QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: The Deep Panda group is known to utilize WMI for lateral movement.
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: Lazarus Group has used "schtasks" for persistence including through the periodic execution of a remote XSL script or a dropped VBS payload.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: BLUELIGHT can collect the local time on a compromised host.
MITRE ATT&CK techniques:
- T1124: System Time Discovery
Threat description: Amadey can download and execute files to further infect a host machine with additional malware.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Tropic Trooper used "pr" and an openly available tool to scan for open ports on target systems.
MITRE ATT&CK techniques:
- T1046: Network Service Discovery
Threat description: BackConfig has been signed with self signed digital certificates mimicking a legitimate software company.
MITRE ATT&CK techniques:
- T1553.002: Subvert Trust Controls - Code Signing
Threat description: The SMOKEDHAM source code is embedded in the dropper as an encrypted string.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1027.009: Obfuscated Files or Information - Embedded Payloads
Threat description: The primary delivered mechaism for Agent Tesla is through email phishing messages.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: Clop can enumerate network shares.
MITRE ATT&CK techniques:
- T1135: Network Share Discovery
Threat description: yty collects the victim’s username.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: ECCENTRICBANDWAGON has stored keystrokes and screenshots within the "%temp%\GoogleChrome", "%temp%\Downloads", and "%temp%\TrendMicroUpdate" directories.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: SHOTPUT has a command to retrieve information about connected users.
MITRE ATT&CK techniques:
- T1087.001: Account Discovery - Local Account
Threat description: down_new has the ability to download files to the compromised host.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Umbreon provides access to the system via SSH or any other protocol that uses PAM to authenticate.
MITRE ATT&CK techniques:
- T1095: Non-Application Layer Protocol
Threat description: KeyBoy has a command to perform screen grabbing.
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: BlackTech has used stolen code-signing certificates for its malicious payloads.
MITRE ATT&CK techniques:
- T1588.003: Obtain Capabilities - Code Signing Certificates
Threat description: Lazarus Group has exfiltrated data and files over a C2 channel through its various tools and malware.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: gh0st RAT has a keylogger.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: Ryuk has injected itself into remote processes to encrypt files using a combination of "VirtualAlloc", "WriteProcessMemory", and "CreateRemoteThread".
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: Metamorfo has used mshta.exe to execute a HTA payload.
MITRE ATT&CK techniques:
- T1218.005: System Binary Proxy Execution - Mshta
Threat description: Xbash can execute malicious VBScript payloads on the victim’s machine.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: CosmicDuke collects user credentials, including passwords, for various programs including Web browsers.
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
Threat description: SideCopy has collected browser information from a compromised host.
MITRE ATT&CK techniques:
- T1518: Software Discovery
Threat description: PowerDuke has commands to get the current user's name and SID.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: GOLD SOUTHFIELD has exploited Oracle WebLogic vulnerabilities for initial compromise.
MITRE ATT&CK techniques:
- T1190: Exploit Public-Facing Application
Threat description: Lazarus Group has developed custom malware for use in their operations.
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: Fysbis has used the command "ls /etc | egrep -e"fedora\*|debian\*|gentoo\*|mandriva\*|mandrake\*|meego\*|redhat\*|lsb-\*|sun-\*|SUSE\*|release"" to determine which Linux OS version is running.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: ADVSTORESHELL can list running processes.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: NanoCore gathers the IP address from the victim’s machine.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: APT41 used a malware variant called WIDETONE to conduct port scans on specified subnets.
MITRE ATT&CK techniques:
- T1046: Network Service Discovery
Threat description: CosmicDuke steals user files from removable media with file extensions and keywords that match a predefined list.
MITRE ATT&CK techniques:
- T1025: Data from Removable Media
Threat description: MarkiRAT can store collected data locally in a created .nfo file.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: Astaroth has used a DGA in C2 communications.
MITRE ATT&CK techniques:
- T1568.002: Dynamic Resolution - Domain Generation Algorithms
Threat description: Azorult can dump credentials from victim browsers.
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: Milan can use hardcoded domains as an input for domain generation algorithms.
MITRE ATT&CK techniques:
- T1568.002: Dynamic Resolution - Domain Generation Algorithms
Threat description: Some InnaputRAT variants establish persistence by modifying the Registry key "HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Run:%appdata%\NeutralApp\NeutralApp.exe".
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Fox Kitten has used valid accounts to access SMB shares.
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
Threat description: DownPaper uses PowerShell to add a Registry Run key in order to establish persistence.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Daserf uses encrypted Windows APIs and also encrypts data using the alternative base64+RC4 or the Caesar cipher.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: BRONZE BUTLER has used tools to enumerate software installed on an infected host.
MITRE ATT&CK techniques:
- T1518: Software Discovery
Threat description: StrongPity has been executed via compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: Leafminer scanned network services to search for vulnerabilities in the victim system.
MITRE ATT&CK techniques:
- T1046: Network Service Discovery
Threat description: PipeMon can decrypt password-protected executables.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: AppleSeed can enumerate the current process on a compromised host.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: Stealth Falcon malware gathers system information via Windows Management Instrumentation (WMI).
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: CharmPower has the ability to download additional modules to a compromised host.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Olympic Destroyer will shut down the compromised system after it is done modifying system configuration settings.
MITRE ATT&CK techniques:
- T1529: System Shutdown/Reboot
Threat description: InnaputRAT variants have attempted to appear legitimate by adding a new service named OfficeUpdateService.
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: APT1 has collected files from a local victim.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Netwalker can add the following registry entry: "HKEY_CURRENT_USER\SOFTWARE\{8 random characters}".
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: HOMEFRY can perform credential dumping.
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: Lazarus Group has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: Ebury can intercept private keys using a trojanized "ssh-add" function.
MITRE ATT&CK techniques:
- T1556: Modify Authentication Process
Threat description: FIN7 used JavaScript scripts to help perform tasks on the victim's machine.
MITRE ATT&CK techniques:
- T1059.007: Command and Scripting Interpreter - JavaScript
Threat description: Cobalt Strike uses a custom command and control protocol that is encapsulated in HTTP, HTTPS, or DNS. In addition, it conducts peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.
MITRE ATT&CK techniques:
- T1572: Protocol Tunneling
Threat description: Valak has used PowerShell to download additional modules.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: GoldenSpy has gathered operating system information.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: NOKKI is written to %LOCALAPPDATA%\MicroSoft Updatea\svServiceUpdate.exe prior being executed in a new process in an apparent attempt to masquerade as a legitimate folder and file.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.
MITRE ATT&CK techniques:
- T1003.002: OS Credential Dumping - Security Account Manager
- T1003.004: OS Credential Dumping - LSA Secrets
Threat description: Cobalt Group has sent emails with URLs pointing to malicious documents.
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: Fox Kitten has named the task for a reverse proxy lpupdate to appear legitimate.
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: Tropic Trooper has used scripts to collect the host's network topology.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: BONDUPDATER is written in PowerShell.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: LockerGoga installation has been immediately preceded by a "task kill" command in order to disable anti-virus.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: Magic Hound has used scheduled tasks to establish persistence.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: Confucius has obtained cloud storage service accounts to host stolen data.
MITRE ATT&CK techniques:
- T1583.006: Acquire Infrastructure - Web Services
Threat description: Bisonal has added itself to the Registry key "HKEY_CURRENT_USER\Software\Microsoft\CurrentVersion\Run\" for persistence.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Uroburos uses a custom packer.
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: HyperBro can run shellcode it injects into a newly created process.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: Sowbug has used command line during its intrusions.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Ryuk has enumerated files and folders on all mounted drives.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: BITTER has used DDNS for C2 communications.
MITRE ATT&CK techniques:
- T1568: Dynamic Resolution
Threat description: ShadowPad has collected the username of the victim system.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: Hikit can upload files from compromised machines.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: JHUHUGIT has registered a Windows shell script under the Registry key "HKCU\Environment\UserInitMprLogonScript" to establish persistence.
MITRE ATT&CK techniques:
- T1037.001: Boot or Logon Initialization Scripts - Logon Script (Windows)
Threat description: Mythic supports SSL encrypted C2.
MITRE ATT&CK techniques:
- T1573.002: Encrypted Channel - Asymmetric Cryptography
Threat description: Tor encapsulates traffic in multiple layers of encryption, using TLS by default.
MITRE ATT&CK techniques:
- T1573.002: Encrypted Channel - Asymmetric Cryptography
Threat description: RemoteCMD copies a file over to the remote system before execution.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: EXOTIC LILY conducted an e-mail thread-hijacking campaign with malicious ISO attachments.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: TAINTEDSCRIBE can copy itself into the current user’s Startup folder as “Narrator.exe” for persistence.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Derusbi is capable of deleting files. It has been observed loading a Linux Kernel Module (LKM) and then deleting it from the hard disk as well as overwriting the data with null bytes.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: Bazar can delete its loader using a batch file in the Windows temporary folder.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: SUGARDUMP has collected browser bookmark and history information.
MITRE ATT&CK techniques:
- T1217: Browser Information Discovery
Threat description: Epic has a command to delete a file from the machine.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: Ke3chang actors have been known to copy files to the network shares of other computers to move laterally.
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
Threat description: MuddyWater has run tools including Browser64 to steal passwords saved in victim web browsers.
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
Threat description: Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from DPAPI.
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
Threat description: During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and manipulate the Registry.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: Night Dragon enticed users to click on links in spearphishing emails to download malware.
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
Threat description: Ke3chang has used keyloggers.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: DEATHRANSOM can download files to a compromised host.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Cryptoistic can gather data on the user of a compromised host.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: Threat Group-3390 actors have used a modified version of Mimikatz called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers.
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: Zox has been encoded with Base64.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: LightNeuron has the ability to download and execute additional files.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: BITTER has used a RAR SFX dropper to deliver malware.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: ShimRatReporter gathered the local privileges for the infected host.
MITRE ATT&CK techniques:
- T1069: Permission Groups Discovery
Threat description: A Night Dragon DLL included an XOR-encoded section.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: OilRig has used Putty to access compromised systems.
MITRE ATT&CK techniques:
- T1021.004: Remote Services - SSH
Threat description: APT29 used 7-Zip to compress stolen emails into password-protected archives prior to exfiltration.
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: FinFisher performs UAC bypass.
MITRE ATT&CK techniques:
- T1548.002: Abuse Elevation Control Mechanism - Bypass User Account Control
Threat description: Goopy has the ability to exfiltrate data over the Microsoft Outlook C2 channel.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: MarkiRAT can initiate communication over HTTP/HTTPS for its C2 server.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: BADFLICK has uploaded files from victims' machines.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Astaroth can check for Windows product ID's used by sandboxes and usernames and disk serial numbers associated with analyst environments.
MITRE ATT&CK techniques:
- T1497.001: Virtualization/Sandbox Evasion - System Checks
Threat description: Emotet has been observed dropping browser password grabber modules.
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
Threat description: Fox Kitten has used the Softerra LDAP browser to browse documentation on service accounts.
MITRE ATT&CK techniques:
- T1087.002: Account Discovery - Domain Account
Threat description: Dragonfly 2.0 modified the Registry to perform multiple techniques through the use of Reg.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: DarkWatchman has created a scheduled task for persistence.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: Ebury has used Python to implement its DGA.
MITRE ATT&CK techniques:
- T1059.006: Command and Scripting Interpreter - Python
Threat description: Dragonfly has used batch scripts to enumerate administrators and users in the domain.
MITRE ATT&CK techniques:
- T1069.002: Permission Groups Discovery - Domain Groups
Threat description: Egregor can inject its payload into iexplore.exe process.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: Responder is used to poison name services to gather hashes and credentials from systems within a local network.
MITRE ATT&CK techniques:
- T1557.001: Adversary-in-the-Middle - LLMNR/NBT-NS Poisoning and SMB Relay
Threat description: WastedLocker has used cmd to execute commands on the system.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Mythic supports scripting of file downloads from agents.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: CaddyWiper can obtain a list of current processes.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: Bandook has used malicious VBA code against the target system.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: StoneDrill has used several anti-emulation techniques to prevent automated analysis by emulators or sandboxes.
MITRE ATT&CK techniques:
- T1497: Virtualization/Sandbox Evasion
Threat description: zwShell has used RDP for lateral movement.
MITRE ATT&CK techniques:
- T1021.001: Remote Services - Remote Desktop Protocol
Threat description: Kevin can send data from the victim host through a DNS C2 channel.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: FunnyDream can check `Software\Microsoft\Windows\CurrentVersion\Internet Settings` to extract the `ProxyServer` string.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: During FunnyDream, the threat actors used a Visual Basic script to run remote commands.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: TYPEFRAME can open the Windows Firewall on the victim’s machine to allow incoming connections.
MITRE ATT&CK techniques:
- T1562.004: Impair Defenses - Disable or Modify System Firewall
Threat description: SeaDuke compressed data with zlib prior to sending it over C2.
MITRE ATT&CK techniques:
- T1560.002: Archive Collected Data - Archive via Library
Threat description: ComRAT has embedded a XOR encrypted communications module inside the orchestrator module.
MITRE ATT&CK techniques:
- T1027.009: Obfuscated Files or Information - Embedded Payloads
Threat description: Cobalt Strike can deliver additional payloads to victim machines.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: KillDisk has attempted to get the access token of a process by calling "OpenProcessToken". If KillDisk gets the access token, then it attempt to modify the token privileges with "AdjustTokenPrivileges".
MITRE ATT&CK techniques:
- T1134: Access Token Manipulation
Threat description: Mustang Panda has embedded VBScript components in LNK files to download additional files and automate collection.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: APT33 has used a variety of publicly available tools like LaZagne, Mimikatz, and ProcDump to dump credentials.
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: Lazarus Group has targeted victims with spearphishing emails containing malicious Microsoft Word documents.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: Bad Rabbit used the EternalRomance SMB exploit to spread through victim networks.
MITRE ATT&CK techniques:
- T1210: Exploitation of Remote Services
Threat description: Leviathan has archived victim's data prior to exfiltration.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: gh0st RAT can capture the victim’s screen remotely.
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: Dragonfly 2.0 added the registry value ntdll to the Registry Run key to establish persistence.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: RainyDay can create and register a service for execution.
MITRE ATT&CK techniques:
- T1007: System Service Discovery
Threat description: Meteor can use `WinAPI` to remove a victim machine from an Active Directory domain.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: Silence has obtained and modified versions of publicly-available tools like Empire and PsExec.
MITRE ATT&CK techniques:
- T1588.002: Obtain Capabilities - Tool
Threat description: BLINDINGCAN has sent user and system information to a C2 server via HTTP POST requests.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Derusbi is capable of capturing video.
MITRE ATT&CK techniques:
- T1125: Video Capture
Threat description: Grandoreiro can use malicious browser extensions to steal cookies and other user information.
MITRE ATT&CK techniques:
- T1176: Browser Extensions
Threat description: TSCookie has the ability to execute shell commands on the infected host.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: BBK has the ability to use HTTP in communications with C2.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: Sakula encodes C2 traffic with single-byte XOR keys.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: Molerats has sent phishing emails with malicious links included.
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: OilRig has used .doc file extensions to mask malicious executables.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: Attor has used Tor for C2 communication.
MITRE ATT&CK techniques:
- T1090.003: Proxy - Multi-hop Proxy
Threat description: TeamTNT has used UPX and Ezuri packer to pack its binaries.
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: Darkhotel has collected the IP address and network adapter information from the victim’s machine.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: Drovorub can use a port forwarding rule on its agent module to relay network traffic through the client module to a remote host on the same network.
MITRE ATT&CK techniques:
- T1090.001: Proxy - Internal Proxy
Threat description: Gamaredon Group has removed security settings for VBA macro execution by changing registry values "HKCU\Software\Microsoft\Office\&lt;version&gt;\&lt;product&gt;\Security\VBAWarnings" and "HKCU\Software\Microsoft\Office\&lt;version&gt;\&lt;product&gt;\Security\AccessVBOM".
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: Dragonfly has modified the Registry to hide created user accounts.
MITRE ATT&CK techniques:
- T1564.002: Hide Artifacts - Hidden Users
Threat description: Mustang Panda has delivered initial payloads hidden using archives and encoding measures.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: ccf32 has copied files to a remote machine infected with Chinoxy or another backdoor.
MITRE ATT&CK techniques:
- T1074.002: Data Staged - Remote Data Staging
Threat description: SEASHARPEE is a Web shell.
MITRE ATT&CK techniques:
- T1505.003: Server Software Component - Web Shell
Threat description: APT41 has executed "file /bin/pwd" on exploited victims, perhaps to return architecture related information.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: Metamorfo has digitally signed executables using AVAST Software certificates.
MITRE ATT&CK techniques:
- T1553.002: Subvert Trust Controls - Code Signing
Threat description: Gamaredon Group has tested connectivity between a compromised machine and a C2 server using  Ping with commands such as `CSIDL_SYSTEM\cmd.exe /c ping -n 1`.
MITRE ATT&CK techniques:
- T1016.001: System Network Configuration Discovery - Internet Connection Discovery
Threat description: Carbon encrypts configuration files and tasks for the malware to complete using CAST-128 algorithm.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Zeus Panda can download additional malware plug-in modules and execute them on the victim’s machine.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Pisloader has a command to collect victim system information, including the system name and OS version.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: SILENTTRINITY can gather a list of logged on users.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: Amadey has sent victim data to its C2 servers.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Sys10 collects the computer name, OS versioning information, and OS install date and sends the information to the C2.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: REvil can obtain the token from the user that launched the explorer.exe process to avoid affecting the desktop of the SYSTEM user.
MITRE ATT&CK techniques:
- T1134.001: Access Token Manipulation - Token Impersonation/Theft
Threat description: Fox Kitten has obtained files from the victim's cloud storage instances.
MITRE ATT&CK techniques:
- T1530: Data from Cloud Storage
Threat description: LoudMiner deleted installation files after completion.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: Meteor has been disguised as the Windows Power Efficiency Diagnostics report tool.
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: A Dipsind variant registers as a Winlogon Event Notify DLL to establish persistence.
MITRE ATT&CK techniques:
- T1547.004: Boot or Logon Autostart Execution - Winlogon Helper DLL
Threat description: Kivars has the ability to list drives on the infected host.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: ShimRatReporter gathered information automatically, without instruction from a C2, related to the user and host machine that is compiled into a report and sent to the operators.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: Saint Bot has been obfuscated to help avoid detection.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Kimsuky has used `rundll32.exe` to execute malicious scripts and malware on a victim's network.
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: Agent Tesla can encrypt data with 3DES before sending it over to a C2 server.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: Grandoreiro can steal cookie data and credentials from Google Chrome.
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
Threat description: BADFLICK has been distributed via spearphishing campaigns containing malicious Microsoft Word documents.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: Maze has forged POST strings with a random choice from a list of possibilities including "forum", "php", "view", etc. while making connection with the C2, hindering detection efforts.
MITRE ATT&CK techniques:
- T1568: Dynamic Resolution
Threat description: FlawedAmmyy has used HTTP for C2.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: SoreFang can download additional payloads from C2.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Bisonal can retrieve a file listing from the system.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: GuLoader has the ability to perform anti-debugging based on time checks, API calls, and CPUID.
MITRE ATT&CK techniques:
- T1497.003: Virtualization/Sandbox Evasion - Time Based Evasion
Threat description: Cyclops Blink can use the Linux API `if_nameindex` to gather network interface names.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: ZxShell can collect the owner and organization information from the target workstation.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: Wizard Spider has used scheduled tasks establish persistence for TrickBot and other malware.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: Carbon uses the "net group" command.
MITRE ATT&CK techniques:
- T1069: Permission Groups Discovery
Threat description: Deep Panda has used ping to identify other machines of interest.
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: PingPull can retrieve the hostname of a compromised host.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Bankshot searches for files on the victim's machine.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: UNC2452 used 7-Zip to decode its Raindrop malware.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: APT38 has prepended a space to all of their terminal commands to operate without leaving traces in the HISTCONTROL environment.
MITRE ATT&CK techniques:
- T1562.003: Impair Defenses - Impair Command History Logging
Threat description: POWERSTATS has used useless code blocks to counter analysis.
MITRE ATT&CK techniques:
- T1027.001: Obfuscated Files or Information - Binary Padding
Threat description: GoldenSpy has exfiltrated host environment information to an external C2 domain via port 9006.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Denis enumerates and collects the username from the victim’s machine.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: PHOREAL communicates via ICMP for C2.
MITRE ATT&CK techniques:
- T1095: Non-Application Layer Protocol
Threat description: StrongPity can delete previously exfiltrated files from the compromised host.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: The Ke3chang group has been known to compress data before exfiltration.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: BloodHound can collect information about local groups and members.
MITRE ATT&CK techniques:
- T1069.001: Permission Groups Discovery - Local Groups
Threat description: Remexi decrypts the configuration data using XOR with 25-character keys.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: APT34 has used WMI for execution.
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: APT3 has a tool that can list out currently running processes.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: Elise is capable of launching a remote shell on the host to delete itself.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: RTM can obtain the victim time zone.
MITRE ATT&CK techniques:
- T1124: System Time Discovery
Threat description: GALLIUM used "netstat -oan" to obtain information about the victim network connections.
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
Threat description: FatDuke can list running processes on the localhost.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: SpeakUp uses the "arp -a" command.
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
Threat description: EXOTIC LILY has registered domains to spoof targeted organizations by changing the top-level domain (TLD) to “.us”, “.co” or “.biz”.
MITRE ATT&CK techniques:
- T1583.001: Acquire Infrastructure - Domains
Threat description: RainyDay has downloaded as a XOR-encrypted payload.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: UNC2452 used "netsh" to configure firewall rules that limited certain UDP outbound packets.
MITRE ATT&CK techniques:
- T1562.004: Impair Defenses - Disable or Modify System Firewall
Threat description: Cobalt Strike's Beacon payload can collect information on process details.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: AdFind can gather information about organizational units (OUs) and domain trusts from Active Directory.
MITRE ATT&CK techniques:
- T1482: Domain Trust Discovery
Threat description: Fox Kitten has used scripts to access credential information from the KeePass database.
MITRE ATT&CK techniques:
- T1555.005: Credentials from Password Stores - Password Managers
Threat description: NETWIRE has used a custom encryption algorithm to encrypt collected data.
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: Cobalt Strike can exploit vulnerabilities such as MS14-058.
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
Threat description: Lazarus Group leveraged Mimikatz to extract Windows Credentials of currently logged-in users and steals passwords stored in browsers. Lazarus Group has also used a custom version Mimikatz to capture credentials.
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: APT3 has used PowerShell on victim systems to download and run payloads after exploitation.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: POWRUNER persists through a scheduled task that executes it every minute.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: NativeZone has used rundll32 to execute a malicious DLL.
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: Penquin has encrypted strings in the binary for obfuscation.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Agent Tesla  has achieved persistence via scheduled tasks.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: FunnyDream can delete files including its dropper component.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: DarkWatchman can stage local data in the Windows Registry.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: Kimsuky  has used HTTP GET and POST requests for C2.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: Kerrdown can use a VBS base64 decoder function published by Motobit.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: InvisiMole has executed legitimate tools in hidden windows.
MITRE ATT&CK techniques:
- T1564.003: Hide Artifacts - Hidden Window
Threat description: During Operation Wocao, threat actors used a custom proxy tool called "Agent" which has support for multiple hops.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: ShadowPad has used UDP for C2 communications.
MITRE ATT&CK techniques:
- T1095: Non-Application Layer Protocol
Threat description: Derusbi is capable of performing audio captures.
MITRE ATT&CK techniques:
- T1123: Audio Capture
Threat description: BONDUPDATER uses a DGA to communicate with command and control servers.
MITRE ATT&CK techniques:
- T1568.002: Dynamic Resolution - Domain Generation Algorithms
Threat description: gh0st RAT has altered the InstallTime subkey.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: LazyScripter has used `rundll32.exe` to execute Koadic stagers.
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: Koadic has 2 methods for elevating integrity. It can bypass UAC through `eventvwr.exe` and `sdclt.exe`.
MITRE ATT&CK techniques:
- T1548.002: Abuse Elevation Control Mechanism - Bypass User Account Control
Threat description: TA505 has signed payloads with code signing certificates from Thawte and Sectigo.
MITRE ATT&CK techniques:
- T1553.002: Subvert Trust Controls - Code Signing
Threat description: TajMahal has the ability to identify hardware information, the computer name, and OS information on an infected host.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Darkhotel has collected the hostname, OS version, service pack version, and the processor architecture from the victim’s machine.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Astaroth collects the machine name and keyboard language from the system.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: njRAT has a module for performing remote desktop access.
MITRE ATT&CK techniques:
- T1021.001: Remote Services - Remote Desktop Protocol
Threat description: ZIRCONIUM has exfiltrated files via the Dropbox API C2.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: EnvyScout has the ability to proxy execution of malicious files with Rundll32.
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: Empire can perform pass the hash attacks.
MITRE ATT&CK techniques:
- T1550.002: Use Alternate Authentication Material - Pass the Hash
Threat description: FlawedAmmyy enumerates the privilege level of the victim during the initial infection.
MITRE ATT&CK techniques:
- T1069.001: Permission Groups Discovery - Local Groups
Threat description: PowerPunch can use the volume serial number from a target host to generate a unique XOR key for the next stage payload.
MITRE ATT&CK techniques:
- T1480.001: Execution Guardrails - Environmental Keying
Threat description: GoldMax has set an execution trigger date and time, stored as an ASCII Unix/Epoch time value.
MITRE ATT&CK techniques:
- T1497.003: Virtualization/Sandbox Evasion - Time Based Evasion
Threat description: BlackEnergy gathers a list of installed apps from the uninstall program Registry. It also gathers registered mail, browser, and instant messaging clients from the Registry. BlackEnergy has searched for given file types.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: OSInfo discovers shares on the network
MITRE ATT&CK techniques:
- T1135: Network Share Discovery
Threat description: ServHelper can execute shell commands against cmd.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: PLEAD has the ability to upload and download files to and from an infected host.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Vasport copies itself to disk and creates an associated run key Registry entry to establish.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Crimson has the ability to determine the date and time on a compromised host.
MITRE ATT&CK techniques:
- T1124: System Time Discovery
Threat description: Honeybee collects data from the local victim system.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: PowGoop can send HTTP GET requests to malicious servers.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: Sibot has downloaded a DLL to the "C:\windows\system32\drivers\" folder and renamed it with a ".sys" extension.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Derusbi obfuscates C2 traffic with variable 4-byte XOR keys.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: PoetRAT has added a registry key in the <RUN> hive for persistence.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: AADInternals can inject a malicious DLL (`PTASpy`) into the `AzureADConnectAuthenticationAgentService` to backdoor Azure AD Pass-Through Authentication.
MITRE ATT&CK techniques:
- T1556.007: Modify Authentication Process - Hybrid Identity
Threat description: Meteor has the ability to download additional files for execution on the victim's machine.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: InvisiMole can collect jpeg files from connected MTP devices.
MITRE ATT&CK techniques:
- T1025: Data from Removable Media
Threat description: Drovorub can transfer files from the victim machine.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: EnvyScout can deobfuscate and write malicious ISO files to disk.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: ROKRAT has used Visual Basic for execution.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: SMOKEDHAM has communicated with its C2 servers via HTTPS and HTTP POST requests.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: Remsec has a plugin that can perform ARP scanning as well as port scanning.
MITRE ATT&CK techniques:
- T1046: Network Service Discovery
Threat description: Nerex creates a backdoor through which remote attackers can download files onto a compromised host.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Koadic can download additional files and tools.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Moses Staff has used signed drivers from an open source tool called DiskCryptor to evade detection.
MITRE ATT&CK techniques:
- T1553.002: Subvert Trust Controls - Code Signing
Threat description: Cardinal RAT contains watchdog functionality that periodically ensures "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load" is set to point to its executable.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: APT32 successfully gained remote access by using pass the ticket.
MITRE ATT&CK techniques:
- T1550.003: Use Alternate Authentication Material - Pass the Ticket
Threat description: OilRig has used "net group /domain", "net group “domain admins” /domain", and "net group “Exchange Trusted Subsystem” /domain" to find domain group permission settings.
MITRE ATT&CK techniques:
- T1069.002: Permission Groups Discovery - Domain Groups
Threat description: Lizar can retrieve browser history and database files.
MITRE ATT&CK techniques:
- T1217: Browser Information Discovery
Threat description: PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit unquoted path vulnerabilities.
MITRE ATT&CK techniques:
- T1574.009: Hijack Execution Flow - Path Interception by Unquoted Path
Threat description: AppleSeed can delete files from a compromised host after they are exfiltrated.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: LAPSUS$ uploaded sensitive files, information, and credentials from a targeted organization for extortion or public release.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Bisonal has collected information from a compromised host.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Turla RPC backdoors have used cmd.exe to execute commands.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Amadey has obfuscated strings such as antivirus vendor names, domains, files, and others.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Confucius has used PowerShell to execute malicious files and payloads.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: Empire can automatically gather the username, domain name, machine name, and other information from a compromised system.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: DropBook can unarchive data downloaded from the C2 to obtain the payload and persistence modules.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: SideCopy has utilized `mshta.exe` to execute a malicious hta file.
MITRE ATT&CK techniques:
- T1218.005: System Binary Proxy Execution - Mshta
Threat description: yty gathers information on victim’s drives and has a plugin for document listing.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: APT41 executed "file /bin/pwd" in activity exploiting CVE-2019-19781 against Citrix devices.
MITRE ATT&CK techniques:
- T1059.004: Command and Scripting Interpreter - Unix Shell