QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: Hildegard has used an IRC channel for C2 communications.
MITRE ATT&CK techniques:
T1071
Threat description: A PingPull variant can communicate with its C2 servers by using HTTPS.
MITRE ATT&CK techniques:
T1071.001
Threat description: APT18 uses HTTP for C2 communications.
MITRE ATT&CK techniques:
T1071.001
Threat description: Aria-body has used HTTP in C2 communications.
MITRE ATT&CK techniques:
T1071.001
Threat description: BBK has the ability to use HTTP in communications with C2.
MITRE ATT&CK techniques:
T1071.001
Threat description: Bankshot uses HTTP for command and control communication.
MITRE ATT&CK techniques:
T1071.001
Threat description: China Chopper's server component executes code sent via HTTP POST commands.
MITRE ATT&CK techniques:
T1071.001
Threat description: Cobalt Strike uses a custom command and control protocol that can be encapsulated in HTTP or HTTPS, or DNS. All protocols use their standard assigned ports.
MITRE ATT&CK techniques:
T1071.001
Threat description: Comnie uses HTTP for C2 communication.
MITRE ATT&CK techniques:
T1071.001
Threat description: DEATHRANSOM can use HTTPS to download files.
MITRE ATT&CK techniques:
T1071.001
Threat description: DarkComet can use HTTP for C2 communications.
MITRE ATT&CK techniques:
T1071.001
Threat description: Dridex has used POST requests and HTTPS for C2 communications.
MITRE ATT&CK techniques:
T1071.001
Threat description: Elise communicates over HTTP or HTTPS for C2.
MITRE ATT&CK techniques:
T1071.001
Threat description: Empire can conduct command and control over protocols like HTTP and HTTPS.
MITRE ATT&CK techniques:
T1071.001
Threat description: Epic uses HTTP and HTTPS for C2 communications.
MITRE ATT&CK techniques:
T1071.001
Threat description: Explosive has used HTTP for communication.
MITRE ATT&CK techniques:
T1071.001
Threat description: FlawedAmmyy has used HTTP for C2.
MITRE ATT&CK techniques:
T1071.001
Threat description: GuLoader can use HTTP to retrieve additional binaries.
MITRE ATT&CK techniques:
T1071.001
Threat description: HAWKBALL has used HTTP to communicate with a single hard-coded C2 server.
MITRE ATT&CK techniques:
T1071.001
Threat description: Kimsuky  has used HTTP GET and POST requests for C2.
MITRE ATT&CK techniques:
T1071.001
Threat description: LitePower can use HTTP and HTTPS for C2 communications.
MITRE ATT&CK techniques:
T1071.001
Threat description: MarkiRAT can initiate communication over HTTP/HTTPS for its C2 server.
MITRE ATT&CK techniques:
T1071.001
Threat description: Mythic supports HTTP-based C2 profiles.
MITRE ATT&CK techniques:
T1071.001
Threat description: NETEAGLE will attempt to detect if the infected host is configured to a proxy. If so, NETEAGLE will send beacons via an HTTP POST request. NETEAGLE will also use HTTP to download resources that contain an IP address and Port Number pair to connect to for further C2.
MITRE ATT&CK techniques:
T1071.001
Threat description: One variant of CloudDuke uses HTTP and HTTPS for C2.
MITRE ATT&CK techniques:
T1071.001
Threat description: POWERTON has used HTTP/HTTPS for C2 traffic.
MITRE ATT&CK techniques:
T1071.001
Threat description: PowGoop can send HTTP GET requests to malicious servers.
MITRE ATT&CK techniques:
T1071.001
Threat description: SMOKEDHAM has communicated with its C2 servers via HTTPS and HTTP POST requests.
MITRE ATT&CK techniques:
T1071.001
Threat description: STARWHALE has the ability to contact actor-controlled C2 servers via HTTP.
MITRE ATT&CK techniques:
T1071.001
Threat description: Saint Bot has used HTTP for C2 communications.
MITRE ATT&CK techniques:
T1071.001
Threat description: Seasalt uses HTTP for C2 communications.
MITRE ATT&CK techniques:
T1071.001
Threat description: Sidewinder has used HTTP in C2 communications.
MITRE ATT&CK techniques:
T1071.001
Threat description: The Carbanak malware communicates to its command server using HTTP with an encrypted payload.
MITRE ATT&CK techniques:
T1071.001
Threat description: Trojan.Karagany can communicate with C2 via HTTP POST requests.
MITRE ATT&CK techniques:
T1071.001
Threat description: WIRTE has used HTTP for network communication.
MITRE ATT&CK techniques:
T1071.001
Threat description: Zebrocy uses HTTP for C2.
MITRE ATT&CK techniques:
T1071.001
Threat description: down_new has the ability to use HTTP in C2 communications.
MITRE ATT&CK techniques:
T1071.001
Threat description: Kazuar uses FTP and FTPS to communicate with the C2 server.
MITRE ATT&CK techniques:
T1071.002
Threat description: Mythic supports SMB-based peer-to-peer C2 profiles.
MITRE ATT&CK techniques:
T1071.002
Threat description: ComRAT can use email attachments for command and control.
MITRE ATT&CK techniques:
T1071.003
Threat description: Kimsuky has used e-mail to send exfiltrated data to C2 servers.
MITRE ATT&CK techniques:
T1071.003
Threat description: FIN7 has performed C2 using DNS via A, OPT, and TXT records.
MITRE ATT&CK techniques:
T1071.004
Threat description: Green Lambert can use DNS for C2 communications.
MITRE ATT&CK techniques:
T1071.004
Threat description: POWERSOURCE uses DNS TXT records for C2.
MITRE ATT&CK techniques:
T1071.004
Threat description: QUADAGENT uses DNS for C2 communications.
MITRE ATT&CK techniques:
T1071.004
Threat description: Tropic Trooper's backdoor has communicated to the C2 over the DNS protocol.
MITRE ATT&CK techniques:
T1071.004
Threat description: It is believed that a patch management system for an anti-virus product commonly installed among targeted companies was used to distribute the Wiper malware.
MITRE ATT&CK techniques:
T1072
Threat description: APT3 has been known to stage files for exfiltration in a single location.
MITRE ATT&CK techniques:
T1074.001
Threat description: Chrommme can store captured system information locally prior to exfiltration.
MITRE ATT&CK techniques:
T1074.001
Threat description: DarkWatchman can stage local data in the Windows Registry.
MITRE ATT&CK techniques:
T1074.001
Threat description: During C0015, PowerView's file share enumeration results were stored in the file `c:\ProgramData\found_shares.txt`.
MITRE ATT&CK techniques:
T1074.001
Threat description: ECCENTRICBANDWAGON has stored keystrokes and screenshots within the "%temp%\GoogleChrome", "%temp%\Downloads", and "%temp%\TrendMicroUpdate" directories.
MITRE ATT&CK techniques:
T1074.001
Threat description: MarkiRAT can store collected data locally in a created .nfo file.
MITRE ATT&CK techniques:
T1074.001
Threat description: MuddyWater has stored a decoy PDF file within a victim's `%temp%` folder.
MITRE ATT&CK techniques:
T1074.001
Threat description: Mustang Panda has stored collected credential files in "c:\windows\temp" prior to exfiltration. Mustang Panda has also stored documents for exfiltration in a hidden folder on USB drives.
MITRE ATT&CK techniques:
T1074.001
Threat description: NavRAT writes multiple outputs to a TMP file using the >> method.
MITRE ATT&CK techniques:
T1074.001
Threat description: Pteranodon creates various subdirectories under "%Temp%\reports\%" and copies files to those subdirectories. It also creates a folder at "C:\Users\<Username>\AppData\Roaming\Microsoft\store" to store screenshot JPEG files.
MITRE ATT&CK techniques:
T1074.001
Threat description: TEMP.Veles has created staging folders in directories that were infrequently used by legitimate users or processes.
MITRE ATT&CK techniques:
T1074.001
Threat description: menuPass stages data prior to exfiltration in multi-part archives, often saved in the Recycle Bin.
MITRE ATT&CK techniques:
T1074.001
Threat description: APT29 staged data and files in password-protected archives on a victim's OWA server.
MITRE ATT&CK techniques:
T1074.002
Threat description: ccf32 has copied files to a remote machine infected with Chinoxy or another backdoor.
MITRE ATT&CK techniques:
T1074.002
Threat description: LAPSUS$ has used compromised credentials and/or session tokens to gain access into a victim's VPN, VDI, RDP, and IAMs.
MITRE ATT&CK techniques:
T1078
Threat description: APT3 leverages valid accounts after gaining credentials for use within the victim domain.
MITRE ATT&CK techniques:
T1078.002
Threat description: TA505 has used stolen domain admin accounts to compromise additional hosts.
MITRE ATT&CK techniques:
T1078.002
Threat description: APT29 has used a compromised O365 administrator account to create a new Service Principal.
MITRE ATT&CK techniques:
T1078.004
Threat description: APT37 collects the computer name, the BIOS model, and execution path.
MITRE ATT&CK techniques:
T1082
Threat description: AppleSeed can identify the OS version of a targeted system.
MITRE ATT&CK techniques:
T1082
Threat description: Astaroth collects the machine name and keyboard language from the system.
MITRE ATT&CK techniques:
T1082
Threat description: BADFLICK has captured victim computer name, memory space, and CPU details.
MITRE ATT&CK techniques:
T1082
Threat description: BLINDINGCAN has collected from a victim machine the system name, processor information, OS version, and disk information, including type and free space available.
MITRE ATT&CK techniques:
T1082
Threat description: Babuk can enumerate disk volumes, get disk information, and query service status.
MITRE ATT&CK techniques:
T1082
Threat description: Bazar can fingerprint architecture, computer name, and OS version on the compromised host. Bazar can also check if the Russian language is installed on the infected machine and terminate if it is found.
MITRE ATT&CK techniques:
T1082
Threat description: BlackMould can enumerate local drives on a compromised host.
MITRE ATT&CK techniques:
T1082
Threat description: Caterpillar WebShell has a module to gather information from the compromrised asset, including the computer version, computer name, IIS version, and more.
MITRE ATT&CK techniques:
T1082
Threat description: Darkhotel has collected the hostname, OS version, service pack version, and the processor architecture from the victim’s machine.
MITRE ATT&CK techniques:
T1082
Threat description: Dridex has collected the computer name and OS architecture information from the system.
MITRE ATT&CK techniques:
T1082
Threat description: During its initial execution, BACKSPACE extracts operating system information from the infected host.
MITRE ATT&CK techniques:
T1082
Threat description: FlawedAmmyy can collect the victim's operating system and computer name during the initial infection.
MITRE ATT&CK techniques:
T1082
Threat description: FunnyDream can enumerate all logical drives on a targeted machine.
MITRE ATT&CK techniques:
T1082
Threat description: Fysbis has used the command "ls /etc | egrep -e"fedora\*|debian\*|gentoo\*|mandriva\*|mandrake\*|meego\*|redhat\*|lsb-\*|sun-\*|SUSE\*|release"" to determine which Linux OS version is running.
MITRE ATT&CK techniques:
T1082
Threat description: GoldenSpy has gathered operating system information.
MITRE ATT&CK techniques:
T1082
Threat description: HALFBAKED can obtain information about the OS, processor, and BIOS.
MITRE ATT&CK techniques:
T1082
Threat description: Honeybee gathers computer name and information using the "systeminfo" command.
MITRE ATT&CK techniques:
T1082
Threat description: InvisiMole can gather information on the mapped drives, OS version, computer name, DEP policy, memory size, and system volume serial number.
MITRE ATT&CK techniques:
T1082
Threat description: JHUHUGIT obtains a build identifier as well as victim hard drive information from Windows registry key "HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum". Another JHUHUGIT variant gathers the victim storage volume serial number and the storage device name.
MITRE ATT&CK techniques:
T1082
Threat description: Kerrdown has the ability to determine if the compromised host is running a 32 or 64 bit OS architecture.
MITRE ATT&CK techniques:
T1082
Threat description: Lucifer can collect the computer name, system architecture, default language, and processor frequency of a compromised host.
MITRE ATT&CK techniques:
T1082
Threat description: Machete collects the hostname of the target computer.
MITRE ATT&CK techniques:
T1082
Threat description: Maze has checked the language of the infected system using the "GetUSerDefaultUILanguage" function.
MITRE ATT&CK techniques:
T1082
Threat description: Micropsia gathers the hostname and OS version from the victim’s machine.
MITRE ATT&CK techniques:
T1082
Threat description: MirageFox can collect CPU and architecture information from the victim’s machine.
MITRE ATT&CK techniques:
T1082
Threat description: MoleNet can collect information about the about the system.
MITRE ATT&CK techniques:
T1082
Threat description: Moses Staff collected information about the infected host, including the machine names and OS architecture.
MITRE ATT&CK techniques:
T1082
Threat description: NDiskMonitor obtains the victim computer name and encrypts the information to send over its C2 channel.
MITRE ATT&CK techniques:
T1082
Threat description: NOKKI can gather information on drives and the operating system on the victim’s machine.
MITRE ATT&CK techniques:
T1082
Threat description: NanHaiShu can gather the victim computer name and serial number.
MITRE ATT&CK techniques:
T1082
Threat description: NavRAT uses "systeminfo" on a victim’s machine.
MITRE ATT&CK techniques:
T1082
Threat description: OSX/Shlayer has collected the IOPlatformUUID, session UID, and the OS version using the command "sw_vers -productVersion".
MITRE ATT&CK techniques:
T1082
Threat description: OSX_OCEANLOTUS.D collects processor information, memory information, computer name, hardware UUID, serial number, and operating system version. OSX_OCEANLOTUS.D has used the "ioreg" command to gather some of this information.
MITRE ATT&CK techniques:
T1082
Threat description: ObliqueRAT has the ability to check for blocklisted computer names on infected endpoints.
MITRE ATT&CK techniques:
T1082
Threat description: Octopus can collect system drive information, the computer name, the size of the disk, OS version, and OS architecture information.
MITRE ATT&CK techniques:
T1082
Threat description: Operation Wocao has discovered the local disks attached to the system and their hardware information including manufacturer and model, as well as the OS versions of systems connected to a targeted network.
MITRE ATT&CK techniques:
T1082
Threat description: POORAIM can identify system information, including battery status.
MITRE ATT&CK techniques:
T1082
Threat description: PinchDuke gathers system configuration information.
MITRE ATT&CK techniques:
T1082
Threat description: PingPull can retrieve the hostname of a compromised host.
MITRE ATT&CK techniques:
T1082
Threat description: Pisloader has a command to collect victim system information, including the system name and OS version.
MITRE ATT&CK techniques:
T1082
Threat description: SHUTTERSPEED can collect system information.
MITRE ATT&CK techniques:
T1082
Threat description: SLOTHFULMEDIA has collected system name, OS version, adapter information, memory usage, and disk information from a victim machine.
MITRE ATT&CK techniques:
T1082
Threat description: SharpStage has checked the system settings to see if Arabic is the configured language.
MITRE ATT&CK techniques:
T1082
Threat description: ShimRatReporter gathered the operating system name and specific Windows version of an infected machine.
MITRE ATT&CK techniques:
T1082
Threat description: SideCopy has identified the OS version of a compromised host.
MITRE ATT&CK techniques:
T1082
Threat description: Sidewinder has used tools to collect the computer name, OS version, installed hotfixes, as well as information regarding the memory and processor on a compromised host.
MITRE ATT&CK techniques:
T1082
Threat description: SpicyOmelette can identify the system name of a compromised host.
MITRE ATT&CK techniques:
T1082
Threat description: SslMM sends information to its hard-coded C2, including OS version, service pack information, processor speed, system name, and OS install date.
MITRE ATT&CK techniques:
T1082
Threat description: SynAck gathers computer names, OS version info, and also checks installed keyboard layouts to estimate if it has been launched from a certain list of countries.
MITRE ATT&CK techniques:
T1082
Threat description: Sys10 collects the computer name, OS versioning information, and OS install date and sends the information to the C2.
MITRE ATT&CK techniques:
T1082
Threat description: T9000 gathers and beacons the operating system build number and CPU Architecture (32-bit/64-bit) during installation.
MITRE ATT&CK techniques:
T1082
Threat description: TAINTEDSCRIBE can use "DriveList" to retrieve drive information.
MITRE ATT&CK techniques:
T1082
Threat description: TYPEFRAME can gather the disk volume information.
MITRE ATT&CK techniques:
T1082
Threat description: TajMahal has the ability to identify hardware information, the computer name, and OS information on an infected host.
MITRE ATT&CK techniques:
T1082
Threat description: TrickBot gathers the OS version, machine name, CPU type, amount of RAM available, and UEFI/BIOS firmware information from the victim’s machine.
MITRE ATT&CK techniques:
T1082
Threat description: Turian can retrieve system information including OS version, memory usage, local hostname, and system adapter information.
MITRE ATT&CK techniques:
T1082
Threat description: UNC2452 used "fsutil" to check available free space before executing actions that might create large files on disk.
MITRE ATT&CK techniques:
T1082
Threat description: WarzoneRAT can collect compromised host information, including OS version, PC name, RAM size, and CPU details.
MITRE ATT&CK techniques:
T1082
Threat description: Wizard Spider has used “systeminfo” and similar commands to acquire detailed configuration information of a victim machine.
MITRE ATT&CK techniques:
T1082
Threat description: ZLib has the ability to enumerate system information.
MITRE ATT&CK techniques:
T1082
Threat description: Zebrocy collects the OS version, computer name and serial number for the storage volume C:\. Zebrocy also runs the "systeminfo" command to gather system information.
MITRE ATT&CK techniques:
T1082
Threat description: can collect system information, including computer name, system manufacturer, IsDebuggerPresent state, and execution path.
MITRE ATT&CK techniques:
T1082
Threat description: yty gathers the computer name, the serial number of the main disk volume, CPU information, Microsoft Windows version, and runs the command "systeminfo".
MITRE ATT&CK techniques:
T1082
Threat description: APT41 has executed "file /bin/pwd" on exploited victims, perhaps to return architecture related information.
MITRE ATT&CK techniques:
T1083
Threat description: BLUELIGHT can enumerate files and collect associated metadata.
MITRE ATT&CK techniques:
T1083
Threat description: Bankshot searches for files on the victim's machine.
MITRE ATT&CK techniques:
T1083
Threat description: Bisonal can retrieve a file listing from the system.
MITRE ATT&CK techniques:
T1083
Threat description: BlackEnergy gathers a list of installed apps from the uninstall program Registry. It also gathers registered mail, browser, and instant messaging clients from the Registry. BlackEnergy has searched for given file types.
MITRE ATT&CK techniques:
T1083
Threat description: CORALDECK searches for specified files.
MITRE ATT&CK techniques:
T1083
Threat description: Cannon can obtain victim drive information as well as a list of folders in C:\Program Files.
MITRE ATT&CK techniques:
T1083
Threat description: CookieMiner has looked for files in the user's home directory with "wallet" in their name using "find".
MITRE ATT&CK techniques:
T1083
Threat description: CrossRAT can list all files on a system.
MITRE ATT&CK techniques:
T1083
Threat description: During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and browse the victim file system.
MITRE ATT&CK techniques:
T1083
Threat description: ELMER is capable of performing directory listings.
MITRE ATT&CK techniques:
T1083
Threat description: FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system and removable media.
MITRE ATT&CK techniques:
T1083
Threat description: Fox Kitten has used WizTree to obtain network files and directory listings.
MITRE ATT&CK techniques:
T1083
Threat description: GrimAgent has the ability to enumerate files and directories on a compromised host.
MITRE ATT&CK techniques:
T1083
Threat description: Industroyer’s data wiper component enumerates specific files on all the Windows drives.
MITRE ATT&CK techniques:
T1083
Threat description: KGH_SPY can enumerate files and directories on a compromised host.
MITRE ATT&CK techniques:
T1083
Threat description: Kazuar finds a specified directory, lists the files and metadata about those files.
MITRE ATT&CK techniques:
T1083
Threat description: Kimsuky has the ability to enumerate all files and directories on an infected system.
MITRE ATT&CK techniques:
T1083
Threat description: Kinsing has used the find command to search for specific files.
MITRE ATT&CK techniques:
T1083
Threat description: Kivars has the ability to list drives on the infected host.
MITRE ATT&CK techniques:
T1083
Threat description: Lokibot can search for specific files on an infected host.
MITRE ATT&CK techniques:
T1083
Threat description: LookBack can retrieve file listings from the victim machine.
MITRE ATT&CK techniques:
T1083
Threat description: Mustang Panda has searched the entire target system for DOC, DOCX, PPT, PPTX, XLS, XLSX, and PDF files.
MITRE ATT&CK techniques:
T1083
Threat description: P.A.S. Webshell has the ability to list files and file characteristics including extension, size, ownership, and permissions.
MITRE ATT&CK techniques:
T1083
Threat description: PLEAD has the ability to list drives and files on the compromised host.
MITRE ATT&CK techniques:
T1083
Threat description: PinchDuke searches for files created within a certain timeframe and whose file extension matches a predefined list.
MITRE ATT&CK techniques:
T1083
Threat description: Ryuk has enumerated files and folders on all mounted drives.
MITRE ATT&CK techniques:
T1083
Threat description: SOUNDBITE is capable of enumerating and manipulating files and directories.
MITRE ATT&CK techniques:
T1083
Threat description: SUNBURST had commands to enumerate files and directories.
MITRE ATT&CK techniques:
T1083
Threat description: Saint Bot can search a compromised host for specific files.
MITRE ATT&CK techniques:
T1083
Threat description: SideTwist has the ability to search for specific files.
MITRE ATT&CK techniques:
T1083
Threat description: SoreFang has the ability to list directories.
MITRE ATT&CK techniques:
T1083
Threat description: Trojan.Karagany can enumerate files and directories on a compromised host.
MITRE ATT&CK techniques:
T1083
Threat description: UPPERCUT has the capability to gather the victim's current directory.
MITRE ATT&CK techniques:
T1083
Threat description: WINERACK can enumerate files and directories.
MITRE ATT&CK techniques:
T1083
Threat description: ZLib has the ability to enumerate files and drives.
MITRE ATT&CK techniques:
T1083
Threat description: Zeus Panda searches for specific directories on the victim’s machine.
MITRE ATT&CK techniques:
T1083
Threat description: yty gathers information on victim’s drives and has a plugin for document listing.
MITRE ATT&CK techniques:
T1083
Threat description: ShimRatReporter listed all non-privileged and privileged accounts available on the machine.
MITRE ATT&CK techniques:
T1087
Threat description: UNC2452 obtained a list of users and their roles from an Exchange server using "Get-ManagementRoleAssignment".
MITRE ATT&CK techniques:
T1087
Threat description: Fox Kitten has accessed ntuser.dat and UserClass.dat on compromised hosts.
MITRE ATT&CK techniques:
T1087.001
Threat description: Moses Staff has collected the administrator username from a compromised host.
MITRE ATT&CK techniques:
T1087.001
Threat description: PowerSploit's "Get-ProcessTokenGroup" Privesc-PowerUp module can enumerate all SIDs associated with its current token.
MITRE ATT&CK techniques:
T1087.001
Threat description: SHOTPUT has a command to retrieve information about connected users.
MITRE ATT&CK techniques:
T1087.001
Threat description: SoreFang can collect usernames from the local system via "net.exe user".
MITRE ATT&CK techniques:
T1087.001
Threat description: USBferry can use "net user" to gather information about local accounts.
MITRE ATT&CK techniques:
T1087.001
Threat description: APT29 has used PowerShell to discover domain accounts by executing "Get-ADUser" and "Get-DGroupMember".
MITRE ATT&CK techniques:
T1087.002
Threat description: BRONZE BUTLER has used "net user /domain" to identify account information.
MITRE ATT&CK techniques:
T1087.002
Threat description: During Operation CuckooBees, the threat actors used the `dsquery` and `dsget` commands to get domain environment information and to query users in administrative groups.
MITRE ATT&CK techniques:
T1087.002
Threat description: Fox Kitten has used the Softerra LDAP browser to browse documentation on service accounts.
MITRE ATT&CK techniques:
T1087.002
Threat description: IcedID can query LDAP to identify additional users on the network to infect.
MITRE ATT&CK techniques:
T1087.002
Threat description: APT29 has conducted enumeration of Azure AD accounts.
MITRE ATT&CK techniques:
T1087.004
Threat description: ROADTools can enumerate Azure AD users.
MITRE ATT&CK techniques:
T1087.004
Threat description: A TYPEFRAME variant can force the compromised system to function as a proxy server.
MITRE ATT&CK techniques:
T1090
Threat description: Aria-body has the ability to use a reverse SOCKS proxy module.
MITRE ATT&CK techniques:
T1090
Threat description: Bisonal has supported use of a proxy server.
MITRE ATT&CK techniques:
T1090
Threat description: Cardinal RAT can act as a reverse proxy.
MITRE ATT&CK techniques:
T1090
Threat description: CopyKittens has used the AirVPN service for operational activity.
MITRE ATT&CK techniques:
T1090
Threat description: During Operation Wocao, threat actors used a custom proxy tool called "Agent" which has support for multiple hops.
MITRE ATT&CK techniques:
T1090
Threat description: Green Lambert can use proxies for C2 traffic.
MITRE ATT&CK techniques:
T1090
Threat description: HARDRAIN uses the command "cmd.exe /c netsh firewall add portopening TCP 443 "adp"" and makes the victim machine function as a proxy server.
MITRE ATT&CK techniques:
T1090
Threat description: Kessel can use a proxy during exfiltration if set in the configuration.
MITRE ATT&CK techniques:
T1090
Threat description: Operation Wocao has used a custom proxy tool called "Agent" which has support for multiple hops.
MITRE ATT&CK techniques:
T1090
Threat description: PLEAD has the ability to proxy network communications.
MITRE ATT&CK techniques:
T1090
Threat description: RainyDay can use proxy tools including boost_proxy_client for reverse proxy functionality.
MITRE ATT&CK techniques:
T1090
Threat description: Sandworm Team's BCS-server tool can create an internal proxy server to redirect traffic from the adversary-controlled C2 to internal servers which may not be connected to the internet, but are interconnected locally.
MITRE ATT&CK techniques:
T1090
Threat description: Turla RPC backdoors have included local UPnP RPC proxies.
MITRE ATT&CK techniques:
T1090
Threat description: XTunnel relays traffic between a C2 server and a victim.
MITRE ATT&CK techniques:
T1090
Threat description: jRAT can serve as a SOCKS proxy server.
MITRE ATT&CK techniques:
T1090
Threat description: APT29 has used SSH port forwarding capabilities on public-facing systems, and configured at least one instance of Cobalt Strike to use a network pipe over SMB during the 2020 SolarWinds intrusion.
MITRE ATT&CK techniques:
T1090.001
Threat description: Drovorub can use a port forwarding rule on its agent module to relay network traffic through the client module to a remote host on the same network.
MITRE ATT&CK techniques:
T1090.001
Threat description: Kazuar has used internal nodes on the compromised network for C2 communications.
MITRE ATT&CK techniques:
T1090.001
Threat description: APT39 has used various tools to proxy C2 communications.
MITRE ATT&CK techniques:
T1090.002
Threat description: Regin leveraged several compromised universities as proxies to obscure its origin.
MITRE ATT&CK techniques:
T1090.002
Threat description: ShimRat can use pre-configured HTTP proxies.
MITRE ATT&CK techniques:
T1090.002
Threat description: Attor has used Tor for C2 communication.
MITRE ATT&CK techniques:
T1090.003
Threat description: During CostaRicto, the threat actors used a layer of proxies to manage C2 communications.
MITRE ATT&CK techniques:
T1090.003
Threat description: Keydnap uses a copy of tor2web proxy for HTTPS communications.
MITRE ATT&CK techniques:
T1090.003
Threat description: Leviathan has used multi-hop proxies to disguise the source of their malicious traffic.
MITRE ATT&CK techniques:
T1090.003
Threat description: Siloscape uses Tor to communicate with C2.
MITRE ATT&CK techniques:
T1090.003
Threat description: Mythic supports domain fronting via custom request headers.
MITRE ATT&CK techniques:
T1090.004
Threat description: meek uses Domain Fronting to disguise the destination of network traffic as another server that is hosted in the same Content Delivery Network (CDN) as the intended destination.
MITRE ATT&CK techniques:
T1090.004
Threat description: Aoqin Dragon has used a dropper that employs a worm infection strategy using a removable device to breach a secure network environment.
MITRE ATT&CK techniques:
T1091
Threat description: Part of APT28's operation involved using CHOPSTICK modules to copy itself to air-gapped machines and using files written to USB sticks to transfer data and command traffic.
MITRE ATT&CK techniques:
T1091
Threat description: Unknown Logger is capable of spreading to USB devices.
MITRE ATT&CK techniques:
T1091
Threat description: Crimson uses a custom TCP protocol for C2.
MITRE ATT&CK techniques:
T1095
Threat description: Misdat network traffic communicates over a raw socket.
MITRE ATT&CK techniques:
T1095
Threat description: PHOREAL communicates via ICMP for C2.
MITRE ATT&CK techniques:
T1095
Threat description: SUGARUSH has used TCP for C2.
MITRE ATT&CK techniques:
T1095
Threat description: ShadowPad has used UDP for C2 communications.
MITRE ATT&CK techniques:
T1095
Threat description: The Penquin C2 mechanism is based on TCP and UDP packets.
MITRE ATT&CK techniques:
T1095
Threat description: Umbreon provides access to the system via SSH or any other protocol that uses PAM to authenticate.
MITRE ATT&CK techniques:
T1095
Threat description: WarzoneRAT can communicate with its C2 server via TCP over port 5200.
MITRE ATT&CK techniques:
T1095
Threat description: Dragonfly has added newly created accounts to the administrators group to maintain elevated access.
MITRE ATT&CK techniques:
T1098
Threat description: CharmPower can download additional modules from actor-controlled Amazon S3 buckets.
MITRE ATT&CK techniques:
T1102
Threat description: DropBook can communicate with its operators by exploiting the Simplenote, DropBox, and the social media platform, Facebook, where it can create fake accounts to control the backdoor and receive instructions.
MITRE ATT&CK techniques:
T1102
Threat description: Fox Kitten has used Amazon Web Services to host C2.
MITRE ATT&CK techniques:
T1102
Threat description: Ngrok has been used by threat actors to proxy C2 connections to ngrok service subdomains.
MITRE ATT&CK techniques:
T1102
Threat description: Rocke has used Pastebin, Gitee, and GitLab for Command and Control.
MITRE ATT&CK techniques:
T1102
Threat description: Sibot has used a legitimate compromised website to download DLLs to the victim's machine.
MITRE ATT&CK techniques:
T1102
Threat description: BADNEWS collects C2 information via a dead drop resolver.
MITRE ATT&CK techniques:
T1102.001
Threat description: BRONZE BUTLER's MSGET downloader uses a dead drop resolver to access malicious payloads.
MITRE ATT&CK techniques:
T1102.001
Threat description: APT37 leverages social networking sites and cloud platforms (AOL, Twitter, Yandex, Mediafire, pCloud, Dropbox, and Box) for C2.
MITRE ATT&CK techniques:
T1102.002
Threat description: BADNEWS can use multiple C2 channels, including RSS feeds, Github, forums, and blogs.
MITRE ATT&CK techniques:
T1102.002
Threat description: BLACKCOFFEE has also obfuscated its C2 traffic as normal traffic to sites such as Github.
MITRE ATT&CK techniques:
T1102.002
Threat description: Clambling can use Dropbox to download malicious payloads, send commands, and receive information.
MITRE ATT&CK techniques:
T1102.002
Threat description: CozyCar uses Twitter as a backup C2 channel to Twitter accounts specified in its configuration file.
MITRE ATT&CK techniques:
T1102.002
Threat description: GLOOXMAIL communicates to servers operated by Google using the Jabber/XMPP protocol.
MITRE ATT&CK techniques:
T1102.002
Threat description: Kimsuky has used Blogspot pages for C2.
MITRE ATT&CK techniques:
T1102.002
Threat description: PowerStallion uses Microsoft OneDrive as a C2 server via a network drive mapped with "net use".
MITRE ATT&CK techniques:
T1102.002
Threat description: ROKRAT has used legitimate social networking sites and cloud platforms (including but not limited to Twitter, Yandex, Dropbox, and Mediafire) for C2 communications.
MITRE ATT&CK techniques:
T1102.002
Threat description: RegDuke can use Dropbox as its C2 server.
MITRE ATT&CK techniques:
T1102.002
Threat description: Revenge RAT used blogpost.com as its primary command and control server during a campaign.
MITRE ATT&CK techniques:
T1102.002
Threat description: Small Sieve has the ability to use the Telegram Bot API from Telegram Messenger to send and receive messages.
MITRE ATT&CK techniques:
T1102.002
Threat description: Twitoor uses Twitter for command and control.
MITRE ATT&CK techniques:
T1102.002
Threat description: APT-C-36 has downloaded binary data from a specified domain after the malicious document is opened.
MITRE ATT&CK techniques:
T1105
Threat description: APT18 can upload a file to the victim’s machine.
MITRE ATT&CK techniques:
T1105
Threat description: APT3 has a tool that can copy files to remote machines.
MITRE ATT&CK techniques:
T1105
Threat description: APT41 used certutil to download additional files.
MITRE ATT&CK techniques:
T1105
Threat description: Amadey can download and execute files to further infect a host machine with additional malware.
MITRE ATT&CK techniques:
T1105
Threat description: Azorult can download and execute additional files. Azorult has also downloaded a ransomware payload called Hermes.
MITRE ATT&CK techniques:
T1105
Threat description: BabyShark has downloaded additional files from the C2.
MITRE ATT&CK techniques:
T1105
Threat description: Bundlore can download and execute new versions of itself.
MITRE ATT&CK techniques:
T1105
Threat description: CharmPower has the ability to download additional modules to a compromised host.
MITRE ATT&CK techniques:
T1105
Threat description: CloudDuke downloads and executes additional malware from either a Web address or a Microsoft OneDrive account.
MITRE ATT&CK techniques:
T1105
Threat description: Cobalt Strike can deliver additional payloads to victim machines.
MITRE ATT&CK techniques:
T1105
Threat description: DEATHRANSOM can download files to a compromised host.
MITRE ATT&CK techniques:
T1105
Threat description: Denis deploys additional backdoors and hacking tools to the system.
MITRE ATT&CK techniques:
T1105
Threat description: During FunnyDream, the threat actors downloaded additional droppers and backdoors onto a compromised system.
MITRE ATT&CK techniques:
T1105
Threat description: During Night Dragon, threat actors used administrative utilities to deliver Trojan components to remote systems.
MITRE ATT&CK techniques:
T1105
Threat description: Ecipekac can download additional payloads to a compromised host.
MITRE ATT&CK techniques:
T1105
Threat description: Elise can download additional files from the C2 server for execution.
MITRE ATT&CK techniques:
T1105
Threat description: FELIXROOT downloads and uploads files to and from the victim’s machine.
MITRE ATT&CK techniques:
T1105
Threat description: Fox Kitten has downloaded additional tools including PsExec directly to endpoints.
MITRE ATT&CK techniques:
T1105
Threat description: HEXANE has downloaded additional payloads and malicious scripts onto a compromised host.
MITRE ATT&CK techniques:
T1105
Threat description: JHUHUGIT can retrieve an additional payload from its C2 server. JHUHUGIT has a command to download files to the victim’s machine.
MITRE ATT&CK techniques:
T1105
Threat description: JSS Loader has the ability to download malicious executables to a compromised host.
MITRE ATT&CK techniques:
T1105
Threat description: KARAE can upload and download files, including second-stage malware.
MITRE ATT&CK techniques:
T1105
Threat description: KGH_SPY has the ability to download and execute code from remote servers.
MITRE ATT&CK techniques:
T1105
Threat description: Kimsuky has downloaded additional scripts, tools, and malware onto victim systems.
MITRE ATT&CK techniques:
T1105
Threat description: Koadic can download additional files and tools.
MITRE ATT&CK techniques:
T1105
Threat description: LightNeuron has the ability to download and execute additional files.
MITRE ATT&CK techniques:
T1105
Threat description: Linfo creates a backdoor through which remote attackers can download files onto compromised hosts.
MITRE ATT&CK techniques:
T1105
Threat description: Magic Hound has downloaded additional code and files from servers onto victims.
MITRE ATT&CK techniques:
T1105
Threat description: Meteor has the ability to download additional files for execution on the victim's machine.
MITRE ATT&CK techniques:
T1105
Threat description: Micropsia can download and execute an executable from the C2 server.
MITRE ATT&CK techniques:
T1105
Threat description: NanHaiShu can download additional files from URLs.
MITRE ATT&CK techniques:
T1105
Threat description: Nerex creates a backdoor through which remote attackers can download files onto a compromised host.
MITRE ATT&CK techniques:
T1105
Threat description: OopsIE can download files from its C2 server to the victim's machine.
MITRE ATT&CK techniques:
T1105
Threat description: PLEAD has the ability to upload and download files to and from an infected host.
MITRE ATT&CK techniques:
T1105
Threat description: PUNCHBUGGY can download additional files and payloads to compromised hosts.
MITRE ATT&CK techniques:
T1105
Threat description: Pandora can load additional drivers and files onto a victim machine.
MITRE ATT&CK techniques:
T1105
Threat description: Patchwork payloads download additional files from the C2 server.
MITRE ATT&CK techniques:
T1105
Threat description: PoetRAT has the ability to copy files and download/upload files into C2 channels using FTP and HTTPS.
MITRE ATT&CK techniques:
T1105
Threat description: Pteranodon can download and execute additional files.
MITRE ATT&CK techniques:
T1105
Threat description: RARSTONE downloads its backdoor component from a C2 server and loads it directly into memory.
MITRE ATT&CK techniques:
T1105
Threat description: RemoteCMD copies a file over to the remote system before execution.
MITRE ATT&CK techniques:
T1105
Threat description: Rocke used malware to download additional malicious files to the target system.
MITRE ATT&CK techniques:
T1105
Threat description: SQLRat can make a direct SQL connection to a Microsoft database controlled by the attackers, retrieve an item from the bindata table, then write and execute the file on disk.
MITRE ATT&CK techniques:
T1105
Threat description: ShadowPad has downloaded code from a C2 server.
MITRE ATT&CK techniques:
T1105
Threat description: SoreFang can download additional payloads from C2.
MITRE ATT&CK techniques:
T1105
Threat description: Turian can download additional files and tools from its C2.
MITRE ATT&CK techniques:
T1105
Threat description: Turla has used shellcode to download Meterpreter after compromising a victim.
MITRE ATT&CK techniques:
T1105
Threat description: UNC2452 downloaded additional tools, such as TEARDROP malware and Cobalt Strike, to the compromised host following initial compromise.
MITRE ATT&CK techniques:
T1105
Threat description: UPPERCUT can download and upload files to and from the victim’s machine.
MITRE ATT&CK techniques:
T1105
Threat description: VaporRage has the ability to download malicious shellcode to compromised systems.
MITRE ATT&CK techniques:
T1105
Threat description: WEBC2 can download and execute a file.
MITRE ATT&CK techniques:
T1105
Threat description: WellMess can write files to a compromised host.
MITRE ATT&CK techniques:
T1105
Threat description: Wiarp creates a backdoor through which remote attackers can download files.
MITRE ATT&CK techniques:
T1105
Threat description: Winnti for Linux has the ability to deploy modules directly from command and control (C2) servers, possibly for remote command execution, file exfiltration, and socks5 proxying on the infected host.
MITRE ATT&CK techniques:
T1105
Threat description: ZIRCONIUM has used tools to download malicious files to compromised hosts.
MITRE ATT&CK techniques:
T1105
Threat description: Zeus Panda can download additional malware plug-in modules and execute them on the victim’s machine.
MITRE ATT&CK techniques:
T1105
Threat description: certutil can be used to download files from a given URL.
MITRE ATT&CK techniques:
T1105
Threat description: down_new has the ability to download files to the compromised host.
MITRE ATT&CK techniques:
T1105
Threat description: After escalating privileges, MegaCortex calls "TerminateProcess()", "CreateRemoteThread", and other Win32 APIs.
MITRE ATT&CK techniques:
T1106
Threat description: BendyBear can load and execute modules and Windows Application Programming (API) calls using standard shellcode API hashing.
MITRE ATT&CK techniques:
T1106
Threat description: Cobalt Strike's Beacon payload is capable of running shell commands without "cmd.exe" and PowerShell commands without "powershell.exe"
MITRE ATT&CK techniques:
T1106
Threat description: DCSrv has used various Windows API functions, including `DeviceIoControl`, as part of its encryption process.
MITRE ATT&CK techniques:
T1106
Threat description: FatDuke can call "ShellExecuteW" to open the default browser on the URL localhost.
MITRE ATT&CK techniques:
T1106
Threat description: HermeticWizard can connect to remote shares using `WNetAddConnection2W`.
MITRE ATT&CK techniques:
T1106
Threat description: KONNI has hardcoded API calls within its functions to use on the victim's machine.
MITRE ATT&CK techniques:
T1106
Threat description: LitePower can use various API calls.
MITRE ATT&CK techniques:
T1106
Threat description: Lokibot has used LoadLibrary(), GetProcAddress() and CreateRemoteThread() API functions to execute its shellcode.
MITRE ATT&CK techniques:
T1106
Threat description: Maze has used several Windows API functions throughout the encryption process including IsDebuggerPresent, TerminateProcess, Process32FirstW, among others.
MITRE ATT&CK techniques:
T1106
Threat description: Meteor can use `WinAPI` to remove a victim machine from an Active Directory domain.
MITRE ATT&CK techniques:
T1106
Threat description: Misdat has used Windows APIs, including `ExitWindowsEx` and `GetKeyboardType`.
MITRE ATT&CK techniques:
T1106
Threat description: Pony has used several Windows functions for various purposes.
MITRE ATT&CK techniques:
T1106
Threat description: RTM can use the "FindNextUrlCacheEntryA" and "FindFirstUrlCacheEntryA" functions to search for specific strings within browser history.
MITRE ATT&CK techniques:
T1106
Threat description: Ramsay can use Windows API functions such as "WriteFile", "CloseHandle", and "GetCurrentHwProfile" during its collection and file storage operations. Ramsay can execute its embedded components via "CreateProcessA" and "ShellExecute".
MITRE ATT&CK techniques:
T1106
Threat description: Ryuk has used multiple native APIs including "ShellExecuteW" to run executables,"GetWindowsDirectoryW" to create folders, and "VirtualAlloc", "WriteProcessMemory", and "CreateRemoteThread" for process injection.
MITRE ATT&CK techniques:
T1106
Threat description: S-Type has used Windows APIs, including `GetKeyboardType`, `NetUserAdd`, and `NetUserDel`.
MITRE ATT&CK techniques:
T1106
Threat description: Saint Bot has used different API calls, including `GetProcAddress`, `VirtualAllocEx`, `WriteProcessMemory`, `CreateProcessA`, and `SetThreadContext`.
MITRE ATT&CK techniques:
T1106
Threat description: Silence has leveraged the Windows API, including using CreateProcess() or ShellExecute(), to perform a variety of tasks.
MITRE ATT&CK techniques:
T1106
Threat description: ZxShell can leverage native API including "RegisterServiceCtrlHandler " to register a service.RegisterServiceCtrlHandler
MITRE ATT&CK techniques:
T1106
Threat description: gh0st RAT has used the `InterlockedExchange`, `SeShutdownPrivilege`, and `ExitWindowsEx` Windows API functions.
MITRE ATT&CK techniques:
T1106
Threat description: DarkVishnya used brute-force attack to obtain login data.
MITRE ATT&CK techniques:
T1110
Threat description: Dragonfly has attempted to brute force credentials to gain access.
MITRE ATT&CK techniques:
T1110
Threat description: PoshC2 has modules for brute forcing local administrator and AD user accounts.
MITRE ATT&CK techniques:
T1110
Threat description: During Operation Wocao, threat actors used a custom collection method to intercept two-factor authentication soft tokens.
MITRE ATT&CK techniques:
T1111
Threat description: Kimsuky has used a proprietary tool to intercept one time passwords required for two-factor authentication.
MITRE ATT&CK techniques:
T1111
Threat description: A Threat Group-3390 tool has created new Registry keys under `HKEY_CURRENT_USER\Software\Classes\` and `HKLM\SYSTEM\CurrentControlSet\services`.
MITRE ATT&CK techniques:
T1112
Threat description: AADInternals can modify registry keys as part of setting a new pass-through authentication agent.
MITRE ATT&CK techniques:
T1112
Threat description: APT32's backdoor has modified the Windows Registry to store the backdoor's configuration.
MITRE ATT&CK techniques:
T1112
Threat description: Chaes stored its instructions in a config file in the Registry.
MITRE ATT&CK techniques:
T1112
Threat description: DarkWatchman can store configuration strings, keylogger, and output of components in the Registry.
MITRE ATT&CK techniques:
T1112
Threat description: Dragonfly 2.0 modified the Registry to perform multiple techniques through the use of Reg.
MITRE ATT&CK techniques:
T1112
Threat description: Dragonfly has modified the Registry to perform multiple techniques through the use of Reg.
MITRE ATT&CK techniques:
T1112
Threat description: During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and manipulate the Registry.
MITRE ATT&CK techniques:
T1112
Threat description: FIN8 has deleted Registry keys during post compromise cleanup activities.
MITRE ATT&CK techniques:
T1112
Threat description: Gamaredon Group has removed security settings for VBA macro execution by changing registry values "HKCU\Software\Microsoft\Office\&lt;version&gt;\&lt;product&gt;\Security\VBAWarnings" and "HKCU\Software\Microsoft\Office\&lt;version&gt;\&lt;product&gt;\Security\AccessVBOM".
MITRE ATT&CK techniques:
T1112
Threat description: KOCTOPUS has added and deleted keys from the Registry.
MITRE ATT&CK techniques:
T1112
Threat description: Lokibot has modified the Registry as part of its UAC bypass process.
MITRE ATT&CK techniques:
T1112
Threat description: Mori can write data to `HKLM\Software\NFC\IPA` and `HKLM\Software\NFC\` and delete Registry values.
MITRE ATT&CK techniques:
T1112
Threat description: Naid creates Registry entries that store information about a created service and point to a malicious DLL dropped to disk.
MITRE ATT&CK techniques:
T1112
Threat description: Netwalker can add the following registry entry: "HKEY_CURRENT_USER\SOFTWARE\{8 random characters}".
MITRE ATT&CK techniques:
T1112
Threat description: PcShare can delete its persistence mechanisms from the registry.
MITRE ATT&CK techniques:
T1112
Threat description: QakBot can store its configuration information in a randomly named subkey under "HKCU\Software\Microsoft".
MITRE ATT&CK techniques:
T1112
Threat description: RTM can delete all Registry entries created during its execution.
MITRE ATT&CK techniques:
T1112