QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: New services created by RawPOS are made to appear like legitimate Windows services, with names such as "Windows Management Help Service", "Microsoft Support", and "Windows Advanced Task Manager".
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: Mustang Panda has used "tasklist /v" to determine active process information.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: JCry has used "cmd.exe" to launch PowerShell.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Twitoor uses Twitter for command and control.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: SLOTHFULMEDIA can add, modify, and/or delete registry keys. It has changed the proxy configuration of a victim system by modifying the "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap" registry.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: Bundlore can download and execute new versions of itself.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Trojan.Karagany can enumerate files and directories on a compromised host.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: PROMETHIUM has used watering hole attacks to deliver malicious versions of legitimate installers.
MITRE ATT&CK techniques:
- T1189: Drive-by Compromise
Threat description: WellMess can write files to a compromised host.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Dridex has collected the computer name and OS architecture information from the system.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: NOKKI uses Base64 encoding for strings.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Cannon can gather the username from the system.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: Turla surveys a system upon check-in to discover network configuration details using the "arp -a", "nbtstat -n", "net config", "ipconfig /all", and "route" commands, as well as NBTscan. Turla RPC backdoors have also retrieved registered RPC interface information from process memory.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: HiddenWasp uses a cipher to implement a decoding function.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Xbash can collect IP addresses and local intranet information from a victim’s machine.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: menuPass has compressed files before exfiltration using TAR and RAR.
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: Babuk can enumerate disk volumes, get disk information, and query service status.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: ZIRCONIUM has used the msiexec.exe command-line utility to download and execute malicious MSI files.
MITRE ATT&CK techniques:
- T1218.007: System Binary Proxy Execution - Msiexec
Threat description: APT3 enables the Remote Desktop Protocol for persistence. APT3 has also interacted with compromised systems to browse and copy files through RDP sessions.
MITRE ATT&CK techniques:
- T1021.001: Remote Services - Remote Desktop Protocol
Threat description: Proton uses a keylogger to capture keystrokes.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.
MITRE ATT&CK techniques:
- T1046: Network Service Discovery
Threat description: APT32's backdoor has modified the Windows Registry to store the backdoor's configuration.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: Aquatic Panda has acquired and used njRAT in its operations.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
Threat description: GravityRAT uses WMI to check the BIOS and manufacturer information for strings like "VMWare", "Virtual", and "XEN" and another WMI request to get the current temperature of the hardware to determine if it's a virtual machine environment.
MITRE ATT&CK techniques:
- T1497.001: Virtualization/Sandbox Evasion - System Checks
Threat description: HyperBro can list all services and their configurations.
MITRE ATT&CK techniques:
- T1007: System Service Discovery
Threat description: For C0011, Transparent Tribe registered domains likely designed to appear relevant to student targets in India.
MITRE ATT&CK techniques:
- T1583.001: Acquire Infrastructure - Domains
Threat description: Silence has used scheduled tasks to stage its operation.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: UNC2452 obtained a list of users and their roles from an Exchange server using "Get-ManagementRoleAssignment".
MITRE ATT&CK techniques:
- T1087: Account Discovery
Threat description: Siloscape uses Tor to communicate with C2.
MITRE ATT&CK techniques:
- T1090.003: Proxy - Multi-hop Proxy
Threat description: WarzoneRAT can collect compromised host information, including OS version, PC name, RAM size, and CPU details.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: DarkWatchman can query the Registry to determine if it has already been installed on the system.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: Pony has attempted to lure targets into clicking links in spoofed emails from legitimate banks.
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
Threat description: Wizard Spider has established persistence via the Registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and a shortcut within the startup folder.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Operation Wocao has used PowerShell on compromised systems.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: Hikit is a Rootkit that has been used by Axiom.
MITRE ATT&CK techniques:
- T1014: Rootkit
Threat description: Dark Caracal has used UPX to pack Bandook.
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: Egregor has used multiple anti-analysis and anti-sandbox techniques to prevent automated analysis by sandboxes.
MITRE ATT&CK techniques:
- T1497: Virtualization/Sandbox Evasion
Threat description: PolyglotDuke can use steganography to hide C2 information in images.
MITRE ATT&CK techniques:
- T1027.003: Obfuscated Files or Information - Steganography
Threat description: Small Sieve has the ability to use the Telegram Bot API from Telegram Messenger to send and receive messages.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: FIN7's Harpy backdoor malware can use DNS as a backup channel for C2 if HTTP fails.
MITRE ATT&CK techniques:
- T1008: Fallback Channels
Threat description: Misdat was typically packed using UPX.
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: yty gathers the computer name, the serial number of the main disk volume, CPU information, Microsoft Windows version, and runs the command "systeminfo".
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Sandworm Team has crafted phishing emails containing malicious hyperlinks.
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: During Operation Wocao, threat actors used the XServer backdoor to exfiltrate data.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: PLEAD samples were found to be highly obfuscated with junk code.
MITRE ATT&CK techniques:
- T1001.001: Data Obfuscation - Junk Data
Threat description: QakBot can use VBS to download and execute malicious files.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: PowerSploit's "Get-ProcessTokenGroup" Privesc-PowerUp module can enumerate all SIDs associated with its current token.
MITRE ATT&CK techniques:
- T1087.001: Account Discovery - Local Account
Threat description: CrackMapExec can dump usernames and hashed passwords from the SAM.
MITRE ATT&CK techniques:
- T1003.002: OS Credential Dumping - Security Account Manager
Threat description: Bazar can enumerate remote systems using " Net View".
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: Patchwork payloads download additional files from the C2 server.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Rocke has used Pastebin, Gitee, and GitLab for Command and Control.
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: UNC2452 used forged SAML tokens that allowed the actors to impersonate users and bypass MFA, enabling UNC2452 to access enterprise cloud applications and services.
MITRE ATT&CK techniques:
- T1550: Use Alternate Authentication Material
Threat description: PROMETHIUM has disguised malicious installer files by bundling them with legitimate software installers.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: APT29 used forged SAML tokens that allowed the actors to impersonate users and bypass MFA, enabling APT29 to access enterprise cloud applications and services.
MITRE ATT&CK techniques:
- T1550: Use Alternate Authentication Material
Threat description: Taidoor can use "GetCurrentProcessId" for process discovery.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: InvisiMole gathers information on the IP forwarding table, MAC address, configured proxy, and network SSID.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: Magic Hound has disabled antivirus services on targeted systems in order to upload malicious payloads.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: APT41 used BITSAdmin to download and install payloads.
MITRE ATT&CK techniques:
- T1197: BITS Jobs
Threat description: Saint Bot has used HTTP for C2 communications.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: Clop can kill several processes and services related to backups and security solutions.
MITRE ATT&CK techniques:
- T1489: Service Stop
Threat description: Green Lambert can use shell scripts for execution, such as "/bin/sh -c".
MITRE ATT&CK techniques:
- T1059.004: Command and Scripting Interpreter - Unix Shell
Threat description: QuasarRAT contains a .NET wrapper DLL for creating and managing scheduled tasks for maintaining persistence upon reboot.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: Kazuar gathers information about opened windows.
MITRE ATT&CK techniques:
- T1010: Application Window Discovery
Threat description: Chimera has used side loading to place malicious DLLs in memory.
MITRE ATT&CK techniques:
- T1574.002: Hijack Execution Flow - DLL Side-Loading
Threat description: ComRAT can use email attachments for command and control.
MITRE ATT&CK techniques:
- T1071.003: Application Layer Protocol - Mail Protocols
Threat description: TrickBot gathers the OS version, machine name, CPU type, amount of RAM available, and UEFI/BIOS firmware information from the victim’s machine.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: KOCTOPUS has added and deleted keys from the Registry.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: Mythic supports domain fronting via custom request headers.
MITRE ATT&CK techniques:
- T1090.004: Proxy - Domain Fronting
Threat description: CCBkdr was added to a legitimate, signed version 5.33 of the CCleaner software and distributed on CCleaner's distribution site.
MITRE ATT&CK techniques:
- T1195.002: Supply Chain Compromise - Compromise Software Supply Chain
Threat description: KeyBoy can launch interactive shells for communicating with the victim machine.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: APT29 changed domain federation trust settings using Azure AD administrative permissions to configure the domain to accept authorization tokens signed by their own SAML signing certificate.
MITRE ATT&CK techniques:
- T1484.002: Domain or Tenant Policy Modification - Trust Modification
Threat description: POWERTON has used HTTP/HTTPS for C2 traffic.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: SHUTTERSPEED can collect system information.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: KOCTOPUS can delete created registry keys used for persistence as part of its cleanup procedure.
MITRE ATT&CK techniques:
- T1070.009: Indicator Removal - Clear Persistence
Threat description: HEXANE has acquired, and sometimes customized, open source tools such as Mimikatz, Empire, VNC remote access software, and DIG.net.
MITRE ATT&CK techniques:
- T1588.002: Obtain Capabilities - Tool
Threat description: A module in Prikormka collects information from the victim about installed anti-virus software.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: RTM can detect if it is running within a sandbox or other virtualized analysis environment.
MITRE ATT&CK techniques:
- T1497: Virtualization/Sandbox Evasion
Threat description: MuddyWater has performed credential dumping with Mimikatz and procdump64.exe.
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: Frankenstein has used MSbuild to execute an actor-created file.
MITRE ATT&CK techniques:
- T1127.001: Trusted Developer Utilities Proxy Execution - MSBuild
Threat description: Pony has used the Adobe Reader icon for the downloaded file to look more trustworthy.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Operation Wocao has used a custom proxy tool called "Agent" which has support for multiple hops.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: Olympic Destroyer uses the native Windows utilities "vssadmin", "wbadmin", and "bcdedit" to delete and disable operating system recovery features such as the Windows backup catalog and Windows Automatic Repair.
MITRE ATT&CK techniques:
- T1490: Inhibit System Recovery
Threat description: Cobalt Strike can conduct peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: Empire can use various modules to search for files containing passwords.
MITRE ATT&CK techniques:
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: Evilnum has sent spearphishing emails designed to trick the recipient into opening malicious shortcut links which downloads a .LNK file.
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
Threat description: TA551 has masked malware DLLs as dat and jpg files.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: MuddyWater has stored a decoy PDF file within a victim's `%temp%` folder.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: Heyoka Backdoor has been spread through malicious document lures.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: DarkVishnya used brute-force attack to obtain login data.
MITRE ATT&CK techniques:
- T1110: Brute Force
Threat description: Valak has used packed DLL payloads.
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: Inception has encrypted malware payloads dropped on victim machines with AES and RC4 encryption.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: YAHOYAH decrypts downloaded files before execution.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Higaisa used JavaScript to execute additional files.
MITRE ATT&CK techniques:
- T1059.007: Command and Scripting Interpreter - JavaScript
Threat description: Lazarus Group has used DOCX files to retrieve a malicious document template/DOTM file.
MITRE ATT&CK techniques:
- T1221: Template Injection
Threat description: MCMD can modify processes to prevent them from being visible on the desktop.
MITRE ATT&CK techniques:
- T1564.003: Hide Artifacts - Hidden Window
Threat description: APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Magic Hound has acquired the personal email addresses of some individuals they intend to target.
MITRE ATT&CK techniques:
- T1589.002: Gather Victim Identity Information - Email Addresses
Threat description: Lucifer can execute TCP, UDP,  and HTTP denial of service (DoS) attacks.
MITRE ATT&CK techniques:
- T1498: Network Denial of Service
Threat description: Ramsay has masqueraded as a 7zip installer.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Kimsuky has decoded malicious VBScripts using Base64.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: MoonWind has a command to return a list of running processes.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: BoxCaon uploads files and data from a compromised host over the existing C2 channel.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: certutil can be used to download files from a given URL.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: PS1 can use an XOR key to decrypt a PowerShell loader and payload binary.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: HermeticWizard can execute files on remote machines using DCOM.
MITRE ATT&CK techniques:
- T1559.001: Inter-Process Communication - Component Object Model
Threat description: Molerats has used msiexec.exe to execute an MSI payload.
MITRE ATT&CK techniques:
- T1218.007: System Binary Proxy Execution - Msiexec
Threat description: HEXANE has used remote desktop sessions for lateral movement.
MITRE ATT&CK techniques:
- T1021.001: Remote Services - Remote Desktop Protocol
Threat description: TinyTurla can upload files from a compromised host.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: LaZagne can obtain credentials from Vault files.
MITRE ATT&CK techniques:
- T1555.004: Credentials from Password Stores - Windows Credential Manager
Threat description: APT3 has a tool that can copy files to remote machines.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: KONNI has registered itself as a service using its export function.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: Leviathan has sent spearphishing emails with malicious attachments, including .rtf, .doc, and .xls files.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: WinMM is usually configured with primary and backup domains for C2 communications.
MITRE ATT&CK techniques:
- T1008: Fallback Channels
Threat description: During C0011, Transparent Tribe sent malicious attachments via email to student targets in India.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: Blue Mockingbird has gained initial access by exploiting CVE-2019-18935, a vulnerability within Telerik UI for ASP.NET AJAX.
MITRE ATT&CK techniques:
- T1190: Exploit Public-Facing Application
Threat description: Green Lambert can use proxies for C2 traffic.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: Maze has used several Windows API functions throughout the encryption process including IsDebuggerPresent, TerminateProcess, Process32FirstW, among others.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: UNC2452 used Rundll32 to execute payloads.
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: PoshC2 has modules for brute forcing local administrator and AD user accounts.
MITRE ATT&CK techniques:
- T1110: Brute Force
Threat description: APT32 used the "ipconfig /all" command to gather the IP address from the system.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: StrongPity has created new services and modified existing services for persistence.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: BloodHound has the ability to collect local admin information via GPO.
MITRE ATT&CK techniques:
- T1615: Group Policy Discovery
Threat description: Aria-body has the ability to duplicate a token from ntprint.exe.
MITRE ATT&CK techniques:
- T1134.001: Access Token Manipulation - Token Impersonation/Theft
Threat description: Lokibot has stolen credentials from multiple applications and data sources including Windows OS credentials, email clients, FTP, and SFTP clients.
MITRE ATT&CK techniques:
- T1555: Credentials from Password Stores
Threat description: Patchwork has used spearphishing with links to try to get users to click, download and open malicious files.
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
Threat description: PowerStallion has been used to monitor process lists.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: Caterpillar WebShell has a module to gather information from the compromrised asset, including the computer version, computer name, IIS version, and more.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: During Operation Sharpshooter, threat actors sent malicious Word OLE documents to victims.
MITRE ATT&CK techniques:
- T1559.002: Inter-Process Communication - Dynamic Data Exchange
Threat description: APT38  has attempted to lure victims into enabling malicious macros within email attachments.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: FALLCHILL collects MAC address and local IP address information from the victim.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: LitePower can determine if the current user has admin privileges.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: OopsIE can download files from its C2 server to the victim's machine.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Inception has ensured persistence at system boot by setting the value "regsvr32 %path%\ctfmonrn.dll /s".
MITRE ATT&CK techniques:
- T1218.010: System Binary Proxy Execution - Regsvr32
Threat description: FIN7 captured screenshots and desktop video recordings.
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: SUNBURST collected the registry value "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid" from compromised hosts.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: SideCopy has used a legitimate DLL file name, `Duser.dll` to disguise a malicious remote access tool.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: MoonWind encrypts C2 traffic using RC4 with a static key.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: APT32's backdoor has used Windows services as a way to execute its malicious payload.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: Revenge RAT uses the PowerShell command "Reflection.Assembly" to load itself into memory to aid in execution.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: Data SPACESHIP copies to the staging area is compressed with zlib. Bytes are rotated by four positions and XOR'ed with 0x23.
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: For C0011, Transparent Tribe used malicious VBA macros within a lure document as part of the Crimson malware installation process onto a compromised host.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: Cobalt Group deleted the DLL dropper from the victim’s machine to cover their tracks.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: Stolen Pencil has used tools that are capable of obtaining credentials from web browsers.
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
Threat description: APT1 has been known to use credential dumping using Mimikatz.
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: FinFisher has used the "KernelCallbackTable" to hijack the execution flow of a process by replacing the "__fnDWORD" function with the address of a created Asynchronous Procedure Call stub routine.
MITRE ATT&CK techniques:
- T1574.013: Hijack Execution Flow - KernelCallbackTable
Threat description: FIN8 has deleted Registry keys during post compromise cleanup activities.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: Chrommme can store captured system information locally prior to exfiltration.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: SpicyOmelette can identify the system name of a compromised host.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: RTM has been delivered as archived Windows executable files masquerading as PDF documents.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: StrifeWater can modify its sleep time responses from the default of 20-22 seconds.
MITRE ATT&CK techniques:
- T1497.003: Virtualization/Sandbox Evasion - Time Based Evasion
Threat description: Aoqin Dragon has used a dropper that employs a worm infection strategy using a removable device to breach a secure network environment.
MITRE ATT&CK techniques:
- T1091: Replication Through Removable Media
Threat description: SUGARDUMP has encrypted collected data using AES CBC mode and encoded it using Base64.
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: Leviathan has used multi-hop proxies to disguise the source of their malicious traffic.
MITRE ATT&CK techniques:
- T1090.003: Proxy - Multi-hop Proxy
Threat description: Remcos has a command to hide itself through injecting into another process.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: Earth Lusca employed a PowerShell script called RDPConnectionParser to read and filter the Windows event log “Microsoft-Windows-TerminalServices-RDPClient/Operational”
(Event ID 1024) to obtain network information from RDP connections. Earth Lusca has also used netstat from a compromised system to obtain network connection information.
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
Threat description: Sowbug extracted documents and bundled them into a RAR archive.
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: MuddyWater has sent targeted spearphishing e-mails with malicious links.
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: APT38 has collected data from a compromised host.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: P8RAT can check the compromised host for processes associated with VMware or VirtualBox environments.
MITRE ATT&CK techniques:
- T1497.001: Virtualization/Sandbox Evasion - System Checks
Threat description: Octopus has relied upon users clicking on a malicious attachment delivered through spearphishing.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: One persistence mechanism used by CozyCar is to set itself to be executed at system startup by adding a Registry value under one of the following Registry keys: <br>"HKLM\Software\Microsoft\Windows\CurrentVersion\Run\" <br>"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" <br>"HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" <br>"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run"
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Wizard Spider has exfiltrated domain credentials and network enumeration information over command and control (C2) channels.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Wizard Spider has used Window Remote Management to move laterally through a victim network.
MITRE ATT&CK techniques:
- T1021.006: Remote Services - Windows Remote Management
Threat description: NETEAGLE allows adversaries to execute shell commands on the infected host.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Green Lambert can use DNS for C2 communications.
MITRE ATT&CK techniques:
- T1071.004: Application Layer Protocol - DNS
Threat description: Siloscape maps the host’s C drive to the container by creating a global symbolic link to the host through the calling of "NtSetInformationSymbolicLink".
MITRE ATT&CK techniques:
- T1611: Escape to Host
Threat description: Elise executes "net start" after initial communication is made to the remote server.
MITRE ATT&CK techniques:
- T1007: System Service Discovery
Threat description: SUNBURST checked the domain name of the compromised host to verify it was running in a real environment.
MITRE ATT&CK techniques:
- T1497.001: Virtualization/Sandbox Evasion - System Checks
Threat description: SUNBURST used Rundll32 to execute payloads.
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: PowerSploit's "Invoke-WmiCommand" CodeExecution module uses WMI to execute and retrieve the output from a PowerShell payload.
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: Fox Kitten has used tools including NMAP to conduct broad scanning to identify open ports.
MITRE ATT&CK techniques:
- T1046: Network Service Discovery
Threat description: Kimsuky has used a modified TeamViewer client as a command and control channel.
MITRE ATT&CK techniques:
- T1219: Remote Access Software
Threat description: APT28 has performed timestomping on victim files.
MITRE ATT&CK techniques:
- T1070.006: Indicator Removal - Timestomp
Threat description: KGH_SPY has been spread through Word documents containing malicious macros.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: jRAT can list network connections.
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
Threat description: Agent Tesla can collect the username from the victim’s machine.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: Ursnif has used Registry modifications as part of its installation routine.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: ThreatNeedle can be loaded into the Startup folder (`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\OneDrives.lnk`) as a Shortcut file for persistence.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: VERMIN is obfuscated using the obfuscation tool called ConfuserEx.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Ursnif has injected code into target processes via thread local storage callbacks.
MITRE ATT&CK techniques:
- T1055.005: Process Injection - Thread Local Storage
Threat description: Aria-body has the ability to use a reverse SOCKS proxy module.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: Empire has a dylib hijacker module that generates a malicious dylib given the path to a legitimate dylib of a vulnerable application.
MITRE ATT&CK techniques:
- T1574.004: Hijack Execution Flow - Dylib Hijacking
Threat description: During Operation Wocao, threat actors targeted people based on their organizational roles and privileges.
MITRE ATT&CK techniques:
- T1589: Gather Victim Identity Information
Threat description: OSX_OCEANLOTUS.D uses a shell script as the main executable inside an app bundle and drops an embedded base64-encoded payload to the "/tmp" folder.
MITRE ATT&CK techniques:
- T1059.004: Command and Scripting Interpreter - Unix Shell
Threat description: FoggyWeb can invoke the `Common.Compress` method to compress data with the C# GZipStream compression class.
MITRE ATT&CK techniques:
- T1560.002: Archive Collected Data - Archive via Library
Threat description: DOGCALL is encrypted using single-byte XOR.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Kimsuky has used e-mail to send exfiltrated data to C2 servers.
MITRE ATT&CK techniques:
- T1071.003: Application Layer Protocol - Mail Protocols
Threat description: UNC2452 used "fsutil" to check available free space before executing actions that might create large files on disk.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: DEATHRANSOM has the ability to use loop operations to enumerate network resources.
MITRE ATT&CK techniques:
- T1135: Network Share Discovery
Threat description: Stuxnet has the ability to generate new C2 domains.
MITRE ATT&CK techniques:
- T1008: Fallback Channels
Threat description: Avenger has the ability to decrypt files downloaded from C2.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Dacls has had its payload named with a dot prefix to make it hidden from view in the Finder application.
MITRE ATT&CK techniques:
- T1564.001: Hide Artifacts - Hidden Files and Directories
Threat description: BRONZE BUTLER has masked executables with document file icons including Word and Adobe PDF.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: Sidewinder has used tools to enumerate software installed on an infected host.
MITRE ATT&CK techniques:
- T1518: Software Discovery
Threat description: WhisperGate overwrites the MBR with a bootloader component that performs destructive wiping operations on hard drives and displays a fake ransom note when the host boots.
MITRE ATT&CK techniques:
- T1542.003: Pre-OS Boot - Bootkit
Threat description: Fox Kitten has used protocol tunneling for communication and RDP activity on compromised hosts through the use of open source tools such as Ngrok and custom tool SSHMinion.
MITRE ATT&CK techniques:
- T1572: Protocol Tunneling
Threat description: Dridex has relied upon users clicking on a malicious attachment delivered through spearphishing.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: Elise communicates over HTTP or HTTPS for C2.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: Hildegard has used an IRC channel for C2 communications.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: Wizard Spider has used Rubeus, MimiKatz Kerberos module, and the Invoke-Kerberoast cmdlet to steal AES hashes.
MITRE ATT&CK techniques:
- T1558.003: Steal or Forge Kerberos Tickets - Kerberoasting
Threat description: Meteor can use group policy to push a scheduled task from the AD to all network machines.
MITRE ATT&CK techniques:
- T1484.001: Domain or Tenant Policy Modification - Group Policy Modification
Threat description: Industroyer’s data wiper component enumerates specific files on all the Windows drives.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: Kazuar finds a specified directory, lists the files and metadata about those files.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: SLOTHFULMEDIA can open a command line to execute commands.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: APT38 has used cron to create pre-scheduled and periodic background jobs on a Linux system.
MITRE ATT&CK techniques:
- T1053.003: Scheduled Task/Job - Cron
Threat description: Threat Group-3390 has exploited MS17-010 to move laterally to other systems on the network.
MITRE ATT&CK techniques:
- T1210: Exploitation of Remote Services
Threat description: NavRAT leverages cmd.exe to perform discovery techniques. NavRAT loads malicious shellcode and executes it in memory.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Matryoshka can establish persistence by adding Registry Run keys.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: SUNBURST had commands to enumerate files and directories.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: LaZagne can perform credential dumping from LSA secrets to obtain account and password information.
MITRE ATT&CK techniques:
- T1003.004: OS Credential Dumping - LSA Secrets
Threat description: TrickBot uses non-descriptive names to hide functionality and uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: BlackEnergy has used a plug-in to gather credentials stored in files on the host by various software programs, including The Bat! email client, Outlook, and Windows Credential Store.
MITRE ATT&CK techniques:
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: Lucifer has used UPX packed binaries.
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: When a document is found matching one of the extensions in the configuration, TINYTYPHON uploads it to the C2 server.
MITRE ATT&CK techniques:
- T1020: Automated Exfiltration
Threat description: EKANS stops database, data backup solution, antivirus, and ICS-related processes.
MITRE ATT&CK techniques:
- T1489: Service Stop
Threat description: SynAck clears event logs.
MITRE ATT&CK techniques:
- T1070.001: Indicator Removal - Clear Windows Event Logs
Threat description: SILENTTRINITY can use `cmd.exe` to enable lateral movement using DCOM.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: During Operation CuckooBees, the threat actors used the `dsquery` and `dsget` commands to get domain environment information and to query users in administrative groups.
MITRE ATT&CK techniques:
- T1087.002: Account Discovery - Domain Account
Threat description: macOS.OSAMiner has placed a Stripped Payloads with a `plist` extension in the Launch Agent's folder.
MITRE ATT&CK techniques:
- T1543.001: Create or Modify System Process - Launch Agent
Threat description: Exaramel for Windows has a command to execute VBS scripts on the victim’s machine.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: Misdat network traffic communicates over a raw socket.
MITRE ATT&CK techniques:
- T1095: Non-Application Layer Protocol
Threat description: PinchDuke gathers system configuration information.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Ember Bear has used control panel files (CPL), delivered via e-mail, for execution.
MITRE ATT&CK techniques:
- T1218.002: System Binary Proxy Execution - Control Panel
Threat description: TRITON attempts to write a dummy program into memory if it fails to reset the Triconex controller.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: Turian can retrieve the internal IP address of a compromised host.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: Bazar has manually loaded ntdll from disk in order to identity and remove API hooks set by security products.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: SDelete deletes data in a way that makes it unrecoverable.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
- T1485: Data Destruction
Threat description: Gallmaker used PowerShell to download additional payloads and for execution.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: Ngrok has been used by threat actors to proxy C2 connections to ngrok service subdomains.
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: Turian can download additional files and tools from its C2.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: For C0010, UNC3890 actors used unique malware, including SUGARUSH and SUGARDUMP.
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: QakBot has spread through emails with malicious attachments.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: Mythic supports SMB-based peer-to-peer C2 profiles.
MITRE ATT&CK techniques:
- T1071.002: Application Layer Protocol - File Transfer Protocols
Threat description: Bazar has the ability to use an alternative C2 server if the primary server fails.
MITRE ATT&CK techniques:
- T1008: Fallback Channels
Threat description: StrongPity can use the "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" Registry key for persistence.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Hydraq creates a backdoor through which remote attackers can read data from files.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: APT33 has used FTP to exfiltrate files (separately from the C2 channel).
MITRE ATT&CK techniques:
- T1048.003: Exfiltration Over Alternative Protocol - Exfiltration Over Unencrypted Non-C2 Protocol
Threat description: SLOTHFULMEDIA has the capability to stop processes and services.
MITRE ATT&CK techniques:
- T1489: Service Stop
Threat description: APT12 has used multiple variants of DNS Calculation including multiplying the first two octets of an IP address and adding the third octet to that value in order to get a resulting command and control port.
MITRE ATT&CK techniques:
- T1568.003: Dynamic Resolution - DNS Calculation
Threat description: EXOTIC LILY has used the e-mail notification features of legitimate file sharing services for spearphishing.
MITRE ATT&CK techniques:
- T1566.003: Phishing - Spearphishing via Service
Threat description: NanHaiShu can gather the victim computer name and serial number.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: PowerSploit's "Get-MicrophoneAudio" Exfiltration module can record system microphone audio.
MITRE ATT&CK techniques:
- T1123: Audio Capture
Threat description: Gamaredon Group has used an Outlook VBA module on infected systems to send phishing emails with malicious attachments to other employees within the organization.
MITRE ATT&CK techniques:
- T1534: Internal Spearphishing
Threat description: Trojan.Karagany can dump passwords and save them into "\ProgramData\Mail\MailAg\pwds.txt".
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: PcShare can delete its persistence mechanisms from the registry.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: SynAck enumerates Registry keys associated with event logs.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: SLOTHFULMEDIA has collected system name, OS version, adapter information, memory usage, and disk information from a victim machine.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: SMOKEDHAM has modified the Registry to hide created user accounts from the Windows logon screen.
MITRE ATT&CK techniques:
- T1564.002: Hide Artifacts - Hidden Users
Threat description: PowerStallion uses Microsoft OneDrive as a C2 server via a network drive mapped with "net use".
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: WarzoneRAT can send collected victim data to its C2 server.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Spark has run the whoami command and has a built-in command to identify the user logged in.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: Imminent Monitor has a PasswordRecoveryPacket module for recovering browser passwords.
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
Threat description: Amadey has used fast flux DNS for its C2.
MITRE ATT&CK techniques:
- T1568.001: Dynamic Resolution - Fast Flux DNS
Threat description: Dragonfly has scanned targeted systems for vulnerable Citrix and Microsoft Exchange services.
MITRE ATT&CK techniques:
- T1595.002: Active Scanning - Vulnerability Scanning
Threat description: menuPass has used a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI.
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: Kimsuky has developed its own unique malware such as MailFetch.py for use in operations.
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: Squirrelwaffle has exfiltrated victim data using HTTP POST requests to its C2 servers.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: PowerShower has used a PowerShell document stealer module to pack and exfiltrate .txt, .pdf, .xls or .doc files smaller than 5MB that were modified during the past two days.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: BadPatch establishes a foothold by adding a link to the malware executable in the startup folder.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Siloscape checks for Kubernetes node permissions.
MITRE ATT&CK techniques:
- T1069: Permission Groups Discovery
Threat description: BitPaymer can use the RegEnumKeyW to iterate through Registry keys.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: The AADInternals `Set-AADIntUserMFA` command can be used to disable MFA for a specified user.
MITRE ATT&CK techniques:
- T1556.006: Modify Authentication Process - Multi-Factor Authentication
Threat description: GravityRAT lists the running processes on the system.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: CoinTicker downloads the EggShell mach-o binary using curl, which does not set the quarantine flag.
MITRE ATT&CK techniques:
- T1553.001: Subvert Trust Controls - Gatekeeper Bypass
Threat description: Chinoxy can use a digitally signed binary ("Logitech Bluetooth Wizard Host Process") to load its dll into memory.
MITRE ATT&CK techniques:
- T1574.002: Hijack Execution Flow - DLL Side-Loading
Threat description: Cyclops Blink can enumerate the process it is currently running under.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: Imminent Monitor has a module for performing remote desktop access.
MITRE ATT&CK techniques:
- T1021.001: Remote Services - Remote Desktop Protocol
Threat description: CharmPower has the ability to capture screenshots.
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: GrimAgent has the ability to enumerate files and directories on a compromised host.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery