QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: POWERSTATS encoded C2 traffic with base64.
MITRE ATT&CK techniques:
T1132.001
T1001
Threat description: PLEAD samples were found to be highly obfuscated with junk code.
MITRE ATT&CK techniques:
T1001.001
Threat description: SUNBURST C2 data attempted to appear as benign XML related to .NET assemblies or as a faux JSON blob.
MITRE ATT&CK techniques:
T1001.002
Threat description: FakeM C2 traffic attempts to evade detection by resembling data generated by legitimate messenger applications, such as MSN and Yahoo! messengers. Additionally, some variants of FakeM use modified SSL code for communications back to C2 servers, making SSL decryption ineffective.
MITRE ATT&CK techniques:
T1001.003
Threat description: Higaisa used a FakeTLS session for C2 communications.
MITRE ATT&CK techniques:
T1001.003
Threat description: InvisiMole can mimic HTTP protocol with custom HTTP “verbs” HIDE, ZVVP, and NOP.
MITRE ATT&CK techniques:
T1001.003
Threat description: Axiom has been known to dump credentials.
MITRE ATT&CK techniques:
T1003
Threat description: Azorult can dump credentials from victim browsers.
MITRE ATT&CK techniques:
T1003
Threat description: HOMEFRY can perform credential dumping.
MITRE ATT&CK techniques:
T1003
Threat description: Trojan.Karagany can dump passwords and save them into "\ProgramData\Mail\MailAg\pwds.txt".
MITRE ATT&CK techniques:
T1003
Threat description: APT1 has been known to use credential dumping using Mimikatz.
MITRE ATT&CK techniques:
T1003.001
Threat description: APT33 has used a variety of publicly available tools like LaZagne, Mimikatz, and ProcDump to dump credentials.
MITRE ATT&CK techniques:
T1003.001
Threat description: Fox Kitten has used prodump to dump credentials from LSASS.
MITRE ATT&CK techniques:
T1003.001
Threat description: Indrik Spider used Cobalt Strike to carry out credential dumping using ProcDump.
MITRE ATT&CK techniques:
T1003.001
Threat description: Lazarus Group leveraged Mimikatz to extract Windows Credentials of currently logged-in users and steals passwords stored in browsers. Lazarus Group has also used a custom version Mimikatz to capture credentials.
MITRE ATT&CK techniques:
T1003.001
Threat description: MuddyWater has performed credential dumping with Mimikatz and procdump64.exe.
MITRE ATT&CK techniques:
T1003.001
Threat description: NotPetya contains a modified version of Mimikatz to help gather credentials that are later used for lateral movement.
MITRE ATT&CK techniques:
T1003.001
Threat description: Threat Group-3390 actors have used a modified version of Mimikatz called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers.
MITRE ATT&CK techniques:
T1003.001
Threat description: CosmicDuke collects Windows account hashes.
MITRE ATT&CK techniques:
T1003.002
Threat description: CrackMapExec can dump usernames and hashed passwords from the SAM.
MITRE ATT&CK techniques:
T1003.002
Threat description: Password stealer and NTLM stealer modules in CozyCar harvest stored credentials from the victim, including credentials used as part of Windows NTLM user authentication.
MITRE ATT&CK techniques:
T1003.002
Threat description: menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.
MITRE ATT&CK techniques:
T1003.004
T1003.002
Threat description: pwdump can be used to dump credentials from the SAM.
MITRE ATT&CK techniques:
T1003.002
Threat description: Chimera has gathered the SYSTEM registry and ntds.dit files from target systems. Chimera specifically has used the NtdsAudit tool to dump the password hashes of domain users via "msadcs.exe "NTDS.dit" -s "SYSTEM" -p RecordedTV_pdmp.txt --users-csv RecordedTV_users.csv" and used ntdsutil to copy the Active Directory database.
MITRE ATT&CK techniques:
T1003.003
Threat description: Dragonfly has dropped and executed SecretsDump to dump password hashes. They also obtained ntds.dit from domain controllers.
MITRE ATT&CK techniques:
T1003.003
Threat description: Fox Kitten has used Volume Shadow Copy to access credential information from NTDS.
MITRE ATT&CK techniques:
T1003.003
Threat description: LaZagne can perform credential dumping from LSA secrets to obtain account and password information.
MITRE ATT&CK techniques:
T1003.004
Threat description: APT1 has collected files from a local victim.
MITRE ATT&CK techniques:
T1005
Threat description: APT38 has collected data from a compromised host.
MITRE ATT&CK techniques:
T1005
Threat description: BADFLICK has uploaded files from victims' machines.
MITRE ATT&CK techniques:
T1005
Threat description: BLINDINGCAN has uploaded files from victim machines.
MITRE ATT&CK techniques:
T1005
Threat description: Bisonal has collected information from a compromised host.
MITRE ATT&CK techniques:
T1005
Threat description: CharmPower can collect data and files from a compromised host.
MITRE ATT&CK techniques:
T1005
Threat description: DanBot can upload files from compromised hosts.
MITRE ATT&CK techniques:
T1005
Threat description: DarkWatchman can collect files from a compromised host.
MITRE ATT&CK techniques:
T1005
Threat description: Dragonfly has collected data from local victim systems.
MITRE ATT&CK techniques:
T1005
Threat description: Drovorub can transfer files from the victim machine.
MITRE ATT&CK techniques:
T1005
Threat description: During CostaRicto, the threat actors collected data and files from compromised networks.
MITRE ATT&CK techniques:
T1005
Threat description: During Operation Wocao, threat actors exfiltrated files and directories of interest from the targeted system.
MITRE ATT&CK techniques:
T1005
Threat description: Flagpro can collect data from a compromised host, including Windows authentication information.
MITRE ATT&CK techniques:
T1005
Threat description: GALLIUM collected data from the victim's local system, including password hashes from the SAM hive in the Registry.
MITRE ATT&CK techniques:
T1005
Threat description: Gelsemium can collect data from a compromised host.
MITRE ATT&CK techniques:
T1005
Threat description: Hikit can upload files from compromised machines.
MITRE ATT&CK techniques:
T1005
Threat description: Honeybee collects data from the local victim system.
MITRE ATT&CK techniques:
T1005
Threat description: Hydraq creates a backdoor through which remote attackers can read data from files.
MITRE ATT&CK techniques:
T1005
Threat description: Kimsuky has collected Office, PDF, and HWP documents from its victims.
MITRE ATT&CK techniques:
T1005
Threat description: LAPSUS$ uploaded sensitive files, information, and credentials from a targeted organization for extortion or public release.
MITRE ATT&CK techniques:
T1005
Threat description: MobileOrder exfiltrates data collected from the victim mobile device.
MITRE ATT&CK techniques:
T1005
Threat description: Mongall has the ability to upload files from victim's machines.
MITRE ATT&CK techniques:
T1005
Threat description: OSX_OCEANLOTUS.D has the ability to upload files from a compromised host.
MITRE ATT&CK techniques:
T1005
Threat description: OutSteel can collect information from a compromised host.
MITRE ATT&CK techniques:
T1005
Threat description: POWERSTATS can upload files from compromised hosts.
MITRE ATT&CK techniques:
T1005
Threat description: PcShare can collect files and information from a compromised host.
MITRE ATT&CK techniques:
T1005
Threat description: PinchDuke collects user files from the compromised host based on predefined file extensions.
MITRE ATT&CK techniques:
T1005
Threat description: QuasarRAT can retrieve files from compromised client machines.
MITRE ATT&CK techniques:
T1005
Threat description: RCSession can collect data from a compromised host.
MITRE ATT&CK techniques:
T1005
Threat description: ROKRAT can collect host data and specific file types.
MITRE ATT&CK techniques:
T1005
Threat description: Rising Sun has collected data and files from a compromised host.
MITRE ATT&CK techniques:
T1005
Threat description: ThreatNeedle can collect data and files from a compromised host.
MITRE ATT&CK techniques:
T1005
Threat description: TinyTurla can upload files from a compromised host.
MITRE ATT&CK techniques:
T1005
Threat description: TrickBot collects local files and information from the victim’s local machine.
MITRE ATT&CK techniques:
T1005
Threat description: Turla RPC backdoors can upload files from victim machines.
MITRE ATT&CK techniques:
T1005
Threat description: WarzoneRAT can collect data from a compromised host.
MITRE ATT&CK techniques:
T1005
Threat description: When it first starts, BADNEWS crawls the victim's local drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.
MITRE ATT&CK techniques:
T1005
Threat description: APT1 used the commands "net start" and "tasklist" to get a listing of the services on the system.
MITRE ATT&CK techniques:
T1007
Threat description: Dyre has the ability to identify running services on a compromised host.
MITRE ATT&CK techniques:
T1007
Threat description: Elise executes "net start" after initial communication is made to the remote server.
MITRE ATT&CK techniques:
T1007
Threat description: Epic uses the "tasklist /svc" command to list the services on the system.
MITRE ATT&CK techniques:
T1007
Threat description: HyperBro can list all services and their configurations.
MITRE ATT&CK techniques:
T1007
Threat description: Indrik Spider has used the win32_service WMI class to retrieve a list of services from the system.
MITRE ATT&CK techniques:
T1007
Threat description: RainyDay can create and register a service for execution.
MITRE ATT&CK techniques:
T1007
Threat description: S-Type runs the command "net start" on a victim.
MITRE ATT&CK techniques:
T1007
Threat description: Bazar has the ability to use an alternative C2 server if the primary server fails.
MITRE ATT&CK techniques:
T1008
Threat description: FIN7's Harpy backdoor malware can use DNS as a backup channel for C2 if HTTP fails.
MITRE ATT&CK techniques:
T1008
Threat description: JHUHUGIT tests if it can reach its C2 server by first attempting a direct connection, and if it fails, obtaining proxy settings and sending the connection through a proxy, and finally injecting code into a running browser if the proxy method fails.
MITRE ATT&CK techniques:
T1008
Threat description: OilRig malware ISMAgent falls back to its DNS tunneling mechanism if it is unable to reach the C2 server over HTTP.
MITRE ATT&CK techniques:
T1008
Threat description: ShimRat has used a secondary C2 location if the first was unavailable.
MITRE ATT&CK techniques:
T1008
Threat description: Stuxnet has the ability to generate new C2 domains.
MITRE ATT&CK techniques:
T1008
Threat description: WinMM is usually configured with primary and backup domains for C2 communications.
MITRE ATT&CK techniques:
T1008
Threat description: Kazuar gathers information about opened windows.
MITRE ATT&CK techniques:
T1010
Threat description: Machete saves the window names.
MITRE ATT&CK techniques:
T1010
Threat description: QakBot has the ability to enumerate windows on a compromised host.
MITRE ATT&CK techniques:
T1010
Threat description: Azorult can check for installed software on the system under the Registry key "Software\Microsoft\Windows\CurrentVersion\Uninstall".
MITRE ATT&CK techniques:
T1012
Threat description: BitPaymer can use the RegEnumKeyW to iterate through Registry keys.
MITRE ATT&CK techniques:
T1012
Threat description: Cardinal RAT contains watchdog functionality that periodically ensures "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load" is set to point to its executable.
MITRE ATT&CK techniques:
T1012
Threat description: Chimera has queried Registry keys using "reg query \\<host>\HKU\<SID>\SOFTWARE\Microsoft\Terminal Server Client\Servers" and "reg query \\<host>\HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Internet Settings".
MITRE ATT&CK techniques:
T1012
Threat description: Crimson can check the Registry for the presence of "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\last_edate" to determine how long it has been installed on a host.
MITRE ATT&CK techniques:
T1012
Threat description: DarkWatchman can query the Registry to determine if it has already been installed on the system.
MITRE ATT&CK techniques:
T1012
Threat description: Derusbi is capable of enumerating Registry keys and values.
MITRE ATT&CK techniques:
T1012
Threat description: DownPaper searches and reads the value of the Windows Update Registry Run key.
MITRE ATT&CK techniques:
T1012
Threat description: Dtrack can collect the RegisteredOwner, RegisteredOrganization, and InstallDate registry values.
MITRE ATT&CK techniques:
T1012
Threat description: During Operation Wocao, the threat actors executed `/c cd /d c:\windows\temp\ & reg query HKEY_CURRENT_USER\Software\<username>\PuTTY\Sessions\` to detect recent PuTTY sessions, likely to further lateral movement.
MITRE ATT&CK techniques:
T1012
Threat description: FunnyDream can check `Software\Microsoft\Windows\CurrentVersion\Internet Settings` to extract the `ProxyServer` string.
MITRE ATT&CK techniques:
T1012
Threat description: LitePower can query the Registry for keys added to execute COM hijacking.
MITRE ATT&CK techniques:
T1012
Threat description: POWRUNER may query the Registry by running "reg query" on a victim.
MITRE ATT&CK techniques:
T1012
Threat description: PlugX can enumerate and query for information contained within the Windows Registry.
MITRE ATT&CK techniques:
T1012
Threat description: PowerSploit contains a collection of Privesc-PowerUp modules that can query Registry keys for potential opportunities.
MITRE ATT&CK techniques:
T1012
Threat description: QUADAGENT checks if a value exists within a Registry key in the HKCU hive whose name is the same as the scheduled task it has created.
MITRE ATT&CK techniques:
T1012
Threat description: RATANKBA uses the command "reg query “HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings”".
MITRE ATT&CK techniques:
T1012
Threat description: REvil can query the Registry to get random file extensions to append to encrypted files.
MITRE ATT&CK techniques:
T1012
Threat description: Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface.
MITRE ATT&CK techniques:
T1012
Threat description: SUNBURST collected the registry value "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid" from compromised hosts.
MITRE ATT&CK techniques:
T1012
Threat description: Shamoon queries several Registry keys to identify hard disk partitions to overwrite.
MITRE ATT&CK techniques:
T1012
Threat description: SodaMaster has the ability to query the Registry to detect a key specific to VMware.
MITRE ATT&CK techniques:
T1012
Threat description: Stuxnet searches the Registry for indicators of security programs.
MITRE ATT&CK techniques:
T1012
Threat description: SynAck enumerates Registry keys associated with event logs.
MITRE ATT&CK techniques:
T1012
Threat description: Ursnif has used Reg to query the Registry for installed programs.
MITRE ATT&CK techniques:
T1012
Threat description: Zebrocy executes the "reg query" command to obtain information in the Registry.
MITRE ATT&CK techniques:
T1012
Threat description: Carberp has used user mode rootkit techniques to remain hidden on the system.
MITRE ATT&CK techniques:
T1014
Threat description: Hikit is a Rootkit that has been used by Axiom.
MITRE ATT&CK techniques:
T1014
Threat description: Zeroaccess is a kernel-mode rootkit.
MITRE ATT&CK techniques:
T1014
Threat description: A module in Prikormka collects information from the victim about its IP addresses and MAC addresses.
MITRE ATT&CK techniques:
T1016
Threat description: APT32 used the "ipconfig /all" command to gather the IP address from the system.
MITRE ATT&CK techniques:
T1016
Threat description: Arp can be used to display ARP configuration information on the host.
MITRE ATT&CK techniques:
T1016
Threat description: BabyShark has executed the "ipconfig /all" command.
MITRE ATT&CK techniques:
T1016
Threat description: Bandook has a command to get the public IP address from a system.
MITRE ATT&CK techniques:
T1016
Threat description: Bisonal can execute "ipconfig" on the victim’s machine.
MITRE ATT&CK techniques:
T1016
Threat description: Brave Prince gathers network configuration information as well as the ARP cache.
MITRE ATT&CK techniques:
T1016
Threat description: Cyclops Blink can use the Linux API `if_nameindex` to gather network interface names.
MITRE ATT&CK techniques:
T1016
Threat description: Darkhotel has collected the IP address and network adapter information from the victim’s machine.
MITRE ATT&CK techniques:
T1016
Threat description: FALLCHILL collects MAC address and local IP address information from the victim.
MITRE ATT&CK techniques:
T1016
Threat description: Higaisa used "ipconfig" to gather network configuration information.
MITRE ATT&CK techniques:
T1016
Threat description: InvisiMole gathers information on the IP forwarding table, MAC address, configured proxy, and network SSID.
MITRE ATT&CK techniques:
T1016
Threat description: KeyBoy can determine the public or WAN IP address for the system.
MITRE ATT&CK techniques:
T1016
Threat description: Kimsuky has used `ipconfig/all` to gather network configuration information.
MITRE ATT&CK techniques:
T1016
Threat description: Koadic can retrieve the contents of the IP routing table as well as information about the Windows domain.
MITRE ATT&CK techniques:
T1016
Threat description: LightNeuron gathers information about network adapters using the Win32 API call "GetAdaptersInfo".
MITRE ATT&CK techniques:
T1016
Threat description: Moses Staff has collected the domain name of a compromised network.
MITRE ATT&CK techniques:
T1016
Threat description: NBTscan can be used to collect MAC addresses.
MITRE ATT&CK techniques:
T1016
Threat description: NanoCore gathers the IP address from the victim’s machine.
MITRE ATT&CK techniques:
T1016
Threat description: Nltest may be used to enumerate the parent domain of a local machine using "/parentdomain".
MITRE ATT&CK techniques:
T1016
Threat description: Pisloader has a command to collect the victim's IP address.
MITRE ATT&CK techniques:
T1016
Threat description: Pupy has built in commands to identify a host’s IP address and find out other network configuration settings by viewing connected sessions.
MITRE ATT&CK techniques:
T1016
Threat description: Saint Bot can collect the IP address of a victim machine.
MITRE ATT&CK techniques:
T1016
Threat description: ShimRatReporter gathered the local proxy, domain, IP, routing tables, mac address, gateway, DNS servers, and DHCP status information from an infected host.
MITRE ATT&CK techniques:
T1016
Threat description: Sliver has the ability to gather network configuration information.
MITRE ATT&CK techniques:
T1016
Threat description: The reconnaissance modules used with Duqu can collect information on network configuration.
MITRE ATT&CK techniques:
T1016
Threat description: TrickBot obtains the IP address, location, and other relevant network information from the victim’s machine.
MITRE ATT&CK techniques:
T1016
Threat description: Tropic Trooper has used scripts to collect the host's network topology.
MITRE ATT&CK techniques:
T1016
Threat description: Turian can retrieve the internal IP address of a compromised host.
MITRE ATT&CK techniques:
T1016
Threat description: Turla surveys a system upon check-in to discover network configuration details using the "arp -a", "nbtstat -n", "net config", "ipconfig /all", and "route" commands, as well as NBTscan. Turla RPC backdoors have also retrieved registered RPC interface information from process memory.
MITRE ATT&CK techniques:
T1016
Threat description: Xbash can collect IP addresses and local intranet information from a victim’s machine.
MITRE ATT&CK techniques:
T1016
Threat description: menuPass has used several tools to scan for open NetBIOS nameservers and enumerate NetBIOS sessions.
MITRE ATT&CK techniques:
T1016
Threat description: APT29 has used GoldFinder to perform HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request travels through.
MITRE ATT&CK techniques:
T1016.001
Threat description: Gamaredon Group has tested connectivity between a compromised machine and a C2 server using  Ping with commands such as `CSIDL_SYSTEM\cmd.exe /c ping -n 1`.
MITRE ATT&CK techniques:
T1016.001
Threat description: Arp can be used to display a host's ARP cache, which may include address resolutions for remote systems.
MITRE ATT&CK techniques:
T1018
Threat description: Bazar can enumerate remote systems using " Net View".
MITRE ATT&CK techniques:
T1018
Threat description: Deep Panda has used ping to identify other machines of interest.
MITRE ATT&CK techniques:
T1018
Threat description: Dragonfly 2.0 likely obtained a list of hosts in the victim environment.
MITRE ATT&CK techniques:
T1018
Threat description: Dragonfly has likely obtained a list of hosts in the victim environment.
MITRE ATT&CK techniques:
T1018
Threat description: During Operation Wocao, threat actors used `nbtscan` and `ping` to discover remote systems, as well as `dsquery subnet` on a domain controller to retrieve all subnets in the Active Directory.
MITRE ATT&CK techniques:
T1018
Threat description: HermeticWizard can find machines on the local network by gathering known local IP addresses through `DNSGetCacheDataTable`, `GetIpNetTable`,`WNetOpenEnumW(RESOURCE_GLOBALNET, RESOURCETYPE_ANY)`,`NetServerEnum`,`GetTcpTable`, and `GetAdaptersAddresses.`
MITRE ATT&CK techniques:
T1018
Threat description: Kinsing has used a script to parse files like "/etc/hosts" and SSH "known_hosts" to discover remote systems.
MITRE ATT&CK techniques:
T1018
Threat description: Leafminer used Microsoft’s Sysinternals tools to gather detailed information about remote systems.
MITRE ATT&CK techniques:
T1018
Threat description: Remsec can ping or traceroute a remote host.
MITRE ATT&CK techniques:
T1018
Threat description: UNC2452 used AdFind to enumerate remote systems.
MITRE ATT&CK techniques:
T1018
Threat description: USBferry can use "net view" to gather information about remote systems.
MITRE ATT&CK techniques:
T1018
Threat description: yty uses the "net view" command for discovery.
MITRE ATT&CK techniques:
T1018
Threat description: Gamaredon Group has used modules that automatically upload gathered documents to the C2 server.
MITRE ATT&CK techniques:
T1020
Threat description: Honeybee performs data exfiltration is accomplished through the following command-line command: "from <COMPUTER-NAME> (<Month>-<Day> <Hour>-<Minute>-<Second>).txt".
MITRE ATT&CK techniques:
T1020
Threat description: When a document is found matching one of the extensions in the configuration, TINYTYPHON uploads it to the C2 server.
MITRE ATT&CK techniques:
T1020
Threat description: Kivars has the ability to remotely trigger keyboard input and mouse clicks.
MITRE ATT&CK techniques:
T1021
Threat description: APT3 enables the Remote Desktop Protocol for persistence. APT3 has also interacted with compromised systems to browse and copy files through RDP sessions.
MITRE ATT&CK techniques:
T1021.001
Threat description: Cobalt Strike can start a VNC-based remote desktop server and tunnel the connection through the already established C2 channel.
MITRE ATT&CK techniques:
T1021.001
Threat description: FIN10 has used RDP to move laterally to systems in the victim environment.
MITRE ATT&CK techniques:
T1021.001
Threat description: HEXANE has used remote desktop sessions for lateral movement.
MITRE ATT&CK techniques:
T1021.001
Threat description: Imminent Monitor has a module for performing remote desktop access.
MITRE ATT&CK techniques:
T1021.001
Threat description: Lazarus Group malware SierraCharlie uses RDP for propagation.
MITRE ATT&CK techniques:
T1021.001
Threat description: Patchwork attempted to use RDP to move laterally.
MITRE ATT&CK techniques:
T1021.001
Threat description: Revenge RAT has a plugin to perform RDP access.
MITRE ATT&CK techniques:
T1021.001
Threat description: WarzoneRAT has the ability to control an infected PC using RDP.
MITRE ATT&CK techniques:
T1021.001
Threat description: njRAT has a module for performing remote desktop access.
MITRE ATT&CK techniques:
T1021.001
Threat description: zwShell has used RDP for lateral movement.
MITRE ATT&CK techniques:
T1021.001
Threat description: APT39 has used SMB for lateral movement.
MITRE ATT&CK techniques:
T1021.002
Threat description: During Operation Wocao, threat actors used Impacket's smbexec.py as well as accessing the C$ and IPC$ shares to move laterally.
MITRE ATT&CK techniques:
T1021.002
Threat description: Emotet leverages the Admin$ share for lateral movement once the local admin password has been brute forced.
MITRE ATT&CK techniques:
T1021.002
Threat description: Fox Kitten has used valid accounts to access SMB shares.
MITRE ATT&CK techniques:
T1021.002
Threat description: Ke3chang actors have been known to copy files to the network shares of other computers to move laterally.
MITRE ATT&CK techniques:
T1021.002
Threat description: Lucifer can infect victims by brute forcing SMB.
MITRE ATT&CK techniques:
T1021.002
Threat description: NotPetya can use PsExec, which interacts with the "ADMIN$" network share to execute commands on remote systems.
MITRE ATT&CK techniques:
T1021.002
Threat description: OilRig has used Putty to access compromised systems.
MITRE ATT&CK techniques:
T1021.004
Threat description: Carberp can start a remote VNC session by downloading a new plugin.
MITRE ATT&CK techniques:
T1021.005
Threat description: TrickBot has used a VNC module to monitor the victim and collect information to pivot to valuable systems on the network
MITRE ATT&CK techniques:
T1021.005
Threat description: Cobalt Strike can use "WinRM" to execute a payload on a remote host.
MITRE ATT&CK techniques:
T1021.006
Threat description: Wizard Spider has used Window Remote Management to move laterally through a victim network.
MITRE ATT&CK techniques:
T1021.006
Threat description: CosmicDuke steals user files from removable media with file extensions and keywords that match a predefined list.
MITRE ATT&CK techniques:
T1025
Threat description: InvisiMole can collect jpeg files from connected MTP devices.
MITRE ATT&CK techniques:
T1025
Threat description: Machete can find, encrypt, and upload files from fixed and removable drives.
MITRE ATT&CK techniques:
T1025
Threat description: Rover searches for files on attached removable drives based on a predefined list of file extensions every five seconds.
MITRE ATT&CK techniques:
T1025
Threat description: A Night Dragon DLL included an XOR-encoded section.
MITRE ATT&CK techniques:
T1027
Threat description: APIs and strings in some TYPEFRAME variants are RC4 encrypted. Another variant is encoded with XOR.
MITRE ATT&CK techniques:
T1027
Threat description: APT39 has used malware to drop encrypted CAB files.
MITRE ATT&CK techniques:
T1027
Threat description: APT41 used VMProtected binaries in multiple intrusions.
MITRE ATT&CK techniques:
T1027
Threat description: Agent Tesla has had its code obfuscated in an apparent attempt to make analysis difficult. Agent Tesla has used the Rijndael symmetric encryption algorithm to encrypt strings.
MITRE ATT&CK techniques:
T1027
Threat description: Amadey has obfuscated strings such as antivirus vendor names, domains, files, and others.
MITRE ATT&CK techniques:
T1027
Threat description: BITTER has used a RAR SFX dropper to deliver malware.
MITRE ATT&CK techniques:
T1027
Threat description: BackConfig has used compressed and decimal encoded VBS scripts.
MITRE ATT&CK techniques:
T1027
Threat description: Bisonal's DLL file and non-malicious decoy file are encrypted with RC4 and some function name strings are obfuscated.
MITRE ATT&CK techniques:
T1027
Threat description: BoxCaon used the "StackStrings" obfuscation technique to hide malicious functionalities.
MITRE ATT&CK techniques:
T1027
Threat description: Bundlore has obfuscated data with base64, AES, RC4, and bz2.
MITRE ATT&CK techniques:
T1027
Threat description: Carbon encrypts configuration files and tasks for the malware to complete using CAST-128 algorithm.
MITRE ATT&CK techniques:
T1027
Threat description: Configuration data used by Rising Sun has been encrypted using an RC4 stream algorithm.
MITRE ATT&CK techniques:
T1027
Threat description: DOGCALL is encrypted using single-byte XOR.
MITRE ATT&CK techniques:
T1027
Threat description: Daserf uses encrypted Windows APIs and also encrypts data using the alternative base64+RC4 or the Caesar cipher.
MITRE ATT&CK techniques:
T1027
Threat description: Dust Storm has encoded payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key.
MITRE ATT&CK techniques:
T1027
Threat description: Ecipekac can use XOR, AES, and DES to encrypt loader shellcode.
MITRE ATT&CK techniques:
T1027
Threat description: Empire has the ability to obfuscate commands using "Invoke-Obfuscation".
MITRE ATT&CK techniques:
T1027
Threat description: Epic heavily obfuscates its code to make analysis more difficult.
MITRE ATT&CK techniques:
T1027
Threat description: Final1stspy obfuscates strings with base64 encoding.
MITRE ATT&CK techniques:
T1027
Threat description: `xyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw_=` character sets."
MITRE ATT&CK techniques:
T1027
Threat description: Fysbis has been encrypted using XOR and RC4.
MITRE ATT&CK techniques:
T1027
Threat description: HyperBro can be delivered encrypted to a compromised host.
MITRE ATT&CK techniques:
T1027
Threat description: IcedID has utilzed encrypted binaries and base64 encoded strings.
MITRE ATT&CK techniques:
T1027
Threat description: Inception has encrypted malware payloads dropped on victim machines with AES and RC4 encryption.
MITRE ATT&CK techniques:
T1027
Threat description: Kazuar is obfuscated using the open source ConfuserEx protector. Kazuar also obfuscates the name of created files/folders/mutexes and encrypts debug messages written to log files using the Rijndael cipher.
MITRE ATT&CK techniques:
T1027
Threat description: Ke3chang has used Base64-encoded shellcode strings.
MITRE ATT&CK techniques:
T1027
Threat description: Kimsuky has obfuscated binary strings including the use of XOR encryption and Base64 encoding. Kimsuky has also modified the first byte of DLL implants targeting victims to prevent recognition of the executable file format.
MITRE ATT&CK techniques:
T1027
Threat description: Kobalos encrypts all strings using RC4 and bundles all functionality into a single function call.
MITRE ATT&CK techniques:
T1027
Threat description: Leafminer obfuscated scripts that were used on victim machines.
MITRE ATT&CK techniques:
T1027
Threat description: MiniDuke can use control flow flattening to obscure code.
MITRE ATT&CK techniques:
T1027
Threat description: Mofang has compressed the ShimRat executable within malicious email attachments. Mofang has also encrypted payloads before they are downloaded to victims.
MITRE ATT&CK techniques:
T1027
Threat description: Most of the strings in ADVSTORESHELL are encrypted with an XOR-based algorithm; some strings are also encrypted with 3DES and reversed. API function names are also reversed, presumably to avoid detection in memory.
MITRE ATT&CK techniques:
T1027
Threat description: Mustang Panda has delivered initial payloads hidden using archives and encoding measures.
MITRE ATT&CK techniques:
T1027
Threat description: NOKKI uses Base64 encoding for strings.
MITRE ATT&CK techniques:
T1027
Threat description: OSX_OCEANLOTUS.D encrypts its strings in RSA256 and encodes them in a custom base64 scheme and XOR.
MITRE ATT&CK techniques:
T1027
Threat description: Patchwork has obfuscated a script with Crypto Obfuscator.
MITRE ATT&CK techniques:
T1027
Threat description: Penquin has encrypted strings in the binary for obfuscation.
MITRE ATT&CK techniques:
T1027
Threat description: Pisloader obfuscates files by splitting strings into smaller sub-strings and including "garbage" strings that are never used. The malware also uses return-oriented programming (ROP) technique and single-byte XOR to obfuscate data.
MITRE ATT&CK techniques:
T1027
Threat description: RainyDay has downloaded as a XOR-encrypted payload.
MITRE ATT&CK techniques:
T1027
Threat description: Ryuk can use anti-disassembly and code transformation obfuscation techniques.
MITRE ATT&CK techniques:
T1027
Threat description: SDBbot has the ability to XOR the strings for its installer component with a hardcoded 128 byte key.
MITRE ATT&CK techniques:
T1027
Threat description: SUNBURST strings were compressed and encoded in Base64. SUNBURST also obfuscated collected system information using a FNV-1a + XOR algorithm.
MITRE ATT&CK techniques:
T1027
Threat description: Saint Bot has been obfuscated to help avoid detection.
MITRE ATT&CK techniques:
T1027
Threat description: Small Sieve has the ability to use a custom hex byte swapping encoding scheme combined with an obfuscated Base64 function to protect program strings and Telegram credentials.
MITRE ATT&CK techniques:
T1027
Threat description: Stuxnet uses encrypted configuration blocks and writes encrypted files to disk.
MITRE ATT&CK techniques:
T1027
Threat description: TA551 has used obfuscated variable names in a JavaScript configuration file.
MITRE ATT&CK techniques:
T1027
Threat description: TajMahal has used an encrypted Virtual File System to store plugins.
MITRE ATT&CK techniques:
T1027
Threat description: The PowerShell script with the RogueRobin payload was obfuscated using the COMPRESS technique in Invoke-Obfuscation.
MITRE ATT&CK techniques:
T1027
Threat description: The SMOKEDHAM source code is embedded in the dropper as an encrypted string.
MITRE ATT&CK techniques:
T1027
T1027.009
Threat description: The WastedLocker payload includes encrypted strings stored within the .bss section of the binary file.
MITRE ATT&CK techniques:
T1027
Threat description: Transparent Tribe has dropped encoded executables on compromised hosts.
MITRE ATT&CK techniques:
T1027
Threat description: TrickBot uses non-descriptive names to hide functionality and uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files.
MITRE ATT&CK techniques:
T1027
Threat description: VERMIN is obfuscated using the obfuscation tool called ConfuserEx.
MITRE ATT&CK techniques:
T1027
Threat description: Zox has been encoded with Base64.
MITRE ATT&CK techniques:
T1027
Threat description: menuPass has encoded strings in its malware with base64 as well as with a simple, single-byte XOR obfuscation using key 0x40.
MITRE ATT&CK techniques:
T1027
Threat description: A variant of Emissary appends junk data to the end of its DLL file to create a large file that may exceed the maximum size that anti-virus programs can scan.
MITRE ATT&CK techniques:
T1027.001
Threat description: APT32 includes garbage code to mislead anti-malware software and researchers.
MITRE ATT&CK techniques:
T1027.001
Threat description: Moafee has been known to employ binary padding.
MITRE ATT&CK techniques:
T1027.001
Threat description: POWERSTATS has used useless code blocks to counter analysis.
MITRE ATT&CK techniques:
T1027.001
Threat description: WastedLocker contains junk code to increase its entropy and hide the actual code.
MITRE ATT&CK techniques:
T1027.001
Threat description: BLINDINGCAN has been packed with the UPX packer.
MITRE ATT&CK techniques:
T1027.002
Threat description: Bazar has a variant with a packed payload.
MITRE ATT&CK techniques:
T1027.002
Threat description: Dark Caracal has used UPX to pack Bandook.
MITRE ATT&CK techniques:
T1027.002
Threat description: Donut can generate packed code modules.
MITRE ATT&CK techniques:
T1027.002
Threat description: GALLIUM packed some payloads using different types of packers, both known and custom.
MITRE ATT&CK techniques:
T1027.002
Threat description: IcedID has packed and encrypted its loader module.
MITRE ATT&CK techniques:
T1027.002
Threat description: Lucifer has used UPX packed binaries.
MITRE ATT&CK techniques:
T1027.002
Threat description: Misdat was typically packed using UPX.
MITRE ATT&CK techniques:
T1027.002
Threat description: Mongall has been packed with Themida.
MITRE ATT&CK techniques:
T1027.002
Threat description: TeamTNT has used UPX and Ezuri packer to pack its binaries.
MITRE ATT&CK techniques:
T1027.002
Threat description: TrickBot leverages a custom packer to obfuscate its functionality.
MITRE ATT&CK techniques:
T1027.002
Threat description: Uroburos uses a custom packer.
MITRE ATT&CK techniques:
T1027.002
Threat description: VERMIN is initially packed.
MITRE ATT&CK techniques:
T1027.002
Threat description: Valak has used packed DLL payloads.
MITRE ATT&CK techniques:
T1027.002
Threat description: jRAT payloads have been packed.
MITRE ATT&CK techniques:
T1027.002
Threat description: yty packs a plugin with UPX.
MITRE ATT&CK techniques:
T1027.002
Threat description: PolyglotDuke can use steganography to hide C2 information in images.
MITRE ATT&CK techniques:
T1027.003
Threat description: TA551 has hidden encoded data for malware DLLs in a PNG.
MITRE ATT&CK techniques:
T1027.003
Threat description: Tropic Trooper has used JPG files with encrypted payloads to mask their backdoor routines and evade detection.
MITRE ATT&CK techniques:
T1027.003
Threat description: FoggyWeb can compile and execute source code sent to the compromised AD FS server via a specific HTTP POST.
MITRE ATT&CK techniques:
T1027.004
Threat description: MuddyWater has used the .NET csc.exe tool to compile executables from downloaded C# code.
MITRE ATT&CK techniques:
T1027.004
Threat description: Based on comparison of Gazer versions, Turla made an effort to obfuscate strings in the malware that could be used as IoCs, including the mutex name and named pipe.
MITRE ATT&CK techniques:
T1027.005
Threat description: Operation Wocao has edited variable names within the Impacket suite to avoid automated detection.
MITRE ATT&CK techniques:
T1027.005
Threat description: ComRAT has embedded a XOR encrypted communications module inside the orchestrator module.
MITRE ATT&CK techniques:
T1027.009
Threat description: Cobalt Strike can set its "beacon" payload to reach out to the C2 server on an arbitrary and random interval. In addition it will break large data sets into smaller chunks for exfiltration.
MITRE ATT&CK techniques:
T1029
Threat description: ComRAT has been programmed to sleep outside local business hours (9 to 5, Monday to Friday).
MITRE ATT&CK techniques:
T1029
Threat description: Linfo creates a backdoor through which remote attackers can change the frequency at which compromised hosts contact remote C2 infrastructure.
MITRE ATT&CK techniques:
T1029
Threat description: Shark can pause C2 communications for a specified time.
MITRE ATT&CK techniques:
T1029
Threat description: RDAT can upload a file via HTTP POST response to the C2 split into 102,400-byte portions. RDAT can also download data from the C2 which is split into 81,920-byte portions.
MITRE ATT&CK techniques:
T1030
Threat description: APT19 used an HTTP malware variant and a Port 22 malware variant to collect the victim’s username.
MITRE ATT&CK techniques:
T1033
Threat description: APT37 identifies the victim username.
MITRE ATT&CK techniques:
T1033
Threat description: Agent Tesla can collect the username from the victim’s machine.
MITRE ATT&CK techniques:
T1033
Threat description: BISCUIT has a command to gather the username from the system.
MITRE ATT&CK techniques:
T1033
Threat description: Bumblebee has the ability to identify the user name.
MITRE ATT&CK techniques:
T1033
Threat description: Cannon can gather the username from the system.
MITRE ATT&CK techniques:
T1033
Threat description: CreepySnail can execute `getUsername` on compromised systems.
MITRE ATT&CK techniques:
T1033
Threat description: Cryptoistic can gather data on the user of a compromised host.
MITRE ATT&CK techniques:
T1033
Threat description: DarkWatchman has collected the username from a victim machine.
MITRE ATT&CK techniques:
T1033
Threat description: Denis enumerates and collects the username from the victim’s machine.
MITRE ATT&CK techniques:
T1033
Threat description: Explosive has collected the username from the infected host.
MITRE ATT&CK techniques:
T1033
Threat description: Frankenstein has enumerated hosts, gathering username, machine name, and administrative permissions information.
MITRE ATT&CK techniques:
T1033
Threat description: Gazer obtains the current user's security identifier.
MITRE ATT&CK techniques:
T1033
Threat description: HEXANE has run `whoami` on compromised machines to identify the current user.
MITRE ATT&CK techniques:
T1033
Threat description: InvisiMole lists local users and session information.
MITRE ATT&CK techniques:
T1033
Threat description: Ixeshe collects the username from the victim’s machine.
MITRE ATT&CK techniques:
T1033
Threat description: LitePower can determine if the current user has admin privileges.
MITRE ATT&CK techniques:
T1033
Threat description: Lokibot has the ability to discover the username on the infected host.
MITRE ATT&CK techniques:
T1033
Threat description: MuddyWater has used malware that can collect the victim’s username.
MITRE ATT&CK techniques:
T1033
Threat description: PowerDuke has commands to get the current user's name and SID.
MITRE ATT&CK techniques:
T1033
Threat description: SILENTTRINITY can gather a list of logged on users.
MITRE ATT&CK techniques:
T1033
Threat description: Sandworm Team has collected the username from a compromised host.
MITRE ATT&CK techniques:
T1033
Threat description: ShadowPad has collected the username of the victim system.
MITRE ATT&CK techniques:
T1033
Threat description: Spark has run the whoami command and has a built-in command to identify the user logged in.
MITRE ATT&CK techniques:
T1033
Threat description: Turian can retrieve usernames.
MITRE ATT&CK techniques:
T1033
Threat description: Windshift has used malware to identify the username on a compromised host.
MITRE ATT&CK techniques:
T1033
Threat description: ZxShell can collect the owner and organization information from the target workstation.
MITRE ATT&CK techniques:
T1033
Threat description: yty collects the victim’s username.
MITRE ATT&CK techniques:
T1033
Threat description: APT29 has set the hostnames of its C2 infrastructure to match legitimate hostnames in the victim environment. They have also used IP addresses originating from the same country as the victim for their VPN infrastructure.
MITRE ATT&CK techniques:
T1036
Threat description: Accounts created by Dragonfly masqueraded as legitimate service accounts.
MITRE ATT&CK techniques:
T1036
Threat description: BRONZE BUTLER has masked executables with document file icons including Word and Adobe PDF.
MITRE ATT&CK techniques:
T1036
Threat description: During C0015, the threat actors named a binary file `compareForfor.jpg` to disguise it as a JPG file.
MITRE ATT&CK techniques:
T1036
Threat description: FatDuke has attempted to mimic a compromised user's traffic by using the same user agent as the installed browser.
MITRE ATT&CK techniques:
T1036
Threat description: FoggyWeb can masquerade the output of C2 commands as a fake, but legitimately formatted WebP file.
MITRE ATT&CK techniques:
T1036
Threat description: OilRig has used .doc file extensions to mask malicious executables.
MITRE ATT&CK techniques:
T1036
Threat description: RTM has been delivered as archived Windows executable files masquerading as PDF documents.
MITRE ATT&CK techniques:
T1036
Threat description: TA551 has masked malware DLLs as dat and jpg files.
MITRE ATT&CK techniques:
T1036
Threat description: TRITON attempts to write a dummy program into memory if it fails to reset the Triconex controller.
MITRE ATT&CK techniques:
T1036
Threat description: ZIRCONIUM has spoofed legitimate applications in phishing lures and changed file extensions to conceal  installation of malware.
MITRE ATT&CK techniques:
T1036
Threat description: BRONZE BUTLER has used Right-to-Left Override to deceive victims into executing several strains of malware.
MITRE ATT&CK techniques:
T1036.002
Threat description: menuPass has renamed certutil and moved it to a different location on the system to avoid detection based on use of the tool.
MITRE ATT&CK techniques:
T1036.003
Threat description: Attor's dispatcher disguises itself as a legitimate task (i.e., the task name and description appear legitimate).
MITRE ATT&CK techniques:
T1036.004
Threat description: During Frankenstein, the threat actors named a malicious scheduled task "WinUpdate" for persistence.
MITRE ATT&CK techniques:
T1036.004
Threat description: Fox Kitten has named the task for a reverse proxy lpupdate to appear legitimate.
MITRE ATT&CK techniques:
T1036.004
Threat description: InnaputRAT variants have attempted to appear legitimate by adding a new service named OfficeUpdateService.
MITRE ATT&CK techniques:
T1036.004
Threat description: Kwampirs establishes persistence by adding a new service with the display name "WMI Performance Adapter Extension" in an attempt to masquerade as a legitimate WMI service.
MITRE ATT&CK techniques:
T1036.004
Threat description: Lazarus Group has used a scheduled task named `SRCheck` to mask the execution of a malicious .dll.
MITRE ATT&CK techniques:
T1036.004
Threat description: Maze operators have created scheduled tasks masquerading as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update" designed to launch the ransomware.
MITRE ATT&CK techniques:
T1036.004
Threat description: Meteor has been disguised as the Windows Power Efficiency Diagnostics report tool.
MITRE ATT&CK techniques:
T1036.004
Threat description: New services created by RawPOS are made to appear like legitimate Windows services, with names such as "Windows Management Help Service", "Microsoft Support", and "Windows Advanced Task Manager".
MITRE ATT&CK techniques:
T1036.004
Threat description: RTM has named the scheduled task it creates "Windows Update".
MITRE ATT&CK techniques:
T1036.004
Threat description: RainyDay has named services and scheduled tasks to appear benign including "ChromeCheck" and "googleupdate."
MITRE ATT&CK techniques:
T1036.004
Threat description: Some Volgmer variants add new services with display names generated by a list of hard-coded strings such as Application, Background, Security, and Windows, presumably as a way to masquerade as a legitimate service.
MITRE ATT&CK techniques:
T1036.004
Threat description: TinyTurla has mimicked an existing Windows service by being installed as "Windows Time Service".
MITRE ATT&CK techniques:
T1036.004
Threat description: APT39 has used malware disguised as Mozilla Firefox and a tool named mfevtpse.exe to proxy C2 communications, closely mimicking a legitimate McAfee file mfevtps.exe.
MITRE ATT&CK techniques:
T1036.005
Threat description: Aoqin Dragon has used fake icons including antivirus and external drives to disguise malicious payloads.
MITRE ATT&CK techniques:
T1036.005
Threat description: BackConfig has hidden malicious payloads in "%USERPROFILE%\Adobe\Driver\dwg\" and mimicked the legitimate DHCP service binary.
MITRE ATT&CK techniques:
T1036.005
Threat description: Bisonal has renamed malicious code to `msacm32.dll` to hide within a legitimate library; earlier versions were disguised as `winhelp`.
MITRE ATT&CK techniques:
T1036.005
Threat description: GoldMax has used filenames that matched the system name, and appeared as a scheduled task impersonating systems management software within the corresponding ProgramData subfolder.
MITRE ATT&CK techniques:
T1036.005
Threat description: Ixeshe has used registry values and file names associated with Adobe software, such as AcroRd32.exe.
MITRE ATT&CK techniques:
T1036.005
Threat description: KOCTOPUS has been disguised as legitimate software programs associated with the travel and airline industries.
MITRE ATT&CK techniques:
T1036.005
Threat description: LightNeuron has used filenames associated with Exchange and Outlook for binary and configuration files, such as "winmail.dat".
MITRE ATT&CK techniques:
T1036.005
Threat description: Mis-Type saves itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.
MITRE ATT&CK techniques:
T1036.005
Threat description: NETWIRE has masqueraded as legitimate software including TeamViewer and macOS Finder.
MITRE ATT&CK techniques:
T1036.005
Threat description: NOKKI is written to %LOCALAPPDATA%\MicroSoft Updatea\svServiceUpdate.exe prior being executed in a new process in an apparent attempt to masquerade as a legitimate folder and file.
MITRE ATT&CK techniques:
T1036.005