QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: PROMETHIUM has disguised malicious installer files by bundling them with legitimate software installers.
MITRE ATT&CK techniques:
T1036.005
Threat description: Pony has used the Adobe Reader icon for the downloaded file to look more trustworthy.
MITRE ATT&CK techniques:
T1036.005
Threat description: Ramsay has masqueraded as a 7zip installer.
MITRE ATT&CK techniques:
T1036.005
Threat description: Sibot has downloaded a DLL to the "C:\windows\system32\drivers\" folder and renamed it with a ".sys" extension.
MITRE ATT&CK techniques:
T1036.005
Threat description: SideCopy has used a legitimate DLL file name, `Duser.dll` to disguise a malicious remote access tool.
MITRE ATT&CK techniques:
T1036.005
Threat description: Small Sieve can use variations of Microsoft and Outlook spellings, such as "Microsift", in its file names to avoid detection.
MITRE ATT&CK techniques:
T1036.005
Threat description: Starloader has masqueraded as legitimate software update packages such as Adobe Acrobat Reader and Intel.
MITRE ATT&CK techniques:
T1036.005
Threat description: TEARDROP files had names that resembled legitimate Window file and directory names.
MITRE ATT&CK techniques:
T1036.005
Threat description: The Remsec loader implements itself with the name Security Support Provider, a legitimate Windows function. Various Remsec .exe files mimic legitimate file names used by Microsoft, Symantec, Kaspersky, Hewlett-Packard, and VMWare. Remsec also disguised malicious modules using similar filenames as custom network encryption software on victims.
MITRE ATT&CK techniques:
T1036.005
Threat description: Transparent Tribe can mimic legitimate Windows directories by using the same icons and names.
MITRE ATT&CK techniques:
T1036.005
Threat description: Rocke has installed an "init.d" startup script to maintain persistence.
MITRE ATT&CK techniques:
T1037
Threat description: JHUHUGIT has registered a Windows shell script under the Registry key "HKCU\Environment\UserInitMprLogonScript" to establish persistence.
MITRE ATT&CK techniques:
T1037.001
Threat description: HiddenWasp installs reboot persistence by adding itself to "/etc/rc.local".
MITRE ATT&CK techniques:
T1037.004
Threat description: iKitten adds an entry to the rc.common file for persistence.
MITRE ATT&CK techniques:
T1037.004
Threat description: BRONZE BUTLER has exfiltrated files stolen from file shares.
MITRE ATT&CK techniques:
T1039
Threat description: Regin appears to have functionality to sniff for credentials passed over HTTP, SMTP, and SMB.
MITRE ATT&CK techniques:
T1040
Threat description: Stolen Pencil has a tool to sniff the network for passwords.
MITRE ATT&CK techniques:
T1040
Threat description: ADVSTORESHELL exfiltrates data over the same channel used for C2.
MITRE ATT&CK techniques:
T1041
Threat description: Amadey has sent victim data to its C2 servers.
MITRE ATT&CK techniques:
T1041
Threat description: BLINDINGCAN has sent user and system information to a C2 server via HTTP POST requests.
MITRE ATT&CK techniques:
T1041
Threat description: BoxCaon uploads files and data from a compromised host over the existing C2 channel.
MITRE ATT&CK techniques:
T1041
Threat description: Carberp has exfiltrated data via HTTP to already established C2 servers.
MITRE ATT&CK techniques:
T1041
Threat description: Chrommme can exfiltrate collected data via C2.
MITRE ATT&CK techniques:
T1041
Threat description: During Operation Wocao, threat actors used the XServer backdoor to exfiltrate data.
MITRE ATT&CK techniques:
T1041
Threat description: GoldenSpy has exfiltrated host environment information to an external C2 domain via port 9006.
MITRE ATT&CK techniques:
T1041
Threat description: Goopy has the ability to exfiltrate data over the Microsoft Outlook C2 channel.
MITRE ATT&CK techniques:
T1041
Threat description: HAWKBALL has sent system information and files over the C2 channel.
MITRE ATT&CK techniques:
T1041
Threat description: Kevin can send data from the victim host through a DNS C2 channel.
MITRE ATT&CK techniques:
T1041
Threat description: Lazarus Group has exfiltrated data and files over a C2 channel through its various tools and malware.
MITRE ATT&CK techniques:
T1041
Threat description: Lokibot has the ability to initiate contact with command and control (C2) to exfiltrate stolen data.
MITRE ATT&CK techniques:
T1041
Threat description: NETEAGLE is capable of reading files over the C2 channel.
MITRE ATT&CK techniques:
T1041
Threat description: Penquin can execute the command code "do_upload" to send files to C2.
MITRE ATT&CK techniques:
T1041
Threat description: PingPull has the ability to exfiltrate stolen victim data through its C2 channel.
MITRE ATT&CK techniques:
T1041
Threat description: PowerShower has used a PowerShell document stealer module to pack and exfiltrate .txt, .pdf, .xls or .doc files smaller than 5MB that were modified during the past two days.
MITRE ATT&CK techniques:
T1041
Threat description: REvil can exfiltrate host and malware information to C2 servers.
MITRE ATT&CK techniques:
T1041
Threat description: SUGARDUMP has sent stolen credentials and other data to its C2 server.
MITRE ATT&CK techniques:
T1041
Threat description: Spark has exfiltrated data over the C2 channel.
MITRE ATT&CK techniques:
T1041
Threat description: Squirrelwaffle has exfiltrated victim data using HTTP POST requests to its C2 servers.
MITRE ATT&CK techniques:
T1041
Threat description: ThiefQuest exfiltrates targeted file extensions in the "/Users/" folder to the command and control server via unencrypted HTTP. Network packets contain a string with two pieces of information: a file path and the contents of the file in a base64 encoded string.
MITRE ATT&CK techniques:
T1041
Threat description: WarzoneRAT can send collected victim data to its C2 server.
MITRE ATT&CK techniques:
T1041
Threat description: Wizard Spider has exfiltrated domain credentials and network enumeration information over command and control (C2) channels.
MITRE ATT&CK techniques:
T1041
Threat description: ZIRCONIUM has exfiltrated files via the Dropbox API C2.
MITRE ATT&CK techniques:
T1041
Threat description: Zebrocy has exfiltrated data to the designated C2 server using HTTP POST requests.
MITRE ATT&CK techniques:
T1041
Threat description: APT41 used a malware variant called WIDETONE to conduct port scans on specified subnets.
MITRE ATT&CK techniques:
T1046
Threat description: BackdoorDiplomacy has used SMBTouch, a vulnerability scanner, to determine whether a target is vulnerable to EternalBlue malware.
MITRE ATT&CK techniques:
T1046
Threat description: Chimera has used the "get -b <start ip> -e <end ip> -p" command for network scanning as well as a custom Python tool  packed into a Windows executable named Get.exe to scan IP ranges for HTTP.
MITRE ATT&CK techniques:
T1046
Threat description: Fox Kitten has used tools including NMAP to conduct broad scanning to identify open ports.
MITRE ATT&CK techniques:
T1046
Threat description: Hildegard has used masscan to look for kubelets in the internal Kubernetes network.
MITRE ATT&CK techniques:
T1046
Threat description: Leafminer scanned network services to search for vulnerabilities in the victim system.
MITRE ATT&CK techniques:
T1046
Threat description: MURKYTOP has the capability to scan for open ports on hosts in a connected network.
MITRE ATT&CK techniques:
T1046
Threat description: P.A.S. Webshell can scan networks for open ports and listening services.
MITRE ATT&CK techniques:
T1046
Threat description: Remsec has a plugin that can perform ARP scanning as well as port scanning.
MITRE ATT&CK techniques:
T1046
Threat description: Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.
MITRE ATT&CK techniques:
T1046
Threat description: Tropic Trooper used "pr" and an openly available tool to scan for open ports on target systems.
MITRE ATT&CK techniques:
T1046
Threat description: APT34 has used WMI for execution.
MITRE ATT&CK techniques:
T1047
Threat description: Action RAT can use WMI to gather AV products installed on an infected host.
MITRE ATT&CK techniques:
T1047
Threat description: During FunnyDream, the threat actors used `wmiexec.vbs` to run remote commands.
MITRE ATT&CK techniques:
T1047
Threat description: FIVEHANDS can use WMI to delete files on a  target machine.
MITRE ATT&CK techniques:
T1047
Threat description: Leviathan has used WMI for execution.
MITRE ATT&CK techniques:
T1047
Threat description: Olympic Destroyer uses WMI to help propagate itself across a network.
MITRE ATT&CK techniques:
T1047
Threat description: Operation Wocao has used WMI to execute commands.
MITRE ATT&CK techniques:
T1047
Threat description: PoshC2 has a number of modules that use WMI to execute tasks.
MITRE ATT&CK techniques:
T1047
Threat description: PowerSploit's "Invoke-WmiCommand" CodeExecution module uses WMI to execute and retrieve the output from a PowerShell payload.
MITRE ATT&CK techniques:
T1047
Threat description: QakBot can execute WMI queries to gather information.
MITRE ATT&CK techniques:
T1047
Threat description: Sibot has used WMI to discover network connections and configurations. Sibot has also used the Win32_Process class to execute a malicious DLL.
MITRE ATT&CK techniques:
T1047
Threat description: Stealth Falcon malware gathers system information via Windows Management Instrumentation (WMI).
MITRE ATT&CK techniques:
T1047
Threat description: StoneDrill has used the WMI command-line (WMIC) utility to run tasks.
MITRE ATT&CK techniques:
T1047
Threat description: The Deep Panda group is known to utilize WMI for lateral movement.
MITRE ATT&CK techniques:
T1047
Threat description: The DustySky dropper uses Windows Management Instrumentation to extract information about the operating system and whether an anti-virus is active.
MITRE ATT&CK techniques:
T1047
Threat description: menuPass has used a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI.
MITRE ATT&CK techniques:
T1047
Threat description: Chaes has exfiltrated its collected data from the infected machine to the C2, sometimes using the MIME protocol.
MITRE ATT&CK techniques:
T1048
Threat description: TeamTNT has sent locally staged files with collected credentials to C2 servers using cURL.
MITRE ATT&CK techniques:
T1048
Threat description: Rclone can exfiltrate data over SFTP or HTTPS via WebDAV.
MITRE ATT&CK techniques:
T1048.002
Threat description: APT33 has used FTP to exfiltrate files (separately from the C2 channel).
MITRE ATT&CK techniques:
T1048.003
Threat description: KONNI has used FTP to exfiltrate reconnaissance data out.
MITRE ATT&CK techniques:
T1048.003
Threat description: APT1 used the "net use" command to get a listing on network connections.
MITRE ATT&CK techniques:
T1049
Threat description: APT3 has a tool that can enumerate current network connections.
MITRE ATT&CK techniques:
T1049
Threat description: (Event ID 1024) to obtain network information from RDP connections. Earth Lusca has also used netstat from a compromised system to obtain network connection information."
MITRE ATT&CK techniques:
T1049
Threat description: Flagpro has been used to execute "netstat -ano" on a compromised host.
MITRE ATT&CK techniques:
T1049
Threat description: GALLIUM used "netstat -oan" to obtain information about the victim network connections.
MITRE ATT&CK techniques:
T1049
Threat description: HEXANE has used netstat to monitor connections to specific ports.
MITRE ATT&CK techniques:
T1049
Threat description: MuddyWater has used a PowerShell backdoor to check for Skype connections on the target machine.
MITRE ATT&CK techniques:
T1049
Threat description: POWRUNER may collect active network connections by running "netstat -an" on a victim.
MITRE ATT&CK techniques:
T1049
Threat description: Remsec can obtain a list of active connections and open ports.
MITRE ATT&CK techniques:
T1049
Threat description: SpeakUp uses the "arp -a" command.
MITRE ATT&CK techniques:
T1049
Threat description: Turla surveys a system upon check-in to discover active local network connections using the "netstat -an", "net use", "net file", and "net session" commands. Turla RPC backdoors have also enumerated the IPv4 TCP connection table via the "GetTcpTable2" API call.
MITRE ATT&CK techniques:
T1049
Threat description: jRAT can list network connections.
MITRE ATT&CK techniques:
T1049
Threat description: StrifeWater has create a scheduled task named `Mozilla\Firefox Default Browser Agent 409046Z0FF4A39CB` for persistence.
MITRE ATT&CK techniques:
T1053
Threat description: Threat Group-3390 actors use at to schedule tasks to run self-extracting RAR archives, which install HTTPBrowser or PlugX on other victims on a network.
MITRE ATT&CK techniques:
T1053.002
Threat description: APT38 has used cron to create pre-scheduled and periodic background jobs on a Linux system.
MITRE ATT&CK techniques:
T1053.003
Threat description: Xbash can create a cronjob for persistence if it determines it is on a Linux system.
MITRE ATT&CK techniques:
T1053.003
Threat description: APT29 used "scheduler" and "schtasks" to create new tasks on remote hosts as part of lateral movement. They have manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration. APT29 also created a scheduled task to maintain SUNSPOT persistence when the host booted during the 2020 SolarWinds intrusion. They previously used named and hijacked scheduled tasks to also establish persistence.
MITRE ATT&CK techniques:
T1053.005
Threat description: APT38 has used Task Scheduler to run programs at system startup or on a scheduled basis for persistence.
MITRE ATT&CK techniques:
T1053.005
Threat description: Agent Tesla  has achieved persistence via scheduled tasks.
MITRE ATT&CK techniques:
T1053.005
Threat description: An APT3 downloader creates persistence by creating the following scheduled task: "schtasks /create /tn "mysc" /tr C:\Users\Public\test.exe /sc ONLOGON /ru "System"".
MITRE ATT&CK techniques:
T1053.005
Threat description: Bazar can create a scheduled task for persistence.
MITRE ATT&CK techniques:
T1053.005
Threat description: CSPY Downloader can use the schtasks utility to bypass UAC.
MITRE ATT&CK techniques:
T1053.005
Threat description: CosmicDuke uses scheduled tasks typically named "Watchmon Service" for persistence.
MITRE ATT&CK techniques:
T1053.005
Threat description: DarkWatchman has created a scheduled task for persistence.
MITRE ATT&CK techniques:
T1053.005
Threat description: During CostaRicto, the threat actors used scheduled tasks to download backdoor tools.
MITRE ATT&CK techniques:
T1053.005
Threat description: Dyre has the ability to achieve persistence by adding a new task in the task scheduler to run every minute.
MITRE ATT&CK techniques:
T1053.005
Threat description: Kimsuky has downloaded additional malware with scheduled tasks.
MITRE ATT&CK techniques:
T1053.005
Threat description: Lazarus Group has used "schtasks" for persistence including through the periodic execution of a remote XSL script or a dropped VBS payload.
MITRE ATT&CK techniques:
T1053.005
Threat description: Magic Hound has used scheduled tasks to establish persistence.
MITRE ATT&CK techniques:
T1053.005
Threat description: Matryoshka can establish persistence by adding a Scheduled Task named "Microsoft Boost Kernel Optimization".
MITRE ATT&CK techniques:
T1053.005
Threat description: Molerats has created scheduled tasks to persistently run VBScripts.
MITRE ATT&CK techniques:
T1053.005
Threat description: POWRUNER persists through a scheduled task that executes it every minute.
MITRE ATT&CK techniques:
T1053.005
Threat description: QuasarRAT contains a .NET wrapper DLL for creating and managing scheduled tasks for maintaining persistence upon reboot.
MITRE ATT&CK techniques:
T1053.005
Threat description: Shamoon copies an executable payload to the target system by using SMB/Windows Admin Shares and then scheduling an unnamed task to execute the malware.
MITRE ATT&CK techniques:
T1053.005
Threat description: Silence has used scheduled tasks to stage its operation.
MITRE ATT&CK techniques:
T1053.005
Threat description: The different components of Machete are executed by Windows Task Scheduler.
MITRE ATT&CK techniques:
T1053.005
Threat description: Valak has used scheduled tasks to execute additional payloads and to gain persistence on a compromised host.
MITRE ATT&CK techniques:
T1053.005
Threat description: Wizard Spider has used scheduled tasks establish persistence for TrickBot and other malware.
MITRE ATT&CK techniques:
T1053.005
Threat description: CostaBricks can inject a payload into the memory of a compromised host.
MITRE ATT&CK techniques:
T1055
Threat description: Dyre has the ability to directly inject its code into the web browser process.
MITRE ATT&CK techniques:
T1055
Threat description: Egregor can inject its payload into iexplore.exe process.
MITRE ATT&CK techniques:
T1055
Threat description: HTRAN can inject into into running processes.
MITRE ATT&CK techniques:
T1055
Threat description: HyperBro can run shellcode it injects into a newly created process.
MITRE ATT&CK techniques:
T1055
Threat description: Remcos has a command to hide itself through injecting into another process.
MITRE ATT&CK techniques:
T1055
Threat description: Ryuk has injected itself into remote processes to encrypt files using a combination of "VirtualAlloc", "WriteProcessMemory", and "CreateRemoteThread".
MITRE ATT&CK techniques:
T1055
Threat description: Sharpshooter has leveraged embedded shellcode to inject a downloader into the memory of Word.
MITRE ATT&CK techniques:
T1055
Threat description: Sliver can inject code into local and remote processes.
MITRE ATT&CK techniques:
T1055
Threat description: BackdoorDiplomacy has dropped legitimate software onto a compromised host and used it to execute malicious DLLs.
MITRE ATT&CK techniques:
T1055.001
Threat description: Conti has loaded an encrypted DLL into memory and then executes it.
MITRE ATT&CK techniques:
T1055.001
Threat description: FinFisher injects itself into various processes depending on whether it is low integrity or high integrity.
MITRE ATT&CK techniques:
T1055.001
Threat description: Heyoka Backdoor can inject a DLL into rundll32.exe for execution.
MITRE ATT&CK techniques:
T1055.001
Threat description: IronNetInjector has the ability to inject a DLL into running processes, including the IronNetInjector DLL into explorer.exe.
MITRE ATT&CK techniques:
T1055.001
Threat description: PowerSploit contains a collection of CodeExecution modules that inject code (DLL, shellcode) into a process.
MITRE ATT&CK techniques:
T1055.001
Threat description: Ramsay can use "ImprovedReflectiveDLLInjection" to deploy components.
MITRE ATT&CK techniques:
T1055.001
Threat description: TA505 has been seen injecting a DLL into winword.exe.
MITRE ATT&CK techniques:
T1055.001
Threat description: Gorgon Group malware can download a remote access tool, ShiftyBug, and inject into another process.
MITRE ATT&CK techniques:
T1055.002
Threat description: Ursnif has injected code into target processes via thread local storage callbacks.
MITRE ATT&CK techniques:
T1055.005
Threat description: A Patchwork payload uses process hollowing to hide the UAC bypass vulnerability exploitation inside svchost.exe.
MITRE ATT&CK techniques:
T1055.012
Threat description: Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code.
MITRE ATT&CK techniques:
T1055.012
Threat description: menuPass has used process hollowing in iexplore.exe to load the RedLeaves implant.
MITRE ATT&CK techniques:
T1055.012
Threat description: Kobalos has used a compromised SSH client to capture the hostname, port, username and password used to establish an SSH connection from the compromised host.
MITRE ATT&CK techniques:
T1056
Threat description: BabyShark has a PowerShell-based remote administration ability that can implement a PowerShell or C# based keylogger.
MITRE ATT&CK techniques:
T1056.001
Threat description: DOGCALL is capable of logging keystrokes.
MITRE ATT&CK techniques:
T1056.001
Threat description: InvisiMole can capture keystrokes on a compromised host.
MITRE ATT&CK techniques:
T1056.001
Threat description: Ke3chang has used keyloggers.
MITRE ATT&CK techniques:
T1056.001
Threat description: Machete logs keystrokes from the victim’s machine.
MITRE ATT&CK techniques:
T1056.001
Threat description: PowerLess can use a module to log keystrokes.
MITRE ATT&CK techniques:
T1056.001
Threat description: Proton uses a keylogger to capture keystrokes.
MITRE ATT&CK techniques:
T1056.001
Threat description: RCSession has the ability to capture keystrokes on a compromised host.
MITRE ATT&CK techniques:
T1056.001
Threat description: Revenge RAT has a plugin for keylogging.
MITRE ATT&CK techniques:
T1056.001
Threat description: Stolen Pencil has a tool to log keystrokes to %userprofile%\appdata\roaming\apach.{txt,log}.
MITRE ATT&CK techniques:
T1056.001
Threat description: When it first starts, BADNEWS spawns a new thread to log keystrokes.
MITRE ATT&CK techniques:
T1056.001
Threat description: gh0st RAT has a keylogger.
MITRE ATT&CK techniques:
T1056.001
Threat description: ADVSTORESHELL can list running processes.
MITRE ATT&CK techniques:
T1057
Threat description: APT3 has a tool that can list out currently running processes.
MITRE ATT&CK techniques:
T1057
Threat description: AppleSeed can enumerate the current process on a compromised host.
MITRE ATT&CK techniques:
T1057
Threat description: Bumblebee can identify processes associated with analytical tools.
MITRE ATT&CK techniques:
T1057
Threat description: CaddyWiper can obtain a list of current processes.
MITRE ATT&CK techniques:
T1057
Threat description: Cobalt Strike's Beacon payload can collect information on process details.
MITRE ATT&CK techniques:
T1057
Threat description: Cyclops Blink can enumerate the process it is currently running under.
MITRE ATT&CK techniques:
T1057
Threat description: DarkComet can list active processes running on the victim’s machine.
MITRE ATT&CK techniques:
T1057
Threat description: Deep Panda uses the Microsoft Tasklist utility to list processes running on systems.
MITRE ATT&CK techniques:
T1057
Threat description: During Frankenstein, the threat actors used Empire to obtain a list of all running processes.
MITRE ATT&CK techniques:
T1057
Threat description: During FunnyDream, the threat actors used Tasklist on targeted systems.
MITRE ATT&CK techniques:
T1057
Threat description: During Operation CuckooBees, the threat actors used the `tasklist` command as part of their advanced reconnaissance.
MITRE ATT&CK techniques:
T1057
Threat description: ELMER is capable of performing process listings.
MITRE ATT&CK techniques:
T1057
Threat description: FatDuke can list running processes on the localhost.
MITRE ATT&CK techniques:
T1057
Threat description: FinFisher checks its parent process for indications that it is running in a sandbox setup.
MITRE ATT&CK techniques:
T1057
Threat description: Final1stspy obtains a list of running processes.
MITRE ATT&CK techniques:
T1057
Threat description: GravityRAT lists the running processes on the system.
MITRE ATT&CK techniques:
T1057
Threat description: Kazuar obtains a list of running processes through WMI querying and the "ps" command.
MITRE ATT&CK techniques:
T1057
Threat description: Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.
MITRE ATT&CK techniques:
T1057
Threat description: MoonWind has a command to return a list of running processes.
MITRE ATT&CK techniques:
T1057
Threat description: Mustang Panda has used "tasklist /v" to determine active process information.
MITRE ATT&CK techniques:
T1057
Threat description: NETEAGLE can send process listings over the C2 channel.
MITRE ATT&CK techniques:
T1057
Threat description: PowerShower has the ability to deploy a reconnaissance module to retrieve a list of the active processes.
MITRE ATT&CK techniques:
T1057
Threat description: PowerStallion has been used to monitor process lists.
MITRE ATT&CK techniques:
T1057
Threat description: Remsec can obtain a process list from the victim.
MITRE ATT&CK techniques:
T1057
Threat description: StreamEx has the ability to enumerate processes.
MITRE ATT&CK techniques:
T1057
Threat description: Taidoor can use "GetCurrentProcessId" for process discovery.
MITRE ATT&CK techniques:
T1057
Threat description: Turla surveys a system upon check-in to discover running processes using the "tasklist /v" command. Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.
MITRE ATT&CK techniques:
T1057
Threat description: Volgmer can gather a list of processes.
MITRE ATT&CK techniques:
T1057
Threat description: jRAT can query and kill system processes.
MITRE ATT&CK techniques:
T1057
Threat description: APT1 has used the Windows command shell to execute commands.
MITRE ATT&CK techniques:
T1059
Threat description: FELIXROOT opens a remote shell to execute commands on the infected system.
MITRE ATT&CK techniques:
T1059
Threat description: FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.
MITRE ATT&CK techniques:
T1059
T1119
Threat description: FIN8 executes commands remotely via cmd.exe.
MITRE ATT&CK techniques:
T1059
Threat description: APT3 has used PowerShell on victim systems to download and run payloads after exploitation.
MITRE ATT&CK techniques:
T1059.001
Threat description: APT39 has used PowerShell to execute malicious code.
MITRE ATT&CK techniques:
T1059.001
Threat description: BONDUPDATER is written in PowerShell.
MITRE ATT&CK techniques:
T1059.001
Threat description: Confucius has used PowerShell to execute malicious files and payloads.
MITRE ATT&CK techniques:
T1059.001
Threat description: CopyKittens has used PowerShell Empire.
MITRE ATT&CK techniques:
T1059.001
Threat description: CreepyDrive can use Powershell for execution, including the cmdlets `Invoke-WebRequest` and `Invoke-Expression`.
MITRE ATT&CK techniques:
T1059.001
Threat description: DarkHydrus leveraged PowerShell to download and execute additional scripts for execution.
MITRE ATT&CK techniques:
T1059.001
Threat description: GRIFFON has used PowerShell to execute the Meterpreter downloader TinyMet.
MITRE ATT&CK techniques:
T1059.001
Threat description: Gallmaker used PowerShell to download additional payloads and for execution.
MITRE ATT&CK techniques:
T1059.001
Threat description: HALFBAKED can execute PowerShell scripts.
MITRE ATT&CK techniques:
T1059.001
Threat description: Hancitor has used PowerShell to execute commands.
MITRE ATT&CK techniques:
T1059.001
Threat description: KGH_SPY can execute PowerShell commands on the victim's machine.
MITRE ATT&CK techniques:
T1059.001
Threat description: Lazarus Group has used Powershell to download malicious payloads.
MITRE ATT&CK techniques:
T1059.001
Threat description: Molerats used PowerShell implants on target machines.
MITRE ATT&CK techniques:
T1059.001
Threat description: Operation Wocao has used PowerShell on compromised systems.
MITRE ATT&CK techniques:
T1059.001
Threat description: Revenge RAT uses the PowerShell command "Reflection.Assembly" to load itself into memory to aid in execution.
MITRE ATT&CK techniques:
T1059.001
Threat description: SILENTTRINITY can use PowerShell to execute commands.
MITRE ATT&CK techniques:
T1059.001
Threat description: Saint Bot has used PowerShell for execution.
MITRE ATT&CK techniques:
T1059.001
Threat description: Squirrelwaffle has used PowerShell to execute its payload.
MITRE ATT&CK techniques:
T1059.001
Threat description: TA505 has used PowerShell to download and execute malware and reconnaissance scripts.
MITRE ATT&CK techniques:
T1059.001
Threat description: TeamTNT has executed PowerShell commands in batch scripts.
MITRE ATT&CK techniques:
T1059.001
Threat description: Valak has used PowerShell to download additional modules.
MITRE ATT&CK techniques:
T1059.001
Threat description: menuPass uses PowerSploit to inject shellcode into PowerShell.
MITRE ATT&CK techniques:
T1059.001
Threat description: Dok uses AppleScript to create a login item for persistence.
MITRE ATT&CK techniques:
T1059.002
Threat description: A module in CozyCar allows arbitrary commands to be executed by invoking "C:\Windows\System32\cmd.exe".
MITRE ATT&CK techniques:
T1059.003
Threat description: APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution.
MITRE ATT&CK techniques:
T1059.003
Threat description: An APT3 downloader uses the Windows command ""cmd.exe" /C whoami". The group also uses a tool to execute commands on remote computers.
MITRE ATT&CK techniques:
T1059.003
Threat description: BBK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.
MITRE ATT&CK techniques:
T1059.003
Threat description: Bisonal has launched cmd.exe and used the ShellExecuteW() API function to execute commands on the system.
MITRE ATT&CK techniques:
T1059.003
Threat description: Blue Mockingbird has used batch script files to automate execution and deployment of payloads.
MITRE ATT&CK techniques:
T1059.003
Threat description: Caterpillar WebShell can run commands on the compromised asset with CMD functions.
MITRE ATT&CK techniques:
T1059.003
Threat description: Chimera has used the Windows Command Shell and batch scripts for execution on compromised hosts.
MITRE ATT&CK techniques:
T1059.003
Threat description: Comnie executes BAT scripts.
MITRE ATT&CK techniques:
T1059.003
Threat description: Daserf can execute shell commands.
MITRE ATT&CK techniques:
T1059.003
Threat description: DropBook can execute arbitrary shell commands on the victims' machines.
MITRE ATT&CK techniques:
T1059.003
Threat description: Egregor has used batch files for execution and can launch Internet Explorer from cmd.exe.
MITRE ATT&CK techniques:
T1059.003
Threat description: FELIXROOT executes batch scripts on the victim’s machine, and can launch a reverse shell for command execution.
MITRE ATT&CK techniques:
T1059.003
Threat description: HARDRAIN uses cmd.exe to execute "netsh"commands.
MITRE ATT&CK techniques:
T1059.003
Threat description: HermeticWiper can use `cmd.exe /Q/c move CSIDL_SYSTEM_DRIVE\temp\sys.tmp1 CSIDL_WINDOWS\policydefinitions\postgresql.exe 1> \\127.0.0.1\ADMIN$\_1636727589.6007507 2>&1` to deploy on an infected system.
MITRE ATT&CK techniques:
T1059.003
Threat description: InvisiMole can launch a remote shell to execute commands.
MITRE ATT&CK techniques:
T1059.003
Threat description: JCry has used "cmd.exe" to launch PowerShell.
MITRE ATT&CK techniques:
T1059.003
Threat description: Kevin can use a renamed image of `cmd.exe` for execution.
MITRE ATT&CK techniques:
T1059.003
Threat description: KeyBoy can launch interactive shells for communicating with the victim machine.
MITRE ATT&CK techniques:
T1059.003
Threat description: Lazarus Group malware uses cmd.exe to execute commands on a compromised host. A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.
MITRE ATT&CK techniques:
T1059.003
Threat description: MCMD can launch a console process (cmd.exe) with redirected standard input and output.
MITRE ATT&CK techniques:
T1059.003
Threat description: MarkiRAT can utilize cmd.exe to execute commands in a victim's environment.
MITRE ATT&CK techniques:
T1059.003
Threat description: MoleNet can execute commands via the command line utility.
MITRE ATT&CK techniques:
T1059.003
Threat description: MuddyWater has used a custom tool for creating reverse shells.
MITRE ATT&CK techniques:
T1059.003
Threat description: NETEAGLE allows adversaries to execute shell commands on the infected host.
MITRE ATT&CK techniques:
T1059.003
Threat description: NavRAT leverages cmd.exe to perform discovery techniques. NavRAT loads malicious shellcode and executes it in memory.
MITRE ATT&CK techniques:
T1059.003
Threat description: PLAINTEE uses cmd.exe to execute commands on the victim’s machine.
MITRE ATT&CK techniques:
T1059.003
Threat description: PoisonIvy creates a backdoor through which remote attackers can open a command-line interface.
MITRE ATT&CK techniques:
T1059.003
Threat description: Pony has used batch scripts to delete itself after execution.
MITRE ATT&CK techniques:
T1059.003
Threat description: Remexi silently executes received commands with cmd.exe.
MITRE ATT&CK techniques:
T1059.003
Threat description: RogueRobin uses Windows Script Components.
MITRE ATT&CK techniques:
T1059.003
Threat description: SILENTTRINITY can use `cmd.exe` to enable lateral movement using DCOM.
MITRE ATT&CK techniques:
T1059.003
Threat description: SLOTHFULMEDIA can open a command line to execute commands.
MITRE ATT&CK techniques:
T1059.003
Threat description: ServHelper can execute shell commands against cmd.
MITRE ATT&CK techniques:
T1059.003
Threat description: Silence has used Windows command-line to run commands.
MITRE ATT&CK techniques:
T1059.003
Threat description: Siloscape can run cmd through an IRC channel.
MITRE ATT&CK techniques:
T1059.003
Threat description: Sowbug has used command line during its intrusions.
MITRE ATT&CK techniques:
T1059.003
Threat description: Spark can use cmd.exe to run commands.
MITRE ATT&CK techniques:
T1059.003
Threat description: Squirrelwaffle has used `cmd.exe` for execution.
MITRE ATT&CK techniques:
T1059.003
Threat description: StrifeWater can execute shell commands using `cmd.exe`.
MITRE ATT&CK techniques:
T1059.003
Threat description: TSCookie has the ability to execute shell commands on the infected host.
MITRE ATT&CK techniques:
T1059.003
Threat description: TURNEDUP is capable of creating a reverse shell.
MITRE ATT&CK techniques:
T1059.003
Threat description: Turla RPC backdoors have used cmd.exe to execute commands.
MITRE ATT&CK techniques:
T1059.003
Threat description: WastedLocker has used cmd to execute commands on the system.
MITRE ATT&CK techniques:
T1059.003
Threat description: WhisperGate can use `cmd.exe` to execute commands.
MITRE ATT&CK techniques:
T1059.003
Threat description: APT41 executed "file /bin/pwd" in activity exploiting CVE-2019-19781 against Citrix devices.
MITRE ATT&CK techniques:
T1059.004
Threat description: Derusbi is capable of creating a remote Bash shell and executing commands.
MITRE ATT&CK techniques:
T1059.004
Threat description: Green Lambert can use shell scripts for execution, such as "/bin/sh -c".
MITRE ATT&CK techniques:
T1059.004
Threat description: Hildegard has used shell scripts for execution.
MITRE ATT&CK techniques:
T1059.004
Threat description: Kazuar uses /bin/bash to execute commands on the victim’s machine.
MITRE ATT&CK techniques:
T1059.004
Threat description: OSX_OCEANLOTUS.D uses a shell script as the main executable inside an app bundle and drops an embedded base64-encoded payload to the "/tmp" folder.
MITRE ATT&CK techniques:
T1059.004
Threat description: Turian has the ability to use "/bin/sh" to execute commands.
MITRE ATT&CK techniques:
T1059.004
Threat description: WindTail can use the "open" command to execute an application.
MITRE ATT&CK techniques:
T1059.004
Threat description: APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.
MITRE ATT&CK techniques:
T1059.005
Threat description: APT32 has used macros, COM scriptlets, and VBS scripts.
MITRE ATT&CK techniques:
T1059.005
Threat description: Bandook has used malicious VBA code against the target system.
MITRE ATT&CK techniques:
T1059.005
Threat description: Comnie executes VBS scripts.
MITRE ATT&CK techniques:
T1059.005
Threat description: During FunnyDream, the threat actors used a Visual Basic script to run remote commands.
MITRE ATT&CK techniques:
T1059.005
Threat description: During Operation Wocao, threat actors used VBScript to conduct reconnaissance on targeted systems.
MITRE ATT&CK techniques:
T1059.005
Threat description: Exaramel for Windows has a command to execute VBS scripts on the victim’s machine.
MITRE ATT&CK techniques:
T1059.005
Threat description: For C0011, Transparent Tribe used malicious VBA macros within a lure document as part of the Crimson malware installation process onto a compromised host.
MITRE ATT&CK techniques:
T1059.005
Threat description: Gorgon Group has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines.
MITRE ATT&CK techniques:
T1059.005
Threat description: HEXANE has used a VisualBasic script named `MicrosoftUpdator.vbs` for execution of a PowerShell keylogger.
MITRE ATT&CK techniques:
T1059.005
Threat description: Higaisa has used VBScript code on the victim's machine.
MITRE ATT&CK techniques:
T1059.005
Threat description: Kerrdown can use a VBS base64 decoder function published by Motobit.
MITRE ATT&CK techniques:
T1059.005
Threat description: KeyBoy uses VBS scripts for installing files and performing execution.
MITRE ATT&CK techniques:
T1059.005
Threat description: Leviathan has used VBScript.
MITRE ATT&CK techniques:
T1059.005
Threat description: Mustang Panda has embedded VBScript components in LNK files to download additional files and automate collection.
MITRE ATT&CK techniques:
T1059.005
Threat description: PoetRAT has used Word documents with VBScripts to execute malicious activities.
MITRE ATT&CK techniques:
T1059.005
Threat description: PowerShower has the ability to save and execute VBScript.
MITRE ATT&CK techniques:
T1059.005
Threat description: QakBot can use VBS to download and execute malicious files.
MITRE ATT&CK techniques:
T1059.005
Threat description: ROKRAT has used Visual Basic for execution.
MITRE ATT&CK techniques:
T1059.005
Threat description: STARWHALE can use the VBScript function `GetRef` as part of its persistence mechanism.
MITRE ATT&CK techniques:
T1059.005
Threat description: Sharpshooter's first-stage downloader was a VBA macro.
MITRE ATT&CK techniques:
T1059.005
Threat description: SideCopy has sent Microsoft Office Publisher documents to victims that have embedded malicious macros that execute an hta file via calling `mshta.exe`.
MITRE ATT&CK techniques:
T1059.005
Threat description: Xbash can execute malicious VBScript payloads on the victim’s machine.
MITRE ATT&CK techniques:
T1059.005
Threat description: Bandook can support commands to execute Python-based payloads.
MITRE ATT&CK techniques:
T1059.006
Threat description: Chaes has used Python scripts for execution and the installation of additional files.
MITRE ATT&CK techniques:
T1059.006
Threat description: Donut can generate shellcode outputs that execute via Python.
MITRE ATT&CK techniques:
T1059.006
Threat description: Earth Lusca used Python scripts for port scanning or building reverse shells.
MITRE ATT&CK techniques:
T1059.006
Threat description: Ebury has used Python to implement its DGA.
MITRE ATT&CK techniques:
T1059.006
Threat description: Kimsuky has used a macOS Python implant to gather data as well as MailFetcher.py code to automatically collect email data.
MITRE ATT&CK techniques:
T1059.006
Threat description: Machete is written in Python and is used in conjunction with additional Python scripts.
MITRE ATT&CK techniques:
T1059.006
Threat description: FIN7 used JavaScript scripts to help perform tasks on the victim's machine.
MITRE ATT&CK techniques:
T1059.007
Threat description: GRIFFON is written in and executed as JavaScript.
MITRE ATT&CK techniques:
T1059.007
Threat description: Higaisa used JavaScript to execute additional files.
MITRE ATT&CK techniques:
T1059.007
Threat description: InvisiMole can use a JavaScript file as part of its execution chain.
MITRE ATT&CK techniques:
T1059.007
Threat description: Cobalt Group has used exploits to increase their levels of rights and privileges.
MITRE ATT&CK techniques:
T1068
Threat description: Cobalt Strike can exploit vulnerabilities such as MS14-058.
MITRE ATT&CK techniques:
T1068
Threat description: CosmicDuke attempts to exploit privilege escalation vulnerabilities CVE-2010-0232 or CVE-2010-4398.
MITRE ATT&CK techniques:
T1068
Threat description: FIN6 has used tools to exploit Windows vulnerabilities in order to escalate privileges. The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.
MITRE ATT&CK techniques:
T1068
Threat description: Flame can use MS10-061 to exploit a print spooler vulnerability in a remote system with a shared printer in order to move laterally.
MITRE ATT&CK techniques:
T1068
T1210
Threat description: Remsec has a plugin to drop and execute vulnerable Outpost Sandbox or avast! Virtualization drivers in order to gain kernel mode privileges.
MITRE ATT&CK techniques:
T1068
Threat description: Stuxnet used MS10-073 and an undisclosed Task Scheduler vulnerability to escalate privileges on local Windows machines.
MITRE ATT&CK techniques:
T1068
Threat description: Carbon uses the "net group" command.
MITRE ATT&CK techniques:
T1069
Threat description: ShimRatReporter gathered the local privileges for the infected host.
MITRE ATT&CK techniques:
T1069
Threat description: Siloscape checks for Kubernetes node permissions.
MITRE ATT&CK techniques:
T1069
Threat description: BloodHound can collect information about local groups and members.
MITRE ATT&CK techniques:
T1069.001
Threat description: FlawedAmmyy enumerates the privilege level of the victim during the initial infection.
MITRE ATT&CK techniques:
T1069.001
Threat description: HEXANE has run `net localgroup` to enumerate local groups.
MITRE ATT&CK techniques:
T1069.001
Threat description: Operation Wocao has used the command "net localgroup administrators" to list all administrators part of a local group.
MITRE ATT&CK techniques:
T1069.001
Threat description: Sys10 collects the group name of the logged-in user and sends it to the C2.
MITRE ATT&CK techniques:
T1069.001
Threat description: Dragonfly has used batch scripts to enumerate administrators and users in the domain.
MITRE ATT&CK techniques:
T1069.002
Threat description: FIN6 has used tools like Adfind to query users, groups, organizational units, and trusts.
MITRE ATT&CK techniques:
T1069.002
Threat description: GRIFFON has used a reconnaissance module that can be used to retrieve Windows domain membership information.
MITRE ATT&CK techniques:
T1069.002
Threat description: OilRig has used "net group /domain", "net group “domain admins” /domain", and "net group “Exchange Trusted Subsystem” /domain" to find domain group permission settings.
MITRE ATT&CK techniques:
T1069.002
Threat description: POWRUNER may collect domain group information by running "net group /domain" or a series of other commands on a victim.
MITRE ATT&CK techniques:
T1069.002
Threat description: FunnyDream has the ability to clean traces of malware deployment.
MITRE ATT&CK techniques:
T1070
Threat description: SUNBURST removed HTTP proxy registry values to clean up traces of execution.
MITRE ATT&CK techniques:
T1070
Threat description: Stuxnet can delete OLE Automation and SQL stored procedures used to store malicious payloads.
MITRE ATT&CK techniques:
T1070
Threat description: Stuxnet removes itself from the system through a DLL export by deleting specific files and stored procedures.
MITRE ATT&CK techniques:
T1070
Threat description: Zeus Panda can uninstall scripts and delete files to cover its track.
MITRE ATT&CK techniques:
T1070
Threat description: SynAck clears event logs.
MITRE ATT&CK techniques:
T1070.001
Threat description: Wevtutil can be used to clear system and security event logs from the system.
MITRE ATT&CK techniques:
T1070.001
Threat description: gh0st RAT is able to wipe event logs.
MITRE ATT&CK techniques:
T1070.001
Threat description: Rocke has cleared log files within the /var/log/ folder.
MITRE ATT&CK techniques:
T1070.002
Threat description: menuPass has used Wevtutil to remove PowerShell execution logs.
MITRE ATT&CK techniques:
T1070.003
Threat description: APT41 deleted files from the system.
MITRE ATT&CK techniques:
T1070.004
Threat description: AppleSeed can delete files from a compromised host after they are exfiltrated.
MITRE ATT&CK techniques:
T1070.004
Threat description: BLACKCOFFEE has the capability to delete files.
MITRE ATT&CK techniques:
T1070.004
Threat description: BackConfig has the ability to remove files and folders related to previous infections.
MITRE ATT&CK techniques:
T1070.004
Threat description: Bazar can delete its loader using a batch file in the Windows temporary folder.
MITRE ATT&CK techniques:
T1070.004
Threat description: Bisonal will delete its dropper and VBS scripts from the victim’s machine.
MITRE ATT&CK techniques:
T1070.004
Threat description: Cobalt Group deleted the DLL dropper from the victim’s machine to cover their tracks.
MITRE ATT&CK techniques:
T1070.004
Threat description: Cryptoistic has the ability delete files from a compromised host.
MITRE ATT&CK techniques:
T1070.004
Threat description: Denis has a command to delete files from the victim’s machine.
MITRE ATT&CK techniques:
T1070.004
Threat description: Derusbi is capable of deleting files. It has been observed loading a Linux Kernel Module (LKM) and then deleting it from the hard disk as well as overwriting the data with null bytes.
MITRE ATT&CK techniques:
T1070.004
Threat description: Elise is capable of launching a remote shell on the host to delete itself.
MITRE ATT&CK techniques:
T1070.004
Threat description: Epic has a command to delete a file from the machine.
MITRE ATT&CK techniques:
T1070.004
Threat description: FunnyDream can delete files including its dropper component.
MITRE ATT&CK techniques:
T1070.004
Threat description: HTTPBrowser deletes its original installer file once installation is complete.
MITRE ATT&CK techniques:
T1070.004
Threat description: Honeybee removes batch files to reduce fingerprint on the system as well as deletes the CAB file that gets encoded upon infection.
MITRE ATT&CK techniques:
T1070.004
Threat description: Kazuar can delete files.
MITRE ATT&CK techniques:
T1070.004
Threat description: LoudMiner deleted installation files after completion.
MITRE ATT&CK techniques:
T1070.004
Threat description: OopsIE has the capability to delete files and scripts from the victim's machine.
MITRE ATT&CK techniques:
T1070.004
Threat description: POWERSTATS can delete all files on the C:\, D:\, E:\ and, F:\ drives using PowerShell Remove-Item commands.
MITRE ATT&CK techniques:
T1070.004
Threat description: Pillowmint has deleted the filepath "%APPDATA%\Intel\devmonsrv.exe".
MITRE ATT&CK techniques:
T1070.004
Threat description: PowerDuke has a command to write random data across a file and delete it.
MITRE ATT&CK techniques:
T1070.004
T1485
Threat description: PowerShower has the ability to remove all files created during the dropper process.
MITRE ATT&CK techniques:
T1070.004
Threat description: Proxysvc can delete files indicated by the attacker and remove itself from disk using a batch file.
MITRE ATT&CK techniques:
T1070.004
Threat description: SDelete deletes data in a way that makes it unrecoverable.
MITRE ATT&CK techniques:
T1070.004
T1485
Threat description: SUNBURST had a command to delete files.
MITRE ATT&CK techniques:
T1070.004
Threat description: StrongPity can delete previously exfiltrated files from the compromised host.
MITRE ATT&CK techniques:
T1070.004
Threat description: The White Company has the ability to delete its malware entirely from the target system.
MITRE ATT&CK techniques:
T1070.004
Threat description: WINDSHIELD is capable of file deletion along with other file system interaction.
MITRE ATT&CK techniques:
T1070.004
Threat description: WindTail has the ability to receive and execute a self-delete command.
MITRE ATT&CK techniques:
T1070.004
Threat description: APT28 has performed timestomping on victim files.
MITRE ATT&CK techniques:
T1070.006
Threat description: PingPull has the ability to timestomp a file.
MITRE ATT&CK techniques:
T1070.006
Threat description: USBStealer sets the timestamps of its dropper files to the last-access and last-write timestamps of a standard Windows library chosen on the system.
MITRE ATT&CK techniques:
T1070.006
Threat description: KOCTOPUS can delete created registry keys used for persistence as part of its cleanup procedure.
MITRE ATT&CK techniques:
T1070.009
Threat description: Clambling has the ability to use Telnet for communication.
MITRE ATT&CK techniques:
T1071
Threat description: Cobalt Strike can conduct peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.
MITRE ATT&CK techniques:
T1071
Threat description: Dragonfly 2.0 used SMB for C2.
MITRE ATT&CK techniques:
T1071