QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: Green Lambert can create a Launch Agent with the `RunAtLoad` key-value pair set to "true", ensuring the `com.apple.GrowlHelper.plist` file runs every time a user logs in.
MITRE ATT&CK techniques:
T1543.001
Threat description: Proton persists via Launch Agent.
MITRE ATT&CK techniques:
T1543.001
Threat description: macOS.OSAMiner has placed a Stripped Payloads with a `plist` extension in the Launch Agent's folder.
MITRE ATT&CK techniques:
T1543.001
Threat description: TeamTNT has established persistence through the creation of a cryptocurrency mining system service using "systemctl".
MITRE ATT&CK techniques:
T1543.002
Threat description: Duqu creates a new service that loads a malicious driver when the system starts. When Duqu is active, the operating system believes that the driver is legitimate, as it has been signed with a valid private key.
MITRE ATT&CK techniques:
T1543.003
Threat description: GreyEnergy chooses a service, drops a DLL file, and writes it to that serviceDLL Registry key.
MITRE ATT&CK techniques:
T1543.003
Threat description: Industroyer can use an arbitrary system service to load at system boot for persistence and replaces the ImagePath registry value of a Windows service with a new backdoor binary.
MITRE ATT&CK techniques:
T1543.003
Threat description: KONNI has registered itself as a service using its export function.
MITRE ATT&CK techniques:
T1543.003
Threat description: Kwampirs creates a new service named WmiApSrvEx to establish persistence.
MITRE ATT&CK techniques:
T1543.003
Threat description: RainyDay can use services to establish persistence.
MITRE ATT&CK techniques:
T1543.003
Threat description: Seasalt is capable of installing itself as a service.
MITRE ATT&CK techniques:
T1543.003
Threat description: StrongPity has created new services and modified existing services for persistence.
MITRE ATT&CK techniques:
T1543.003
Threat description: Ursnif has registered itself as a system service in the Registry for automatic execution at system startup.
MITRE ATT&CK techniques:
T1543.003
Threat description: Wiarp creates a backdoor through which remote attackers can create a service.
MITRE ATT&CK techniques:
T1543.003
Threat description: ZeroT can add a new service to ensure PlugX persists on the system when delivered as another payload onto the system.
MITRE ATT&CK techniques:
T1543.003
Threat description: zwShell has established persistence by adding itself as a new service.
MITRE ATT&CK techniques:
T1543.003
Threat description: SDBbot has the ability to use application shimming for persistence if it detects it is running as admin on Windows XP or 7, by creating a shim database to patch services.exe.
MITRE ATT&CK techniques:
T1546.011
Threat description: APT28 has used COM hijacking for persistence by replacing the legitimate "MMDeviceEnumerator" object with a payload.
MITRE ATT&CK techniques:
T1546.015
Threat description: Amadey has changed the Startup folder to the one containing its executable by overwriting the registry keys.
MITRE ATT&CK techniques:
T1547.001
Threat description: BadPatch establishes a foothold by adding a link to the malware executable in the startup folder.
MITRE ATT&CK techniques:
T1547.001
Threat description: Bisonal has added itself to the Registry key "HKEY_CURRENT_USER\Software\Microsoft\CurrentVersion\Run\" for persistence.
MITRE ATT&CK techniques:
T1547.001
Threat description: CORESHELL has established persistence by creating autostart extensibility point (ASEP) Registry entries in the Run key and other Registry keys, as well as by creating shortcuts in the Internet Explorer Quick Start folder.
MITRE ATT&CK techniques:
T1547.001
Threat description: Carberp has maintained persistence by placing itself inside the current user's startup folder.
MITRE ATT&CK techniques:
T1547.001
Threat description: Chinoxy has established persistence via the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` registry key and by loading a dropper to `(%COMMON_ STARTUP%\\eoffice.exe)`.
MITRE ATT&CK techniques:
T1547.001
Threat description: DarkComet adds several Registry entries to enable automatic execution at every system startup.
MITRE ATT&CK techniques:
T1547.001
Threat description: DownPaper uses PowerShell to add a Registry Run key in order to establish persistence.
MITRE ATT&CK techniques:
T1547.001
Threat description: Dragonfly 2.0 added the registry value ntdll to the Registry Run key to establish persistence.
MITRE ATT&CK techniques:
T1547.001
Threat description: During Operation Honeybee, the threat actors used batch files that allowed them to establish persistence by adding the following Registry key: `"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost" /v COMSysApp /t REG_MULTI_SZ /d "COMSysApp" /f`.
MITRE ATT&CK techniques:
T1547.001
Threat description: Empire can modify the registry run keys "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" and "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" for persistence.
MITRE ATT&CK techniques:
T1547.001
Threat description: GuLoader can establish persistence via the Registry under "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce".
MITRE ATT&CK techniques:
T1547.001
Threat description: Hancitor  has added Registry Run keys to establish persistence.
MITRE ATT&CK techniques:
T1547.001
Threat description: Helminth establishes persistence by creating a shortcut in the Start Menu folder.
MITRE ATT&CK techniques:
T1547.001
Threat description: Higaisa added a spoofed binary to the start-up folder for persistence.
MITRE ATT&CK techniques:
T1547.001
Threat description: Ixeshe can achieve persistence by adding itself to the "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" Registry key.
MITRE ATT&CK techniques:
T1547.001
Threat description: LiteDuke can create persistence by adding a shortcut in the "CurrentVersion\Run" Registry key.
MITRE ATT&CK techniques:
T1547.001
Threat description: Magic Hound malware has used Registry Run keys to establish persistence.
MITRE ATT&CK techniques:
T1547.001
Threat description: Matryoshka can establish persistence by adding Registry Run keys.
MITRE ATT&CK techniques:
T1547.001
Threat description: Metamorfo has configured persistence to the Registry ket "HKCU\Software\Microsoft\Windows\CurrentVersion\Run, Spotify =% APPDATA%\Spotify\Spotify.exe" and used .LNK files in the startup folder to achieve persistence.
MITRE ATT&CK techniques:
T1547.001
Threat description: NanoCore creates a RunOnce key in the Registry to execute its VBS scripts each time the user logs on to the machine.
MITRE ATT&CK techniques:
T1547.001
Threat description: One persistence mechanism used by CozyCar is to set itself to be executed at system startup by adding a Registry value under one of the following Registry keys: <br>"HKLM\Software\Microsoft\Windows\CurrentVersion\Run\" <br>"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" <br>"HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" <br>"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run"
MITRE ATT&CK techniques:
T1547.001
Threat description: PoetRAT has added a registry key in the <RUN> hive for persistence.
MITRE ATT&CK techniques:
T1547.001
Threat description: RTM tries to add a Registry Run key under the name "Windows Update" to establish persistence.
MITRE ATT&CK techniques:
T1547.001
Threat description: RogueRobin created a shortcut in the Windows startup folder to launch a PowerShell script each time the user logs in to establish persistence.
MITRE ATT&CK techniques:
T1547.001
Threat description: Rover persists by creating a Registry entry in "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\".
MITRE ATT&CK techniques:
T1547.001
Threat description: SDBbot has the ability to add a value to the Registry Run key to establish persistence if it detects it is running with regular user privilege.
MITRE ATT&CK techniques:
T1547.001
Threat description: ShimRat has installed a registry based start-up key "HKCU\Software\microsoft\windows\CurrentVersion\Run" to maintain persistence should other methods fail.
MITRE ATT&CK techniques:
T1547.001
Threat description: Some InnaputRAT variants establish persistence by modifying the Registry key "HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Run:%appdata%\NeutralApp\NeutralApp.exe".
MITRE ATT&CK techniques:
T1547.001
Threat description: StrongPity can use the "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" Registry key for persistence.
MITRE ATT&CK techniques:
T1547.001
Threat description: TAINTEDSCRIBE can copy itself into the current user’s Startup folder as “Narrator.exe” for persistence.
MITRE ATT&CK techniques:
T1547.001
Threat description: TURNEDUP is capable of writing to a Registry Run key to establish.
MITRE ATT&CK techniques:
T1547.001
Threat description: ThreatNeedle can be loaded into the Startup folder (`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\OneDrives.lnk`) as a Shortcut file for persistence.
MITRE ATT&CK techniques:
T1547.001
Threat description: Trojan.Karagany can create a link to itself in the Startup folder to automatically start itself upon system restart.
MITRE ATT&CK techniques:
T1547.001
Threat description: Vasport copies itself to disk and creates an associated run key Registry entry to establish.
MITRE ATT&CK techniques:
T1547.001
Threat description: Wizard Spider has established persistence via the Registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and a shortcut within the startup folder.
MITRE ATT&CK techniques:
T1547.001
Threat description: Flame can use Windows Authentication Packages for persistence.
MITRE ATT&CK techniques:
T1547.002
Threat description: A Dipsind variant registers as a Winlogon Event Notify DLL to establish persistence.
MITRE ATT&CK techniques:
T1547.004
Threat description: KeyBoy issues the command "reg add “HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon”" to achieve persistence.
MITRE ATT&CK techniques:
T1547.004
Threat description: Empire can enumerate Security Support Providers (SSPs) as well as utilize PowerSploit's "Install-SSP" and "Invoke-Mimikatz" to install malicious SSPs and log authentication events.
MITRE ATT&CK techniques:
T1547.005
Threat description: A version of KONNI drops a Windows shortcut on the victim’s machine to establish persistence.
MITRE ATT&CK techniques:
T1547.009
Threat description: APT39 has modified LNK shortcuts.
MITRE ATT&CK techniques:
T1547.009
Threat description: Astaroth's initial payload is a malicious .LNK file.
MITRE ATT&CK techniques:
T1547.009
Threat description: Dragonfly 2.0 manipulated .lnk files to gather user credentials in conjunction with Forced Authentication.
MITRE ATT&CK techniques:
T1547.009
Threat description: Exaramel for Linux can execute commands with high privileges via a specific binary with setuid functionality.
MITRE ATT&CK techniques:
T1548.001
Threat description: Keydnap adds the setuid flag to a binary so it can easily elevate in the future.
MITRE ATT&CK techniques:
T1548.001
Threat description: Earth Lusca has used the Fodhelper UAC bypass technique to gain elevated privileges.
MITRE ATT&CK techniques:
T1548.002
Threat description: FinFisher performs UAC bypass.
MITRE ATT&CK techniques:
T1548.002
Threat description: Koadic has 2 methods for elevating integrity. It can bypass UAC through `eventvwr.exe` and `sdclt.exe`.
MITRE ATT&CK techniques:
T1548.002
Threat description: APT29 used forged SAML tokens that allowed the actors to impersonate users and bypass MFA, enabling APT29 to access enterprise cloud applications and services.
MITRE ATT&CK techniques:
T1550
Threat description: UNC2452 used forged SAML tokens that allowed the actors to impersonate users and bypass MFA, enabling UNC2452 to access enterprise cloud applications and services.
MITRE ATT&CK techniques:
T1550
Threat description: Empire can perform pass the hash attacks.
MITRE ATT&CK techniques:
T1550.002
Threat description: GALLIUM used dumped hashes to authenticate to other machines via pass the hash.
MITRE ATT&CK techniques:
T1550.002
Threat description: APT32 successfully gained remote access by using pass the ticket.
MITRE ATT&CK techniques:
T1550.003
Threat description: BlackEnergy has used a plug-in to gather credentials stored in files on the host by various software programs, including The Bat! email client, Outlook, and Windows Credential Store.
MITRE ATT&CK techniques:
T1552.001
Threat description: Empire can use various modules to search for files containing passwords.
MITRE ATT&CK techniques:
T1552.001
Threat description: Kimsuky has used tools that are capable of obtaining credentials from saved mail.
MITRE ATT&CK techniques:
T1552.001
Threat description: Pysa has extracted credentials from the password database before encrypting the files.
MITRE ATT&CK techniques:
T1552.001
Threat description: Agent Tesla has the ability to extract credentials from the Registry.
MITRE ATT&CK techniques:
T1552.002
Threat description: Operation Wocao has used Mimikatz to dump certificates and private keys from the Windows certificate store.
MITRE ATT&CK techniques:
T1552.004
Threat description: UNC2452 obtained the private encryption key from an Active Directory Federation Services (AD FS) container to decrypt corresponding SAML signing certificates.
MITRE ATT&CK techniques:
T1552.004
Threat description: CoinTicker downloads the EggShell mach-o binary using curl, which does not set the quarantine flag.
MITRE ATT&CK techniques:
T1553.001
Threat description: AppleJeus has used a valid digital signature from Sectigo to appear legitimate.
MITRE ATT&CK techniques:
T1553.002
Threat description: BOOSTWRITE has been signed by a valid CA.
MITRE ATT&CK techniques:
T1553.002
Threat description: BackConfig has been signed with self signed digital certificates mimicking a legitimate software company.
MITRE ATT&CK techniques:
T1553.002
Threat description: Janicab used a valid AppleDeveloperID to sign the code to get past security restrictions.
MITRE ATT&CK techniques:
T1553.002
Threat description: Metamorfo has digitally signed executables using AVAST Software certificates.
MITRE ATT&CK techniques:
T1553.002
Threat description: Moses Staff has used signed drivers from an open source tool called DiskCryptor to evade detection.
MITRE ATT&CK techniques:
T1553.002
Threat description: PipeMon, its installer, and tools are signed with stolen code-signing certificates.
MITRE ATT&CK techniques:
T1553.002
Threat description: Suckfly has used stolen certificates to sign its malware.
MITRE ATT&CK techniques:
T1553.002
Threat description: TA505 has signed payloads with code signing certificates from Thawte and Sectigo.
MITRE ATT&CK techniques:
T1553.002
Threat description: menuPass has resized and added data to the certificate table to enable the signing of modified files with legitimate signatures.
MITRE ATT&CK techniques:
T1553.002
Threat description: Hikit uses "certmgr.exe -add GlobalSign.cer -c -s -r localMachine Root" and "certmgr.exe -add GlobalSign.cer -c -s -r localMachineTrustedPublisher" to install a self-generated certificate to the local trust store as a root CA and Trusted Publisher.
MITRE ATT&CK techniques:
T1553.004
Threat description: Carberp's passw.plug plugin can gather account information from multiple instant messaging, email, and social media services, as well as FTP, VNC, and VPN clients.
MITRE ATT&CK techniques:
T1555
Threat description: Evilnum can collect email credentials from victims.
MITRE ATT&CK techniques:
T1555
Threat description: Lokibot has stolen credentials from multiple applications and data sources including Windows OS credentials, email clients, FTP, and SFTP clients.
MITRE ATT&CK techniques:
T1555
Threat description: MuddyWater has performed credential dumping with LaZagne and other tools, including by dumping passwords saved in victim email.
MITRE ATT&CK techniques:
T1555
Threat description: CosmicDuke collects user credentials, including passwords, for various programs including Web browsers.
MITRE ATT&CK techniques:
T1555.003
Threat description: Emotet has been observed dropping browser password grabber modules.
MITRE ATT&CK techniques:
T1555.003
Threat description: Grandoreiro can steal cookie data and credentials from Google Chrome.
MITRE ATT&CK techniques:
T1555.003
Threat description: H1N1 dumps usernames and passwords from Firefox, Internet Explorer, and Outlook.
MITRE ATT&CK techniques:
T1555.003
Threat description: HEXANE has used a Mimikatz-based tool and a PowerShell script to steal passwords from Google Chrome.
MITRE ATT&CK techniques:
T1555.003
Threat description: Imminent Monitor has a PasswordRecoveryPacket module for recovering browser passwords.
MITRE ATT&CK techniques:
T1555.003
Threat description: Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from DPAPI.
MITRE ATT&CK techniques:
T1555.003
Threat description: MuddyWater has run tools including Browser64 to steal passwords saved in victim web browsers.
MITRE ATT&CK techniques:
T1555.003
Threat description: OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access. OilRig has also used tool named PICKPOCKET to dump passwords from web browsers.
MITRE ATT&CK techniques:
T1555.003
Threat description: PoetRAT has used a Python tool named Browdec.exe to steal browser credentials.
MITRE ATT&CK techniques:
T1555.003
Threat description: SUGARDUMP variants have harvested credentials from browsers such as Firefox, Chrome, Opera, and Edge.
MITRE ATT&CK techniques:
T1555.003
Threat description: Stolen Pencil has used tools that are capable of obtaining credentials from web browsers.
MITRE ATT&CK techniques:
T1555.003
Threat description: TA505 has used malware to gather credentials from Internet Explorer.
MITRE ATT&CK techniques:
T1555.003
Threat description: Unknown Logger is capable of stealing usernames and passwords from browsers on the victim machine.
MITRE ATT&CK techniques:
T1555.003
Threat description: ZIRCONIUM has used a tool to steal credentials from installed web browsers including Microsoft Internet Explorer and Google Chrome.
MITRE ATT&CK techniques:
T1555.003
Threat description: LaZagne can obtain credentials from Vault files.
MITRE ATT&CK techniques:
T1555.004
Threat description: Lizar has a plugin that can retrieve credentials from Internet Explorer and Microsoft Edge using `vaultcmd.exe` and another that can collect RDP access credentials using the `CredEnumerateW` function.
MITRE ATT&CK techniques:
T1555.004
Threat description: Fox Kitten has used scripts to access credential information from the KeePass database.
MITRE ATT&CK techniques:
T1555.005
Threat description: Ebury can intercept private keys using a trojanized "ssh-add" function.
MITRE ATT&CK techniques:
T1556
Threat description: The AADInternals `Set-AADIntUserMFA` command can be used to disable MFA for a specified user.
MITRE ATT&CK techniques:
T1556.006
Threat description: AADInternals can inject a malicious DLL (`PTASpy`) into the `AzureADConnectAuthenticationAgentService` to backdoor Azure AD Pass-Through Authentication.
MITRE ATT&CK techniques:
T1556.007
Threat description: Kimsuky has used modified versions of PHProxy to examine web traffic between the victim and the accessed website.
MITRE ATT&CK techniques:
T1557
Threat description: Empire can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks.
MITRE ATT&CK techniques:
T1557.001
Threat description: Responder is used to poison name services to gather hashes and credentials from systems within a local network.
MITRE ATT&CK techniques:
T1557.001
Threat description: Impacket modules like GetUserSPNs can be used to get Service Principal Names (SPNs) for user accounts. The output is formatted to be compatible with cracking tools like John the Ripper and Hashcat.
MITRE ATT&CK techniques:
T1558.003
Threat description: Wizard Spider has used Rubeus, MimiKatz Kerberos module, and the Invoke-Kerberoast cmdlet to steal AES hashes.
MITRE ATT&CK techniques:
T1558.003
Threat description: HermeticWizard can execute files on remote machines using DCOM.
MITRE ATT&CK techniques:
T1559.001
Threat description: Milan can use a COM component to generate scheduled tasks.
MITRE ATT&CK techniques:
T1559.001
Threat description: POWERSTATS can use DCOM (targeting the 127.0.0.1 loopback address) to execute additional payloads on compromised hosts.
MITRE ATT&CK techniques:
T1559.001
Threat description: Ursnif droppers have used COM objects to execute the malware's full executable payload.
MITRE ATT&CK techniques:
T1559.001
Threat description: During Operation Sharpshooter, threat actors sent malicious Word OLE documents to victims.
MITRE ATT&CK techniques:
T1559.002
Threat description: GravityRAT has been delivered via Word documents using DDE for execution.
MITRE ATT&CK techniques:
T1559.002
Threat description: Leviathan has utilized OLE as a method to insert malicious content inside various phishing documents.
MITRE ATT&CK techniques:
T1559.002
Threat description: MuddyWater has used malware that can execute PowerShell scripts via DDE.
MITRE ATT&CK techniques:
T1559.002
Threat description: Sharpshooter has sent malicious Word OLE documents to victims.
MITRE ATT&CK techniques:
T1559.002
Threat description: Sidewinder has used the ActiveXObject utility to create OLE objects to obtain execution through Internet Explorer.
MITRE ATT&CK techniques:
T1559.002
Threat description: Agent Tesla can encrypt data with 3DES before sending it over to a C2 server.
MITRE ATT&CK techniques:
T1560
Threat description: Axiom has compressed and encrypted data prior to exfiltration.
MITRE ATT&CK techniques:
T1560
Threat description: Dtrack packs collected data into a password protected archive.
MITRE ATT&CK techniques:
T1560
Threat description: Exaramel for Windows automatically encrypts files before sending them to the C2 server.
MITRE ATT&CK techniques:
T1560
Threat description: Leviathan has archived victim's data prior to exfiltration.
MITRE ATT&CK techniques:
T1560
Threat description: Machete stores zipped files with profile data from installed web browsers.
MITRE ATT&CK techniques:
T1560
Threat description: Remexi encrypts and adds all gathered browser data into files for upload to C2.
MITRE ATT&CK techniques:
T1560
Threat description: RunningRAT contains code to compress files.
MITRE ATT&CK techniques:
T1560
Threat description: The Ke3chang group has been known to compress data before exfiltration.
MITRE ATT&CK techniques:
T1560
Threat description: APT28 has used a variety of utilities, including WinRAR, to archive collected data with password protection.
MITRE ATT&CK techniques:
T1560.001
Threat description: APT29 used 7-Zip to compress stolen emails into password-protected archives prior to exfiltration.
MITRE ATT&CK techniques:
T1560.001
Threat description: Earth Lusca has used WinRAR to compress stolen files into an archive prior to exfiltration.
MITRE ATT&CK techniques:
T1560.001
Threat description: FIN8 has used RAR to compress collected data before exfiltration.
MITRE ATT&CK techniques:
T1560.001
Threat description: Gallmaker has used WinZip, likely to archive data prior to exfiltration.
MITRE ATT&CK techniques:
T1560.001
Threat description: Operation Wocao has archived collected files with WinRAR, prior to exfiltration.
MITRE ATT&CK techniques:
T1560.001
Threat description: Sowbug extracted documents and bundled them into a RAR archive.
MITRE ATT&CK techniques:
T1560.001
Threat description: ccf32 has used `xcopy \\<target_host>\c$\users\public\path.7z c:\users\public\bin\<target_host>.7z /H /Y` to archive collected files.
MITRE ATT&CK techniques:
T1560.001
Threat description: menuPass has compressed files before exfiltration using TAR and RAR.
MITRE ATT&CK techniques:
T1560.001
Threat description: Cardinal RAT applies compression to C2 traffic using the ZLIB library.
MITRE ATT&CK techniques:
T1560.002
Threat description: Denis compressed collected data using zlib.
MITRE ATT&CK techniques:
T1560.002
Threat description: FoggyWeb can invoke the `Common.Compress` method to compress data with the C# GZipStream compression class.
MITRE ATT&CK techniques:
T1560.002
Threat description: Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.
MITRE ATT&CK techniques:
T1560.002
Threat description: SeaDuke compressed data with zlib prior to sending it over C2.
MITRE ATT&CK techniques:
T1560.002
Threat description: The ZLib backdoor compresses communications using the standard Zlib compression library.
MITRE ATT&CK techniques:
T1560.002
Threat description: A Lazarus Group malware sample encrypts data using a simple byte based XOR operation prior to exfiltration.
MITRE ATT&CK techniques:
T1560.003
Threat description: Data SPACESHIP copies to the staging area is compressed with zlib. Bytes are rotated by four positions and XOR'ed with 0x23.
MITRE ATT&CK techniques:
T1560.003
Threat description: FoggyWeb can use a dynamic XOR key and a custom XOR methodology to encode data before exfiltration. Also, FoggyWeb can encode C2 command output within a legitimate WebP file.
MITRE ATT&CK techniques:
T1560.003
Threat description: Mustang Panda has encrypted documents with RC4 prior to exfiltration.
MITRE ATT&CK techniques:
T1560.003
Threat description: NETWIRE has used a custom encryption algorithm to encrypt collected data.
MITRE ATT&CK techniques:
T1560.003
Threat description: SUGARDUMP has encrypted collected data using AES CBC mode and encoded it using Base64.
MITRE ATT&CK techniques:
T1560.003
Threat description: Avaddon looks for and attempts to stop anti-malware solutions.
MITRE ATT&CK techniques:
T1562.001
Threat description: Bazar has manually loaded ntdll from disk in order to identity and remove API hooks set by security products.
MITRE ATT&CK techniques:
T1562.001
Threat description: Bundlore can change browser security settings to enable extensions to be installed. Bundlore uses the "pkill cfprefsd" command to prevent users from inspecting processes.
MITRE ATT&CK techniques:
T1562.001
Threat description: EKANS stops processes related to security and management software.
MITRE ATT&CK techniques:
T1562.001
Threat description: Ember Bear has executed a batch script designed to disable Windows Defender on a compromised host.
MITRE ATT&CK techniques:
T1562.001
Threat description: Gorgon Group malware can attempt to disable security features in Microsoft Office and Windows Defender using the "taskkill" command.
MITRE ATT&CK techniques:
T1562.001
Threat description: LockerGoga installation has been immediately preceded by a "task kill" command in order to disable anti-virus.
MITRE ATT&CK techniques:
T1562.001
Threat description: Magic Hound has disabled antivirus services on targeted systems in order to upload malicious payloads.
MITRE ATT&CK techniques:
T1562.001
Threat description: Maze has disabled dynamic analysis and other security tools including IDA debugger, x32dbg, and OllyDbg. It has also disabled Windows Defender's Real-Time Monitoring feature and attempted to disable endpoint protection services.
MITRE ATT&CK techniques:
T1562.001
Threat description: MegaCortex was used to kill endpoint security processes.
MITRE ATT&CK techniques:
T1562.001
Threat description: OSX/Shlayer can disable Gatekeeper using the native "spctl" application.
MITRE ATT&CK techniques:
T1562.001
Threat description: ThiefQuest uses the function "kill_unwanted" to obtain a list of running processes and kills each process matching a list of security related processes.
MITRE ATT&CK techniques:
T1562.001
Threat description: Threat Group-3390 has used appcmd.exe to disable logging on a victim server.
MITRE ATT&CK techniques:
T1562.002
Threat description: APT38 has prepended a space to all of their terminal commands to operate without leaving traces in the HISTCONTROL environment.
MITRE ATT&CK techniques:
T1562.003
Threat description: BADCALL disables the Windows firewall before binding to a port.
MITRE ATT&CK techniques:
T1562.004
Threat description: DarkComet can disable Security Center functions like the Windows Firewall.
MITRE ATT&CK techniques:
T1562.004
Threat description: H1N1 kills and disables services for Windows Firewall.
MITRE ATT&CK techniques:
T1562.004
Threat description: Kimsuky has been observed disabling the system firewall.
MITRE ATT&CK techniques:
T1562.004
Threat description: TYPEFRAME can open the Windows Firewall on the victim’s machine to allow incoming connections.
MITRE ATT&CK techniques:
T1562.004
Threat description: UNC2452 used "netsh" to configure firewall rules that limited certain UDP outbound packets.
MITRE ATT&CK techniques:
T1562.004
Threat description: netsh can be used to disable local firewall settings.
MITRE ATT&CK techniques:
T1562.004
Threat description: Ebury can hook logging functions so that nothing from the backdoor gets sent to the logging facility.
MITRE ATT&CK techniques:
T1562.006
Threat description: WarzoneRAT can masquerade the Process Environment Block on a compromised host to hide it's attempts to elevate privileges through `IFileOperation`.
MITRE ATT&CK techniques:
T1564
Threat description: APT28 has saved files with hidden file attributes.
MITRE ATT&CK techniques:
T1564.001
Threat description: Agent Tesla has created hidden folders.
MITRE ATT&CK techniques:
T1564.001
Threat description: Dacls has had its payload named with a dot prefix to make it hidden from view in the Finder application.
MITRE ATT&CK techniques:
T1564.001
Threat description: Ixeshe sets its own executable file's attributes to hidden.
MITRE ATT&CK techniques:
T1564.001
Threat description: Lokibot has the ability to copy itself to a hidden file and directory.
MITRE ATT&CK techniques:
T1564.001
Threat description: Micropsia creates a new hidden directory to store all components' outputs in a dedicated sub-folder for each.
MITRE ATT&CK techniques:
T1564.001
Threat description: SysUpdate has the ability to set file attributes to hidden.
MITRE ATT&CK techniques:
T1564.001
Threat description: Transparent Tribe can hide legitimate directories and replace them with malicious copies of the same name.
MITRE ATT&CK techniques:
T1564.001
Threat description: Dragonfly has modified the Registry to hide created user accounts.
MITRE ATT&CK techniques:
T1564.002
Threat description: SMOKEDHAM has modified the Registry to hide created user accounts from the Windows logon screen.
MITRE ATT&CK techniques:
T1564.002
Threat description: APT28 has used the WindowStyle parameter to conceal PowerShell windows.
MITRE ATT&CK techniques:
T1564.003
Threat description: Higaisa used a payload that creates a hidden window.
MITRE ATT&CK techniques:
T1564.003
Threat description: InvisiMole has executed legitimate tools in hidden windows.
MITRE ATT&CK techniques:
T1564.003
Threat description: MCMD can modify processes to prevent them from being visible on the desktop.
MITRE ATT&CK techniques:
T1564.003
Threat description: Meteor can hide its console window upon execution to decrease its visibility to a victim.
MITRE ATT&CK techniques:
T1564.003
Threat description: Anchor has used NTFS to hide files.
MITRE ATT&CK techniques:
T1564.004
Threat description: Astaroth can abuse alternate data streams (ADS) to store content for malicious payloads.
MITRE ATT&CK techniques:
T1564.004
Threat description: If the victim is using PowerShell 3.0 or later, POWERSOURCE writes its decoded payload to an alternate data stream (ADS) named kernel32.dll that is saved in "%PROGRAMDATA%\Windows\".
MITRE ATT&CK techniques:
T1564.004
Threat description: GOLD SOUTHFIELD has conducted malicious spam (malspam) campaigns to gain access to victim's machines.
MITRE ATT&CK techniques:
T1566
Threat description: APT12 has sent emails with malicious Microsoft Office documents and PDFs attached.
MITRE ATT&CK techniques:
T1566.001
Threat description: APT19 sent spearphishing emails with malicious attachments in RTF and XLSM formats to deliver initial exploits.
MITRE ATT&CK techniques:
T1566.001
Threat description: APT29 has used spearphishing emails with an attachment to deliver files with exploits to initial victims.
MITRE ATT&CK techniques:
T1566.001
Threat description: BADFLICK has been distributed via spearphishing campaigns containing malicious Microsoft Word documents.
MITRE ATT&CK techniques:
T1566.001
Threat description: BITTER has sent spearphishing emails with a malicious RTF document or Excel spreadsheet.
MITRE ATT&CK techniques:
T1566.001
Threat description: Dragonfly has sent emails with malicious attachments to gain initial access.
MITRE ATT&CK techniques:
T1566.001
Threat description: During C0011, Transparent Tribe sent malicious attachments via email to student targets in India.
MITRE ATT&CK techniques:
T1566.001
Threat description: During Operation Spalax, the threat actors sent phishing emails that included a PDF document that in some cases led to the download and execution of malware.
MITRE ATT&CK techniques:
T1566.001
Threat description: EXOTIC LILY conducted an e-mail thread-hijacking campaign with malicious ISO attachments.
MITRE ATT&CK techniques:
T1566.001
Threat description: FIN6 has targeted victims with e-mails containing malicious attachments.
MITRE ATT&CK techniques:
T1566.001
Threat description: Higaisa has sent spearphishing emails containing malicious attachments.
MITRE ATT&CK techniques:
T1566.001
Threat description: Inception has used weaponized documents attached to spearphishing emails for reconnaissance and initial compromise.
MITRE ATT&CK techniques:
T1566.001
Threat description: KONNI has been delivered via spearphishing campaigns through a malicious Word document.
MITRE ATT&CK techniques:
T1566.001
Threat description: Lazarus Group has targeted victims with spearphishing emails containing malicious Microsoft Word documents.
MITRE ATT&CK techniques:
T1566.001
Threat description: Leviathan has sent spearphishing emails with malicious attachments, including .rtf, .doc, and .xls files.
MITRE ATT&CK techniques:
T1566.001
Threat description: Machete has delivered spearphishing emails that contain a zipped file with malicious contents.
MITRE ATT&CK techniques:
T1566.001
Threat description: Magic Hound has used personalized spearphishing attachments.
MITRE ATT&CK techniques:
T1566.001
Threat description: Molerats has sent phishing emails with malicious Microsoft Word and PDF attachments.
MITRE ATT&CK techniques:
T1566.001
Threat description: MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients.
MITRE ATT&CK techniques:
T1566.001
Threat description: NETWIRE has been spread via e-mail campaigns utilizing malicious attachments.
MITRE ATT&CK techniques:
T1566.001
Threat description: Nomadic Octopus has targeted victims with spearphishing emails containing malicious attachments.
MITRE ATT&CK techniques:
T1566.001
Threat description: Octopus has been delivered via spearsphishing emails.
MITRE ATT&CK techniques:
T1566.001
Threat description: QakBot has spread through emails with malicious attachments.
MITRE ATT&CK techniques:
T1566.001
Threat description: The primary delivered mechaism for Agent Tesla is through email phishing messages.
MITRE ATT&CK techniques:
T1566.001
Threat description: Tonto Team has delivered payloads via spearphishing attachments.
MITRE ATT&CK techniques:
T1566.001
Threat description: WarzoneRAT has been distributed as a malicious attachment within an email.
MITRE ATT&CK techniques:
T1566.001
Threat description: menuPass has sent malicious Office documents via email as part of spearphishing campaigns as well as executables disguised as documents.
MITRE ATT&CK techniques:
T1566.001
Threat description: APT32 has sent spearphishing emails containing malicious links.
MITRE ATT&CK techniques:
T1566.002
Threat description: APT33 has sent spearphishing emails containing links to .hta files.
MITRE ATT&CK techniques:
T1566.002
Threat description: Cobalt Group has sent emails with URLs pointing to malicious documents.
MITRE ATT&CK techniques:
T1566.002
Threat description: Grandoreiro has been spread via malicious links embedded in e-mails.
MITRE ATT&CK techniques:
T1566.002
Threat description: GuLoader has been spread in phishing campaigns using malicious web links.
MITRE ATT&CK techniques:
T1566.002
Threat description: Kerrdown has been distributed via e-mails containing a malicious link.
MITRE ATT&CK techniques:
T1566.002
Threat description: Machete has sent phishing emails that contain a link to an external server with ZIP and RAR archives.
MITRE ATT&CK techniques:
T1566.002
Threat description: Molerats has sent phishing emails with malicious links included.
MITRE ATT&CK techniques:
T1566.002
Threat description: MuddyWater has sent targeted spearphishing e-mails with malicious links.
MITRE ATT&CK techniques:
T1566.002
Threat description: OilRig has sent spearphising emails with malicious links to potential victims.
MITRE ATT&CK techniques:
T1566.002
Threat description: Sandworm Team has crafted phishing emails containing malicious hyperlinks.
MITRE ATT&CK techniques:
T1566.002
Threat description: SpicyOmelette has been distributed via emails containing a malicious link that appears to be a PDF document.
MITRE ATT&CK techniques:
T1566.002
Threat description: Transparent Tribe has embedded links to malicious downloads in e-mails.
MITRE ATT&CK techniques:
T1566.002
Threat description: Wizard Spider has sent phishing emails containing a link to an actor-controlled Google Drive document or other free online file hosting services.
MITRE ATT&CK techniques:
T1566.002
Threat description: EXOTIC LILY has used the e-mail notification features of legitimate file sharing services for spearphishing.
MITRE ATT&CK techniques:
T1566.003
Threat description: Windshift has used fake personas on social media to engage and target victims.
MITRE ATT&CK techniques:
T1566.003
Threat description: Ngrok has been used by threat actors to configure servers for data exfiltration.
MITRE ATT&CK techniques:
T1567
Threat description: Empire can use GitHub for data exfiltration.
MITRE ATT&CK techniques:
T1567.001
Threat description: BITTER has used DDNS for C2 communications.
MITRE ATT&CK techniques:
T1568
Threat description: Maze has forged POST strings with a random choice from a list of possibilities including "forum", "php", "view", etc. while making connection with the C2, hindering detection efforts.
MITRE ATT&CK techniques:
T1568
Threat description: RTM has resolved Pony C2 server IP addresses by either converting Bitcoin blockchain transaction data to specific octets, or accessing IP addresses directly within the Namecoin blockchain.
MITRE ATT&CK techniques:
T1568
Threat description: SUNBURST dynamically resolved C2 infrastructure for randomly-generated subdomains within a parent domain.
MITRE ATT&CK techniques:
T1568
Threat description: Amadey has used fast flux DNS for its C2.
MITRE ATT&CK techniques:
T1568.001
Threat description: Astaroth has used a DGA in C2 communications.
MITRE ATT&CK techniques:
T1568.002
Threat description: BONDUPDATER uses a DGA to communicate with command and control servers.
MITRE ATT&CK techniques:
T1568.002
Threat description: Doki has used the DynDNS service and a DGA based on the Dogecoin blockchain to generate C2 domains.
MITRE ATT&CK techniques:
T1568.002
Threat description: Grandoreiro can use a DGA for hiding C2 addresses, including use of an algorithm with a user-specific key that changes daily.
MITRE ATT&CK techniques:
T1568.002
Threat description: Milan can use hardcoded domains as an input for domain generation algorithms.
MITRE ATT&CK techniques:
T1568.002
Threat description: Ursnif has used a DGA to generate domain names for C2.
MITRE ATT&CK techniques:
T1568.002
Threat description: APT12 has used multiple variants of DNS Calculation including multiplying the first two octets of an IP address and adding the third octet to that value in order to get a resulting command and control port.
MITRE ATT&CK techniques:
T1568.003
Threat description: LoudMiner launched the QEMU services in the "/Library/LaunchDaemons/" folder using "launchctl". It also uses "launchctl" to unload all Launch Daemons when updating to a newer version of LoudMiner.
MITRE ATT&CK techniques:
T1569.001
Threat description: APT32's backdoor has used Windows services as a way to execute its malicious payload.
MITRE ATT&CK techniques:
T1569.002
Threat description: Attor's dispatcher can be executed as a service.
MITRE ATT&CK techniques:
T1569.002
Threat description: Bad Rabbit drops a file named "infpub.dat"into the Windows directory and is executed through SCManager and "rundll.exe".
MITRE ATT&CK techniques:
T1569.002
Threat description: Clambling can create and start services on a compromised host.
MITRE ATT&CK techniques:
T1569.002
Threat description: Net Crawler uses PsExec to perform remote service manipulation to execute a copy of itself as part of lateral movement.
MITRE ATT&CK techniques:
T1569.002
Threat description: StrongPity can install a service to execute itself as a service.
MITRE ATT&CK techniques:
T1569.002
Threat description: WhisperGate can download and execute AdvancedRun.exe via `sc.exe`.
MITRE ATT&CK techniques:
T1569.002
Threat description: ZxShell can create a new service for execution.
MITRE ATT&CK techniques:
T1569.002
Threat description: During Operation Wocao, threat actors used SMB to copy files to and from target systems.
MITRE ATT&CK techniques:
T1570
Threat description: Lucifer can use certutil for propagation on Windows hosts within intranets.
MITRE ATT&CK techniques:
T1570
Threat description: njRAT has used port 1177 for HTTP C2 communications.
MITRE ATT&CK techniques:
T1571
Threat description: Cobalt Strike uses a custom command and control protocol that is encapsulated in HTTP, HTTPS, or DNS. In addition, it conducts peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.
MITRE ATT&CK techniques:
T1572
Threat description: Fox Kitten has used protocol tunneling for communication and RDP activity on compromised hosts through the use of open source tools such as Ngrok and custom tool SSHMinion.
MITRE ATT&CK techniques:
T1572
Threat description: Chaes has used encryption for its C2 channel.
MITRE ATT&CK techniques:
T1573
Threat description: Cardinal RAT uses a secret key with a series of XOR and addition operations to encrypt C2 traffic.
MITRE ATT&CK techniques:
T1573.001
Threat description: Daserf uses RC4 encryption to obfuscate HTTP traffic.
MITRE ATT&CK techniques:
T1573.001
Threat description: Derusbi obfuscates C2 traffic with variable 4-byte XOR keys.
MITRE ATT&CK techniques:
T1573.001
Threat description: Explosive has encrypted communications with the RC4 method.
MITRE ATT&CK techniques:
T1573.001
Threat description: Mongall has the ability to RC4 encrypt C2 communications.
MITRE ATT&CK techniques:
T1573.001
Threat description: MoonWind encrypts C2 traffic using RC4 with a static key.
MITRE ATT&CK techniques:
T1573.001
Threat description: Nebulae can use RC4 and XOR to encrypt C2 communications.
MITRE ATT&CK techniques:
T1573.001
Threat description: Okrum uses AES to encrypt network traffic. The key can be hardcoded or negotiated with the C2 server in the registration phase.
MITRE ATT&CK techniques:
T1573.001
Threat description: RTM encrypts C2 traffic with a custom RC4 variant.
MITRE ATT&CK techniques:
T1573.001
Threat description: RedLeaves has encrypted C2 traffic with RC4, previously using keys of 88888888 and babybear.
MITRE ATT&CK techniques:
T1573.001
Threat description: Sakula encodes C2 traffic with single-byte XOR keys.
MITRE ATT&CK techniques:
T1573.001
Threat description: Torisma has encrypted its C2 communications using XOR and VEST-32.
MITRE ATT&CK techniques:
T1573.001
Threat description: ZIRCONIUM has used AES encrypted communications in C2.
MITRE ATT&CK techniques:
T1573.001
Threat description: Carbon has used RSA encryption for C2 communications.
MITRE ATT&CK techniques:
T1573.002
Threat description: ComRAT can use SSL/TLS encryption for its HTTP-based C2 channel. ComRAT has used public key cryptography with RSA and AES encrypted email attachments for its Gmail C2 channel.
MITRE ATT&CK techniques:
T1573.002
Threat description: Cyclops Blink can encrypt C2 messages with AES-256-CBC sent underneath TLS. OpenSSL library functions are also used to encrypt each message using a randomly generated key and IV, which are then encrypted using a hard-coded RSA public key.
MITRE ATT&CK techniques:
T1573.002
Threat description: Grandoreiro can use SSL in C2 communication.
MITRE ATT&CK techniques:
T1573.002
Threat description: Mythic supports SSL encrypted C2.
MITRE ATT&CK techniques:
T1573.002
Threat description: Operation Wocao's proxy implementation "Agent" can upgrade the socket in use to a TLS socket.
MITRE ATT&CK techniques:
T1573.002
Threat description: Tor encapsulates traffic in multiple layers of encryption, using TLS by default.
MITRE ATT&CK techniques:
T1573.002
Threat description: Denis replaces the nonexistent Windows DLL "msfte.dll" with its own malicious version, which is loaded by the SearchIndexer.exe and SearchProtocolHost.exe.
MITRE ATT&CK techniques:
T1574
Threat description: One of Dtrack can replace the normal flow of a program execution with malicious code.
MITRE ATT&CK techniques:
T1574
Threat description: BackdoorDiplomacy has executed DLL search order hijacking.
MITRE ATT&CK techniques:
T1574.001
Threat description: Evilnum has used the malware variant, TerraTV, to load a malicious DLL placed in the TeamViewer directory, instead of the original Windows DLL located in a system folder.
MITRE ATT&CK techniques:
T1574.001
Threat description: HTTPBrowser abuses the Windows DLL load order by using a legitimate Symantec anti-virus binary, VPDN_LU.exe, to load a malicious DLL that mimics a legitimate Symantec DLL, navlu.dll.
MITRE ATT&CK techniques:
T1574.001
Threat description: Prikormka uses DLL search order hijacking for persistence by saving itself as ntshrui.dll to the Windows directory so it will load before the legitimate ntshrui.dll saved in the System32 subdirectory.
MITRE ATT&CK techniques:
T1574.001
Threat description: Tonto Team abuses a legitimate and signed Microsoft executable to launch a malicious DLL.
MITRE ATT&CK techniques:
T1574.001
Threat description: Chimera has used side loading to place malicious DLLs in memory.
MITRE ATT&CK techniques:
T1574.002
Threat description: Chinoxy can use a digitally signed binary ("Logitech Bluetooth Wizard Host Process") to load its dll into memory.
MITRE ATT&CK techniques:
T1574.002
Threat description: DLL side-loading has been used to execute BBSRAT through a legitimate Citrix executable, ssonsvr.exe. The Citrix executable was dropped along with BBSRAT by the dropper.
MITRE ATT&CK techniques:
T1574.002
Threat description: GALLIUM used DLL side-loading to covertly load PoisonIvy into memory on the victim machine.
MITRE ATT&CK techniques:
T1574.002
Threat description: Lazarus Group has replaced `win_fw.dll`, an internal component that is executed during IDA Pro installation, with a malicious DLL to download and execute a payload.
MITRE ATT&CK techniques:
T1574.002
Threat description: Empire has a dylib hijacker module that generates a malicious dylib given the path to a legitimate dylib of a vulnerable application.
MITRE ATT&CK techniques:
T1574.004
Threat description: HiddenWasp adds itself as a shared object to the LD_PRELOAD environment variable.
MITRE ATT&CK techniques:
T1574.006
Threat description: Hildegard has modified /etc/ld.so.preload to intercept shared library import functions.
MITRE ATT&CK techniques:
T1574.006
Threat description: PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit path interception opportunities in the PATH environment variable.
MITRE ATT&CK techniques:
T1574.007
Threat description: PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit search order hijacking vulnerabilities.
MITRE ATT&CK techniques:
T1574.008
Threat description: PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit unquoted path vulnerabilities.
MITRE ATT&CK techniques:
T1574.009
Threat description: Blue Mockingbird has used wmic.exe and Windows Registry modifications to set the COR_PROFILER environment variable to execute a malicious DLL whenever a process loads the .NET CLR.
MITRE ATT&CK techniques:
T1574.012