.
njRAT has used a fast flux DNS for C2 IP resolution.
It has used fast flux to mask botnets by distributing payloads across multiple IPs.
Technique:  Dynamic Resolution:Domain Generation Algorithms
It has used DGAs to change their C2 servers monthly.
Aria-body has the ability to use a DGA for C2 communications.
Astaroth has used a DGA in C2 communications.
Bazar can implement DGA using the current date as a seed variable.
BONDUPDATER uses a DGA to communicate with command and control servers.
CCBkdr can use a DGA for Fallback Channels if communications with the primary command and control server are lost.
CHOPSTICK can use a DGA for Fallback Channels, domains are generated by concatenating words from lists.
Conficker has used a DGA that seeds with the current UTC victim system date to generate domains.
DarkWatchman has used a DGA to generate a domain name for C2.
Doki has used the DynDNS service and a DGA based on the Dogecoin blockchain to generate C2 domains.
Ebury has used a DGA to generate a domain name for C2.
Grandoreiro can use a DGA for hiding C2 addresses, including use of an algorithm with a user-specific key that changes daily.
Milan can use hardcoded domains as an input for domain generation algorithms.
MiniDuke can use DGA to generate new Twitter URLs for C2.
ngrok can provide DGA for C2 servers through the use of random URL strings that change every 12 hours.
POSHSPY uses a DGA to derive command and control URLs from a word list.
QakBot can use domain generation algorithms in C2 communication.
ShadowPad uses a DGA that is based on the day of the month for C2 servers.
Shark can send DNS C2 communications using a unique domain generation algorithm.
SombRAT can use a custom DGA to generate a subdomain for C2.
It has used a DGA to generate URLs from executed macros.
Ursnif has used a DGA to generate domain names for C2.
Technique:  Dynamic Resolution:DNS Calculation
It has used multiple variants of DNS Calculation including multiplying the first two octets of an IP address and adding the third octet to that value in order to get a resulting command and control port.
Technique:  Encrypted Channel
It has used multiple layers of encryption within malware to protect C2 communication.
It has encrypted their C2 communications.
Chaes has used encryption for its C2 channel.
Cryptoistic can engage in encrypted communications with C2.
gh0st RAT has encrypted TCP communications to evade detection.
Lizar can support encrypted communications between the client and server.
MacMa has used TLS encryption to initialize a custom protocol for C2 communications.
It has used an encrypted http proxy in C2 communications.
NETWIRE can encrypt C2 communications.
PowerLess can use an encrypted channel for C2 communications.
PowGoop can receive encrypted commands from C2.
RCSession can use an encrypted beacon to check in with C2.
It has encrypted traffic with the C2 to prevent network detection.
Technique:  Multi-Stage Channels
An It downloader first establishes a SOCKS5 connection to 192.157.198[.]103 using TCP port 1913; once the server response is verified, it then requests a connection to 192.184.60[.]229 on TCP port 81.
It used the storescyncsvc.dll BEACON backdoor to download a secondary backdoor.
BACKSPACE attempts to avoid detection by checking a first stage command and control server to determine if it should connect to the second stage server, which performs "louder" interactions with the malware.
The Bazar loader is used to download and execute the Bazar backdoor.
BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain an encoded tag containing the IP address of a command and control server and then communicates separately with that IP address for C2. If the C2 server is discovered or shut down, the threat actors can update the encoded IP address on TechNet to maintain control of the victims’ machines.
After initial compromise, Chaos will download a second stage to establish a more permanent presence on the affected system.
It has used multi-stage malware components that inject later stages into separate processes.
It has used one C2 to obtain enumeration scripts and monitor web logs, but a different C2 to send data back.
Snip3 can download and execute additional payloads and modules over separate communication channels.
Individual Uroburos implants can use multiple communication channels based on one of four available modes of operation.
Valak can download additional modules and malware capable of using separate C2 channels.