QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: TrickBot uses vncDll module to remote control the victim machine.
MITRE ATT&CK techniques:
- T1219: Remote Access Software
Threat description: Lazarus Group has used a scheduled task named `SRCheck` to mask the execution of a malicious .dll.
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: Bundlore has the ability to enumerate what browser is being used as well as version information for Safari.
MITRE ATT&CK techniques:
- T1518: Software Discovery
Threat description: BOOSTWRITE has used a a 32-byte long multi-XOR key to decode data inside its payload.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: MarkiRAT can use the "GetKeyboardLayout" API to check if a compromised host's keyboard is set to Persian.
MITRE ATT&CK techniques:
- T1614.001: System Location Discovery - System Language Discovery
Threat description: Stuxnet uses encrypted configuration blocks and writes encrypted files to disk.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: XCSSET searches firewall configuration files located in "/Library/Preferences/" and uses "csrutil status" to determine if System Integrity Protection is enabled.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: Bundlore has obfuscated data with base64, AES, RC4, and bz2.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: USBStealer sets the timestamps of its dropper files to the last-access and last-write timestamps of a standard Windows library chosen on the system.
MITRE ATT&CK techniques:
- T1070.006: Indicator Removal - Timestomp
Threat description: Ke3chang has used Base64-encoded shellcode strings.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Torisma has encrypted its C2 communications using XOR and VEST-32.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: KGH_SPY can enumerate files and directories on a compromised host.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: MegaCortex was used to kill endpoint security processes.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: APT39 has used malware to drop encrypted CAB files.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: HermeticWizard can find machines on the local network by gathering known local IP addresses through `DNSGetCacheDataTable`, `GetIpNetTable`,`WNetOpenEnumW(RESOURCE_GLOBALNET, RESOURCETYPE_ANY)`,`NetServerEnum`,`GetTcpTable`, and `GetAdaptersAddresses.`
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: Mustang Panda has searched the entire target system for DOC, DOCX, PPT, PPTX, XLS, XLSX, and PDF files.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: TEMP.Veles has created staging folders in directories that were infrequently used by legitimate users or processes.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: Higaisa added a spoofed binary to the start-up folder for persistence.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Chimera has gathered the SYSTEM registry and ntds.dit files from target systems. Chimera specifically has used the NtdsAudit tool to dump the password hashes of domain users via "msadcs.exe "NTDS.dit" -s "SYSTEM" -p RecordedTV_pdmp.txt --users-csv RecordedTV_users.csv" and used ntdsutil to copy the Active Directory database.
MITRE ATT&CK techniques:
- T1003.003: OS Credential Dumping - NTDS
Threat description: The different components of Machete are executed by Windows Task Scheduler.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: Zebrocy uses HTTP for C2.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: GoldMax has used filenames that matched the system name, and appeared as a scheduled task impersonating systems management software within the corresponding ProgramData subfolder.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Pysa has extracted credentials from the password database before encrypting the files.
MITRE ATT&CK techniques:
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: During FunnyDream, the threat actors used Tasklist on targeted systems.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: Empire can enumerate Security Support Providers (SSPs) as well as utilize PowerSploit's "Install-SSP" and "Invoke-Mimikatz" to install malicious SSPs and log authentication events.
MITRE ATT&CK techniques:
- T1547.005: Boot or Logon Autostart Execution - Security Support Provider
Threat description: Lokibot has reflectively loaded the decoded DLL into memory.
MITRE ATT&CK techniques:
- T1620: Reflective Code Loading
Threat description: APT37 collects the computer name, the BIOS model, and execution path.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: SysUpdate has the ability to set file attributes to hidden.
MITRE ATT&CK techniques:
- T1564.001: Hide Artifacts - Hidden Files and Directories
Threat description: Transparent Tribe can hide legitimate directories and replace them with malicious copies of the same name.
MITRE ATT&CK techniques:
- T1564.001: Hide Artifacts - Hidden Files and Directories
Threat description: Ursnif droppers have used COM objects to execute the malware's full executable payload.
MITRE ATT&CK techniques:
- T1559.001: Inter-Process Communication - Component Object Model
Threat description: CrossRAT can list all files on a system.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: DarkVishnya used DameWare Mini Remote Control for lateral movement.
MITRE ATT&CK techniques:
- T1219: Remote Access Software
Threat description: Leafminer obfuscated scripts that were used on victim machines.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: HermeticWiper can initiate a system shutdown.
MITRE ATT&CK techniques:
- T1529: System Shutdown/Reboot
Threat description: ObliqueRAT has the ability to check for blocklisted computer names on infected endpoints.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Hildegard has used shell scripts for execution.
MITRE ATT&CK techniques:
- T1059.004: Command and Scripting Interpreter - Unix Shell
Threat description: TA505 has been seen injecting a DLL into winword.exe.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Sowbug listed remote shared drives that were accessible from a victim.
MITRE ATT&CK techniques:
- T1135: Network Share Discovery
Threat description: ShimRat can use pre-configured HTTP proxies.
MITRE ATT&CK techniques:
- T1090.002: Proxy - External Proxy
Threat description: Naid creates Registry entries that store information about a created service and point to a malicious DLL dropped to disk.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: One of Dtrack can replace the normal flow of a program execution with malicious code.
MITRE ATT&CK techniques:
- T1574: Hijack Execution Flow
Threat description: WarzoneRAT can masquerade the Process Environment Block on a compromised host to hide it's attempts to elevate privileges through `IFileOperation`.
MITRE ATT&CK techniques:
- T1564: Hide Artifacts
Threat description: DarkWatchman can store configuration strings, keylogger, and output of components in the Registry.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: Dragonfly 2.0 manipulated .lnk files to gather user credentials in conjunction with Forced Authentication.
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: Bazar can create a scheduled task for persistence.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: APT41 used a ransomware called Encryptor RaaS to encrypt files on the targeted systems and provide a ransom note to the user.
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: FIN6 has used malicious documents to lure victims into allowing execution of PowerShell scripts.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: Revenge RAT has the ability to access the webcam.
MITRE ATT&CK techniques:
- T1125: Video Capture
Threat description: During Frankenstein, the threat actors used Empire to obtain a list of all running processes.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: SpicyOmelette can check for the presence of 29 different antivirus tools.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: RemoteUtilities can use Msiexec to install a service.
MITRE ATT&CK techniques:
- T1218.007: System Binary Proxy Execution - Msiexec
Threat description: Deep Panda has used regsvr32.exe to execute a server variant of Derusbi in victim networks.
MITRE ATT&CK techniques:
- T1218.010: System Binary Proxy Execution - Regsvr32
Threat description: Evilnum can collect email credentials from victims.
MITRE ATT&CK techniques:
- T1555: Credentials from Password Stores
Threat description: Ngrok has been used by threat actors to configure servers for data exfiltration.
MITRE ATT&CK techniques:
- T1567: Exfiltration Over Web Service
Threat description: Dyre has the ability to directly inject its code into the web browser process.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: Leviathan has used WMI for execution.
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: ZxShell can create a new service for execution.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: Kimsuky has downloaded additional malware with scheduled tasks.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: Pillowmint has deleted the filepath "%APPDATA%\Intel\devmonsrv.exe".
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit search order hijacking vulnerabilities.
MITRE ATT&CK techniques:
- T1574.008: Hijack Execution Flow - Path Interception by Search Order Hijacking
Threat description: During CostaRicto, the threat actors used a layer of proxies to manage C2 communications.
MITRE ATT&CK techniques:
- T1090.003: Proxy - Multi-hop Proxy
Threat description: ISMInjector uses the "certutil" command to decode a payload file.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: KillDisk deletes system files to make the OS unbootable. KillDisk also targets and deletes files with 35 different file extensions.
MITRE ATT&CK techniques:
- T1485: Data Destruction
Threat description: Operation Wocao has used WMI to execute commands.
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: menuPass uses PowerSploit to inject shellcode into PowerShell.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: POWERSOURCE uses DNS TXT records for C2.
MITRE ATT&CK techniques:
- T1071.004: Application Layer Protocol - DNS
Threat description: ThreatNeedle can collect data and files from a compromised host.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Doki has used the DynDNS service and a DGA based on the Dogecoin blockchain to generate C2 domains.
MITRE ATT&CK techniques:
- T1568.002: Dynamic Resolution - Domain Generation Algorithms
Threat description: ZIRCONIUM has spoofed legitimate applications in phishing lures and changed file extensions to conceal  installation of malware.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: Carberp has used user mode rootkit techniques to remain hidden on the system.
MITRE ATT&CK techniques:
- T1014: Rootkit
Threat description: NanHaiShu can download additional files from URLs.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: HEXANE has used netstat to monitor connections to specific ports.
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
Threat description: TA551 has used obfuscated variable names in a JavaScript configuration file.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Cardinal RAT lures victims into executing malicious macros embedded within Microsoft Excel documents.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: Matryoshka uses rundll32.exe in a Registry Run key value for execution as part of its persistence mechanism.
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: Saint Bot has run several virtual machine and sandbox checks, including checking if `Sbiedll.dll` is present in a list of loaded modules, comparing the machine name to `HAL9TH` and the user name to `JohnDoe`, and checking the BIOS version for known virtual machine identifiers.
MITRE ATT&CK techniques:
- T1497.001: Virtualization/Sandbox Evasion - System Checks
Threat description: MiniDuke can use control flow flattening to obscure code.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Bazar has a variant with a packed payload.
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: Sidewinder has used the ActiveXObject utility to create OLE objects to obtain execution through Internet Explorer.
MITRE ATT&CK techniques:
- T1559.002: Inter-Process Communication - Dynamic Data Exchange
Threat description: Daserf can execute shell commands.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: BoxCaon used the "StackStrings" obfuscation technique to hide malicious functionalities.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: APT12 has sent emails with malicious Microsoft Office documents and PDFs attached.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: BOOSTWRITE has been signed by a valid CA.
MITRE ATT&CK techniques:
- T1553.002: Subvert Trust Controls - Code Signing
Threat description: APT12 has attempted to get victims to open malicious Microsoft Word and PDF attachment sent via spearphishing.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: Blue Mockingbird has used wmic.exe and Windows Registry modifications to set the COR_PROFILER environment variable to execute a malicious DLL whenever a process loads the .NET CLR.
MITRE ATT&CK techniques:
- T1574.012: Hijack Execution Flow - COR_PROFILER
Threat description: PoshC2 can use "Get-PassPol" to enumerate the domain password policy.
MITRE ATT&CK techniques:
- T1201: Password Policy Discovery
Threat description: HEXANE has used a Mimikatz-based tool and a PowerShell script to steal passwords from Google Chrome.
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
Threat description: Magic Hound has downloaded additional code and files from servers onto victims.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: NotPetya contains a modified version of Mimikatz to help gather credentials that are later used for lateral movement.
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: TEARDROP files had names that resembled legitimate Window file and directory names.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Cardinal RAT can act as a reverse proxy.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: Trojan.Karagany can communicate with C2 via HTTP POST requests.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: AppleJeus's spearphishing links required user interaction to navigate to the malicious website.
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
Threat description: SideCopy has sent Microsoft Office Publisher documents to victims that have embedded malicious macros that execute an hta file via calling `mshta.exe`.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: Taidoor has relied upon a victim to click on a malicious email attachment.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: Password stealer and NTLM stealer modules in CozyCar harvest stored credentials from the victim, including credentials used as part of Windows NTLM user authentication.
MITRE ATT&CK techniques:
- T1003.002: OS Credential Dumping - Security Account Manager
Threat description: Ecipekac can use XOR, AES, and DES to encrypt loader shellcode.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Agent Tesla has the ability to extract credentials from the Registry.
MITRE ATT&CK techniques:
- T1552.002: Unsecured Credentials - Credentials in Registry
Threat description: Dragonfly 2.0 used SMB for C2.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: UPPERCUT can download and upload files to and from the victim’s machine.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: ADVSTORESHELL exfiltrates data over the same channel used for C2.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Zeus Panda can uninstall scripts and delete files to cover its track.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: yty uses the "net view" command for discovery.
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: Fox Kitten has downloaded additional tools including PsExec directly to endpoints.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Dragonfly 2.0 likely obtained a list of hosts in the victim environment.
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: APT39 has used SMB for lateral movement.
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
Threat description: Cobalt Strike uses a custom command and control protocol that can be encapsulated in HTTP or HTTPS, or DNS. All protocols use their standard assigned ports.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: ShimRat has installed a registry based start-up key "HKCU\Software\microsoft\windows\CurrentVersion\Run" to maintain persistence should other methods fail.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: FunnyDream can Base64 encode its C2 address stored in a template binary with the `xyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw_-` or
`xyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw_=` character sets.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: NanoCore creates a RunOnce key in the Registry to execute its VBS scripts each time the user logs on to the machine.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Grandoreiro can use a DGA for hiding C2 addresses, including use of an algorithm with a user-specific key that changes daily.
MITRE ATT&CK techniques:
- T1568.002: Dynamic Resolution - Domain Generation Algorithms
Threat description: Most of the strings in ADVSTORESHELL are encrypted with an XOR-based algorithm; some strings are also encrypted with 3DES and reversed. API function names are also reversed, presumably to avoid detection in memory.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: gh0st RAT is able to wipe event logs.
MITRE ATT&CK techniques:
- T1070.001: Indicator Removal - Clear Windows Event Logs
Threat description: Aria-body has used HTTP in C2 communications.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: PowerShower has the ability to deploy a reconnaissance module to retrieve a list of the active processes.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: KARAE can upload and download files, including second-stage malware.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Agent Tesla has created hidden folders.
MITRE ATT&CK techniques:
- T1564.001: Hide Artifacts - Hidden Files and Directories
Threat description: HotCroissant has the ability to stop services on the infected host.
MITRE ATT&CK techniques:
- T1489: Service Stop
Threat description: Mustang Panda has used mshta.exe to launch collection scripts.
MITRE ATT&CK techniques:
- T1218.005: System Binary Proxy Execution - Mshta
Threat description: zwShell has established persistence by adding itself as a new service.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: Gelsemium has established infrastructure through renting servers at multiple providers worldwide.
MITRE ATT&CK techniques:
- T1583.004: Acquire Infrastructure - Server
Threat description: ShimRatReporter listed all non-privileged and privileged accounts available on the machine.
MITRE ATT&CK techniques:
- T1087: Account Discovery
Threat description: For Operation Sharpshooter, the threat actors compromised a server they used as part of the campaign's infrastructure.
MITRE ATT&CK techniques:
- T1584.004: Compromise Infrastructure - Server
Threat description: OSX/Shlayer has collected the IOPlatformUUID, session UID, and the OS version using the command "sw_vers -productVersion".
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: CosmicDuke uses scheduled tasks typically named "Watchmon Service" for persistence.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: STARWHALE has the ability to contact actor-controlled C2 servers via HTTP.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: S-Type has used Windows APIs, including `GetKeyboardType`, `NetUserAdd`, and `NetUserDel`.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: VERMIN is initially packed.
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: PowerShower has the ability to save and execute VBScript.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: NDiskMonitor obtains the victim computer name and encrypts the information to send over its C2 channel.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: GuLoader can use HTTP to retrieve additional binaries.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: A TYPEFRAME variant can force the compromised system to function as a proxy server.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: Avaddon looks for and attempts to stop anti-malware solutions.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: The FunnyDream FilepakMonitor component can detect removable drive insertion.
MITRE ATT&CK techniques:
- T1120: Peripheral Device Discovery
Threat description: GOLD SOUTHFIELD has conducted malicious spam (malspam) campaigns to gain access to victim's machines.
MITRE ATT&CK techniques:
- T1566: Phishing
Threat description: Trojan.Karagany can create a link to itself in the Startup folder to automatically start itself upon system restart.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: NotPetya uses "rundll32.exe" to install itself on remote systems when accessed via PsExec or "wmic".
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: DarkHydrus has sent malware that required users to hit the enable button in Microsoft Excel to allow an .iqy file to be downloaded.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: Saint Bot has used PowerShell for execution.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: Bad Rabbit drops a file named "infpub.dat"into the Windows directory and is executed through SCManager and "rundll.exe".
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: A Lazarus Group malware sample encrypts data using a simple byte based XOR operation prior to exfiltration.
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: Fysbis has been encrypted using XOR and RC4.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Leafminer used Microsoft’s Sysinternals tools to gather detailed information about remote systems.
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: HEXANE has run `net localgroup` to enumerate local groups.
MITRE ATT&CK techniques:
- T1069.001: Permission Groups Discovery - Local Groups
Threat description: RTM tries to add a Registry Run key under the name "Windows Update" to establish persistence.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: DRATzarus can use `IsDebuggerPresent` to detect whether a debugger is present on a victim.
MITRE ATT&CK techniques:
- T1622: Debugger Evasion
Threat description: Rover persists by creating a Registry entry in "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\".
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: RCSession can collect data from a compromised host.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: TrickBot decodes the configuration data and modules.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Zebrocy executes the "reg query" command to obtain information in the Registry.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system and removable media.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: Silent Librarian has obtained free Let's Encrypt SSL certificates for use on their phishing pages.
MITRE ATT&CK techniques:
- T1588.004: Obtain Capabilities - Digital Certificates
Threat description: Starloader decrypts and executes shellcode from a file called Stars.jps.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Threat Group-3390 actors use at to schedule tasks to run self-extracting RAR archives, which install HTTPBrowser or PlugX on other victims on a network.
MITRE ATT&CK techniques:
- T1053.002: Scheduled Task/Job - At
Threat description: S-Type has attempted to determine if a compromised system was using a Japanese keyboard via the `GetKeyboardType` API call.
MITRE ATT&CK techniques:
- T1614.001: System Location Discovery - System Language Discovery
Threat description: Clambling can create and start services on a compromised host.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: Denis has a command to delete files from the victim’s machine.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: Arp can be used to display ARP configuration information on the host.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: Kimsuky has used modified versions of PHProxy to examine web traffic between the victim and the accessed website.
MITRE ATT&CK techniques:
- T1557: Adversary-in-the-Middle
Threat description: Chimera has queried Registry keys using "reg query \\<host>\HKU\<SID>\SOFTWARE\Microsoft\Terminal Server Client\Servers" and "reg query \\<host>\HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Internet Settings".
MITRE ATT&CK techniques:
- T1012: Query Registry