QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: Empire can modify the registry run keys "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" and "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" for persistence.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: DarkVishnya used Bash Bunny, Raspberry Pi, netbooks or inexpensive laptops to connect to the company’s local network.
MITRE ATT&CK techniques:
- T1200: Hardware Additions
Threat description: GALLIUM used DLL side-loading to covertly load PoisonIvy into memory on the victim machine.
MITRE ATT&CK techniques:
- T1574.002: Hijack Execution Flow - DLL Side-Loading
Threat description: During Frankenstein, the threat actors named a malicious scheduled task "WinUpdate" for persistence.
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: KGH_SPY has the ability to download and execute code from remote servers.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: During Operation Wocao, threat actors used a custom collection method to intercept two-factor authentication soft tokens.
MITRE ATT&CK techniques:
- T1111: Multi-Factor Authentication Interception
Threat description: OSX/Shlayer can install malicious Safari browser extensions to serve ads.
MITRE ATT&CK techniques:
- T1176: Browser Extensions
Threat description: WastedLocker contains junk code to increase its entropy and hide the actual code.
MITRE ATT&CK techniques:
- T1027.001: Obfuscated Files or Information - Binary Padding
Threat description: MuddyWater has used malware that can execute PowerShell scripts via DDE.
MITRE ATT&CK techniques:
- T1559.002: Inter-Process Communication - Dynamic Data Exchange
Threat description: Fox Kitten has used Volume Shadow Copy to access credential information from NTDS.
MITRE ATT&CK techniques:
- T1003.003: OS Credential Dumping - NTDS
Threat description: RTM can use the "FindNextUrlCacheEntryA" and "FindFirstUrlCacheEntryA" functions to search for specific strings within browser history.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: meek uses Domain Fronting to disguise the destination of network traffic as another server that is hosted in the same Content Delivery Network (CDN) as the intended destination.
MITRE ATT&CK techniques:
- T1090.004: Proxy - Domain Fronting
Threat description: RTM can delete all Registry entries created during its execution.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: IndigoZebra sent spearphishing emails containing malicious attachments that urged recipients to review modifications in the file which would trigger the attack.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: Proxysvc can delete files indicated by the attacker and remove itself from disk using a batch file.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: Sidewinder has lured targets to click on malicious files to gain execution in the target environment.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: Cryptoistic has the ability delete files from a compromised host.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: SDBbot has the ability to use application shimming for persistence if it detects it is running as admin on Windows XP or 7, by creating a shim database to patch services.exe.
MITRE ATT&CK techniques:
- T1546.011: Event Triggered Execution - Application Shimming
Threat description: PowerSploit contains a collection of Privesc-PowerUp modules that can query Registry keys for potential opportunities.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: NotPetya can use PsExec, which interacts with the "ADMIN$" network share to execute commands on remote systems.
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
Threat description: JSS Loader has been executed through malicious attachments contained in spearphishing emails.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: Cobian RAT has a feature to perform screen capture.
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: PowerLess can use a module to log keystrokes.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Lucifer can collect the computer name, system architecture, default language, and processor frequency of a compromised host.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: RARSTONE downloads its backdoor component from a C2 server and loads it directly into memory.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: If the victim is using PowerShell 3.0 or later, POWERSOURCE writes its decoded payload to an alternate data stream (ADS) named kernel32.dll that is saved in "%PROGRAMDATA%\Windows\".
MITRE ATT&CK techniques:
- T1564.004: Hide Artifacts - NTFS File Attributes
Threat description: Net Crawler uses PsExec to perform remote service manipulation to execute a copy of itself as part of lateral movement.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: Green Lambert can create a Launch Agent with the `RunAtLoad` key-value pair set to "true", ensuring the `com.apple.GrowlHelper.plist` file runs every time a user logs in.
MITRE ATT&CK techniques:
- T1543.001: Create or Modify System Process - Launch Agent
Threat description: LazyScripter has used dynamic DNS providers to create legitimate-looking subdomains for C2.
MITRE ATT&CK techniques:
- T1583.001: Acquire Infrastructure - Domains
Threat description: RegDuke can use Dropbox as its C2 server.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: Mori can write data to `HKLM\Software\NFC\IPA` and `HKLM\Software\NFC\` and delete Registry values.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: DOGCALL is capable of logging keystrokes.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: Aoqin Dragon has used fake icons including antivirus and external drives to disguise malicious payloads.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Rover searches for files on attached removable drives based on a predefined list of file extensions every five seconds.
MITRE ATT&CK techniques:
- T1025: Data from Removable Media
Threat description: Kimsuky has used tools that are capable of obtaining credentials from saved mail.
MITRE ATT&CK techniques:
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: Leviathan has utilized OLE as a method to insert malicious content inside various phishing documents.
MITRE ATT&CK techniques:
- T1559.002: Inter-Process Communication - Dynamic Data Exchange
Threat description: Hildegard has modified /etc/ld.so.preload to intercept shared library import functions.
MITRE ATT&CK techniques:
- T1574.006: Hijack Execution Flow - Dynamic Linker Hijacking
Threat description: UPPERCUT can capture desktop screenshots in the PNG format and send them to the C2 server.
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: APT37 identifies the victim username.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: During its initial execution, BACKSPACE extracts operating system information from the infected host.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: During C0010, UNC3890 actors likely compromised the domain of a legitimate Israeli shipping company.
MITRE ATT&CK techniques:
- T1584.001: Compromise Infrastructure - Domains
Threat description: Mis-Type saves itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: During Operation CuckooBees, the threat actors used the `fsutil fsinfo drives` command as part of their advanced reconnaissance.
MITRE ATT&CK techniques:
- T1120: Peripheral Device Discovery
Threat description: Flame can use MS10-061 to exploit a print spooler vulnerability in a remote system with a shared printer in order to move laterally.
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
- T1210: Exploitation of Remote Services
Threat description: BloodHound has the ability to map domain trusts and identify misconfigurations for potential abuse.
MITRE ATT&CK techniques:
- T1482: Domain Trust Discovery
Threat description: Seasalt is capable of installing itself as a service.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: PLEAD has the ability to list drives and files on the compromised host.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: APT1 has used the Windows command shell to execute commands.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: Inception has used weaponized documents attached to spearphishing emails for reconnaissance and initial compromise.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: PowerDuke has a command to write random data across a file and delete it.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
- T1485: Data Destruction
Threat description: Mongall has been packed with Themida.
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: Chimera has used "type \\<hostname>\c$\Users\<username>\Favorites\Links\Bookmarks bar\Imported From IE\*citrix*" for bookmark discovery.
MITRE ATT&CK techniques:
- T1217: Browser Information Discovery
Threat description: Frankenstein has enumerated hosts, gathering username, machine name, and administrative permissions information.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: Machete logs keystrokes from the victim’s machine.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: Ixeshe sets its own executable file's attributes to hidden.
MITRE ATT&CK techniques:
- T1564.001: Hide Artifacts - Hidden Files and Directories
Threat description: Ryuk can launch "icacls <path> /grant Everyone:F /T /C /Q" to delete every access-based restrictions on files and directories.
MITRE ATT&CK techniques:
- T1222.001: File and Directory Permissions Modification - Windows File and Directory Permissions Modification
Threat description: TURNEDUP is capable of creating a reverse shell.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Windshift has used malware to identify the username on a compromised host.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: Moses Staff has collected the administrator username from a compromised host.
MITRE ATT&CK techniques:
- T1087.001: Account Discovery - Local Account
Threat description: DarkComet can use HTTP for C2 communications.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: Machete has has relied on users opening malicious links delivered through spearphishing to execute malware.
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
Threat description: Pisloader has a command to collect the victim's IP address.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: RTM has used a modified version of TeamViewer and Remote Utilities for remote access.
MITRE ATT&CK techniques:
- T1219: Remote Access Software
Threat description: PcShare can collect files and information from a compromised host.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: For Operation Dust Storm, the threat actors established email addresses to register domains for their operations.
MITRE ATT&CK techniques:
- T1585.002: Establish Accounts - Email Accounts
Threat description: SynAck lists all the keyboard layouts installed on the victim’s system using "GetKeyboardLayoutList" API and checks against a hardcoded language code list. If a match if found, SynAck sleeps for 300 seconds and then exits without encrypting files.
MITRE ATT&CK techniques:
- T1614.001: System Location Discovery - System Language Discovery
Threat description: Bisonal can execute "ipconfig" on the victim’s machine.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: Starloader has masqueraded as legitimate software update packages such as Adobe Acrobat Reader and Intel.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: menuPass has used Wevtutil to remove PowerShell execution logs.
MITRE ATT&CK techniques:
- T1070.003: Indicator Removal - Clear Command History
Threat description: Mofang has compressed the ShimRat executable within malicious email attachments. Mofang has also encrypted payloads before they are downloaded to victims.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: PinchDuke searches for files created within a certain timeframe and whose file extension matches a predefined list.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: PUNCHBUGGY can load a DLL using the LoadLibrary API.
MITRE ATT&CK techniques:
- T1129: Shared Modules
Threat description: Carberp can start a remote VNC session by downloading a new plugin.
MITRE ATT&CK techniques:
- T1021.005: Remote Services - VNC
Threat description: AppleJeus has used a valid digital signature from Sectigo to appear legitimate.
MITRE ATT&CK techniques:
- T1553.002: Subvert Trust Controls - Code Signing
Threat description: During Operation Wocao, threat actors used Impacket's smbexec.py as well as accessing the C$ and IPC$ shares to move laterally.
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
Threat description: Xbash has destroyed Linux-based databases as part of its ransomware capabilities.
MITRE ATT&CK techniques:
- T1485: Data Destruction
Threat description: Mustang Panda has stored collected credential files in "c:\windows\temp" prior to exfiltration. Mustang Panda has also stored documents for exfiltration in a hidden folder on USB drives.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: pwdump can be used to dump credentials from the SAM.
MITRE ATT&CK techniques:
- T1003.002: OS Credential Dumping - Security Account Manager
Threat description: Leviathan has collected compromised credentials to use for targeting efforts.
MITRE ATT&CK techniques:
- T1589.001: Gather Victim Identity Information - Credentials
Threat description: DownPaper searches and reads the value of the Windows Update Registry Run key.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: LAPSUS$ has used compromised credentials and/or session tokens to gain access into a victim's VPN, VDI, RDP, and IAMs.
MITRE ATT&CK techniques:
- T1078: Valid Accounts
Threat description: BlackMould can enumerate local drives on a compromised host.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: BADNEWS collects C2 information via a dead drop resolver.
MITRE ATT&CK techniques:
- T1102.001: Web Service - Dead Drop Resolver
Threat description: PinchDuke collects user files from the compromised host based on predefined file extensions.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Comnie executes VBS scripts.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: Patchwork has obfuscated a script with Crypto Obfuscator.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: ccf32 can determine the local time on targeted machines.
MITRE ATT&CK techniques:
- T1124: System Time Discovery
Threat description: Peirates can enumerate Kubernetes pods in a given namespace.
MITRE ATT&CK techniques:
- T1613: Container and Resource Discovery
Threat description: PLEAD has the ability to proxy network communications.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: Silence has used Windows command-line to run commands.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: LAPSUS$ has created global admin accounts in the targeted organization's cloud instances to gain persistence.
MITRE ATT&CK techniques:
- T1136.003: Create Account - Cloud Account
Threat description: Kinsing has used a script to parse files like "/etc/hosts" and SSH "known_hosts" to discover remote systems.
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: Conti has decrypted its payload using a hardcoded AES-256 key.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.
MITRE ATT&CK techniques:
- T1560.002: Archive Collected Data - Archive via Library
Threat description: QakBot can store its configuration information in a randomly named subkey under "HKCU\Software\Microsoft".
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: NETEAGLE can send process listings over the C2 channel.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: Sharpshooter's first-stage downloader was a VBA macro.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: FYAnti has the ability to decrypt an embedded .NET module.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: GRIFFON is written in and executed as JavaScript.
MITRE ATT&CK techniques:
- T1059.007: Command and Scripting Interpreter - JavaScript
Threat description: OSX_OCEANLOTUS.D has the ability to upload files from a compromised host.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Denis compressed collected data using zlib.
MITRE ATT&CK techniques:
- T1560.002: Archive Collected Data - Archive via Library
Threat description: Kerrdown has been distributed via e-mails containing a malicious link.
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: Kimsuky has used a macOS Python implant to gather data as well as MailFetcher.py code to automatically collect email data.
MITRE ATT&CK techniques:
- T1059.006: Command and Scripting Interpreter - Python
Threat description: Ixeshe has used registry values and file names associated with Adobe software, such as AcroRd32.exe.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: TrickBot has used a VNC module to monitor the victim and collect information to pivot to valuable systems on the network
MITRE ATT&CK techniques:
- T1021.005: Remote Services - VNC
Threat description: DarkWatchman can load DLLs.
MITRE ATT&CK techniques:
- T1129: Shared Modules
Threat description: During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and browse the victim file system.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: Fox Kitten has accessed ntuser.dat and UserClass.dat on compromised hosts.
MITRE ATT&CK techniques:
- T1087.001: Account Discovery - Local Account
Threat description: FIVEHANDS has the ability to delete volume shadow copies on compromised hosts.
MITRE ATT&CK techniques:
- T1490: Inhibit System Recovery
Threat description: REvil can query the Registry to get random file extensions to append to encrypted files.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: IcedID has used web injection attacks to redirect victims to spoofed sites designed to harvest banking and other credentials.  IcedID can use a self signed TLS certificate in connection with the spoofed site and simultaneously maintains a live connection with the legitimate site to display the correct URL and certificates in the browser.
MITRE ATT&CK techniques:
- T1185: Browser Session Hijacking
Threat description: MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: Trojan.Karagany can detect commonly used and generic virtualization platforms based primarily on drivers and file paths.
MITRE ATT&CK techniques:
- T1497.001: Virtualization/Sandbox Evasion - System Checks
Threat description: When it first starts, BADNEWS crawls the victim's local drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Operation Wocao has edited variable names within the Impacket suite to avoid automated detection.
MITRE ATT&CK techniques:
- T1027.005: Obfuscated Files or Information - Indicator Removal from Tools
Threat description: UNC2452 used AdFind to enumerate remote systems.
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: MuddyWater has used a custom tool for creating reverse shells.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: FELIXROOT uses Rundll32 for executing the dropper program.
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: P.A.S. Webshell can scan networks for open ports and listening services.
MITRE ATT&CK techniques:
- T1046: Network Service Discovery
Threat description: Bisonal has supported use of a proxy server.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: Ryuk has used multiple native APIs including "ShellExecuteW" to run executables,"GetWindowsDirectoryW" to create folders, and "VirtualAlloc", "WriteProcessMemory", and "CreateRemoteThread" for process injection.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: Dacls can establish persistence via a LaunchAgent.
MITRE ATT&CK techniques:
- T1543.001: Create or Modify System Process - Launch Agent
Threat description: BRONZE BUTLER has used Right-to-Left Override to deceive victims into executing several strains of malware.
MITRE ATT&CK techniques:
- T1036.002: Masquerading - Right-to-Left Override
Threat description: Kinsing was executed in an Ubuntu container deployed via an open Docker daemon API.
MITRE ATT&CK techniques:
- T1133: External Remote Services
Threat description: Kimsuky has downloaded additional scripts, tools, and malware onto victim systems.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: HARDRAIN uses the command "cmd.exe /c netsh firewall add portopening TCP 443 "adp"" and makes the victim machine function as a proxy server.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: OSX_OCEANLOTUS.D collects processor information, memory information, computer name, hardware UUID, serial number, and operating system version. OSX_OCEANLOTUS.D has used the "ioreg" command to gather some of this information.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Mongall has the ability to upload files from victim's machines.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Sliver can inject code into local and remote processes.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: Okrum's loader can detect presence of an emulator by using two calls to GetTickCount API, and checking whether the time has been accelerated.
MITRE ATT&CK techniques:
- T1497.003: Virtualization/Sandbox Evasion - Time Based Evasion
Threat description: Remsec can obtain a process list from the victim.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: Indrik Spider used Cobalt Strike to carry out credential dumping using ProcDump.
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: JSS Loader has the ability to download malicious executables to a compromised host.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: RedLeaves can capture screenshots.
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: EnvyScout can use protocol handlers to coax the operating system to send NTLMv2 authentication responses to attacker-controlled infrastructure.
MITRE ATT&CK techniques:
- T1187: Forced Authentication
Threat description: Higaisa used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: TrickBot collects local files and information from the victim’s local machine.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: build_downer has the ability to detect if the infected host is running an anti-virus process.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: Saint Bot has relied on users to click on a malicious link delivered via a spearphishing.
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
Threat description: BLUELIGHT can check to see if the infected machine has VM tools running.
MITRE ATT&CK techniques:
- T1497.001: Virtualization/Sandbox Evasion - System Checks
Threat description: Hancitor has used a macro to check that an ActiveDocument shape object in the lure message is present. If this object is not found, the macro will exit without downloading additional payloads.
MITRE ATT&CK techniques:
- T1497: Virtualization/Sandbox Evasion
Threat description: Ryuk can use anti-disassembly and code transformation obfuscation techniques.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Stuxnet removes itself from the system through a DLL export by deleting specific files and stored procedures.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: Shark can pause C2 communications for a specified time.
MITRE ATT&CK techniques:
- T1029: Scheduled Transfer
Threat description: Honeybee performs data exfiltration is accomplished through the following command-line command: "from <COMPUTER-NAME> (<Month>-<Day> <Hour>-<Minute>-<Second>).txt".
MITRE ATT&CK techniques:
- T1020: Automated Exfiltration
Threat description: BLUELIGHT can enumerate files and collect associated metadata.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: Ecipekac can download additional payloads to a compromised host.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: CopyKittens has used the AirVPN service for operational activity.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: BabyShark has a PowerShell-based remote administration ability that can implement a PowerShell or C# based keylogger.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: It is believed that a patch management system for an anti-virus product commonly installed among targeted companies was used to distribute the Wiper malware.
MITRE ATT&CK techniques:
- T1072: Software Deployment Tools
Threat description: APT28 has used a variety of utilities, including WinRAR, to archive collected data with password protection.
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: Zebrocy collects the OS version, computer name and serial number for the storage volume C:\. Zebrocy also runs the "systeminfo" command to gather system information.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Operation Wocao has used their own web shells, as well as those previously placed on target systems by other threat actors, for reconnaissance and lateral movement.
MITRE ATT&CK techniques:
- T1505.003: Server Software Component - Web Shell
Threat description: Grandoreiro can decrypt its encrypted internal strings.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: KONNI has been delivered via spearphishing campaigns through a malicious Word document.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: H1N1 dumps usernames and passwords from Firefox, Internet Explorer, and Outlook.
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
Threat description: An APT3 downloader uses the Windows command ""cmd.exe" /C whoami". The group also uses a tool to execute commands on remote computers.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Gorgon Group has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: SharpStage has checked the system settings to see if Arabic is the configured language.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Duqu creates a new service that loads a malicious driver when the system starts. When Duqu is active, the operating system believes that the driver is legitimate, as it has been signed with a valid private key.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: RunningRAT contains code to open and copy data from the clipboard.
MITRE ATT&CK techniques:
- T1115: Clipboard Data
Threat description: Valak has used scheduled tasks to execute additional payloads and to gain persistence on a compromised host.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: InvisiMole can gather network share information.
MITRE ATT&CK techniques:
- T1135: Network Share Discovery
Threat description: APT33 has used kill dates in their malware to guardrail execution.
MITRE ATT&CK techniques:
- T1480: Execution Guardrails
Threat description: Orz can gather the victim's Internet Explorer version.
MITRE ATT&CK techniques:
- T1518: Software Discovery
Threat description: StoneDrill has used the WMI command-line (WMIC) utility to run tasks.
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: Zebrocy has exfiltrated data to the designated C2 server using HTTP POST requests.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Regin appears to have functionality to sniff for credentials passed over HTTP, SMTP, and SMB.
MITRE ATT&CK techniques:
- T1040: Network Sniffing
Threat description: Lokibot has the ability to discover the username on the infected host.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1119: Automated Collection
Threat description: Seasalt uses HTTP for C2 communications.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
Threat description: Lokibot has used LoadLibrary(), GetProcAddress() and CreateRemoteThread() API functions to execute its shellcode.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: EXOTIC LILY has established social media profiles to mimic employees of targeted companies.
MITRE ATT&CK techniques:
- T1585.001: Establish Accounts - Social Media Accounts
Threat description: HARDRAIN uses cmd.exe to execute "netsh"commands.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: SDBbot has the ability to add a value to the Registry Run key to establish persistence if it detects it is running with regular user privilege.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: APT29 used "scheduler" and "schtasks" to create new tasks on remote hosts as part of lateral movement. They have manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration. APT29 also created a scheduled task to maintain SUNSPOT persistence when the host booted during the 2020 SolarWinds intrusion. They previously used named and hijacked scheduled tasks to also establish persistence.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: YAHOYAH checks for antimalware solution processes on the system.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: RedLeaves has encrypted C2 traffic with RC4, previously using keys of 88888888 and babybear.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: VERMIN decrypts code, strings, and commands to use once it's on the victim's machine.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Carberp has exfiltrated data via HTTP to already established C2 servers.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Axiom has been known to dump credentials.
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: Turian has the ability to use "/bin/sh" to execute commands.
MITRE ATT&CK techniques:
- T1059.004: Command and Scripting Interpreter - Unix Shell
Threat description: BLACKCOFFEE has also obfuscated its C2 traffic as normal traffic to sites such as Github.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: Earth Lusca used Python scripts for port scanning or building reverse shells.
MITRE ATT&CK techniques:
- T1059.006: Command and Scripting Interpreter - Python
Threat description: Ragnar Locker encrypts files on the local machine and mapped drives prior to displaying a note demanding a ransom.
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: OutSteel can collect information from a compromised host.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Confucius has used a weaponized Microsoft Word document with an embedded RTF exploit.
MITRE ATT&CK techniques:
- T1221: Template Injection
Threat description: Some Volgmer variants add new services with display names generated by a list of hard-coded strings such as Application, Background, Security, and Windows, presumably as a way to masquerade as a legitimate service.
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: Diavol has a `ENMDSKS` command to enumerates available network shares.
MITRE ATT&CK techniques:
- T1135: Network Share Discovery
Threat description: SILENTTRINITY can use PowerShell to execute commands.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: Doki was run through a deployed container.
MITRE ATT&CK techniques:
- T1610: Deploy Container
Threat description: TinyTurla has mimicked an existing Windows service by being installed as "Windows Time Service".
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: ZIRCONIUM has used a tool to steal credentials from installed web browsers including Microsoft Internet Explorer and Google Chrome.
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
Threat description: Silent Librarian has established e-mail accounts to receive e-mails forwarded from compromised accounts.
MITRE ATT&CK techniques:
- T1585.002: Establish Accounts - Email Accounts
Threat description: Revenge RAT uses the Forfiles utility to execute commands on the system.
MITRE ATT&CK techniques:
- T1202: Indirect Command Execution
Threat description: RunningRAT contains code to compress files.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: P.A.S. Webshell has the ability to list files and file characteristics including extension, size, ownership, and permissions.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: Kazuar uses FTP and FTPS to communicate with the C2 server.
MITRE ATT&CK techniques:
- T1071.002: Application Layer Protocol - File Transfer Protocols
Threat description: Lizar has a plugin that can retrieve credentials from Internet Explorer and Microsoft Edge using `vaultcmd.exe` and another that can collect RDP access credentials using the `CredEnumerateW` function.
MITRE ATT&CK techniques:
- T1555.004: Credentials from Password Stores - Windows Credential Manager
Threat description: Machete collects the hostname of the target computer.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Operation Wocao has used Mimikatz to dump certificates and private keys from the Windows certificate store.
MITRE ATT&CK techniques:
- T1552.004: Unsecured Credentials - Private Keys
Threat description: Micropsia gathers the hostname and OS version from the victim’s machine.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: SUNBURST dynamically resolved C2 infrastructure for randomly-generated subdomains within a parent domain.
MITRE ATT&CK techniques:
- T1568: Dynamic Resolution
Threat description: Machete’s downloaded data is decrypted using AES.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: FunnyDream has the ability to clean traces of malware deployment.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: ELMER is capable of performing directory listings.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: AADInternals can modify registry keys as part of setting a new pass-through authentication agent.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: QakBot has the ability to enumerate windows on a compromised host.
MITRE ATT&CK techniques:
- T1010: Application Window Discovery
Threat description: GravityRAT has been delivered via Word documents using DDE for execution.
MITRE ATT&CK techniques:
- T1559.002: Inter-Process Communication - Dynamic Data Exchange
Threat description: KONNI has used FTP to exfiltrate reconnaissance data out.
MITRE ATT&CK techniques:
- T1048.003: Exfiltration Over Alternative Protocol - Exfiltration Over Unencrypted Non-C2 Protocol
Threat description: Ebury can hook logging functions so that nothing from the backdoor gets sent to the logging facility.
MITRE ATT&CK techniques:
- T1562.006: Impair Defenses - Indicator Blocking
Threat description: APT33 has sent spearphishing emails containing links to .hta files.
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: MuddyWater has used a PowerShell backdoor to check for Skype connections on the target machine.
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
Threat description: China Chopper's server component executes code sent via HTTP POST commands.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: HiddenWasp installs reboot persistence by adding itself to "/etc/rc.local".
MITRE ATT&CK techniques:
- T1037.004: Boot or Logon Initialization Scripts - RC Scripts
Threat description: SOUNDBITE is capable of enumerating and manipulating files and directories.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: Pandora can load additional drivers and files onto a victim machine.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: During CostaRicto, the threat actors used scheduled tasks to download backdoor tools.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: Moafee has been known to employ binary padding.
MITRE ATT&CK techniques:
- T1027.001: Obfuscated Files or Information - Binary Padding
Threat description: Silence has leveraged the Windows API, including using CreateProcess() or ShellExecute(), to perform a variety of tasks.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: BLINDINGCAN has encoded its C2 traffic with Base64.
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: Gamaredon Group tools decrypted additional payloads from the C2. Gamaredon Group has also decoded base64-encoded source code of a downloader.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Wevtutil can be used to clear system and security event logs from the system.
MITRE ATT&CK techniques:
- T1070.001: Indicator Removal - Clear Windows Event Logs
Threat description: MirageFox can collect CPU and architecture information from the victim’s machine.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Evilnum has used the malware variant, TerraTV, to load a malicious DLL placed in the TeamViewer directory, instead of the original Windows DLL located in a system folder.
MITRE ATT&CK techniques:
- T1574.001: Hijack Execution Flow - DLL Search Order Hijacking
Threat description: Olympic Destroyer uses WMI to help propagate itself across a network.
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: APT3 has lured victims into clicking malicious links delivered through spearphishing.
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
Threat description: Gazer obtains the current user's security identifier.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: BLACKCOFFEE has the capability to delete files.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit path interception opportunities in the PATH environment variable.
MITRE ATT&CK techniques:
- T1574.007: Hijack Execution Flow - Path Interception by PATH Environment Variable
Threat description: Tonto Team has used EternalBlue exploits for lateral movement.
MITRE ATT&CK techniques:
- T1210: Exploitation of Remote Services
Threat description: menuPass has renamed certutil and moved it to a different location on the system to avoid detection based on use of the tool.
MITRE ATT&CK techniques:
- T1036.003: Masquerading - Rename System Utilities
Threat description: RTM has named the scheduled task it creates "Windows Update".
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: DarkVishnya has obtained and used tools such as Impacket, Winexe, and PsExec.
MITRE ATT&CK techniques:
- T1588.002: Obtain Capabilities - Tool
Threat description: PoisonIvy creates a backdoor through which remote attackers can open a command-line interface.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: SQLRat can make a direct SQL connection to a Microsoft database controlled by the attackers, retrieve an item from the bindata table, then write and execute the file on disk.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: netsh can be used to disable local firewall settings.
MITRE ATT&CK techniques:
- T1562.004: Impair Defenses - Disable or Modify System Firewall
Threat description: Patchwork attempted to use RDP to move laterally.
MITRE ATT&CK techniques:
- T1021.001: Remote Services - Remote Desktop Protocol
Threat description: SharpStage has decompressed data received from the C2 server.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: LAPSUS$ has gathered employee email addresses, including personal accounts, for social engineering and initial access efforts.
MITRE ATT&CK techniques:
- T1589.002: Gather Victim Identity Information - Email Addresses
Threat description: Maze has disabled dynamic analysis and other security tools including IDA debugger, x32dbg, and OllyDbg. It has also disabled Windows Defender's Real-Time Monitoring feature and attempted to disable endpoint protection services.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: Winnti Group has registered domains for C2 that mimicked sites of their intended targets.
MITRE ATT&CK techniques:
- T1583.001: Acquire Infrastructure - Domains
Threat description: CloudDuke downloads and executes additional malware from either a Web address or a Microsoft OneDrive account.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: During Operation Wocao, threat actors used the `time` command to retrieve the current time of a compromised system.
MITRE ATT&CK techniques:
- T1124: System Time Discovery
Threat description: Grandoreiro can use SSL in C2 communication.
MITRE ATT&CK techniques:
- T1573.002: Encrypted Channel - Asymmetric Cryptography
Threat description: OopsIE checks to see if the system is configured with "Daylight" time and checks for a specific region to be set for the timezone.
MITRE ATT&CK techniques:
- T1124: System Time Discovery
Threat description: Maze has checked the language of the infected system using the "GetUSerDefaultUILanguage" function.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: njRAT has used port 1177 for HTTP C2 communications.
MITRE ATT&CK techniques:
- T1571: Non-Standard Port
Threat description: Molerats used PowerShell implants on target machines.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: DarkWatchman can collect files from a compromised host.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Sliver has the ability to gather network configuration information.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: Mori can use `regsvr32.exe` for DLL execution.
MITRE ATT&CK techniques:
- T1218.010: System Binary Proxy Execution - Regsvr32
Threat description: Pisloader obfuscates files by splitting strings into smaller sub-strings and including "garbage" strings that are never used. The malware also uses return-oriented programming (ROP) technique and single-byte XOR to obfuscate data.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: SUNBURST strings were compressed and encoded in Base64. SUNBURST also obfuscated collected system information using a FNV-1a + XOR algorithm.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: DarkComet can disable Security Center functions like the Windows Firewall.
MITRE ATT&CK techniques:
- T1562.004: Impair Defenses - Disable or Modify System Firewall
Threat description: PingPull has the ability to timestomp a file.
MITRE ATT&CK techniques:
- T1070.006: Indicator Removal - Timestomp
Threat description: Micropsia can download and execute an executable from the C2 server.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Ryuk has called "kill.bat" for stopping services, disabling services and killing processes.
MITRE ATT&CK techniques:
- T1489: Service Stop
Threat description: PowGoop can decrypt PowerShell scripts for execution.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information