QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: During Operation Wocao, threat actors used `nbtscan` and `ping` to discover remote systems, as well as `dsquery subnet` on a domain controller to retrieve all subnets in the Active Directory.
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: ECCENTRICBANDWAGON can capture screenshots and store them locally.
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: Higaisa used malicious e-mail attachments to lure victims into executing LNK files.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: MuddyWater decoded base64-encoded PowerShell commands using a VBS file.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Gamaredon Group malware has used rundll32 to launch additional malicious components.
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: Flagpro can collect data from a compromised host, including Windows authentication information.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: HTTPBrowser deletes its original installer file once installation is complete.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: POWERSTATS can use DCOM (targeting the 127.0.0.1 loopback address) to execute additional payloads on compromised hosts.
MITRE ATT&CK techniques:
- T1559.001: Inter-Process Communication - Component Object Model
Threat description: For Operation Wocao, the threat actors registered email accounts to use during the campaign.
MITRE ATT&CK techniques:
- T1585.002: Establish Accounts - Email Accounts
Threat description: Zeroaccess is a kernel-mode rootkit.
MITRE ATT&CK techniques:
- T1014: Rootkit
Threat description: During Operation Honeybee, threat actors registered domains for C2.
MITRE ATT&CK techniques:
- T1583.001: Acquire Infrastructure - Domains
Threat description: During Night Dragon, threat actors obtained and used tools such as gsecdump.
MITRE ATT&CK techniques:
- T1588.002: Obtain Capabilities - Tool
Threat description: FakeM C2 traffic attempts to evade detection by resembling data generated by legitimate messenger applications, such as MSN and Yahoo! messengers. Additionally, some variants of FakeM use modified SSL code for communications back to C2 servers, making SSL decryption ineffective.
MITRE ATT&CK techniques:
- T1001.003: Data Obfuscation - Protocol Impersonation
Threat description: Mongall has the ability to RC4 encrypt C2 communications.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: RTM has resolved Pony C2 server IP addresses by either converting Bitcoin blockchain transaction data to specific octets, or accessing IP addresses directly within the Namecoin blockchain.
MITRE ATT&CK techniques:
- T1568: Dynamic Resolution
Threat description: Axiom has compressed and encrypted data prior to exfiltration.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: Tomiris has the ability to sleep for at least nine minutes to evade sandbox-based analysis systems.
MITRE ATT&CK techniques:
- T1497.003: Virtualization/Sandbox Evasion - Time Based Evasion
Threat description: OSX_OCEANLOTUS.D encrypts its strings in RSA256 and encodes them in a custom base64 scheme and XOR.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: StrongPity can identify if ESET or BitDefender antivirus are installed before dropping its payload.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: RCSession has the ability to capture keystrokes on a compromised host.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: Winnti for Linux has the ability to deploy modules directly from command and control (C2) servers, possibly for remote command execution, file exfiltration, and socks5 proxying on the infected host.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Dragonfly 2.0 identified and browsed file servers in the victim network, sometimes , viewing files pertaining to ICS or Supervisory Control and Data Acquisition (SCADA) systems.
MITRE ATT&CK techniques:
- T1135: Network Share Discovery
Threat description: Epic heavily obfuscates its code to make analysis more difficult.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: T9000 gathers and beacons the system time during installation.
MITRE ATT&CK techniques:
- T1124: System Time Discovery
Threat description: Lazarus Group has obtained SSL certificates for their C2 domains.
MITRE ATT&CK techniques:
- T1588.004: Obtain Capabilities - Digital Certificates
Threat description: APT32 includes garbage code to mislead anti-malware software and researchers.
MITRE ATT&CK techniques:
- T1027.001: Obfuscated Files or Information - Binary Padding
Threat description: Squirrelwaffle has relied on users enabling malicious macros within Microsoft Excel and Word attachments.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: Transparent Tribe has embedded links to malicious downloads in e-mails.
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: Zeus Panda searches for specific directories on the victim’s machine.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: Gamaredon Group tools have contained an application to check performance of USB flash drives. Gamaredon Group has also used malware to scan for removable drives.
MITRE ATT&CK techniques:
- T1120: Peripheral Device Discovery
Threat description: Remexi encrypts and adds all gathered browser data into files for upload to C2.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: Magic Hound has used personalized spearphishing attachments.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: BLINDINGCAN has collected from a victim machine the system name, processor information, OS version, and disk information, including type and free space available.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Denis deploys additional backdoors and hacking tools to the system.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: OilRig has sent spearphising emails with malicious links to potential victims.
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: BRONZE BUTLER's MSGET downloader uses a dead drop resolver to access malicious payloads.
MITRE ATT&CK techniques:
- T1102.001: Web Service - Dead Drop Resolver
Threat description: Sandworm Team has collected the username from a compromised host.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: Ke3chang has obtained and used tools such as Mimikatz.
MITRE ATT&CK techniques:
- T1588.002: Obtain Capabilities - Tool
Threat description: IcedID has utilzed encrypted binaries and base64 encoded strings.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: The Winnti for Windows dropper can decrypt and decompresses a data blob.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Higaisa used a payload that creates a hidden window.
MITRE ATT&CK techniques:
- T1564.003: Hide Artifacts - Hidden Window
Threat description: APT41 has obtained and used tools such as Mimikatz, pwdump, PowerSploit, and Windows Credential Editor.
MITRE ATT&CK techniques:
- T1588.002: Obtain Capabilities - Tool
Threat description: IcedID has packed and encrypted its loader module.
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: During Operation Honeybee, the threat actors used batch files that allowed them to establish persistence by adding the following Registry key: `"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost" /v COMSysApp /t REG_MULTI_SZ /d "COMSysApp" /f`.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: APT28 has compromised targets via strategic web compromise utilizing custom exploit kits.
MITRE ATT&CK techniques:
- T1189: Drive-by Compromise
Threat description: SslMM sends information to its hard-coded C2, including OS version, service pack information, processor speed, system name, and OS install date.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: MoleNet can collect information about the about the system.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Explosive has collected the username from the infected host.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: ShadowPad has downloaded code from a C2 server.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: APT29 has used GoldFinder to perform HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request travels through.
MITRE ATT&CK techniques:
- T1016.001: System Network Configuration Discovery - Internet Connection Discovery
Threat description: Kessel can use a proxy during exfiltration if set in the configuration.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: HyperBro can be delivered encrypted to a compromised host.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: QUADAGENT uses DNS for C2 communications.
MITRE ATT&CK techniques:
- T1071.004: Application Layer Protocol - DNS
Threat description: DarkComet adds several Registry entries to enable automatic execution at every system startup.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: APT32 has used macros, COM scriptlets, and VBS scripts.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: JHUHUGIT tests if it can reach its C2 server by first attempting a direct connection, and if it fails, obtaining proxy settings and sending the connection through a proxy, and finally injecting code into a running browser if the proxy method fails.
MITRE ATT&CK techniques:
- T1008: Fallback Channels
Threat description: WINERACK can enumerate files and directories.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: WhisperGate can shutdown a compromised host through execution of `ExitWindowsEx` with the `EXW_SHUTDOWN` flag.
MITRE ATT&CK techniques:
- T1529: System Shutdown/Reboot
Threat description: menuPass has used tools to exploit the ZeroLogon vulnerability (CVE-2020-1472).
MITRE ATT&CK techniques:
- T1210: Exploitation of Remote Services
Threat description: Squirrelwaffle has used PowerShell to execute its payload.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: OilRig malware ISMAgent falls back to its DNS tunneling mechanism if it is unable to reach the C2 server over HTTP.
MITRE ATT&CK techniques:
- T1008: Fallback Channels
Threat description: GOLD SOUTHFIELD has used the cloud-based remote management and monitoring tool "ConnectWise Control" to deploy REvil.
MITRE ATT&CK techniques:
- T1219: Remote Access Software
Threat description: During C0015, the threat actors loaded DLLs via `rundll32` using the `svchost` process.
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: Carberp has maintained persistence by placing itself inside the current user's startup folder.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Bazar can attempt to overload sandbox analysis by sending 1550 calls to "printf".
MITRE ATT&CK techniques:
- T1497: Virtualization/Sandbox Evasion
Threat description: Confucius has lured victims into clicking on a malicious link sent through spearphishing.
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
Threat description: The Penquin C2 mechanism is based on TCP and UDP packets.
MITRE ATT&CK techniques:
- T1095: Non-Application Layer Protocol
Threat description: DarkWatchman can retrieve browser history.
MITRE ATT&CK techniques:
- T1217: Browser Information Discovery
Threat description: CreepyDrive can use Powershell for execution, including the cmdlets `Invoke-WebRequest` and `Invoke-Expression`.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: TURNEDUP is capable of writing to a Registry Run key to establish.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Lazarus Group malware uses cmd.exe to execute commands on a compromised host. A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: APT37 leverages social networking sites and cloud platforms (AOL, Twitter, Yandex, Mediafire, pCloud, Dropbox, and Box) for C2.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: Higaisa used a FakeTLS session for C2 communications.
MITRE ATT&CK techniques:
- T1001.003: Data Obfuscation - Protocol Impersonation
Threat description: LookBack can retrieve file listings from the victim machine.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: Empire can use GitHub for data exfiltration.
MITRE ATT&CK techniques:
- T1567.001: Exfiltration Over Web Service - Exfiltration to Code Repository
Threat description: OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access. OilRig has also used tool named PICKPOCKET to dump passwords from web browsers.
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
Threat description: Amadey has changed the Startup folder to the one containing its executable by overwriting the registry keys.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Kazuar has used internal nodes on the compromised network for C2 communications.
MITRE ATT&CK techniques:
- T1090.001: Proxy - Internal Proxy
Threat description: SDBbot has used rundll32.exe to execute DLLs.
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: During Operation Wocao, threat actors collected clipboard data in plaintext.
MITRE ATT&CK techniques:
- T1115: Clipboard Data
Threat description: Pony has used batch scripts to delete itself after execution.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Sys10 collects the group name of the logged-in user and sends it to the C2.
MITRE ATT&CK techniques:
- T1069.001: Permission Groups Discovery - Local Groups
Threat description: HiddenWasp adds itself as a shared object to the LD_PRELOAD environment variable.
MITRE ATT&CK techniques:
- T1574.006: Hijack Execution Flow - Dynamic Linker Hijacking
Threat description: Kazuar can delete files.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: SUGARUSH has used TCP for C2.
MITRE ATT&CK techniques:
- T1095: Non-Application Layer Protocol
Threat description: BackdoorDiplomacy has obtained and used leaked malware, including DoublePulsar, EternalBlue, EternalRocks, and EternalSynergy, in its operations.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
Threat description: IronNetInjector has the ability to inject a DLL into running processes, including the IronNetInjector DLL into explorer.exe.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Bad Rabbit has used rundll32 to launch a malicious DLL as "C:Windowsinfpub.dat".
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: Cuba has a hardcoded list of services and processes to terminate.
MITRE ATT&CK techniques:
- T1489: Service Stop
Threat description: FIN6 has targeted victims with e-mails containing malicious attachments.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: Xbash can create a cronjob for persistence if it determines it is on a Linux system.
MITRE ATT&CK techniques:
- T1053.003: Scheduled Task/Job - Cron
Threat description: UNC2452 obtained the private encryption key from an Active Directory Federation Services (AD FS) container to decrypt corresponding SAML signing certificates.
MITRE ATT&CK techniques:
- T1552.004: Unsecured Credentials - Private Keys
Threat description: CORALDECK searches for specified files.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using rundll32.exe.
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: OwaAuth has been loaded onto Exchange servers and disguised as an ISAPI filter (owaauth.dll). The IIS w3wp.exe process then loads the malicious DLL.
MITRE ATT&CK techniques:
- T1505.004: Server Software Component - IIS Components
Threat description: Bad Rabbit has encrypted files and disks using AES-128-CBC and RSA-2048.
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: Nltest may be used to enumerate the parent domain of a local machine using "/parentdomain".
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: NavRAT uses "systeminfo" on a victim’s machine.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: TAINTEDSCRIBE can use "DriveList" to retrieve drive information.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Agent Tesla has had its code obfuscated in an apparent attempt to make analysis difficult. Agent Tesla has used the Rijndael symmetric encryption algorithm to encrypt strings.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Higaisa has used VBScript code on the victim's machine.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: During C0010, UNC3890 actors likely established a watering hole that was hosted on a login page of a legitimate Israeli shipping company that was active until at least November 2021.
MITRE ATT&CK techniques:
- T1189: Drive-by Compromise
Threat description: Tropic Trooper's backdoor has communicated to the C2 over the DNS protocol.
MITRE ATT&CK techniques:
- T1071.004: Application Layer Protocol - DNS
Threat description: KGH_SPY can execute PowerShell commands on the victim's machine.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: S-Type runs the command "net start" on a victim.
MITRE ATT&CK techniques:
- T1007: System Service Discovery
Threat description: Attor's dispatcher disguises itself as a legitimate task (i.e., the task name and description appear legitimate).
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: During Operation CuckooBees, the threat actors used the `tasklist` command as part of their advanced reconnaissance.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: WhisperGate can download and execute AdvancedRun.exe via `sc.exe`.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: Silent Librarian has searched victim's websites to identify the interests and academic areas of targeted individuals and to scrape source code, branding, and organizational contact information for phishing pages.
MITRE ATT&CK techniques:
- T1594: Search Victim-Owned Websites
Threat description: GoldenSpy's installer has delayed installation of GoldenSpy for two hours after it reaches a victim system.
MITRE ATT&CK techniques:
- T1497.003: Virtualization/Sandbox Evasion - Time Based Evasion
Threat description: Derusbi is capable of creating a remote Bash shell and executing commands.
MITRE ATT&CK techniques:
- T1059.004: Command and Scripting Interpreter - Unix Shell
Threat description: Kimsuky has used Blogspot pages for C2.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: DEATHRANSOM can use HTTPS to download files.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: FinFisher injects itself into various processes depending on whether it is low integrity or high integrity.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: A PingPull variant can communicate with its C2 servers by using HTTPS.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: REvil can exfiltrate host and malware information to C2 servers.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Tonto Team has delivered payloads via spearphishing attachments.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: LightNeuron has used filenames associated with Exchange and Outlook for binary and configuration files, such as "winmail.dat".
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: MoonWind obtains the victim's current time.
MITRE ATT&CK techniques:
- T1124: System Time Discovery
Threat description: Gamaredon Group has used modules that automatically upload gathered documents to the C2 server.
MITRE ATT&CK techniques:
- T1020: Automated Exfiltration
Threat description: Maze operators have created scheduled tasks masquerading as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update" designed to launch the ransomware.
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: Kimsuky has collected Office, PDF, and HWP documents from its victims.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Revenge RAT has a plugin to perform RDP access.
MITRE ATT&CK techniques:
- T1021.001: Remote Services - Remote Desktop Protocol
Threat description: Crimson uses a custom TCP protocol for C2.
MITRE ATT&CK techniques:
- T1095: Non-Application Layer Protocol
Threat description: CreepySnail can execute `getUsername` on compromised systems.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: Janicab used a valid AppleDeveloperID to sign the code to get past security restrictions.
MITRE ATT&CK techniques:
- T1553.002: Subvert Trust Controls - Code Signing
Threat description: APT19 sent spearphishing emails with malicious attachments in RTF and XLSM formats to deliver initial exploits.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: InvisiMole gathers the local system time from the victim’s machine.
MITRE ATT&CK techniques:
- T1124: System Time Discovery
Threat description: PowerShower has the ability to remove all files created during the dropper process.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: menuPass has encoded strings in its malware with base64 as well as with a simple, single-byte XOR obfuscation using key 0x40.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: XTunnel relays traffic between a C2 server and a victim.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: Donut can generate packed code modules.
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: Bumblebee has the ability to set a hardcoded and randomized sleep interval.
MITRE ATT&CK techniques:
- T1497.003: Virtualization/Sandbox Evasion - Time Based Evasion
Threat description: Mustang Panda has searched the victim system for the "InstallUtil.exe" program and its version.
MITRE ATT&CK techniques:
- T1518: Software Discovery
Threat description: The DustySky dropper uses Windows Management Instrumentation to extract information about the operating system and whether an anti-virus is active.
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: PipeMon, its installer, and tools are signed with stolen code-signing certificates.
MITRE ATT&CK techniques:
- T1553.002: Subvert Trust Controls - Code Signing
Threat description: Ruler can be used to automate the abuse of Outlook Forms to establish persistence.
MITRE ATT&CK techniques:
- T1137.003: Office Application Startup - Outlook Forms
Threat description: SUNBURST removed HTTP proxy registry values to clean up traces of execution.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: HALFBAKED can execute PowerShell scripts.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: Elise can download additional files from the C2 server for execution.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: UNC2452 downloaded additional tools, such as TEARDROP malware and Cobalt Strike, to the compromised host following initial compromise.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: CORESHELL has established persistence by creating autostart extensibility point (ASEP) Registry entries in the Run key and other Registry keys, as well as by creating shortcuts in the Internet Explorer Quick Start folder.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: ShimRatReporter gathered the local proxy, domain, IP, routing tables, mac address, gateway, DNS servers, and DHCP status information from an infected host.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: Lazarus Group has rebooted systems after destroying files and wiping the MBR on infected systems.
MITRE ATT&CK techniques:
- T1529: System Shutdown/Reboot
Threat description: Sidewinder has used tools to collect the computer name, OS version, installed hotfixes, as well as information regarding the memory and processor on a compromised host.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: ThiefQuest exfiltrates targeted file extensions in the "/Users/" folder to the command and control server via unencrypted HTTP. Network packets contain a string with two pieces of information: a file path and the contents of the file in a base64 encoded string.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Dragonfly has likely obtained a list of hosts in the victim environment.
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: Lucifer can use certutil for propagation on Windows hosts within intranets.
MITRE ATT&CK techniques:
- T1570: Lateral Tool Transfer
Threat description: Valak has the ability to decode and decrypt downloaded files.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Shamoon will reboot the infected system once the wiping functionality has been completed.
MITRE ATT&CK techniques:
- T1529: System Shutdown/Reboot
Threat description: DCSrv has used various Windows API functions, including `DeviceIoControl`, as part of its encryption process.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: Dtrack packs collected data into a password protected archive.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: USBferry can use "net user" to gather information about local accounts.
MITRE ATT&CK techniques:
- T1087.001: Account Discovery - Local Account
Threat description: Prikormka uses DLL search order hijacking for persistence by saving itself as ntshrui.dll to the Windows directory so it will load before the legitimate ntshrui.dll saved in the System32 subdirectory.
MITRE ATT&CK techniques:
- T1574.001: Hijack Execution Flow - DLL Search Order Hijacking
Threat description: BLINDINGCAN has uploaded files from victim machines.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Comnie uses HTTP for C2 communication.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: Misdat has used Windows APIs, including `ExitWindowsEx` and `GetKeyboardType`.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: JHUHUGIT obtains a build identifier as well as victim hard drive information from Windows registry key "HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum". Another JHUHUGIT variant gathers the victim storage volume serial number and the storage device name.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: PoetRAT has used a Python tool named Browdec.exe to steal browser credentials.
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
Threat description: Shamoon copies an executable payload to the target system by using SMB/Windows Admin Shares and then scheduling an unnamed task to execute the malware.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: InvisiMole can mimic HTTP protocol with custom HTTP “verbs” HIDE, ZVVP, and NOP.
MITRE ATT&CK techniques:
- T1001.003: Data Obfuscation - Protocol Impersonation
Threat description: Comnie executes a batch script to store discovery information in %TEMP%\info.dat and then uploads the temporarily file to the remote C2 server.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: USBferry can use "net view" to gather information about remote systems.
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: OceanSalt can encode data with a NOT operation before sending the data to the control server.
MITRE ATT&CK techniques:
- T1132.002: Data Encoding - Non-Standard Encoding
Threat description: FunnyDream can enumerate all logical drives on a targeted machine.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Calisto adds a .plist file to the /Library/LaunchAgents folder to maintain persistence.
MITRE ATT&CK techniques:
- T1543.001: Create or Modify System Process - Launch Agent
Threat description: TA505 has used stolen domain admin accounts to compromise additional hosts.
MITRE ATT&CK techniques:
- T1078.002: Valid Accounts - Domain Accounts
Threat description: Ramsay can take screenshots every 30 seconds as well as when an external removable storage device is connected.
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: menuPass has used the Csvde tool to collect Active Directory files and data.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: Cyclops Blink can encrypt C2 messages with AES-256-CBC sent underneath TLS. OpenSSL library functions are also used to encrypt each message using a randomly generated key and IV, which are then encrypted using a hard-coded RSA public key.
MITRE ATT&CK techniques:
- T1573.002: Encrypted Channel - Asymmetric Cryptography
Threat description: Stolen Pencil has a tool to log keystrokes to %userprofile%\appdata\roaming\apach.{txt,log}.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: During Operation Wocao, the threat actors executed `/c cd /d c:\windows\temp\ & reg query HKEY_CURRENT_USER\Software\<username>\PuTTY\Sessions\` to detect recent PuTTY sessions, likely to further lateral movement.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: APT39 has used malware disguised as Mozilla Firefox and a tool named mfevtpse.exe to proxy C2 communications, closely mimicking a legitimate McAfee file mfevtps.exe.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: WarzoneRAT has the ability to control an infected PC using RDP.
MITRE ATT&CK techniques:
- T1021.001: Remote Services - Remote Desktop Protocol
Threat description: Cobalt Strike can use "WinRM" to execute a payload on a remote host.
MITRE ATT&CK techniques:
- T1021.006: Remote Services - Windows Remote Management
Threat description: ComRAT has been programmed to sleep outside local business hours (9 to 5, Monday to Friday).
MITRE ATT&CK techniques:
- T1029: Scheduled Transfer
Threat description: Dok uses AppleScript to create a login item for persistence.
MITRE ATT&CK techniques:
- T1059.002: Command and Scripting Interpreter - AppleScript
Threat description: Squirrelwaffle has used `cmd.exe` for execution.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: A Threat Group-3390 tool has created new Registry keys under `HKEY_CURRENT_USER\Software\Classes\` and `HKLM\SYSTEM\CurrentControlSet\services`.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: SUNBURST had a command to delete files.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: Ramsay can use Windows API functions such as "WriteFile", "CloseHandle", and "GetCurrentHwProfile" during its collection and file storage operations. Ramsay can execute its embedded components via "CreateProcessA" and "ShellExecute".
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: QakBot can execute WMI queries to gather information.
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: Chimera has used the "get -b <start ip> -e <end ip> -p" command for network scanning as well as a custom Python tool  packed into a Windows executable named Get.exe to scan IP ranges for HTTP.
MITRE ATT&CK techniques:
- T1046: Network Service Discovery
Threat description: Honeybee removes batch files to reduce fingerprint on the system as well as deletes the CAB file that gets encoded upon infection.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: CopyKittens has used PowerShell Empire.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: Lokibot can search for specific files on an infected host.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: During Night Dragon, threat actors purchased hosted services to use for C2.
MITRE ATT&CK techniques:
- T1583.004: Acquire Infrastructure - Server
Threat description: UPPERCUT has the capability to gather the victim's current directory.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: Ursnif has used a 30 minute delay after execution to evade sandbox monitoring tools.
MITRE ATT&CK techniques:
- T1497.003: Virtualization/Sandbox Evasion - Time Based Evasion
Threat description: Transparent Tribe has dropped encoded executables on compromised hosts.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Cobalt Strike can set its "beacon" payload to reach out to the C2 server on an arbitrary and random interval. In addition it will break large data sets into smaller chunks for exfiltration.
MITRE ATT&CK techniques:
- T1029: Scheduled Transfer
Threat description: WindTail has the ability to receive and execute a self-delete command.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: Stuxnet can delete OLE Automation and SQL stored procedures used to store malicious payloads.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: Confucius has lured victims to execute malicious attachments included in crafted spearphishing emails related to current topics.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: Octopus can collect system drive information, the computer name, the size of the disk, OS version, and OS architecture information.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Turla has used shellcode to download Meterpreter after compromising a victim.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Mythic supports HTTP-based C2 profiles.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: BabyShark has downloaded additional files from the C2.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Rocke has extracted tar.gz files after downloading them from a C2 server.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: FIN8 executes commands remotely via cmd.exe.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: FIN10 has used RDP to move laterally to systems in the victim environment.
MITRE ATT&CK techniques:
- T1021.001: Remote Services - Remote Desktop Protocol
Threat description: Ixeshe collects the username from the victim’s machine.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: Empire can conduct command and control over protocols like HTTP and HTTPS.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: Kazuar uses /bin/bash to execute commands on the victim’s machine.
MITRE ATT&CK techniques:
- T1059.004: Command and Scripting Interpreter - Unix Shell
Threat description: BADNEWS can use multiple C2 channels, including RSS feeds, Github, forums, and blogs.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: Exaramel for Linux can execute commands with high privileges via a specific binary with setuid functionality.
MITRE ATT&CK techniques:
- T1548.001: Abuse Elevation Control Mechanism - Setuid and Setgid
Threat description: StreamEx has the ability to enumerate processes.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: HEXANE has run `whoami` on compromised machines to identify the current user.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: HyperBro can unpack and decrypt its payload prior to execution.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Ruler can be used to automate the abuse of Outlook Rules to establish persistence.
MITRE ATT&CK techniques:
- T1137.005: Office Application Startup - Outlook Rules
Threat description: Pteranodon creates various subdirectories under "%Temp%\reports\%" and copies files to those subdirectories. It also creates a folder at "C:\Users\<Username>\AppData\Roaming\Microsoft\store" to store screenshot JPEG files.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: Siloscape can run cmd through an IRC channel.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Operation Wocao has used a script to collect information about the infected system.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: SoreFang has the ability to list directories.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: LazyScripter has lured users to open malicious email attachments.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: Revenge RAT used blogpost.com as its primary command and control server during a campaign.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: AppleJeus has decoded files received from a C2.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: HEXANE has used a VisualBasic script named `MicrosoftUpdator.vbs` for execution of a PowerShell keylogger.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: can collect system information, including computer name, system manufacturer, IsDebuggerPresent state, and execution path.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
- T1082: System Information Discovery
Threat description: Mustang Panda has used "InstallUtil.exe" to execute a malicious Beacon stager.
MITRE ATT&CK techniques:
- T1218.004: System Binary Proxy Execution - InstallUtil
Threat description: TajMahal has the ability to steal web session cookies from Internet Explorer, Netscape Navigator, FireFox and RealNetworks applications.
MITRE ATT&CK techniques:
- T1539: Steal Web Session Cookie
Threat description: APT18 uses HTTP for C2 communications.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: Bumblebee has used `rundll32` for execution of the loader component.
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: jRAT payloads have been packed.
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: Clambling has the ability to use Telnet for communication.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: MoleNet can execute commands via the command line utility.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: APT41 used certutil to download additional files.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: During Night Dragon, threat actors used administrative utilities to deliver Trojan components to remote systems.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Micropsia creates a new hidden directory to store all components' outputs in a dedicated sub-folder for each.
MITRE ATT&CK techniques:
- T1564.001: Hide Artifacts - Hidden Files and Directories
Threat description: Kivars has the ability to remotely trigger keyboard input and mouse clicks.
MITRE ATT&CK techniques:
- T1021: Remote Services
Threat description: ROKRAT has used legitimate social networking sites and cloud platforms (including but not limited to Twitter, Yandex, Dropbox, and Mediafire) for C2 communications.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: BackConfig has used compressed and decimal encoded VBS scripts.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Night Dragon has performed SQL injection attacks of extranet web servers to gain access.
MITRE ATT&CK techniques:
- T1190: Exploit Public-Facing Application
Threat description: HAWKBALL has sent system information and files over the C2 channel.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Chinoxy has established persistence via the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` registry key and by loading a dropper to `(%COMMON_ STARTUP%\\eoffice.exe)`.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Clambling can use Dropbox to download malicious payloads, send commands, and receive information.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: Diavol can delete shadow copies using the `IVssBackupComponents` COM object to call the `DeleteSnapshots` method.
MITRE ATT&CK techniques:
- T1490: Inhibit System Recovery
Threat description: MURKYTOP has the capability to scan for open ports on hosts in a connected network.
MITRE ATT&CK techniques:
- T1046: Network Service Discovery
Threat description: BendyBear can load and execute modules and Windows Application Programming (API) calls using standard shellcode API hashing.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: RATANKBA uses the command "reg query “HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings”".
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: Remsec can obtain a list of active connections and open ports.
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
Threat description: Tropic Trooper has used JPG files with encrypted payloads to mask their backdoor routines and evade detection.
MITRE ATT&CK techniques:
- T1027.003: Obfuscated Files or Information - Steganography
Threat description: SDBbot has the ability to XOR the strings for its installer component with a hardcoded 128 byte key.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: SUGARDUMP has sent stolen credentials and other data to its C2 server.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: APT29 has used spearphishing emails with an attachment to deliver files with exploits to initial victims.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: POWERSTATS encoded C2 traffic with base64.
MITRE ATT&CK techniques:
- T1001: Data Obfuscation
- T1132.001: Data Encoding - Standard Encoding
Threat description: InvisiMole can use a JavaScript file as part of its execution chain.
MITRE ATT&CK techniques:
- T1059.007: Command and Scripting Interpreter - JavaScript
Threat description: Molerats has sent phishing emails with malicious Microsoft Word and PDF attachments.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: SHARPSTATS has the ability to identify the current date and time on the compromised host.
MITRE ATT&CK techniques:
- T1124: System Time Discovery
Threat description: Magic Hound malware has used Registry Run keys to establish persistence.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Ember Bear has executed a batch script designed to disable Windows Defender on a compromised host.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: Hancitor  has added Registry Run keys to establish persistence.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Sidewinder has used HTTP in C2 communications.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: APT39 has used PowerShell to execute malicious code.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: Octopus has been delivered via spearsphishing emails.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: BBK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: TrickBot leverages a custom packer to obfuscate its functionality.
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: Wizard Spider has sent phishing emails containing a link to an actor-controlled Google Drive document or other free online file hosting services.
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: Cobian RAT has a feature to access the webcam on the victim’s machine.
MITRE ATT&CK techniques:
- T1125: Video Capture
Threat description: Wizard Spider has used “systeminfo” and similar commands to acquire detailed configuration information of a victim machine.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: BackConfig has hidden malicious payloads in "%USERPROFILE%\Adobe\Driver\dwg\" and mimicked the legitimate DHCP service binary.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Egregor has used batch files for execution and can launch Internet Explorer from cmd.exe.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Stolen Pencil has a tool to sniff the network for passwords.
MITRE ATT&CK techniques:
- T1040: Network Sniffing