QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: SLOTHFULMEDIA can add, modify, and/or delete registry keys. It has changed the proxy configuration of a victim system by modifying the "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap" registry.
MITRE ATT&CK techniques:
T1112
Threat description: ShadowPad maintains a configuration block and virtual file system in the Registry.
MITRE ATT&CK techniques:
T1112
Threat description: Ursnif has used Registry modifications as part of its installation routine.
MITRE ATT&CK techniques:
T1112
Threat description: gh0st RAT has altered the InstallTime subkey.
MITRE ATT&CK techniques:
T1112
Threat description: CharmPower has the ability to capture screenshots.
MITRE ATT&CK techniques:
T1113
Threat description: Cobian RAT has a feature to perform screen capture.
MITRE ATT&CK techniques:
T1113
Threat description: ECCENTRICBANDWAGON can capture screenshots and store them locally.
MITRE ATT&CK techniques:
T1113
Threat description: FIN7 captured screenshots and desktop video recordings.
MITRE ATT&CK techniques:
T1113
Threat description: GRIFFON has used a screenshot module that can be used to take a screenshot of the remote system.
MITRE ATT&CK techniques:
T1113
Threat description: KEYMARBLE can capture screenshots of the victim’s machine.
MITRE ATT&CK techniques:
T1113
Threat description: Kazuar captures screenshots of the victim’s screen.
MITRE ATT&CK techniques:
T1113
Threat description: KeyBoy has a command to perform screen grabbing.
MITRE ATT&CK techniques:
T1113
Threat description: Ramsay can take screenshots every 30 seconds as well as when an external removable storage device is connected.
MITRE ATT&CK techniques:
T1113
Threat description: RedLeaves can capture screenshots.
MITRE ATT&CK techniques:
T1113
Threat description: Remcos takes automated screenshots of the infected machine.
MITRE ATT&CK techniques:
T1113
Threat description: Revenge RAT has a plugin for screen capture.
MITRE ATT&CK techniques:
T1113
Threat description: UPPERCUT can capture desktop screenshots in the PNG format and send them to the C2 server.
MITRE ATT&CK techniques:
T1113
Threat description: gh0st RAT can capture the victim’s screen remotely.
MITRE ATT&CK techniques:
T1113
Threat description: During Night Dragon, threat actors used RAT malware to exfiltrate email archives.
MITRE ATT&CK techniques:
T1114.001
Threat description: Out1 can parse e-mails on a target machine.
MITRE ATT&CK techniques:
T1114.001
Threat description: During Operation Wocao, threat actors collected clipboard data in plaintext.
MITRE ATT&CK techniques:
T1115
Threat description: RunningRAT contains code to open and copy data from the clipboard.
MITRE ATT&CK techniques:
T1115
Threat description: Chimera has used custom DLLs for continuous retrieval of data from memory.
MITRE ATT&CK techniques:
T1119
Threat description: Comnie executes a batch script to store discovery information in %TEMP%\info.dat and then uploads the temporarily file to the remote C2 server.
MITRE ATT&CK techniques:
T1119
Threat description: Crutch can automatically monitor removable drives in a loop and copy interesting files.
MITRE ATT&CK techniques:
T1119
Threat description: Empire can automatically gather the username, domain name, machine name, and other information from a compromised system.
MITRE ATT&CK techniques:
T1119
Threat description: Mythic supports scripting of file downloads from agents.
MITRE ATT&CK techniques:
T1119
Threat description: NETWIRE can automatically archive collected data.
MITRE ATT&CK techniques:
T1119
Threat description: Operation Wocao has used a script to collect information about the infected system.
MITRE ATT&CK techniques:
T1119
Threat description: ShimRatReporter gathered information automatically, without instruction from a C2, related to the user and host machine that is compiled into a report and sent to the operators.
MITRE ATT&CK techniques:
T1119
Threat description: Tropic Trooper has collected information automatically using the adversary's USBferry attack.
MITRE ATT&CK techniques:
T1119
Threat description: menuPass has used the Csvde tool to collect Active Directory files and data.
MITRE ATT&CK techniques:
T1119
Threat description: DarkWatchman can list signed PnP drivers for smartcard readers.
MITRE ATT&CK techniques:
T1120
Threat description: During Operation CuckooBees, the threat actors used the `fsutil fsinfo drives` command as part of their advanced reconnaissance.
MITRE ATT&CK techniques:
T1120
Threat description: Gamaredon Group tools have contained an application to check performance of USB flash drives. Gamaredon Group has also used malware to scan for removable drives.
MITRE ATT&CK techniques:
T1120
Threat description: Heyoka Backdoor can identify removable media attached to victim's machines.
MITRE ATT&CK techniques:
T1120
Threat description: The FunnyDream FilepakMonitor component can detect removable drive insertion.
MITRE ATT&CK techniques:
T1120
Threat description: njRAT will attempt to detect if the victim system has a camera during the initial infection. njRAT can also detect any removable drives connected to the system.
MITRE ATT&CK techniques:
T1120
Threat description: Derusbi is capable of performing audio captures.
MITRE ATT&CK techniques:
T1123
Threat description: Imminent Monitor has a remote microphone monitoring capability.
MITRE ATT&CK techniques:
T1123
Threat description: PowerSploit's "Get-MicrophoneAudio" Exfiltration module can record system microphone audio.
MITRE ATT&CK techniques:
T1123
Threat description: BLUELIGHT can collect the local time on a compromised host.
MITRE ATT&CK techniques:
T1124
Threat description: Crimson has the ability to determine the date and time on a compromised host.
MITRE ATT&CK techniques:
T1124
Threat description: During Operation Wocao, threat actors used the `time` command to retrieve the current time of a compromised system.
MITRE ATT&CK techniques:
T1124
Threat description: FELIXROOT gathers the time zone information from the victim’s machine.
MITRE ATT&CK techniques:
T1124
Threat description: InvisiMole gathers the local system time from the victim’s machine.
MITRE ATT&CK techniques:
T1124
Threat description: MoonWind obtains the victim's current time.
MITRE ATT&CK techniques:
T1124
Threat description: OopsIE checks to see if the system is configured with "Daylight" time and checks for a specific region to be set for the timezone.
MITRE ATT&CK techniques:
T1124
Threat description: RTM can obtain the victim time zone.
MITRE ATT&CK techniques:
T1124
Threat description: SHARPSTATS has the ability to identify the current date and time on the compromised host.
MITRE ATT&CK techniques:
T1124
Threat description: Sidewinder has used tools to obtain the current system time.
MITRE ATT&CK techniques:
T1124
Threat description: T9000 gathers and beacons the system time during installation.
MITRE ATT&CK techniques:
T1124
Threat description: ccf32 can determine the local time on targeted machines.
MITRE ATT&CK techniques:
T1124
Threat description: Cobian RAT has a feature to access the webcam on the victim’s machine.
MITRE ATT&CK techniques:
T1125
Threat description: Derusbi is capable of capturing video.
MITRE ATT&CK techniques:
T1125
Threat description: Revenge RAT has the ability to access the webcam.
MITRE ATT&CK techniques:
T1125
Threat description: Frankenstein has used MSbuild to execute an actor-created file.
MITRE ATT&CK techniques:
T1127.001
Threat description: DarkWatchman can load DLLs.
MITRE ATT&CK techniques:
T1129
Threat description: PUNCHBUGGY can load a DLL using the LoadLibrary API.
MITRE ATT&CK techniques:
T1129
Threat description: BLINDINGCAN has encoded its C2 traffic with Base64.
MITRE ATT&CK techniques:
T1132.001
Threat description: OopsIE encodes data in hexadecimal format over the C2 channel.
MITRE ATT&CK techniques:
T1132.001
Threat description: SUNBURST used Base64 encoding in its C2 traffic.
MITRE ATT&CK techniques:
T1132.001
Threat description: OceanSalt can encode data with a NOT operation before sending the data to the control server.
MITRE ATT&CK techniques:
T1132.002
Threat description: Kinsing was executed in an Ubuntu container deployed via an open Docker daemon API.
MITRE ATT&CK techniques:
T1133
Threat description: KillDisk has attempted to get the access token of a process by calling "OpenProcessToken". If KillDisk gets the access token, then it attempt to modify the token privileges with "AdjustTokenPrivileges".
MITRE ATT&CK techniques:
T1134
Threat description: MegaCortex can enable "SeDebugPrivilege" and adjust token privileges.
MITRE ATT&CK techniques:
T1134
Threat description: Aria-body has the ability to duplicate a token from ntprint.exe.
MITRE ATT&CK techniques:
T1134.001
Threat description: REvil can obtain the token from the user that launched the explorer.exe process to avoid affecting the desktop of the SYSTEM user.
MITRE ATT&CK techniques:
T1134.001
Threat description: Empire can use "Invoke-RunAs" to make tokens.
MITRE ATT&CK techniques:
T1134.002
Threat description: Turla RPC backdoors can impersonate or steal process tokens before executing commands.
MITRE ATT&CK techniques:
T1134.002
Threat description: Clop can enumerate network shares.
MITRE ATT&CK techniques:
T1135
Threat description: DEATHRANSOM has the ability to use loop operations to enumerate network resources.
MITRE ATT&CK techniques:
T1135
Threat description: Diavol has a `ENMDSKS` command to enumerates available network shares.
MITRE ATT&CK techniques:
T1135
Threat description: Dragonfly 2.0 identified and browsed file servers in the victim network, sometimes , viewing files pertaining to ICS or Supervisory Control and Data Acquisition (SCADA) systems.
MITRE ATT&CK techniques:
T1135
Threat description: InvisiMole can gather network share information.
MITRE ATT&CK techniques:
T1135
Threat description: MURKYTOP has the capability to retrieve information about shares on remote hosts.
MITRE ATT&CK techniques:
T1135
Threat description: OSInfo discovers shares on the network
MITRE ATT&CK techniques:
T1135
Threat description: ShimRat can enumerate connected drives for infected host machines.
MITRE ATT&CK techniques:
T1135
Threat description: Sowbug listed remote shared drives that were accessible from a victim.
MITRE ATT&CK techniques:
T1135
Threat description: Calisto has the capability to add its own account to the victim's machine.
MITRE ATT&CK techniques:
T1136.001
Threat description: Dragonfly has created accounts on victims, including administrator accounts, some of which appeared to be tailored to each individual staging target.
MITRE ATT&CK techniques:
T1136.001
Threat description: HiddenWasp creates a user account as a means to provide initial persistence to the compromised machine.
MITRE ATT&CK techniques:
T1136.001
Threat description: S-Type may create a temporary user on the system named `Lost_{Unique Identifier}` with the password `pond~!@6”{Unique Identifier}`.
MITRE ATT&CK techniques:
T1136.001
Threat description: Empire has a module for creating a new domain user if permissions allow.
MITRE ATT&CK techniques:
T1136.002
Threat description: LAPSUS$ has created global admin accounts in the targeted organization's cloud instances to gain persistence.
MITRE ATT&CK techniques:
T1136.003
Threat description: Ruler can be used to automate the abuse of Outlook Forms to establish persistence.
MITRE ATT&CK techniques:
T1137.003
Threat description: Ruler can be used to automate the abuse of Outlook Rules to establish persistence.
MITRE ATT&CK techniques:
T1137.005
Threat description: AppleJeus has decoded files received from a C2.
MITRE ATT&CK techniques:
T1140
Threat description: Avenger has the ability to decrypt files downloaded from C2.
MITRE ATT&CK techniques:
T1140
Threat description: BOOSTWRITE has used a a 32-byte long multi-XOR key to decode data inside its payload.
MITRE ATT&CK techniques:
T1140
Threat description: ComRAT has used unique per machine passwords to decrypt the orchestrator payload and a hardcoded XOR key to decrypt its communications module. ComRAT has also used a unique password to decrypt the file used for its hidden file system.
MITRE ATT&CK techniques:
T1140
Threat description: Conti has decrypted its payload using a hardcoded AES-256 key.
MITRE ATT&CK techniques:
T1140
Threat description: DropBook can unarchive data downloaded from the C2 to obtain the payload and persistence modules.
MITRE ATT&CK techniques:
T1140
Threat description: EnvyScout can deobfuscate and write malicious ISO files to disk.
MITRE ATT&CK techniques:
T1140
Threat description: FYAnti has the ability to decrypt an embedded .NET module.
MITRE ATT&CK techniques:
T1140
Threat description: FoggyWeb can be decrypted in memory using a Lightweight Encryption Algorithm (LEA)-128 key and decoded using a XOR key.
MITRE ATT&CK techniques:
T1140
Threat description: Frankenstein has deobfuscated base64-encoded commands following the execution of a malicious script, which revealed a small script designed to obtain an additional payload.
MITRE ATT&CK techniques:
T1140
Threat description: Gamaredon Group tools decrypted additional payloads from the C2. Gamaredon Group has also decoded base64-encoded source code of a downloader.
MITRE ATT&CK techniques:
T1140
Threat description: Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.
MITRE ATT&CK techniques:
T1140
Threat description: Grandoreiro can decrypt its encrypted internal strings.
MITRE ATT&CK techniques:
T1140
Threat description: HiddenWasp uses a cipher to implement a decoding function.
MITRE ATT&CK techniques:
T1140
Threat description: Higaisa used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.
MITRE ATT&CK techniques:
T1140
Threat description: HyperBro can unpack and decrypt its payload prior to execution.
MITRE ATT&CK techniques:
T1140
Threat description: ISMInjector uses the "certutil" command to decode a payload file.
MITRE ATT&CK techniques:
T1140
Threat description: Imminent Monitor has decoded malware components that are then dropped to the system.
MITRE ATT&CK techniques:
T1140
Threat description: Kimsuky has decoded malicious VBScripts using Base64.
MITRE ATT&CK techniques:
T1140
Threat description: Machete’s downloaded data is decrypted using AES.
MITRE ATT&CK techniques:
T1140
Threat description: MuddyWater decoded base64-encoded PowerShell commands using a VBS file.
MITRE ATT&CK techniques:
T1140
Threat description: NOKKI uses a unique, custom de-obfuscation technique.
MITRE ATT&CK techniques:
T1140
Threat description: PS1 can use an XOR key to decrypt a PowerShell loader and payload binary.
MITRE ATT&CK techniques:
T1140
Threat description: PipeMon can decrypt password-protected executables.
MITRE ATT&CK techniques:
T1140
Threat description: PowGoop can decrypt PowerShell scripts for execution.
MITRE ATT&CK techniques:
T1140
Threat description: PowerLess can use base64 and AES ECB decryption prior to execution of downloaded modules.
MITRE ATT&CK techniques:
T1140
Threat description: Remexi decrypts the configuration data using XOR with 25-character keys.
MITRE ATT&CK techniques:
T1140
Threat description: Rocke has extracted tar.gz files after downloading them from a C2 server.
MITRE ATT&CK techniques:
T1140
Threat description: SharpStage has decompressed data received from the C2 server.
MITRE ATT&CK techniques:
T1140
Threat description: SideTwist can decode and decrypt messages received from C2.
MITRE ATT&CK techniques:
T1140
Threat description: Starloader decrypts and executes shellcode from a file called Stars.jps.
MITRE ATT&CK techniques:
T1140
Threat description: The Winnti for Windows dropper can decrypt and decompresses a data blob.
MITRE ATT&CK techniques:
T1140
Threat description: Torisma has used XOR and Base64 to decode C2 data.
MITRE ATT&CK techniques:
T1140
Threat description: TrickBot decodes the configuration data and modules.
MITRE ATT&CK techniques:
T1140
Threat description: UNC2452 used 7-Zip to decode its Raindrop malware.
MITRE ATT&CK techniques:
T1140
Threat description: VERMIN decrypts code, strings, and commands to use once it's on the victim's machine.
MITRE ATT&CK techniques:
T1140
Threat description: Valak has the ability to decode and decrypt downloaded files.
MITRE ATT&CK techniques:
T1140
Threat description: YAHOYAH decrypts downloaded files before execution.
MITRE ATT&CK techniques:
T1140
Threat description: gh0st RAT has decrypted and loaded the gh0st RAT DLL into memory, once the initial dropper executable is launched.
MITRE ATT&CK techniques:
T1140
Threat description: Grandoreiro can use malicious browser extensions to steal cookies and other user information.
MITRE ATT&CK techniques:
T1176
Threat description: OSX/Shlayer can install malicious Safari browser extensions to serve ads.
MITRE ATT&CK techniques:
T1176
Threat description: Chaes has used the Puppeteer module to hook and monitor the Chrome web browser to collect user information from infected hosts.
MITRE ATT&CK techniques:
T1185
Threat description: IcedID has used web injection attacks to redirect victims to spoofed sites designed to harvest banking and other credentials.  IcedID can use a self signed TLS certificate in connection with the spoofed site and simultaneously maintains a live connection with the legitimate site to display the correct URL and certificates in the browser.
MITRE ATT&CK techniques:
T1185
Threat description: Dragonfly has performed forced authentication to gather hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems.
MITRE ATT&CK techniques:
T1187
Threat description: EnvyScout can use protocol handlers to coax the operating system to send NTLMv2 authentication responses to attacker-controlled infrastructure.
MITRE ATT&CK techniques:
T1187
Threat description: APT28 has compromised targets via strategic web compromise utilizing custom exploit kits.
MITRE ATT&CK techniques:
T1189
Threat description: Bad Rabbit spread through watering holes on popular sites by injecting JavaScript into the HTML body or a ".js" file.
MITRE ATT&CK techniques:
T1189
Threat description: During C0010, UNC3890 actors likely established a watering hole that was hosted on a login page of a legitimate Israeli shipping company that was active until at least November 2021.
MITRE ATT&CK techniques:
T1189
Threat description: PROMETHIUM has used watering hole attacks to deliver malicious versions of legitimate installers.
MITRE ATT&CK techniques:
T1189
Threat description: Blue Mockingbird has gained initial access by exploiting CVE-2019-18935, a vulnerability within Telerik UI for ASP.NET AJAX.
MITRE ATT&CK techniques:
T1190
Threat description: GOLD SOUTHFIELD has exploited Oracle WebLogic vulnerabilities for initial compromise.
MITRE ATT&CK techniques:
T1190
Threat description: Moses Staff has exploited known vulnerabilities in public-facing infrastructure such as Microsoft Exchange Servers.
MITRE ATT&CK techniques:
T1190
Threat description: Night Dragon has performed SQL injection attacks of extranet web servers to gain access.
MITRE ATT&CK techniques:
T1190
Threat description: UNC2452 exploited CVE-2020-0688 against the Microsoft Exchange Control Panel to regain access to a network.
MITRE ATT&CK techniques:
T1190
Threat description: CCBkdr was added to a legitimate, signed version 5.33 of the CCleaner software and distributed on CCleaner's distribution site.
MITRE ATT&CK techniques:
T1195.002
Threat description: APT41 used BITSAdmin to download and install payloads.
MITRE ATT&CK techniques:
T1197
Threat description: Tropic Trooper has leveraged the BITSadmin command-line tool to create a job and launch a malicious process.
MITRE ATT&CK techniques:
T1197
Threat description: DarkVishnya used Bash Bunny, Raspberry Pi, netbooks or inexpensive laptops to connect to the company’s local network.
MITRE ATT&CK techniques:
T1200
Threat description: Chimera has used the NtdsAudit utility to collect information related to accounts and passwords.
MITRE ATT&CK techniques:
T1201
Threat description: PoshC2 can use "Get-PassPol" to enumerate the domain password policy.
MITRE ATT&CK techniques:
T1201
Threat description: Revenge RAT uses the Forfiles utility to execute commands on the system.
MITRE ATT&CK techniques:
T1202
Threat description: Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.
MITRE ATT&CK techniques:
T1203
Threat description: Frankenstein has used CVE-2017-11882 to execute code on the victim's machine.
MITRE ATT&CK techniques:
T1203
Threat description: HAWKBALL has exploited Microsoft Office vulnerabilities CVE-2017-11882 and CVE-2018-0802 to deliver the payload.
MITRE ATT&CK techniques:
T1203
Threat description: Mustang Panda has exploited CVE-2017-0199 in Microsoft Word to execute code.
MITRE ATT&CK techniques:
T1203
Threat description: TA459 has exploited Microsoft Word vulnerability CVE-2017-0199 for execution.
MITRE ATT&CK techniques:
T1203
Threat description: APT3 has lured victims into clicking malicious links delivered through spearphishing.
MITRE ATT&CK techniques:
T1204.001
Threat description: AppleJeus's spearphishing links required user interaction to navigate to the malicious website.
MITRE ATT&CK techniques:
T1204.001
Threat description: Confucius has lured victims into clicking on a malicious link sent through spearphishing.
MITRE ATT&CK techniques:
T1204.001
Threat description: Ember Bear has attempted to lure users to click on a malicious link within a spearphishing email.
MITRE ATT&CK techniques:
T1204.001
Threat description: Evilnum has sent spearphishing emails designed to trick the recipient into opening malicious shortcut links which downloads a .LNK file.
MITRE ATT&CK techniques:
T1204.001
Threat description: GuLoader has relied upon users clicking on links to malicious documents.
MITRE ATT&CK techniques:
T1204.001
Threat description: Machete has has relied on users opening malicious links delivered through spearphishing to execute malware.
MITRE ATT&CK techniques:
T1204.001
Threat description: Molerats has sent malicious links via email trick users into opening a RAR archive and running an executable.
MITRE ATT&CK techniques:
T1204.001
Threat description: Night Dragon enticed users to click on links in spearphishing emails to download malware.
MITRE ATT&CK techniques:
T1204.001
Threat description: Patchwork has used spearphishing with links to try to get users to click, download and open malicious files.
MITRE ATT&CK techniques:
T1204.001
Threat description: Pony has attempted to lure targets into clicking links in spoofed emails from legitimate banks.
MITRE ATT&CK techniques:
T1204.001
Threat description: Saint Bot has relied on users to click on a malicious link delivered via a spearphishing.
MITRE ATT&CK techniques:
T1204.001
Threat description: APT12 has attempted to get victims to open malicious Microsoft Word and PDF attachment sent via spearphishing.
MITRE ATT&CK techniques:
T1204.002
Threat description: APT38  has attempted to lure victims into enabling malicious macros within email attachments.
MITRE ATT&CK techniques:
T1204.002
Threat description: Agent Tesla has been executed through malicious e-mail attachments
MITRE ATT&CK techniques:
T1204.002
Threat description: Cardinal RAT lures victims into executing malicious macros embedded within Microsoft Excel documents.
MITRE ATT&CK techniques:
T1204.002
Threat description: Confucius has lured victims to execute malicious attachments included in crafted spearphishing emails related to current topics.
MITRE ATT&CK techniques:
T1204.002
Threat description: DarkHydrus has sent malware that required users to hit the enable button in Microsoft Excel to allow an .iqy file to be downloaded.
MITRE ATT&CK techniques:
T1204.002
Threat description: Dridex has relied upon users clicking on a malicious attachment delivered through spearphishing.
MITRE ATT&CK techniques:
T1204.002
Threat description: EnvyScout has been executed through malicious files attached to e-mails.
MITRE ATT&CK techniques:
T1204.002
Threat description: FIN6 has used malicious documents to lure victims into allowing execution of PowerShell scripts.
MITRE ATT&CK techniques:
T1204.002
Threat description: Heyoka Backdoor has been spread through malicious document lures.
MITRE ATT&CK techniques:
T1204.002
Threat description: Higaisa used malicious e-mail attachments to lure victims into executing LNK files.
MITRE ATT&CK techniques:
T1204.002
Threat description: IndigoZebra sent spearphishing emails containing malicious attachments that urged recipients to review modifications in the file which would trigger the attack.
MITRE ATT&CK techniques:
T1204.002
Threat description: Indrik Spider has attempted to get users to click on a malicious zipped file.
MITRE ATT&CK techniques:
T1204.002
Threat description: JSS Loader has been executed through malicious attachments contained in spearphishing emails.
MITRE ATT&CK techniques:
T1204.002
Threat description: KGH_SPY has been spread through Word documents containing malicious macros.
MITRE ATT&CK techniques:
T1204.002
Threat description: Lazarus Group has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email.
MITRE ATT&CK techniques:
T1204.002
Threat description: LazyScripter has lured users to open malicious email attachments.
MITRE ATT&CK techniques:
T1204.002
Threat description: Nomadic Octopus as attempted to lure victims into clicking on malicious attachments within spearphishing emails.
MITRE ATT&CK techniques:
T1204.002
Threat description: Octopus has relied upon users clicking on a malicious attachment delivered through spearphishing.
MITRE ATT&CK techniques:
T1204.002
Threat description: Rancor attempted to get users to click on an embedded macro within a Microsoft Office Excel document to launch their malware.
MITRE ATT&CK techniques:
T1204.002
Threat description: Sidewinder has lured targets to click on malicious files to gain execution in the target environment.
MITRE ATT&CK techniques:
T1204.002
Threat description: Squirrelwaffle has relied on users enabling malicious macros within Microsoft Excel and Word attachments.
MITRE ATT&CK techniques:
T1204.002
Threat description: StrongPity has been executed via compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.
MITRE ATT&CK techniques:
T1204.002
Threat description: Taidoor has relied upon a victim to click on a malicious email attachment.
MITRE ATT&CK techniques:
T1204.002
Threat description: Umbreon provides additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet.
MITRE ATT&CK techniques:
T1205
Threat description: Mimikatz’s "LSADUMP::DCShadow" module can be used to make AD updates by temporarily setting a computer to be a DC.
MITRE ATT&CK techniques:
T1207
Threat description: Bad Rabbit used the EternalRomance SMB exploit to spread through victim networks.
MITRE ATT&CK techniques:
T1210
Threat description: FIN7 has exploited ZeroLogon (CVE-2020-1472) against vulnerable domain controllers.
MITRE ATT&CK techniques:
T1210
Threat description: Threat Group-3390 has exploited MS17-010 to move laterally to other systems on the network.
MITRE ATT&CK techniques:
T1210
Threat description: Tonto Team has used EternalBlue exploits for lateral movement.
MITRE ATT&CK techniques:
T1210
Threat description: WannaCry uses an exploit in SMBv1 to spread itself to other remote systems on a network.
MITRE ATT&CK techniques:
T1210
Threat description: menuPass has used tools to exploit the ZeroLogon vulnerability (CVE-2020-1472).
MITRE ATT&CK techniques:
T1210
Threat description: Turla has used a custom .NET tool to collect documents from an organization's internal central database.
MITRE ATT&CK techniques:
T1213
Threat description: LAPSUS$ has searched a victim's network for code repositories like GitLab and GitHub to discover further high-privilege account credentials.
MITRE ATT&CK techniques:
T1213.003
Threat description: Chimera has used "type \\<hostname>\c$\Users\<username>\Favorites\Links\Bookmarks bar\Imported From IE\*citrix*" for bookmark discovery.
MITRE ATT&CK techniques:
T1217
Threat description: DarkWatchman can retrieve browser history.
MITRE ATT&CK techniques:
T1217
Threat description: Lizar can retrieve browser history and database files.
MITRE ATT&CK techniques:
T1217
Threat description: SUGARDUMP has collected browser bookmark and history information.
MITRE ATT&CK techniques:
T1217
Threat description: Ember Bear has used control panel files (CPL), delivered via e-mail, for execution.
MITRE ATT&CK techniques:
T1218.002
Threat description: Mustang Panda has used "InstallUtil.exe" to execute a malicious Beacon stager.
MITRE ATT&CK techniques:
T1218.004
Threat description: Metamorfo has used mshta.exe to execute a HTA payload.
MITRE ATT&CK techniques:
T1218.005
Threat description: Mustang Panda has used mshta.exe to launch collection scripts.
MITRE ATT&CK techniques:
T1218.005
Threat description: POWERSTATS can use Mshta.exe to execute additional payloads on compromised hosts.
MITRE ATT&CK techniques:
T1218.005
Threat description: SideCopy has utilized `mshta.exe` to execute a malicious hta file.
MITRE ATT&CK techniques:
T1218.005
Threat description: Molerats has used msiexec.exe to execute an MSI payload.
MITRE ATT&CK techniques:
T1218.007
Threat description: RemoteUtilities can use Msiexec to install a service.
MITRE ATT&CK techniques:
T1218.007
Threat description: ZIRCONIUM has used the msiexec.exe command-line utility to download and execute malicious MSI files.
MITRE ATT&CK techniques:
T1218.007
Threat description: Deep Panda has used regsvr32.exe to execute a server variant of Derusbi in victim networks.
MITRE ATT&CK techniques:
T1218.010
Threat description: Hi-Zor executes using regsvr32.exe called from the Registry Run Keys / Startup Folder persistence mechanism.
MITRE ATT&CK techniques:
T1218.010
Threat description: Inception has ensured persistence at system boot by setting the value "regsvr32 %path%\ctfmonrn.dll /s".
MITRE ATT&CK techniques:
T1218.010
Threat description: Mori can use `regsvr32.exe` for DLL execution.
MITRE ATT&CK techniques:
T1218.010
Threat description: APT29 has used "Rundll32.exe" to execute payloads.
MITRE ATT&CK techniques:
T1218.011
Threat description: Bad Rabbit has used rundll32 to launch a malicious DLL as "C:Windowsinfpub.dat".
MITRE ATT&CK techniques:
T1218.011
Threat description: Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using rundll32.exe.
MITRE ATT&CK techniques:
T1218.011
Threat description: Bumblebee has used `rundll32` for execution of the loader component.
MITRE ATT&CK techniques:
T1218.011
Threat description: During C0015, the threat actors loaded DLLs via `rundll32` using the `svchost` process.
MITRE ATT&CK techniques:
T1218.011
Threat description: EnvyScout has the ability to proxy execution of malicious files with Rundll32.
MITRE ATT&CK techniques:
T1218.011
Threat description: FELIXROOT uses Rundll32 for executing the dropper program.
MITRE ATT&CK techniques:
T1218.011
Threat description: Gamaredon Group malware has used rundll32 to launch additional malicious components.
MITRE ATT&CK techniques:
T1218.011
Threat description: Kimsuky has used `rundll32.exe` to execute malicious scripts and malware on a victim's network.
MITRE ATT&CK techniques:
T1218.011
Threat description: LazyScripter has used `rundll32.exe` to execute Koadic stagers.
MITRE ATT&CK techniques:
T1218.011
Threat description: Matryoshka uses rundll32.exe in a Registry Run key value for execution as part of its persistence mechanism.
MITRE ATT&CK techniques:
T1218.011
Threat description: NativeZone has used rundll32 to execute a malicious DLL.
MITRE ATT&CK techniques:
T1218.011
Threat description: NotPetya uses "rundll32.exe" to install itself on remote systems when accessed via PsExec or "wmic".
MITRE ATT&CK techniques:
T1218.011
Threat description: SDBbot has used rundll32.exe to execute DLLs.
MITRE ATT&CK techniques:
T1218.011
Threat description: SUNBURST used Rundll32 to execute payloads.
MITRE ATT&CK techniques:
T1218.011
Threat description: The Winnti for Windows installer loads a DLL using rundll32.
MITRE ATT&CK techniques:
T1218.011
Threat description: UNC2452 used Rundll32 to execute payloads.
MITRE ATT&CK techniques:
T1218.011
Threat description: Cobalt Group used the Ammyy Admin tool as well as TeamViewer for remote access, including to preserve remote access if a Cobalt Strike module was lost.
MITRE ATT&CK techniques:
T1219
Threat description: DarkVishnya used DameWare Mini Remote Control for lateral movement.
MITRE ATT&CK techniques:
T1219
Threat description: GOLD SOUTHFIELD has used the cloud-based remote management and monitoring tool "ConnectWise Control" to deploy REvil.
MITRE ATT&CK techniques:
T1219
Threat description: Kimsuky has used a modified TeamViewer client as a command and control channel.
MITRE ATT&CK techniques:
T1219
Threat description: RTM has used a modified version of TeamViewer and Remote Utilities for remote access.
MITRE ATT&CK techniques:
T1219
Threat description: TrickBot uses vncDll module to remote control the victim machine.
MITRE ATT&CK techniques:
T1219
Threat description: Confucius has used a weaponized Microsoft Word document with an embedded RTF exploit.
MITRE ATT&CK techniques:
T1221
Threat description: Lazarus Group has used DOCX files to retrieve a malicious document template/DOTM file.
MITRE ATT&CK techniques:
T1221
Threat description: Ryuk can launch "icacls <path> /grant Everyone:F /T /C /Q" to delete every access-based restrictions on files and directories.
MITRE ATT&CK techniques:
T1222.001
Threat description: XCSSET uses the "chmod +x" command to grant executable permissions to the malicious file.
MITRE ATT&CK techniques:
T1222.002
Threat description: APT33 has used kill dates in their malware to guardrail execution.
MITRE ATT&CK techniques:
T1480
Threat description: PowerPunch can use the volume serial number from a target host to generate a unique XOR key for the next stage payload.
MITRE ATT&CK techniques:
T1480.001
Threat description: APT29 used the "Get-AcceptedDomain" PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell. They also used AdFind to enumerate domains and to discover trust between federated domains.
MITRE ATT&CK techniques:
T1482
Threat description: AdFind can gather information about organizational units (OUs) and domain trusts from Active Directory.
MITRE ATT&CK techniques:
T1482
Threat description: BloodHound has the ability to map domain trusts and identify misconfigurations for potential abuse.
MITRE ATT&CK techniques:
T1482
Threat description: Egregor can modify the GPO to evade detection.
MITRE ATT&CK techniques:
T1484.001
Threat description: Meteor can use group policy to push a scheduled task from the AD to all network machines.
MITRE ATT&CK techniques:
T1484.001
Threat description: APT29 changed domain federation trust settings using Azure AD administrative permissions to configure the domain to accept authorization tokens signed by their own SAML signing certificate.
MITRE ATT&CK techniques:
T1484.002
Threat description: KillDisk deletes system files to make the OS unbootable. KillDisk also targets and deletes files with 35 different file extensions.
MITRE ATT&CK techniques:
T1485
Threat description: Proxysvc can overwrite files indicated by the attacker before deleting them.
MITRE ATT&CK techniques:
T1485
Threat description: WhisperGate can corrupt files by overwriting the first 1 MB with `0xcc` and appending random extensions.
MITRE ATT&CK techniques:
T1485
Threat description: Xbash has destroyed Linux-based databases as part of its ransomware capabilities.
MITRE ATT&CK techniques:
T1485
Threat description: APT41 used a ransomware called Encryptor RaaS to encrypt files on the targeted systems and provide a ransom note to the user.
MITRE ATT&CK techniques:
T1486
Threat description: Babuk can use ChaCha8 and ECDH to encrypt data.
MITRE ATT&CK techniques:
T1486
Threat description: Bad Rabbit has encrypted files and disks using AES-128-CBC and RSA-2048.
MITRE ATT&CK techniques:
T1486
Threat description: DCSrv has encrypted drives using the core encryption mechanism from DiskCryptor.
MITRE ATT&CK techniques:
T1486
Threat description: During C0015, the threat actors used Conti ransomware to encrypt a compromised network.
MITRE ATT&CK techniques:
T1486
Threat description: ProLock can encrypt files on a compromised host with RC6, and encrypts the key with RSA-1024.
MITRE ATT&CK techniques:
T1486
Threat description: Ragnar Locker encrypts files on the local machine and mapped drives prior to displaying a note demanding a ransom.
MITRE ATT&CK techniques:
T1486
Threat description: Seth-Locker can encrypt files on a targeted system, appending them with the suffix .seth.
MITRE ATT&CK techniques:
T1486
Threat description: Clop can kill several processes and services related to backups and security solutions.
MITRE ATT&CK techniques:
T1489
Threat description: Cuba has a hardcoded list of services and processes to terminate.
MITRE ATT&CK techniques:
T1489
Threat description: EKANS stops database, data backup solution, antivirus, and ICS-related processes.
MITRE ATT&CK techniques:
T1489
Threat description: HotCroissant has the ability to stop services on the infected host.
MITRE ATT&CK techniques:
T1489
Threat description: Ryuk has called "kill.bat" for stopping services, disabling services and killing processes.
MITRE ATT&CK techniques:
T1489
Threat description: SLOTHFULMEDIA has the capability to stop processes and services.
MITRE ATT&CK techniques:
T1489
Threat description: Diavol can delete shadow copies using the `IVssBackupComponents` COM object to call the `DeleteSnapshots` method.
MITRE ATT&CK techniques:
T1490
Threat description: FIVEHANDS has the ability to delete volume shadow copies on compromised hosts.
MITRE ATT&CK techniques:
T1490
Threat description: HermeticWiper can disable the VSS service on a compromised host using the service control manager.
MITRE ATT&CK techniques:
T1490
Threat description: Maze has attempted to delete the shadow volumes of infected machines, once before and once after the encryption process.
MITRE ATT&CK techniques:
T1490
Threat description: Olympic Destroyer uses the native Windows utilities "vssadmin", "wbadmin", and "bcdedit" to delete and disable operating system recovery features such as the Windows backup catalog and Windows Automatic Repair.
MITRE ATT&CK techniques:
T1490
Threat description: Lazarus Group replaced the background wallpaper of systems with a threatening image after rendering the system unbootable with a Disk Structure Wipe.
MITRE ATT&CK techniques:
T1491.001
Threat description: Meteor can change both the desktop wallpaper and the lock screen image to a custom image.
MITRE ATT&CK techniques:
T1491.001
Threat description: Bonadan can download an additional module which has a cryptocurrency mining extension.
MITRE ATT&CK techniques:
T1496
Threat description: Bazar can attempt to overload sandbox analysis by sending 1550 calls to "printf".
MITRE ATT&CK techniques:
T1497
Threat description: Egregor has used multiple anti-analysis and anti-sandbox techniques to prevent automated analysis by sandboxes.
MITRE ATT&CK techniques:
T1497
Threat description: Hancitor has used a macro to check that an ActiveDocument shape object in the lure message is present. If this object is not found, the macro will exit without downloading additional payloads.
MITRE ATT&CK techniques:
T1497
Threat description: RTM can detect if it is running within a sandbox or other virtualized analysis environment.
MITRE ATT&CK techniques:
T1497
Threat description: StoneDrill has used several anti-emulation techniques to prevent automated analysis by emulators or sandboxes.
MITRE ATT&CK techniques:
T1497
Threat description: Astaroth can check for Windows product ID's used by sandboxes and usernames and disk serial numbers associated with analyst environments.
MITRE ATT&CK techniques:
T1497.001
Threat description: BLUELIGHT can check to see if the infected machine has VM tools running.
MITRE ATT&CK techniques:
T1497.001
Threat description: CSPY Downloader can search loaded modules, PEB structure, file paths, Registry keys, and memory to determine if it is being debugged or running in a virtual environment.
MITRE ATT&CK techniques:
T1497.001
Threat description: GravityRAT uses WMI to check the BIOS and manufacturer information for strings like "VMWare", "Virtual", and "XEN" and another WMI request to get the current temperature of the hardware to determine if it's a virtual machine environment.
MITRE ATT&CK techniques:
T1497.001
Threat description: P8RAT can check the compromised host for processes associated with VMware or VirtualBox environments.
MITRE ATT&CK techniques:
T1497.001
Threat description: SUNBURST checked the domain name of the compromised host to verify it was running in a real environment.
MITRE ATT&CK techniques:
T1497.001
Threat description: Saint Bot has run several virtual machine and sandbox checks, including checking if `Sbiedll.dll` is present in a list of loaded modules, comparing the machine name to `HAL9TH` and the user name to `JohnDoe`, and checking the BIOS version for known virtual machine identifiers.
MITRE ATT&CK techniques:
T1497.001
Threat description: Trojan.Karagany can detect commonly used and generic virtualization platforms based primarily on drivers and file paths.
MITRE ATT&CK techniques:
T1497.001
Threat description: Bumblebee has the ability to set a hardcoded and randomized sleep interval.
MITRE ATT&CK techniques:
T1497.003
Threat description: GoldMax has set an execution trigger date and time, stored as an ASCII Unix/Epoch time value.
MITRE ATT&CK techniques:
T1497.003
Threat description: GoldenSpy's installer has delayed installation of GoldenSpy for two hours after it reaches a victim system.
MITRE ATT&CK techniques:
T1497.003
Threat description: GuLoader has the ability to perform anti-debugging based on time checks, API calls, and CPUID.
MITRE ATT&CK techniques:
T1497.003
Threat description: Okrum's loader can detect presence of an emulator by using two calls to GetTickCount API, and checking whether the time has been accelerated.
MITRE ATT&CK techniques:
T1497.003
Threat description: StrifeWater can modify its sleep time responses from the default of 20-22 seconds.
MITRE ATT&CK techniques:
T1497.003
Threat description: Tomiris has the ability to sleep for at least nine minutes to evade sandbox-based analysis systems.
MITRE ATT&CK techniques:
T1497.003
Threat description: Ursnif has used a 30 minute delay after execution to evade sandbox monitoring tools.
MITRE ATT&CK techniques:
T1497.003
Threat description: Lucifer can execute TCP, UDP,  and HTTP denial of service (DoS) attacks.
MITRE ATT&CK techniques:
T1498
Threat description: Dragonfly 2.0 commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files.
MITRE ATT&CK techniques:
T1505.003
Threat description: Fox Kitten has installed web shells on compromised hosts to maintain access.
MITRE ATT&CK techniques:
T1505.003
Threat description: Magic Hound has used multiple web shells to gain execution.
MITRE ATT&CK techniques:
T1505.003
Threat description: Operation Wocao has used their own web shells, as well as those previously placed on target systems by other threat actors, for reconnaissance and lateral movement.
MITRE ATT&CK techniques:
T1505.003
Threat description: SEASHARPEE is a Web shell.
MITRE ATT&CK techniques:
T1505.003
Threat description: OwaAuth has been loaded onto Exchange servers and disguised as an ISAPI filter (owaauth.dll). The IIS w3wp.exe process then loads the malicious DLL.
MITRE ATT&CK techniques:
T1505.004
Threat description: BRONZE BUTLER has used tools to enumerate software installed on an infected host.
MITRE ATT&CK techniques:
T1518
Threat description: Bundlore has the ability to enumerate what browser is being used as well as version information for Safari.
MITRE ATT&CK techniques:
T1518
Threat description: Dyre has the ability to identify installed programs on a compromised host.
MITRE ATT&CK techniques:
T1518
Threat description: Mustang Panda has searched the victim system for the "InstallUtil.exe" program and its version.
MITRE ATT&CK techniques:
T1518
Threat description: Orz can gather the victim's Internet Explorer version.
MITRE ATT&CK techniques:
T1518
Threat description: SideCopy has collected browser information from a compromised host.
MITRE ATT&CK techniques:
T1518
Threat description: Sidewinder has used tools to enumerate software installed on an infected host.
MITRE ATT&CK techniques:
T1518
Threat description: A module in Prikormka collects information from the victim about installed anti-virus software.
MITRE ATT&CK techniques:
T1518.001
Threat description: Bumblebee can identify specific analytical tools based on running processes.
MITRE ATT&CK techniques:
T1518.001
Threat description: CookieMiner has checked for the presence of "Little Snitch", macOS network monitoring and application firewall software, stopping and exiting if it is found.
MITRE ATT&CK techniques:
T1518.001
T1562.004
Threat description: MoleNet can use WMI commands to check the system for firewall and antivirus software.
MITRE ATT&CK techniques:
T1518.001
Threat description: Mosquito's installer searches the Registry and system to see if specific antivirus tools are installed on the system.
MITRE ATT&CK techniques:
T1518.001
Threat description: Operation Wocao has used scripts to detect security software.
MITRE ATT&CK techniques:
T1518.001
Threat description: SpicyOmelette can check for the presence of 29 different antivirus tools.
MITRE ATT&CK techniques:
T1518.001
Threat description: StrongPity can identify if ESET or BitDefender antivirus are installed before dropping its payload.
MITRE ATT&CK techniques:
T1518.001
Threat description: XCSSET searches firewall configuration files located in "/Library/Preferences/" and uses "csrutil status" to determine if System Integrity Protection is enabled.
MITRE ATT&CK techniques:
T1518.001
Threat description: YAHOYAH checks for antimalware solution processes on the system.
MITRE ATT&CK techniques:
T1518.001
Threat description: build_downer has the ability to detect if the infected host is running an anti-virus process.
MITRE ATT&CK techniques:
T1518.001
Threat description: ROADTools can enumerate Azure AD applications and service principals.
MITRE ATT&CK techniques:
T1526
Threat description: HermeticWiper can initiate a system shutdown.
MITRE ATT&CK techniques:
T1529
Threat description: Lazarus Group has rebooted systems after destroying files and wiping the MBR on infected systems.
MITRE ATT&CK techniques:
T1529
Threat description: Maze has issued a shutdown command on a victim machine that, upon reboot, will run the ransomware within a VM.
MITRE ATT&CK techniques:
T1529
Threat description: Olympic Destroyer will shut down the compromised system after it is done modifying system configuration settings.
MITRE ATT&CK techniques:
T1529
Threat description: Shamoon will reboot the infected system once the wiping functionality has been completed.
MITRE ATT&CK techniques:
T1529
Threat description: WhisperGate can shutdown a compromised host through execution of `ExitWindowsEx` with the `EXW_SHUTDOWN` flag.
MITRE ATT&CK techniques:
T1529
Threat description: Fox Kitten has obtained files from the victim's cloud storage instances.
MITRE ATT&CK techniques:
T1530
Threat description: MegaCortex has changed user account passwords and logged users off the system.
MITRE ATT&CK techniques:
T1531
Threat description: Gamaredon Group has used an Outlook VBA module on infected systems to send phishing emails with malicious attachments to other employees within the organization.
MITRE ATT&CK techniques:
T1534
Threat description: TajMahal has the ability to steal web session cookies from Internet Explorer, Netscape Navigator, FireFox and RealNetworks applications.
MITRE ATT&CK techniques:
T1539
Threat description: WhisperGate overwrites the MBR with a bootloader component that performs destructive wiping operations on hard drives and displays a fake ransom note when the host boots.
MITRE ATT&CK techniques:
T1542.003
Threat description: Calisto adds a .plist file to the /Library/LaunchAgents folder to maintain persistence.
MITRE ATT&CK techniques:
T1543.001
Threat description: Dacls can establish persistence via a LaunchAgent.
MITRE ATT&CK techniques:
T1543.001