QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: PLAINTEE uses cmd.exe to execute commands on the victim’s machine.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: NBTscan can be used to collect MAC addresses.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: ZeroT can add a new service to ensure PlugX persists on the system when delivered as another payload onto the system.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: DLL side-loading has been used to execute BBSRAT through a legitimate Citrix executable, ssonsvr.exe. The Citrix executable was dropped along with BBSRAT by the dropper.
MITRE ATT&CK techniques:
- T1574.002: Hijack Execution Flow - DLL Side-Loading
Threat description: KONNI has hardcoded API calls within its functions to use on the victim's machine.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: The Remsec loader implements itself with the name Security Support Provider, a legitimate Windows function. Various Remsec .exe files mimic legitimate file names used by Microsoft, Symantec, Kaspersky, Hewlett-Packard, and VMWare. Remsec also disguised malicious modules using similar filenames as custom network encryption software on victims.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Machete has sent phishing emails that contain a link to an external server with ZIP and RAR archives.
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: Spark can use cmd.exe to run commands.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Gallmaker has used WinZip, likely to archive data prior to exfiltration.
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: WarzoneRAT has been distributed as a malicious attachment within an email.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: SUNBURST C2 data attempted to appear as benign XML related to .NET assemblies or as a faux JSON blob.
MITRE ATT&CK techniques:
- T1001.002: Data Obfuscation - Steganography
Threat description: Operation Wocao has archived collected files with WinRAR, prior to exfiltration.
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: Koadic can retrieve the contents of the IP routing table as well as information about the Windows domain.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: Volgmer can gather a list of processes.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: VaporRage has the ability to download malicious shellcode to compromised systems.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Out1 can parse e-mails on a target machine.
MITRE ATT&CK techniques:
- T1114.001: Email Collection - Local Email Collection
Threat description: APT19 used an HTTP malware variant and a Port 22 malware variant to collect the victim’s username.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: menuPass has used several tools to scan for open NetBIOS nameservers and enumerate NetBIOS sessions.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: KOCTOPUS has been disguised as legitimate software programs associated with the travel and airline industries.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Kimsuky has obfuscated binary strings including the use of XOR encryption and Base64 encoding. Kimsuky has also modified the first byte of DLL implants targeting victims to prevent recognition of the executable file format.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: POWRUNER may query the Registry by running "reg query" on a victim.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: Dragonfly has added newly created accounts to the administrators group to maintain elevated access.
MITRE ATT&CK techniques:
- T1098: Account Manipulation
Threat description: Earth Lusca has used WinRAR to compress stolen files into an archive prior to exfiltration.
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: Molerats has created scheduled tasks to persistently run VBScripts.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: UNC2452 exploited CVE-2020-0688 against the Microsoft Exchange Control Panel to regain access to a network.
MITRE ATT&CK techniques:
- T1190: Exploit Public-Facing Application
Threat description: Bandook can support commands to execute Python-based payloads.
MITRE ATT&CK techniques:
- T1059.006: Command and Scripting Interpreter - Python
Threat description: OopsIE encodes data in hexadecimal format over the C2 channel.
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: APT29 used the "Get-AcceptedDomain" PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell. They also used AdFind to enumerate domains and to discover trust between federated domains.
MITRE ATT&CK techniques:
- T1482: Domain Trust Discovery
Threat description: FIN6 has used tools like Adfind to query users, groups, organizational units, and trusts.
MITRE ATT&CK techniques:
- T1069.002: Permission Groups Discovery - Domain Groups
Threat description: HTTPBrowser abuses the Windows DLL load order by using a legitimate Symantec anti-virus binary, VPDN_LU.exe, to load a malicious DLL that mimics a legitimate Symantec DLL, navlu.dll.
MITRE ATT&CK techniques:
- T1574.001: Hijack Execution Flow - DLL Search Order Hijacking
Threat description: Proxysvc can overwrite files indicated by the attacker before deleting them.
MITRE ATT&CK techniques:
- T1485: Data Destruction
Threat description: InvisiMole can gather information on the mapped drives, OS version, computer name, DEP policy, memory size, and system volume serial number.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: APT28 has used the WindowStyle parameter to conceal PowerShell windows.
MITRE ATT&CK techniques:
- T1564.003: Hide Artifacts - Hidden Window
Threat description: RainyDay can use proxy tools including boost_proxy_client for reverse proxy functionality.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: Impacket modules like GetUserSPNs can be used to get Service Principal Names (SPNs) for user accounts. The output is formatted to be compatible with cracking tools like John the Ripper and Hashcat.
MITRE ATT&CK techniques:
- T1558.003: Steal or Forge Kerberos Tickets - Kerberoasting
Threat description: Penquin can execute the command code "do_upload" to send files to C2.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Crutch can automatically monitor removable drives in a loop and copy interesting files.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: Honeybee gathers computer name and information using the "systeminfo" command.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Egregor can modify the GPO to evade detection.
MITRE ATT&CK techniques:
- T1484.001: Domain or Tenant Policy Modification - Group Policy Modification
Threat description: Cleaver has obtained and used open-source tools such as PsExec, Windows Credential Editor, and Mimikatz.
MITRE ATT&CK techniques:
- T1588.002: Obtain Capabilities - Tool
Threat description: Chaes has used Python scripts for execution and the installation of additional files.
MITRE ATT&CK techniques:
- T1059.006: Command and Scripting Interpreter - Python
Threat description: FinFisher checks its parent process for indications that it is running in a sandbox setup.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: Mosquito's installer searches the Registry and system to see if specific antivirus tools are installed on the system.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: Chaes has used encryption for its C2 channel.
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: The Carbanak malware communicates to its command server using HTTP with an encrypted payload.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: After escalating privileges, MegaCortex calls "TerminateProcess()", "CreateRemoteThread", and other Win32 APIs.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: Meteor can change both the desktop wallpaper and the lock screen image to a custom image.
MITRE ATT&CK techniques:
- T1491.001: Defacement - Internal Defacement
Threat description: ZIRCONIUM has used AES encrypted communications in C2.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: Final1stspy obfuscates strings with base64 encoding.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: FELIXROOT opens a remote shell to execute commands on the infected system.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: TajMahal has used an encrypted Virtual File System to store plugins.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Final1stspy obtains a list of running processes.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: WannaCry uses an exploit in SMBv1 to spread itself to other remote systems on a network.
MITRE ATT&CK techniques:
- T1210: Exploitation of Remote Services
Threat description: Magic Hound has used multiple web shells to gain execution.
MITRE ATT&CK techniques:
- T1505.003: Server Software Component - Web Shell
Threat description: Cardinal RAT uses a secret key with a series of XOR and addition operations to encrypt C2 traffic.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: Rocke has installed an "init.d" startup script to maintain persistence.
MITRE ATT&CK techniques:
- T1037: Boot or Logon Initialization Scripts
Threat description: Bisonal will delete its dropper and VBS scripts from the victim’s machine.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: ThiefQuest uses the function "kill_unwanted" to obtain a list of running processes and kills each process matching a list of security related processes.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: POWRUNER may collect active network connections by running "netstat -an" on a victim.
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
Threat description: Threat Group-3390 has used appcmd.exe to disable logging on a victim server.
MITRE ATT&CK techniques:
- T1562.002: Impair Defenses - Disable Windows Event Logging
Threat description: For Operation CuckooBees, the threat actors obtained publicly-available JSP code that was used to deploy a webshell onto a compromised server.
MITRE ATT&CK techniques:
- T1588.002: Obtain Capabilities - Tool
Threat description: Astaroth's initial payload is a malicious .LNK file.
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: APT38 has used Task Scheduler to run programs at system startup or on a scheduled basis for persistence.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: Bundlore can change browser security settings to enable extensions to be installed. Bundlore uses the "pkill cfprefsd" command to prevent users from inspecting processes.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: Bonadan can download an additional module which has a cryptocurrency mining extension.
MITRE ATT&CK techniques:
- T1496: Resource Hijacking
Threat description: Wiarp creates a backdoor through which remote attackers can create a service.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: Dragonfly 2.0 commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files.
MITRE ATT&CK techniques:
- T1505.003: Server Software Component - Web Shell
Threat description: AppleSeed can identify the OS version of a targeted system.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: TYPEFRAME can gather the disk volume information.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: APT29 has used PowerShell to discover domain accounts by executing "Get-ADUser" and "Get-DGroupMember".
MITRE ATT&CK techniques:
- T1087.002: Account Discovery - Domain Account
Threat description: Molerats has sent malicious links via email trick users into opening a RAR archive and running an executable.
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
Threat description: Kobalos encrypts all strings using RC4 and bundles all functionality into a single function call.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Nomadic Octopus as attempted to lure victims into clicking on malicious attachments within spearphishing emails.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: BLINDINGCAN has been packed with the UPX packer.
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: LightNeuron gathers information about network adapters using the Win32 API call "GetAdaptersInfo".
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: Imminent Monitor has decoded malware components that are then dropped to the system.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Indrik Spider has used the win32_service WMI class to retrieve a list of services from the system.
MITRE ATT&CK techniques:
- T1007: System Service Discovery
Threat description: menuPass has resized and added data to the certificate table to enable the signing of modified files with legitimate signatures.
MITRE ATT&CK techniques:
- T1553.002: Subvert Trust Controls - Code Signing
Threat description: APT28 has used COM hijacking for persistence by replacing the legitimate "MMDeviceEnumerator" object with a payload.
MITRE ATT&CK techniques:
- T1546.015: Event Triggered Execution - Component Object Model Hijacking
Threat description: ComRAT can use SSL/TLS encryption for its HTTP-based C2 channel. ComRAT has used public key cryptography with RSA and AES encrypted email attachments for its Gmail C2 channel.
MITRE ATT&CK techniques:
- T1573.002: Encrypted Channel - Asymmetric Cryptography
Threat description: CosmicDuke attempts to exploit privilege escalation vulnerabilities CVE-2010-0232 or CVE-2010-4398.
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
Threat description: Bisonal's DLL file and non-malicious decoy file are encrypted with RC4 and some function name strings are obfuscated.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Lucifer can infect victims by brute forcing SMB.
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
Threat description: HAWKBALL has exploited Microsoft Office vulnerabilities CVE-2017-11882 and CVE-2018-0802 to deliver the payload.
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
Threat description: Magic Hound has created fake LinkedIn and other social media accounts to contact targets and convince them--through messages and voice communications--to open malicious links.
MITRE ATT&CK techniques:
- T1585.001: Establish Accounts - Social Media Accounts
Threat description: Dyre has the ability to identify running services on a compromised host.
MITRE ATT&CK techniques:
- T1007: System Service Discovery
Threat description: Ixeshe can achieve persistence by adding itself to the "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" Registry key.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: FlawedAmmyy can collect the victim's operating system and computer name during the initial infection.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Earth Lusca has compromised Google Drive repositories.
MITRE ATT&CK techniques:
- T1584.006: Compromise Infrastructure - Web Services
Threat description: SUGARDUMP variants have harvested credentials from browsers such as Firefox, Chrome, Opera, and Edge.
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
Threat description: LAPSUS$ has searched a victim's network for code repositories like GitLab and GitHub to discover further high-privilege account credentials.
MITRE ATT&CK techniques:
- T1213.003: Data from Information Repositories - Code Repositories
Threat description: Mustang Panda has exploited CVE-2017-0199 in Microsoft Word to execute code.
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
Threat description: Industroyer can use an arbitrary system service to load at system boot for persistence and replaces the ImagePath registry value of a Windows service with a new backdoor binary.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: PowerLess can use base64 and AES ECB decryption prior to execution of downloaded modules.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Chaes stored its instructions in a config file in the Registry.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: Dragonfly has modified the Registry to perform multiple techniques through the use of Reg.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: DarkWatchman can list signed PnP drivers for smartcard readers.
MITRE ATT&CK techniques:
- T1120: Peripheral Device Discovery
Threat description: Sandworm Team's BCS-server tool can create an internal proxy server to redirect traffic from the adversary-controlled C2 to internal servers which may not be connected to the internet, but are interconnected locally.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: Chaes has used the Puppeteer module to hook and monitor the Chrome web browser to collect user information from infected hosts.
MITRE ATT&CK techniques:
- T1185: Browser Session Hijacking
Threat description: A module in Prikormka collects information from the victim about its IP addresses and MAC addresses.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: QuasarRAT can retrieve files from compromised client machines.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Mimikatz’s "LSADUMP::DCShadow" module can be used to make AD updates by temporarily setting a computer to be a DC.
MITRE ATT&CK techniques:
- T1207: Rogue Domain Controller
Threat description: NETEAGLE is capable of reading files over the C2 channel.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Sibot has used a legitimate compromised website to download DLLs to the victim's machine.
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: Windshift has used fake personas on social media to engage and target victims.
MITRE ATT&CK techniques:
- T1566.003: Phishing - Spearphishing via Service
Threat description: TA459 has exploited Microsoft Word vulnerability CVE-2017-0199 for execution.
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
Threat description: APT-C-36 has downloaded binary data from a specified domain after the malicious document is opened.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: ComRAT has used unique per machine passwords to decrypt the orchestrator payload and a hardcoded XOR key to decrypt its communications module. ComRAT has also used a unique password to decrypt the file used for its hidden file system.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Remexi silently executes received commands with cmd.exe.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Carbon has used RSA encryption for C2 communications.
MITRE ATT&CK techniques:
- T1573.002: Encrypted Channel - Asymmetric Cryptography
Threat description: Bumblebee has the ability to identify the user name.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: GreyEnergy chooses a service, drops a DLL file, and writes it to that serviceDLL Registry key.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: Wiarp creates a backdoor through which remote attackers can download files.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Tonto Team abuses a legitimate and signed Microsoft executable to launch a malicious DLL.
MITRE ATT&CK techniques:
- T1574.001: Hijack Execution Flow - DLL Search Order Hijacking
Threat description: Flagpro has been used to execute "netstat -ano" on a compromised host.
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
Threat description: For FunnyDream, the threat actors registered a variety of domains.
MITRE ATT&CK techniques:
- T1583.001: Acquire Infrastructure - Domains
Threat description: During CostaRicto, the threat actors collected data and files from compromised networks.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: APT29 staged data and files in password-protected archives on a victim's OWA server.
MITRE ATT&CK techniques:
- T1074.002: Data Staged - Remote Data Staging
Threat description: Fox Kitten has used WizTree to obtain network files and directory listings.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: TeamTNT has established persistence through the creation of a cryptocurrency mining system service using "systemctl".
MITRE ATT&CK techniques:
- T1543.002: Create or Modify System Process - Systemd Service
Threat description: Tropic Trooper has leveraged the BITSadmin command-line tool to create a job and launch a malicious process.
MITRE ATT&CK techniques:
- T1197: BITS Jobs
Threat description: HermeticWiper can use `cmd.exe /Q/c move CSIDL_SYSTEM_DRIVE\temp\sys.tmp1 CSIDL_WINDOWS\policydefinitions\postgresql.exe 1> \\127.0.0.1\ADMIN$\_1636727589.6007507 2>&1` to deploy on an infected system.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: RainyDay has named services and scheduled tasks to appear benign including "ChromeCheck" and "googleupdate."
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: EKANS stops processes related to security and management software.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: Daserf uses RC4 encryption to obfuscate HTTP traffic.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: APT29 has used a compromised O365 administrator account to create a new Service Principal.
MITRE ATT&CK techniques:
- T1078.004: Valid Accounts - Cloud Accounts
Threat description: Rancor attempted to get users to click on an embedded macro within a Microsoft Office Excel document to launch their malware.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: Sibot has used WMI to discover network connections and configurations. Sibot has also used the Win32_Process class to execute a malicious DLL.
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: Accounts created by Dragonfly masqueraded as legitimate service accounts.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: WarzoneRAT can collect data from a compromised host.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Metamorfo has configured persistence to the Registry ket "HKCU\Software\Microsoft\Windows\CurrentVersion\Run, Spotify =% APPDATA%\Spotify\Spotify.exe" and used .LNK files in the startup folder to achieve persistence.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: CSPY Downloader can search loaded modules, PEB structure, file paths, Registry keys, and memory to determine if it is being debugged or running in a virtual environment.
MITRE ATT&CK techniques:
- T1497.001: Virtualization/Sandbox Evasion - System Checks
Threat description: HermeticWiper can disable the VSS service on a compromised host using the service control manager.
MITRE ATT&CK techniques:
- T1490: Inhibit System Recovery
Threat description: NETEAGLE will attempt to detect if the infected host is configured to a proxy. If so, NETEAGLE will send beacons via an HTTP POST request. NETEAGLE will also use HTTP to download resources that contain an IP address and Port Number pair to connect to for further C2.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: Calisto has the capability to add its own account to the victim's machine.
MITRE ATT&CK techniques:
- T1136.001: Create Account - Local Account
Threat description: Remcos takes automated screenshots of the infected machine.
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: Crimson can check the Registry for the presence of "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\last_edate" to determine how long it has been installed on a host.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: Empire can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks.
MITRE ATT&CK techniques:
- T1557.001: Adversary-in-the-Middle - LLMNR/NBT-NS Poisoning and SMB Relay
Threat description: GRIFFON has used PowerShell to execute the Meterpreter downloader TinyMet.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: MarkiRAT can utilize cmd.exe to execute commands in a victim's environment.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: During C0015, PowerView's file share enumeration results were stored in the file `c:\ProgramData\found_shares.txt`.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: Denis replaces the nonexistent Windows DLL "msfte.dll" with its own malicious version, which is loaded by the SearchIndexer.exe and SearchProtocolHost.exe.
MITRE ATT&CK techniques:
- T1574: Hijack Execution Flow
Threat description: Operation Wocao has used the command "net localgroup administrators" to list all administrators part of a local group.
MITRE ATT&CK techniques:
- T1069.001: Permission Groups Discovery - Local Groups
Threat description: STARWHALE can use the VBScript function `GetRef` as part of its persistence mechanism.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: Astaroth can abuse alternate data streams (ADS) to store content for malicious payloads.
MITRE ATT&CK techniques:
- T1564.004: Hide Artifacts - NTFS File Attributes
Threat description: Cannon can obtain victim drive information as well as a list of folders in C:\Program Files.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: Helminth establishes persistence by creating a shortcut in the Start Menu folder.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: MuddyWater has used the .NET csc.exe tool to compile executables from downloaded C# code.
MITRE ATT&CK techniques:
- T1027.004: Obfuscated Files or Information - Compile After Delivery
Threat description: yty packs a plugin with UPX.
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: Dyre has the ability to identify installed programs on a compromised host.
MITRE ATT&CK techniques:
- T1518: Software Discovery
Threat description: Moses Staff collected information about the infected host, including the machine names and OS architecture.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: OSX/Shlayer can disable Gatekeeper using the native "spctl" application.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: Blue Mockingbird has obtained and used tools such as Mimikatz.
MITRE ATT&CK techniques:
- T1588.002: Obtain Capabilities - Tool
Threat description: Lokibot has modified the Registry as part of its UAC bypass process.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: Lazarus Group has obtained a variety of tools for their operations, including Responder, PuTTy PSCP, Wake-On-Lan, ChromePass, and dbxcli.
MITRE ATT&CK techniques:
- T1588.002: Obtain Capabilities - Tool
Threat description: Turian can retrieve usernames.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: Anchor has used NTFS to hide files.
MITRE ATT&CK techniques:
- T1564.004: Hide Artifacts - NTFS File Attributes
Threat description: Conti has loaded an encrypted DLL into memory and then executes it.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: MoleNet can use WMI commands to check the system for firewall and antivirus software.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: KEYMARBLE can capture screenshots of the victim’s machine.
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: Kazuar captures screenshots of the victim’s screen.
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: Babuk can use ChaCha8 and ECDH to encrypt data.
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: Attor's dispatcher can be executed as a service.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: Cobalt Strike can start a VNC-based remote desktop server and tunnel the connection through the already established C2 channel.
MITRE ATT&CK techniques:
- T1021.001: Remote Services - Remote Desktop Protocol
Threat description: Regin leveraged several compromised universities as proxies to obscure its origin.
MITRE ATT&CK techniques:
- T1090.002: Proxy - External Proxy
Threat description: ZxShell can leverage native API including "RegisterServiceCtrlHandler " to register a service.RegisterServiceCtrlHandler
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: The White Company has the ability to delete its malware entirely from the target system.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: FIN7 has performed C2 using DNS via A, OPT, and TXT records.
MITRE ATT&CK techniques:
- T1071.004: Application Layer Protocol - DNS
Threat description: BISCUIT has a command to gather the username from the system.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: Chimera has used custom DLLs for continuous retrieval of data from memory.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: MCMD can launch a console process (cmd.exe) with redirected standard input and output.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Exaramel for Windows automatically encrypts files before sending them to the C2 server.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: Bisonal has renamed malicious code to `msacm32.dll` to hide within a legitimate library; earlier versions were disguised as `winhelp`.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Caterpillar WebShell can run commands on the compromised asset with CMD functions.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Based on comparison of Gazer versions, Turla made an effort to obfuscate strings in the malware that could be used as IoCs, including the mutex name and named pipe.
MITRE ATT&CK techniques:
- T1027.005: Obfuscated Files or Information - Indicator Removal from Tools
Threat description: An APT3 downloader creates persistence by creating the following scheduled task: "schtasks /create /tn "mysc" /tr C:\Users\Public\test.exe /sc ONLOGON /ru "System"".
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: SoreFang can collect usernames from the local system via "net.exe user".
MITRE ATT&CK techniques:
- T1087.001: Account Discovery - Local Account
Threat description: CharmPower can collect data and files from a compromised host.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Linfo creates a backdoor through which remote attackers can download files onto compromised hosts.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: njRAT will attempt to detect if the victim system has a camera during the initial infection. njRAT can also detect any removable drives connected to the system.
MITRE ATT&CK techniques:
- T1120: Peripheral Device Discovery
Threat description: HAWKBALL has used HTTP to communicate with a single hard-coded C2 server.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: TeamTNT executed Hildegard through the kubelet API run command and by executing commands on running containers.
MITRE ATT&CK techniques:
- T1609: Container Administration Command
Threat description: Turla surveys a system upon check-in to discover running processes using the "tasklist /v" command. Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: Machete stores zipped files with profile data from installed web browsers.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: gh0st RAT has decrypted and loaded the gh0st RAT DLL into memory, once the initial dropper executable is launched.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Rocke has cleared log files within the /var/log/ folder.
MITRE ATT&CK techniques:
- T1070.002: Indicator Removal - Clear Linux or Mac System Logs
Threat description: TA505 has used malware to gather credentials from Internet Explorer.
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
Threat description: Moses Staff has collected the domain name of a compromised network.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: Lokibot has the ability to copy itself to a hidden file and directory.
MITRE ATT&CK techniques:
- T1564.001: Hide Artifacts - Hidden Files and Directories
Threat description: Configuration data used by Rising Sun has been encrypted using an RC4 stream algorithm.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: TrickBot obtains the IP address, location, and other relevant network information from the victim’s machine.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: CozyCar uses Twitter as a backup C2 channel to Twitter accounts specified in its configuration file.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: FELIXROOT gathers the time zone information from the victim’s machine.
MITRE ATT&CK techniques:
- T1124: System Time Discovery
Threat description: Agent Tesla has been executed through malicious e-mail attachments
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: BRONZE BUTLER has exfiltrated files stolen from file shares.
MITRE ATT&CK techniques:
- T1039: Data from Network Shared Drive
Threat description: Flame can use Windows Authentication Packages for persistence.
MITRE ATT&CK techniques:
- T1547.002: Boot or Logon Autostart Execution - Authentication Package
Threat description: Bandook has a command to get the public IP address from a system.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: BADCALL disables the Windows firewall before binding to a port.
MITRE ATT&CK techniques:
- T1562.004: Impair Defenses - Disable or Modify System Firewall
Threat description: For C0010, UNC3890 actors staged malware on their infrastructure for direct download onto a compromised system.
MITRE ATT&CK techniques:
- T1608.001: Stage Capabilities - Upload Malware
Threat description: Kimsuky has the ability to enumerate all files and directories on an infected system.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: Turla surveys a system upon check-in to discover active local network connections using the "netstat -an", "net use", "net file", and "net session" commands. Turla RPC backdoors have also enumerated the IPv4 TCP connection table via the "GetTcpTable2" API call.
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
Threat description: FELIXROOT executes batch scripts on the victim’s machine, and can launch a reverse shell for command execution.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: ShimRatReporter gathered the operating system name and specific Windows version of an infected machine.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Moses Staff has exploited known vulnerabilities in public-facing infrastructure such as Microsoft Exchange Servers.
MITRE ATT&CK techniques:
- T1190: Exploit Public-Facing Application
Threat description: FatDuke has attempted to mimic a compromised user's traffic by using the same user agent as the installed browser.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: Pteranodon can download and execute additional files.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Kimsuky has been observed disabling the system firewall.
MITRE ATT&CK techniques:
- T1562.004: Impair Defenses - Disable or Modify System Firewall
Threat description: LoudMiner launched the QEMU services in the "/Library/LaunchDaemons/" folder using "launchctl". It also uses "launchctl" to unload all Launch Daemons when updating to a newer version of LoudMiner.
MITRE ATT&CK techniques:
- T1569.001: System Services - Launchctl
Threat description: Seth-Locker can encrypt files on a targeted system, appending them with the suffix .seth.
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: Ember Bear has attempted to lure users to click on a malicious link within a spearphishing email.
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
Threat description: ShimRat has used a secondary C2 location if the first was unavailable.
MITRE ATT&CK techniques:
- T1008: Fallback Channels
Threat description: Empire has the ability to obfuscate commands using "Invoke-Obfuscation".
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Operation Wocao's proxy implementation "Agent" can upgrade the socket in use to a TLS socket.
MITRE ATT&CK techniques:
- T1573.002: Encrypted Channel - Asymmetric Cryptography
Threat description: Turla RPC backdoors can upload files from victim machines.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: BackdoorDiplomacy has dropped legitimate software onto a compromised host and used it to execute malicious DLLs.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: The ZLib backdoor compresses communications using the standard Zlib compression library.
MITRE ATT&CK techniques:
- T1560.002: Archive Collected Data - Archive via Library
Threat description: ccf32 has used `xcopy \\<target_host>\c$\users\public\path.7z c:\users\public\bin\<target_host>.7z /H /Y` to archive collected files.
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: Kwampirs establishes persistence by adding a new service with the display name "WMI Performance Adapter Extension" in an attempt to masquerade as a legitimate WMI service.
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: For Operation Wocao, the threat actors purchased servers with Bitcoin to use during the operation.
MITRE ATT&CK techniques:
- T1583.004: Acquire Infrastructure - Server
Threat description: POORAIM can identify system information, including battery status.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Kazuar is obfuscated using the open source ConfuserEx protector. Kazuar also obfuscates the name of created files/folders/mutexes and encrypts debug messages written to log files using the Rijndael cipher.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: APT3 leverages valid accounts after gaining credentials for use within the victim domain.
MITRE ATT&CK techniques:
- T1078.002: Valid Accounts - Domain Accounts
Threat description: Dragonfly has collected data from local victim systems.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: GALLIUM used dumped hashes to authenticate to other machines via pass the hash.
MITRE ATT&CK techniques:
- T1550.002: Use Alternate Authentication Material - Pass the Hash
Threat description: ZLib has the ability to enumerate system information.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Nebulae can use RC4 and XOR to encrypt C2 communications.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: APT3 has been known to stage files for exfiltration in a single location.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: Grandoreiro has been spread via malicious links embedded in e-mails.
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: BRONZE BUTLER has used "net user /domain" to identify account information.
MITRE ATT&CK techniques:
- T1087.002: Account Discovery - Domain Account
Threat description: Kimsuky has hosted content used for targeting efforts via web services such as Blogspot.
MITRE ATT&CK techniques:
- T1583.006: Acquire Infrastructure - Web Services
Threat description: FIN6 has used tools to exploit Windows vulnerabilities in order to escalate privileges. The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
Threat description: APT29 has conducted enumeration of Azure AD accounts.
MITRE ATT&CK techniques:
- T1087.004: Account Discovery - Cloud Account
Threat description: Hancitor has used PowerShell to execute commands.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: PlugX can enumerate and query for information contained within the Windows Registry.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: Revenge RAT has a plugin for screen capture.
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: RainyDay can use services to establish persistence.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: During Operation Wocao, threat actors exfiltrated files and directories of interest from the targeted system.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: CookieMiner has looked for files in the user's home directory with "wallet" in their name using "find".
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: WINDSHIELD is capable of file deletion along with other file system interaction.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: BackdoorDiplomacy has used SMBTouch, a vulnerability scanner, to determine whether a target is vulnerable to EternalBlue malware.
MITRE ATT&CK techniques:
- T1046: Network Service Discovery
Threat description: Blue Mockingbird has used batch script files to automate execution and deployment of payloads.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: DCSrv has encrypted drives using the core encryption mechanism from DiskCryptor.
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: Hi-Zor executes using regsvr32.exe called from the Registry Run Keys / Startup Folder persistence mechanism.
MITRE ATT&CK techniques:
- T1218.010: System Binary Proxy Execution - Regsvr32
Threat description: InvisiMole can launch a remote shell to execute commands.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: LitePower can use HTTP and HTTPS for C2 communications.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: Azorult can download and execute additional files. Azorult has also downloaded a ransomware payload called Hermes.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: HTRAN can inject into into running processes.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: Explosive has used HTTP for communication.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: CharmPower can download additional modules from actor-controlled Amazon S3 buckets.
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: Carberp's passw.plug plugin can gather account information from multiple instant messaging, email, and social media services, as well as FTP, VNC, and VPN clients.
MITRE ATT&CK techniques:
- T1555: Credentials from Password Stores
Threat description: UNC2452 bypassed MFA set on OWA accounts by generating a cookie value from a previously stolen secret key.
MITRE ATT&CK techniques:
- T1606.001: Forge Web Credentials - Web Cookies
Threat description: Dtrack can collect the RegisteredOwner, RegisteredOrganization, and InstallDate registry values.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: Small Sieve has the ability to use a custom hex byte swapping encoding scheme combined with an obfuscated Base64 function to protect program strings and Telegram credentials.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Bazar can fingerprint architecture, computer name, and OS version on the compromised host. Bazar can also check if the Russian language is installed on the infected machine and terminate if it is found.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Bankshot uses HTTP for command and control communication.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: KeyBoy issues the command "reg add “HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon”" to achieve persistence.
MITRE ATT&CK techniques:
- T1547.004: Boot or Logon Autostart Execution - Winlogon Helper DLL
Threat description: Chimera has obtained and used tools such as BloodHound, Cobalt Strike, Mimikatz, and PsExec.
MITRE ATT&CK techniques:
- T1588.002: Obtain Capabilities - Tool
Threat description: Cobalt Group has used exploits to increase their levels of rights and privileges.
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation