QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: RDAT can upload a file via HTTP POST response to the C2 split into 102,400-byte portions. RDAT can also download data from the C2 which is split into 81,920-byte portions.
MITRE ATT&CK techniques:
- T1030: Data Transfer Size Limits
Threat description: APT1 used the commands "net start" and "tasklist" to get a listing of the services on the system.
MITRE ATT&CK techniques:
- T1007: System Service Discovery
Threat description: SodaMaster has the ability to query the Registry to detect a key specific to VMware.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: APT3 has a tool that can enumerate current network connections.
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
Threat description: Magic Hound has obtained and used open-source penetration testing tools like Havij, sqlmap, Metasploit, and Mimikatz.
MITRE ATT&CK techniques:
- T1588.002: Obtain Capabilities - Tool
Threat description: FoggyWeb can be decrypted in memory using a Lightweight Encryption Algorithm (LEA)-128 key and decoded using a XOR key.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Kazuar obtains a list of running processes through WMI querying and the "ps" command.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: H1N1 kills and disables services for Windows Firewall.
MITRE ATT&CK techniques:
- T1562.004: Impair Defenses - Disable or Modify System Firewall
Threat description: ELMER is capable of performing process listings.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: APT18 can upload a file to the victim’s machine.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Dragonfly has attempted to brute force credentials to gain access.
MITRE ATT&CK techniques:
- T1110: Brute Force
Threat description: Machete is written in Python and is used in conjunction with additional Python scripts.
MITRE ATT&CK techniques:
- T1059.006: Command and Scripting Interpreter - Python
Threat description: During FunnyDream, the threat actors downloaded additional droppers and backdoors onto a compromised system.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Kobalos has used a compromised SSH client to capture the hostname, port, username and password used to establish an SSH connection from the compromised host.
MITRE ATT&CK techniques:
- T1056: Input Capture
Threat description: Ursnif has registered itself as a system service in the Registry for automatic execution at system startup.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: Machete has delivered spearphishing emails that contain a zipped file with malicious contents.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: WindTail can use the "open" command to execute an application.
MITRE ATT&CK techniques:
- T1059.004: Command and Scripting Interpreter - Unix Shell
Threat description: Action RAT can use WMI to gather AV products installed on an infected host.
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: Arp can be used to display a host's ARP cache, which may include address resolutions for remote systems.
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: Ramsay can use "ImprovedReflectiveDLLInjection" to deploy components.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: ZIRCONIUM has used tools to download malicious files to compromised hosts.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: XCSSET uses the "chmod +x" command to grant executable permissions to the malicious file.
MITRE ATT&CK techniques:
- T1222.002: File and Directory Permissions Modification - Linux and Mac File and Directory Permissions Modification
Threat description: Empire can use "Invoke-RunAs" to make tokens.
MITRE ATT&CK techniques:
- T1134.002: Access Token Manipulation - Create Process with Token
Threat description: Lokibot has the ability to initiate contact with command and control (C2) to exfiltrate stolen data.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: FIN8 has used RAR to compress collected data before exfiltration.
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: A variant of Emissary appends junk data to the end of its DLL file to create a large file that may exceed the maximum size that anti-virus programs can scan.
MITRE ATT&CK techniques:
- T1027.001: Obfuscated Files or Information - Binary Padding
Threat description: Lazarus Group replaced the background wallpaper of systems with a threatening image after rendering the system unbootable with a Disk Structure Wipe.
MITRE ATT&CK techniques:
- T1491.001: Defacement - Internal Defacement
Threat description: GALLIUM collected data from the victim's local system, including password hashes from the SAM hive in the Registry.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: CSPY Downloader can use the schtasks utility to bypass UAC.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: APT29 has set the hostnames of its C2 infrastructure to match legitimate hostnames in the victim environment. They have also used IP addresses originating from the same country as the victim for their VPN infrastructure.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: During Operation Spalax, the threat actors sent phishing emails that included a PDF document that in some cases led to the download and execution of malware.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: Pony has used several Windows functions for various purposes.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: Machete saves the window names.
MITRE ATT&CK techniques:
- T1010: Application Window Discovery
Threat description: During Operation Wocao, threat actors used SMB to copy files to and from target systems.
MITRE ATT&CK techniques:
- T1570: Lateral Tool Transfer
Threat description: FoggyWeb can use a dynamic XOR key and a custom XOR methodology to encode data before exfiltration. Also, FoggyWeb can encode C2 command output within a legitimate WebP file.
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: ZLib has the ability to enumerate files and drives.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: Cobalt Strike's Beacon payload is capable of running shell commands without "cmd.exe" and PowerShell commands without "powershell.exe"
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: During FunnyDream, the threat actors used `wmiexec.vbs` to run remote commands.
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: Matryoshka can establish persistence by adding a Scheduled Task named "Microsoft Boost Kernel Optimization".
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: Machete can find, encrypt, and upload files from fixed and removable drives.
MITRE ATT&CK techniques:
- T1025: Data from Removable Media
Threat description: The WastedLocker payload includes encrypted strings stored within the .bss section of the binary file.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: LiteDuke can create persistence by adding a shortcut in the "CurrentVersion\Run" Registry key.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Operation Wocao has discovered the local disks attached to the system and their hardware information including manufacturer and model, as well as the OS versions of systems connected to a targeted network.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Bumblebee can search for tools used in static analysis.
MITRE ATT&CK techniques:
- T1622: Debugger Evasion
Threat description: HAFNIUM gathered the fully qualified domain names (FQDNs) for targeted Exchange servers in the victim's environment.
MITRE ATT&CK techniques:
- T1590: Gather Victim Network Information
Threat description: BADFLICK has captured victim computer name, memory space, and CPU details.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Bisonal has launched cmd.exe and used the ShellExecuteW() API function to execute commands on the system.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: HermeticWizard can connect to remote shares using `WNetAddConnection2W`.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: A version of KONNI drops a Windows shortcut on the victim’s machine to establish persistence.
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: Cardinal RAT applies compression to C2 traffic using the ZLIB library.
MITRE ATT&CK techniques:
- T1560.002: Archive Collected Data - Archive via Library
Threat description: POWERSTATS can upload files from compromised hosts.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: BabyShark has executed the "ipconfig /all" command.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: Epic uses HTTP and HTTPS for C2 communications.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: Amadey does not run any tasks or install additional malware if the victim machine is based in Russia.
MITRE ATT&CK techniques:
- T1614: System Location Discovery
Threat description: ShimRat can enumerate connected drives for infected host machines.
MITRE ATT&CK techniques:
- T1135: Network Share Discovery
Threat description: The reconnaissance modules used with Duqu can collect information on network configuration.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: Remsec has a plugin to drop and execute vulnerable Outpost Sandbox or avast! Virtualization drivers in order to gain kernel mode privileges.
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
Threat description: Meteor can hide its console window upon execution to decrease its visibility to a victim.
MITRE ATT&CK techniques:
- T1564.003: Hide Artifacts - Hidden Window
Threat description: During Night Dragon, threat actors used RAT malware to exfiltrate email archives.
MITRE ATT&CK techniques:
- T1114.001: Email Collection - Local Email Collection
Threat description: MuddyWater has performed credential dumping with LaZagne and other tools, including by dumping passwords saved in victim email.
MITRE ATT&CK techniques:
- T1555: Credentials from Password Stores
Threat description: Transparent Tribe can mimic legitimate Windows directories by using the same icons and names.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: FIVEHANDS can use WMI to delete files on a  target machine.
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: POWRUNER may collect domain group information by running "net group /domain" or a series of other commands on a victim.
MITRE ATT&CK techniques:
- T1069.002: Permission Groups Discovery - Domain Groups
Threat description: SpicyOmelette has been distributed via emails containing a malicious link that appears to be a PDF document.
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: ShadowPad maintains a configuration block and virtual file system in the Registry.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: APT28 has saved files with hidden file attributes.
MITRE ATT&CK techniques:
- T1564.001: Hide Artifacts - Hidden Files and Directories
Threat description: RogueRobin created a shortcut in the Windows startup folder to launch a PowerShell script each time the user logs in to establish persistence.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: A Patchwork payload uses process hollowing to hide the UAC bypass vulnerability exploitation inside svchost.exe.
MITRE ATT&CK techniques:
- T1055.012: Process Injection - Process Hollowing
Threat description: QUADAGENT checks if a value exists within a Registry key in the HKCU hive whose name is the same as the scheduled task it has created.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: StrifeWater has create a scheduled task named `Mozilla\Firefox Default Browser Agent 409046Z0FF4A39CB` for persistence.
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
Threat description: Thrip has obtained and used tools such as Mimikatz and PsExec.
MITRE ATT&CK techniques:
- T1588.002: Obtain Capabilities - Tool
Threat description: MuddyWater has used malware that can collect the victim’s username.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: Indrik Spider has attempted to get users to click on a malicious zipped file.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: Keydnap adds the setuid flag to a binary so it can easily elevate in the future.
MITRE ATT&CK techniques:
- T1548.001: Abuse Elevation Control Mechanism - Setuid and Setgid
Threat description: Chrommme can exfiltrate collected data via C2.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Bad Rabbit spread through watering holes on popular sites by injecting JavaScript into the HTML body or a ".js" file.
MITRE ATT&CK techniques:
- T1189: Drive-by Compromise
Threat description: Azorult can check for installed software on the system under the Registry key "Software\Microsoft\Windows\CurrentVersion\Uninstall".
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: GuLoader has relied upon users clicking on links to malicious documents.
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
Threat description: PoetRAT has used Word documents with VBScripts to execute malicious activities.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: Frankenstein has deobfuscated base64-encoded commands following the execution of a malicious script, which revealed a small script designed to obtain an additional payload.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Unknown Logger is capable of spreading to USB devices.
MITRE ATT&CK techniques:
- T1091: Replication Through Removable Media
Threat description: Lazarus Group has used Powershell to download malicious payloads.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: MURKYTOP has the capability to retrieve information about shares on remote hosts.
MITRE ATT&CK techniques:
- T1135: Network Share Discovery
Threat description: InvisiMole lists local users and session information.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: Stuxnet used MS10-073 and an undisclosed Task Scheduler vulnerability to escalate privileges on local Windows machines.
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
Threat description: WarzoneRAT can communicate with its C2 server via TCP over port 5200.
MITRE ATT&CK techniques:
- T1095: Non-Application Layer Protocol
Threat description: APT29 has used "Rundll32.exe" to execute payloads.
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: NETWIRE has been spread via e-mail campaigns utilizing malicious attachments.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: gh0st RAT has used the `InterlockedExchange`, `SeShutdownPrivilege`, and `ExitWindowsEx` Windows API functions.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: Bumblebee can identify processes associated with analytical tools.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: Milan can use a COM component to generate scheduled tasks.
MITRE ATT&CK techniques:
- T1559.001: Inter-Process Communication - Component Object Model
Threat description: WIRTE has used HTTP for network communication.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: NETWIRE can automatically archive collected data.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: T9000 gathers and beacons the operating system build number and CPU Architecture (32-bit/64-bit) during installation.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: HiddenWasp creates a user account as a means to provide initial persistence to the compromised machine.
MITRE ATT&CK techniques:
- T1136.001: Create Account - Local Account
Threat description: One variant of CloudDuke uses HTTP and HTTPS for C2.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: Tropic Trooper has collected information automatically using the adversary's USBferry attack.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: Kwampirs creates a new service named WmiApSrvEx to establish persistence.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: Kevin can use a renamed image of `cmd.exe` for execution.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: OopsIE has the capability to delete files and scripts from the victim's machine.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: GRIFFON has used a reconnaissance module that can be used to retrieve Windows domain membership information.
MITRE ATT&CK techniques:
- T1069.002: Permission Groups Discovery - Domain Groups
Threat description: Leviathan has used VBScript.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: GuLoader can establish persistence via the Registry under "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce".
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Turla has used a custom .NET tool to collect documents from an organization's internal central database.
MITRE ATT&CK techniques:
- T1213: Data from Information Repositories
Threat description: Maze has attempted to delete the shadow volumes of infected machines, once before and once after the encryption process.
MITRE ATT&CK techniques:
- T1490: Inhibit System Recovery
Threat description: FELIXROOT downloads and uploads files to and from the victim’s machine.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: DarkHydrus leveraged PowerShell to download and execute additional scripts for execution.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: iKitten adds an entry to the rc.common file for persistence.
MITRE ATT&CK techniques:
- T1037.004: Boot or Logon Initialization Scripts - RC Scripts
Threat description: Imminent Monitor has a remote microphone monitoring capability.
MITRE ATT&CK techniques:
- T1123: Audio Capture
Threat description: Lazarus Group has created new email accounts for spearphishing operations.
MITRE ATT&CK techniques:
- T1585.002: Establish Accounts - Email Accounts
Threat description: Derusbi is capable of enumerating Registry keys and values.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: NOKKI can gather information on drives and the operating system on the victim’s machine.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Dragonfly has sent emails with malicious attachments to gain initial access.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: EnvyScout has been executed through malicious files attached to e-mails.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: Lazarus Group malware SierraCharlie uses RDP for propagation.
MITRE ATT&CK techniques:
- T1021.001: Remote Services - Remote Desktop Protocol
Threat description: TA505 has used PowerShell to download and execute malware and reconnaissance scripts.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: ROKRAT can collect host data and specific file types.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Turian can retrieve system information including OS version, memory usage, local hostname, and system adapter information.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Sharpshooter has sent malicious Word OLE documents to victims.
MITRE ATT&CK techniques:
- T1559.002: Inter-Process Communication - Dynamic Data Exchange
Threat description: IcedID can query LDAP to identify additional users on the network to infect.
MITRE ATT&CK techniques:
- T1087.002: Account Discovery - Domain Account
Threat description: Sidewinder has used tools to obtain the current system time.
MITRE ATT&CK techniques:
- T1124: System Time Discovery
Threat description: Fox Kitten has used prodump to dump credentials from LSASS.
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: Saint Bot can search a compromised host for specific files.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: TeamTNT has sent locally staged files with collected credentials to C2 servers using cURL.
MITRE ATT&CK techniques:
- T1048: Exfiltration Over Alternative Protocol
Threat description: Deep Panda uses the Microsoft Tasklist utility to list processes running on systems.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: PoetRAT has the ability to copy files and download/upload files into C2 channels using FTP and HTTPS.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Stuxnet searches the Registry for indicators of security programs.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: Brave Prince gathers network configuration information as well as the ARP cache.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: Linfo creates a backdoor through which remote attackers can change the frequency at which compromised hosts contact remote C2 infrastructure.
MITRE ATT&CK techniques:
- T1029: Scheduled Transfer
Threat description: Rclone can exfiltrate data over SFTP or HTTPS via WebDAV.
MITRE ATT&CK techniques:
- T1048.002: Exfiltration Over Alternative Protocol - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
Threat description: LitePower can use various API calls.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: Bumblebee can identify specific analytical tools based on running processes.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: Kinsing has used the find command to search for specific files.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: Ursnif has used Reg to query the Registry for installed programs.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: GLOOXMAIL communicates to servers operated by Google using the Jabber/XMPP protocol.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: MobileOrder exfiltrates data collected from the victim mobile device.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: POWERSTATS can delete all files on the C:\, D:\, E:\ and, F:\ drives using PowerShell Remove-Item commands.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: Dragonfly has created accounts on victims, including administrator accounts, some of which appeared to be tailored to each individual staging target.
MITRE ATT&CK techniques:
- T1136.001: Create Account - Local Account
Threat description: Turla RPC backdoors have included local UPnP RPC proxies.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: CookieMiner has checked for the presence of "Little Snitch", macOS network monitoring and application firewall software, stopping and exiting if it is found.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
- T1562.004: Impair Defenses - Disable or Modify System Firewall
Threat description: jRAT can serve as a SOCKS proxy server.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: Magic Hound has acquired mobile phone numbers of potential targets, possibly for mobile malware or additional phishing operations.
MITRE ATT&CK techniques:
- T1589: Gather Victim Identity Information
Threat description: APIs and strings in some TYPEFRAME variants are RC4 encrypted. Another variant is encoded with XOR.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: SUNBURST used Base64 encoding in its C2 traffic.
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: Torisma has used XOR and Base64 to decode C2 data.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: The PowerShell script with the RogueRobin payload was obfuscated using the COMPRESS technique in Invoke-Obfuscation.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: down_new has the ability to use HTTP in C2 communications.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: Cobalt Group used the Ammyy Admin tool as well as TeamViewer for remote access, including to preserve remote access if a Cobalt Strike module was lost.
MITRE ATT&CK techniques:
- T1219: Remote Access Software
Threat description: APT41 deleted files from the system.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: GRIFFON has used a screenshot module that can be used to take a screenshot of the remote system.
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: Saint Bot can collect the IP address of a victim machine.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: A module in CozyCar allows arbitrary commands to be executed by invoking "C:\Windows\System32\cmd.exe".
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: SideCopy has identified the OS version of a compromised host.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: APT39 has modified LNK shortcuts.
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: Rising Sun has collected data and files from a compromised host.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Pupy has built in commands to identify a host’s IP address and find out other network configuration settings by viewing connected sessions.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: TA551 has hidden encoded data for malware DLLs in a PNG.
MITRE ATT&CK techniques:
- T1027.003: Obfuscated Files or Information - Steganography
Threat description: Okrum uses AES to encrypt network traffic. The key can be hardcoded or negotiated with the C2 server in the registration phase.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: Turla RPC backdoors can impersonate or steal process tokens before executing commands.
MITRE ATT&CK techniques:
- T1134.002: Access Token Manipulation - Create Process with Token
Threat description: Heyoka Backdoor can inject a DLL into rundll32.exe for execution.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: WhisperGate can use `cmd.exe` to execute commands.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: jRAT can query and kill system processes.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: Unknown Logger is capable of stealing usernames and passwords from browsers on the victim machine.
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
Threat description: Fox Kitten has used Amazon Web Services to host C2.
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: Explosive has encrypted communications with the RC4 method.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: PingPull has the ability to exfiltrate stolen victim data through its C2 channel.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: During C0015, the threat actors used Conti ransomware to encrypt a compromised network.
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: The Winnti for Windows installer loads a DLL using rundll32.
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: CostaBricks can inject a payload into the memory of a compromised host.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: NETWIRE has masqueraded as legitimate software including TeamViewer and macOS Finder.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Comnie executes BAT scripts.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Dragonfly has dropped and executed SecretsDump to dump password hashes. They also obtained ntds.dit from domain controllers.
MITRE ATT&CK techniques:
- T1003.003: OS Credential Dumping - NTDS
Threat description: menuPass has used process hollowing in iexplore.exe to load the RedLeaves implant.
MITRE ATT&CK techniques:
- T1055.012: Process Injection - Process Hollowing
Threat description: Rocke used malware to download additional malicious files to the target system.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Heyoka Backdoor can identify removable media attached to victim's machines.
MITRE ATT&CK techniques:
- T1120: Peripheral Device Discovery
Threat description: SynAck gathers computer names, OS version info, and also checks installed keyboard layouts to estimate if it has been launched from a certain list of countries.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: GALLIUM packed some payloads using different types of packers, both known and custom.
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: Proton persists via Launch Agent.
MITRE ATT&CK techniques:
- T1543.001: Create or Modify System Process - Launch Agent
Threat description: APT1 used the "net use" command to get a listing on network connections.
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
Threat description: StrongPity can install a service to execute itself as a service.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: FoggyWeb can masquerade the output of C2 commands as a fake, but legitimately formatted WebP file.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: Part of APT28's operation involved using CHOPSTICK modules to copy itself to air-gapped machines and using files written to USB sticks to transfer data and command traffic.
MITRE ATT&CK techniques:
- T1091: Replication Through Removable Media
Threat description: NavRAT writes multiple outputs to a TMP file using the >> method.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: Shamoon queries several Registry keys to identify hard disk partitions to overwrite.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: Leviathan has created new social media accounts for targeting efforts.
MITRE ATT&CK techniques:
- T1585.001: Establish Accounts - Social Media Accounts
Threat description: Keydnap uses a copy of tor2web proxy for HTTPS communications.
MITRE ATT&CK techniques:
- T1090.003: Proxy - Multi-hop Proxy
Threat description: DropBook can execute arbitrary shell commands on the victims' machines.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Spark has exfiltrated data over the C2 channel.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Gelsemium can collect data from a compromised host.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: WEBC2 can download and execute a file.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Suckfly has used stolen certificates to sign its malware.
MITRE ATT&CK techniques:
- T1553.002: Subvert Trust Controls - Code Signing
Threat description: Hikit uses "certmgr.exe -add GlobalSign.cer -c -s -r localMachine Root" and "certmgr.exe -add GlobalSign.cer -c -s -r localMachineTrustedPublisher" to install a self-generated certificate to the local trust store as a root CA and Trusted Publisher.
MITRE ATT&CK techniques:
- T1553.004: Subvert Trust Controls - Install Root Certificate
Threat description: APT41 used VMProtected binaries in multiple intrusions.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: During C0015, the threat actors named a binary file `compareForfor.jpg` to disguise it as a JPG file.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: KeyBoy uses VBS scripts for installing files and performing execution.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: Earth Lusca has used the Fodhelper UAC bypass technique to gain elevated privileges.
MITRE ATT&CK techniques:
- T1548.002: Abuse Elevation Control Mechanism - Bypass User Account Control
Threat description: HEXANE has downloaded additional payloads and malicious scripts onto a compromised host.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Revenge RAT has a plugin for keylogging.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: InvisiMole can capture keystrokes on a compromised host.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: Dust Storm has encoded payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Sharpshooter has leveraged embedded shellcode to inject a downloader into the memory of Word.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: Kerrdown has the ability to determine if the compromised host is running a 32 or 64 bit OS architecture.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Hildegard has used masscan to look for kubelets in the internal Kubernetes network.
MITRE ATT&CK techniques:
- T1046: Network Service Discovery
Threat description: PowerSploit contains a collection of CodeExecution modules that inject code (DLL, shellcode) into a process.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: MegaCortex can enable "SeDebugPrivilege" and adjust token privileges.
MITRE ATT&CK techniques:
- T1134: Access Token Manipulation
Threat description: Dragonfly has performed forced authentication to gather hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems.
MITRE ATT&CK techniques:
- T1187: Forced Authentication
Threat description: Fox Kitten has installed web shells on compromised hosts to maintain access.
MITRE ATT&CK techniques:
- T1505.003: Server Software Component - Web Shell
Threat description: PUNCHBUGGY can download additional files and payloads to compromised hosts.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Operation Wocao has used scripts to detect security software.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: Kimsuky has used a proprietary tool to intercept one time passwords required for two-factor authentication.
MITRE ATT&CK techniques:
- T1111: Multi-Factor Authentication Interception
Threat description: Higaisa used "ipconfig" to gather network configuration information.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: FIN7 has exploited ZeroLogon (CVE-2020-1472) against vulnerable domain controllers.
MITRE ATT&CK techniques:
- T1210: Exploitation of Remote Services
Threat description: CosmicDuke collects Windows account hashes.
MITRE ATT&CK techniques:
- T1003.002: OS Credential Dumping - Security Account Manager
Threat description: SideTwist can decode and decrypt messages received from C2.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Mustang Panda has encrypted documents with RC4 prior to exfiltration.
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: RogueRobin uses Windows Script Components.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: menuPass has sent malicious Office documents via email as part of spearphishing campaigns as well as executables disguised as documents.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: Dyre has the ability to achieve persistence by adding a new task in the task scheduler to run every minute.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: BackdoorDiplomacy has executed DLL search order hijacking.
MITRE ATT&CK techniques:
- T1574.001: Hijack Execution Flow - DLL Search Order Hijacking
Threat description: Empire has a module for creating a new domain user if permissions allow.
MITRE ATT&CK techniques:
- T1136.002: Create Account - Domain Account
Threat description: DropBook can communicate with its operators by exploiting the Simplenote, DropBox, and the social media platform, Facebook, where it can create fake accounts to control the backdoor and receive instructions.
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: SideTwist has the ability to search for specific files.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: POWERSTATS can use Mshta.exe to execute additional payloads on compromised hosts.
MITRE ATT&CK techniques:
- T1218.005: System Binary Proxy Execution - Mshta
Threat description: GuLoader has been spread in phishing campaigns using malicious web links.
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: Chimera has used the Windows Command Shell and batch scripts for execution on compromised hosts.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: BackConfig has the ability to remove files and folders related to previous infections.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: Emotet leverages the Admin$ share for lateral movement once the local admin password has been brute forced.
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
Threat description: PoshC2 has a number of modules that use WMI to execute tasks.
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code.
MITRE ATT&CK techniques:
- T1055.012: Process Injection - Process Hollowing
Threat description: Donut can generate shellcode outputs that execute via Python.
MITRE ATT&CK techniques:
- T1059.006: Command and Scripting Interpreter - Python
Threat description: ROADTools can enumerate Azure AD applications and service principals.
MITRE ATT&CK techniques:
- T1526: Cloud Service Discovery
Threat description: Nomadic Octopus has targeted victims with spearphishing emails containing malicious attachments.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: DarkComet can list active processes running on the victim’s machine.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: Chaes has exfiltrated its collected data from the infected machine to the C2, sometimes using the MIME protocol.
MITRE ATT&CK techniques:
- T1048: Exfiltration Over Alternative Protocol
Threat description: HALFBAKED can obtain information about the OS, processor, and BIOS.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: FatDuke can call "ShellExecuteW" to open the default browser on the URL localhost.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: BITTER has sent spearphishing emails with a malicious RTF document or Excel spreadsheet.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: Maze has issued a shutdown command on a victim machine that, upon reboot, will run the ransomware within a VM.
MITRE ATT&CK techniques:
- T1529: System Shutdown/Reboot
Threat description: Gorgon Group malware can download a remote access tool, ShiftyBug, and inject into another process.
MITRE ATT&CK techniques:
- T1055.002: Process Injection - Portable Executable Injection
Threat description: Dridex has used POST requests and HTTPS for C2 communications.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: Saint Bot has used different API calls, including `GetProcAddress`, `VirtualAllocEx`, `WriteProcessMemory`, `CreateProcessA`, and `SetThreadContext`.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: APT29 has used SSH port forwarding capabilities on public-facing systems, and configured at least one instance of Cobalt Strike to use a network pipe over SMB during the 2020 SolarWinds intrusion.
MITRE ATT&CK techniques:
- T1090.001: Proxy - Internal Proxy
Threat description: Chimera has used the NtdsAudit utility to collect information related to accounts and passwords.
MITRE ATT&CK techniques:
- T1201: Password Policy Discovery
Threat description: Ursnif has used a DGA to generate domain names for C2.
MITRE ATT&CK techniques:
- T1568.002: Dynamic Resolution - Domain Generation Algorithms
Threat description: For Operation Honeybee, the threat actors stole a digital signature from Adobe Systems to use with their MaoCheng dropper.
MITRE ATT&CK techniques:
- T1588.004: Obtain Capabilities - Digital Certificates
Threat description: APT39 has used various tools to proxy C2 communications.
MITRE ATT&CK techniques:
- T1090.002: Proxy - External Proxy
Threat description: S-Type may create a temporary user on the system named `Lost_{Unique Identifier}` with the password `pond~!@6”{Unique Identifier}`.
MITRE ATT&CK techniques:
- T1136.001: Create Account - Local Account
Threat description: APT32 has sent spearphishing emails containing malicious links.
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: NOKKI uses a unique, custom de-obfuscation technique.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: DarkWatchman has collected the username from a victim machine.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: FoggyWeb can compile and execute source code sent to the compromised AD FS server via a specific HTTP POST.
MITRE ATT&CK techniques:
- T1027.004: Obfuscated Files or Information - Compile After Delivery
Threat description: When it first starts, BADNEWS spawns a new thread to log keystrokes.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: MegaCortex has changed user account passwords and logged users off the system.
MITRE ATT&CK techniques:
- T1531: Account Access Removal
Threat description: StrifeWater can execute shell commands using `cmd.exe`.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Epic uses the "tasklist /svc" command to list the services on the system.
MITRE ATT&CK techniques:
- T1007: System Service Discovery
Threat description: WhisperGate can corrupt files by overwriting the first 1 MB with `0xcc` and appending random extensions.
MITRE ATT&CK techniques:
- T1485: Data Destruction
Threat description: Higaisa has sent spearphishing emails containing malicious attachments.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: Gorgon Group malware can attempt to disable security features in Microsoft Office and Windows Defender using the "taskkill" command.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: KeyBoy can determine the public or WAN IP address for the system.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: menuPass stages data prior to exfiltration in multi-part archives, often saved in the Recycle Bin.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: RTM encrypts C2 traffic with a custom RC4 variant.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: ROADTools can enumerate Azure AD users.
MITRE ATT&CK techniques:
- T1087.004: Account Discovery - Cloud Account
Threat description: LitePower can query the Registry for keys added to execute COM hijacking.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: Lazarus Group has replaced `win_fw.dll`, an internal component that is executed during IDA Pro installation, with a malicious DLL to download and execute a payload.
MITRE ATT&CK techniques:
- T1574.002: Hijack Execution Flow - DLL Side-Loading
Threat description: TeamTNT has executed PowerShell commands in batch scripts.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: ProLock can encrypt files on a compromised host with RC6, and encrypts the key with RSA-1024.
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: Small Sieve can use variations of Microsoft and Outlook spellings, such as "Microsift", in its file names to avoid detection.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Umbreon provides additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet.
MITRE ATT&CK techniques:
- T1205: Traffic Signaling
Threat description: During Operation Wocao, threat actors used VBScript to conduct reconnaissance on targeted systems.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: JHUHUGIT can retrieve an additional payload from its C2 server. JHUHUGIT has a command to download files to the victim’s machine.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: DanBot can upload files from compromised hosts.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Kimsuky has used `ipconfig/all` to gather network configuration information.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: Frankenstein has used CVE-2017-11882 to execute code on the victim's machine.
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
Threat description: Remsec can ping or traceroute a remote host.
MITRE ATT&CK techniques:
- T1018: Remote System Discovery