QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: FIN6 conducted internal reconnaissance with a Windows batch file leveraging Adfind to query Active Directory, then 7-zip to compress the results for exfiltration
MITRE ATT&CK techniques:
T1069
T1018
Threat description: , a tool that has been used by adversaries, writes programs to the ADMIN$ network share to execute commands on remote systems.
MITRE ATT&CK techniques:
T1021.002
Threat description: achieves persistence by creating a shortcut in the Startup folder.
MITRE ATT&CK techniques:
T1547.001
T1547.009
Threat description: achieves persistence by using various Registry Run keys.
MITRE ATT&CK techniques:
T1547.001
Threat description: A  configuration file is encrypted with a simple XOR key, 0x53.
MITRE ATT&CK techniques:
T1027
Threat description: actors deleted tools and batch files from victim systems.
MITRE ATT&CK techniques:
T1070.004
Threat description: actors installed a credential logger on Microsoft Exchange servers.  also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.
MITRE ATT&CK techniques:
T1056
Threat description: actors mapped network drives using net use.
MITRE ATT&CK techniques:
T1021.002
Threat description: actors used the following command after exploiting a machine with  malware to acquire information about local networks: ipconfig /all >> %temp%\download
MITRE ATT&CK techniques:
T1016
Threat description: actors used the following command following exploitation of a machine with  malware to list local groups: net localgroup administrator >> %temp%\download
MITRE ATT&CK techniques:
T1069
Threat description: added the registry value ntdll to the Registry Run key to establish persistence.
MITRE ATT&CK techniques:
T1547.001
Threat description: adds a sub-key under several Registry run keys.
MITRE ATT&CK techniques:
T1547.001
Threat description: adds collected files to a temp.zip file saved in the %temp% folder, then base64 encodes it and uploads it to control server.
MITRE ATT&CK techniques:
T1560
T1074
T1486
Threat description: adds itself to the startup folder or adds itself to the Registry key SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run for persistence.
MITRE ATT&CK techniques:
T1547.001
Threat description: adds permissions and remote logins to all users.
MITRE ATT&CK techniques:
T1098
Threat description: adds the setuid flag to a binary so it can easily elevate in the future.
MITRE ATT&CK techniques:
T1548.001
Threat description: Adversaries can direct  to upload files to the C2 Server.
MITRE ATT&CK techniques:
T1041
Threat description: After collecting documents from removable media,  compresses the collected files.
MITRE ATT&CK techniques:
T1560
Threat description: After compromising a victim,  discovers all running services.
MITRE ATT&CK techniques:
T1007
Threat description: After data is collected by  malware, it is exfiltrated over the existing C2 channel.
MITRE ATT&CK techniques:
T1041
Threat description: A module in  collects information about the paths, size, and creation time of files with specific file extensions, but not the actual content of the file.
MITRE ATT&CK techniques:
T1083
Threat description: A module in  gathers logins and passwords stored in applications on the victims, including Google Chrome, Mozilla Firefox, and several other browsers.
MITRE ATT&CK techniques:
T1552.001
Threat description: An  downloader establishes SOCKS5 connections to two separate IP addresses over TCP port 1913 and TCP port 81.
MITRE ATT&CK techniques:
T1571
Threat description: An  loader Trojan saves its payload with hidden file attributes.
MITRE ATT&CK techniques:
T1564.001
Threat description: appears to have functionality to sniff for credentials passed over HTTP, SMTP, and SMB.
MITRE ATT&CK techniques:
T1040
Threat description: A  tool can create a new Registry key under HKEY_CURRENT_USER\Software\Classes\.
MITRE ATT&CK techniques:
T1112
Threat description: automatically collects data about the victim and sends it to the control server.
MITRE ATT&CK techniques:
T1119
Threat description: A  variant accesses a screenshot saved in the clipboard and converts it to a JPG image.
MITRE ATT&CK techniques:
T1115
Threat description: A  variant can use port 127 for communications.
MITRE ATT&CK techniques:
T1571
Threat description: A  variant registers as a Winlogon Event Notify DLL to establish persistence.
MITRE ATT&CK techniques:
T1547.004
Threat description: A  variant takes screenshots by simulating the user pressing the "Take Screenshot" key (VK_SCREENSHOT), accessing the screenshot saved in the clipboard, and converting it to a JPG image.
MITRE ATT&CK techniques:
T1113
Threat description: A  variant uses a custom packer.
MITRE ATT&CK techniques:
T1027.002
Threat description: A version of  introduced in July 2015 obfuscated the binary using opaque predicates and other techniques in a likely attempt to obfuscate it and bypass security products.
MITRE ATT&CK techniques:
T1027
Threat description: A version of  uses the MPRESS packer.
MITRE ATT&CK techniques:
T1027.002
Threat description: backdoor RoyalDNS established persistence through adding a service called Nwsapagent.
MITRE ATT&CK techniques:
T1543.003
Threat description: base64 encodes strings that are sent to the C2 over its DNS tunnel.
MITRE ATT&CK techniques:
T1001
Threat description: binds to a raw socket on a random source port between 31800 and 31900 for C2.
MITRE ATT&CK techniques:
T1095
Threat description: can be configured to only run during normal working hours, which would make its communications harder to distinguish from normal traffic.
MITRE ATT&CK techniques:
T1029
Threat description: can be used to act on (ex: copy, move, etc.) files/directories in a system during (ex: copy files into a staging area before).
MITRE ATT&CK techniques:
T1005
Threat description: can be used to automate exploitation of SQL injection vulnerabilities.
MITRE ATT&CK techniques:
T1190
Threat description: can be used to discover routing configuration information.
MITRE ATT&CK techniques:
T1016
Threat description: can be used to display adapter configuration on Windows systems, including information for TCP/IP, DNS, and DHCP.
MITRE ATT&CK techniques:
T1016
Threat description: can be used to gather information on user accounts within a domain.
MITRE ATT&CK techniques:
T1087
Threat description: can bypass UAC and create an elevated COM object to escalate privileges.
MITRE ATT&CK techniques:
T1548.002
Threat description: can capture screenshots of the desktop over multiple monitors.
MITRE ATT&CK techniques:
T1113
Threat description: can collect system information.
MITRE ATT&CK techniques:
T1082
Threat description: can communicate using HTTP or HTTPS.
MITRE ATT&CK techniques:
T1071
Threat description: can compress data before sending it.
MITRE ATT&CK techniques:
T1560
Threat description: can create a link to itself in the Startup folder to automatically start itself upon system restart.
MITRE ATT&CK techniques:
T1547.001
Threat description: can create a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands.
MITRE ATT&CK techniques:
T1059
Threat description: can decrypt, unpack and load a DLL from its resources.
MITRE ATT&CK techniques:
T1140
Threat description: can download additional components from the C2 server.
MITRE ATT&CK techniques:
T1105
Threat description: can download a hosted "beacon" payload using .
MITRE ATT&CK techniques:
T1197
Threat description: can download and execute a file from given URL.
MITRE ATT&CK techniques:
T1105
Threat description: can download files.
MITRE ATT&CK techniques:
T1105
Threat description: can download files and upgrade itself.
MITRE ATT&CK techniques:
T1105
Threat description: can dump process memory and extract clear-text credentials.
MITRE ATT&CK techniques:
T1003
Threat description: can enumerate files and directories.
MITRE ATT&CK techniques:
T1083
Threat description: can enumerate registry keys.
MITRE ATT&CK techniques:
T1012
Threat description: can enumerate services.
MITRE ATT&CK techniques:
T1007
Threat description: can execute shell commands.
MITRE ATT&CK techniques:
T1059
Threat description: can gather information about the victim proxy server.
MITRE ATT&CK techniques:
T1016
Threat description: can gather the username from the victim’s machine.
MITRE ATT&CK techniques:
T1033
Threat description: can gather the victim computer name.
MITRE ATT&CK techniques:
T1082
Threat description: can inject content into lsass.exe to load a module.
MITRE ATT&CK techniques:
T1055
Threat description: can install as a Windows service for persistence.
MITRE ATT&CK techniques:
T1543.003
Threat description: can list directory contents.
MITRE ATT&CK techniques:
T1083
Threat description: can obtain a list of running processes on the system.
MITRE ATT&CK techniques:
T1057
Threat description: can obtain a list of users.
MITRE ATT&CK techniques:
T1087
Threat description: can obtain information about network parameters.
MITRE ATT&CK techniques:
T1016
Threat description: can obtain the victim time zone.
MITRE ATT&CK techniques:
T1124
Threat description: can perform audio capture.
MITRE ATT&CK techniques:
T1123
Threat description: can perform credential dumping.
MITRE ATT&CK techniques:
T1003
Threat description: can perform port scans from an infected host.
MITRE ATT&CK techniques:
T1046
Threat description: can perform webcam viewing.
MITRE ATT&CK techniques:
T1125
Threat description: can remove itself from a system.
MITRE ATT&CK techniques:
T1070.004
Threat description: can retrieve an additional payload from its C2 server.
MITRE ATT&CK techniques:
T1105
Threat description: can search files on a victim.
MITRE ATT&CK techniques:
T1083
Threat description: can sleep for a given number of seconds.
MITRE ATT&CK techniques:
T1029
Threat description: can SSH to a remote service.
MITRE ATT&CK techniques:
T1021
Threat description: can start, stop, or delete services.
MITRE ATT&CK techniques:
T1569.002
Threat description: can upload and download files, including second-stage malware.
MITRE ATT&CK techniques:
T1105
Threat description: can use an add on feature when creating payloads that allows you to create custom Python scripts (“scriptlets”) to perform tasks offline (without requiring a session) such as sandbox detection, adding persistence, etc.
MITRE ATT&CK techniques:
T1064
Threat description: can use a WMI script to achieve persistence.
MITRE ATT&CK techniques:
T1546.003
Threat description: can use base64 encoded C2 communications.
MITRE ATT&CK techniques:
T1132
Threat description: can use multiple C2 channels, including RSS feeds, Github, forums, and blogs.  also collects C2 information via a dead drop resolver.
MITRE ATT&CK techniques:
T1102
Threat description: can use Regsvr32 to execute additional payloads.
MITRE ATT&CK techniques:
T1218.010
Threat description: can use steganography to hide malicious code downloaded to the victim.
MITRE ATT&CK techniques:
T1001
Threat description: can use  to execute a payload on a remote host. It can also use Service Control Manager to start new services.
MITRE ATT&CK techniques:
T1569.002
Threat description: can use WMI to deliver a payload to a remote host.
MITRE ATT&CK techniques:
T1047
Threat description: captured audio and sent it out to a C2 server.
MITRE ATT&CK techniques:
T1123
Threat description: captures images from the webcam.
MITRE ATT&CK techniques:
T1125
Threat description: checks for anti-malware products and processes.
MITRE ATT&CK techniques:
T1518.001
Threat description: checks for ant-sandboxing software such as virtual PC, sandboxie, and VMware.
MITRE ATT&CK techniques:
T1518.001
Threat description: checks for the presence of certain security-related processes and deletes its installer/uninstaller component if it identifies any of them.
MITRE ATT&CK techniques:
T1518.001
Threat description: checks its directory location in an attempt to avoid launching in a sandbox.
MITRE ATT&CK techniques:
T1083
Threat description: checks the running processes on the victim’s machine.
MITRE ATT&CK techniques:
T1057
Threat description: collects a list of available servers with the command net view.
MITRE ATT&CK techniques:
T1018
Threat description: collects a list of running services with the command tasklist /v.
MITRE ATT&CK techniques:
T1057
Threat description: collects files from the local system.
MITRE ATT&CK techniques:
T1005
Threat description: collects hostname, volume serial number and OS version data from the victim and sends the information to its C2 server.
MITRE ATT&CK techniques:
T1082
Threat description: collects information about the Internet adapter configuration.
MITRE ATT&CK techniques:
T1016
Threat description: collects information on bookmarks from Google Chrome.
MITRE ATT&CK techniques:
T1217
Threat description: collects information on local user accounts from the victim.
MITRE ATT&CK techniques:
T1087
Threat description: collects information on programs and services on the victim that are configured to automatically run at startup.
MITRE ATT&CK techniques:
T1007
Threat description: collects lists of local accounts with administrative access, local group user accounts, and domain local groups with the commands net localgroup administrators, net localgroup users, and net localgroup /domain.
MITRE ATT&CK techniques:
T1069
Threat description: collects registered owner details by using the commands systeminfo and net config workstation.
MITRE ATT&CK techniques:
T1033
Threat description: collects system information, including the operating system version and hostname.
MITRE ATT&CK techniques:
T1082
Threat description: collects the username from the victim.
MITRE ATT&CK techniques:
T1033
Threat description: collects the victim host name and serial number, and then sends the information to the C2 server.
MITRE ATT&CK techniques:
T1082
Threat description: collects the victim username along with other account information (account type, description, full name, SID and status).
MITRE ATT&CK techniques:
T1033
Threat description: collects the victim username and sends it to the C2 server.
MITRE ATT&CK techniques:
T1033
Threat description: collects user credentials, including passwords, for various programs and browsers, including popular instant messaging applications, Web browsers, and email clients. Windows account hashes, domain accounts, and LSA secrets are also collected, as are WLAN keys.
MITRE ATT&CK techniques:
T1003
Threat description: communicates over port 80 for C2.
MITRE ATT&CK techniques:
T1043
Threat description: communicates with its C2 domain over ports 443 and 8443.
MITRE ATT&CK techniques:
T1043
Threat description: contains a collection of ScriptModification modules that compress and encode scripts and payloads.
MITRE ATT&CK techniques:
T1027
Threat description: contains a command to list processes.
MITRE ATT&CK techniques:
T1057
Threat description: contains a feature to manipulate process privileges and tokens.
MITRE ATT&CK techniques:
T1134
Threat description: contains a module to collect data from removable drives.
MITRE ATT&CK techniques:
T1025
Threat description: contains a module to move data from airgapped networks to Internet-connected systems by using a removable USB device.
MITRE ATT&CK techniques:
T1052
Threat description: contains a network loader to receive executable modules from remote attackers and run them on the local victim. It can also upload and download files over HTTP and HTTPS.
MITRE ATT&CK techniques:
T1105
Threat description: creates a backdoor through which remote attackers can list contents of drives and search for files.
MITRE ATT&CK techniques:
T1083
Threat description: creates a backdoor through which remote attackers can monitor processes.
MITRE ATT&CK techniques:
T1057
Threat description: creates a backdoor through which remote attackers can open a command line interface.
MITRE ATT&CK techniques:
T1059
Threat description: creates a backdoor through which remote attackers can read data from files.
MITRE ATT&CK techniques:
T1005
Threat description: creates a backdoor through which remote attackers can retrieve information such as computer name, OS version, processor speed, memory size, and CPU speed.
MITRE ATT&CK techniques:
T1082
Threat description: creates a file named thumb.dd on all USB flash drives connected to the victim. This file contains information about the infected system and activity logs.
MITRE ATT&CK techniques:
T1052
Threat description: creates a scheduled task on the system that provides persistence.
MITRE ATT&CK techniques:
T1053.005
Threat description: CRYPTO::Extract module can extract keys by interacting with Windows cryptographic application programming interface (API) functions.
MITRE ATT&CK techniques:
T1552.004
Threat description: decodes the configuration data and modules.
MITRE ATT&CK techniques:
T1140
Threat description: decrypts and executes shellcode from a file called Stars.jps.
MITRE ATT&CK techniques:
T1140
Threat description: deletes its payload along with the payload's parent process after it finishes copying files.
MITRE ATT&CK techniques:
T1070.004
Threat description: delets all artifacts associated with the malware from the infected machine.
MITRE ATT&CK techniques:
T1070
Threat description: deobfuscates its code.
MITRE ATT&CK techniques:
T1140
Threat description: developed a file stealer to search C:\ and collect files with certain extensions.  also executed a script to enumerate all drives, store them as a list, and upload generated files to the C2 server.
MITRE ATT&CK techniques:
T1119
Threat description: disables the Windows firewall before binding to a port.
MITRE ATT&CK techniques:
T1562.001
Threat description: downloads additional plug-ins to load on the victim’s machine, including the ability to upgrade and replace its own binary.
MITRE ATT&CK techniques:
T1105
Threat description: downloads and uploads files to and from the victim’s machine.
MITRE ATT&CK techniques:
T1105
Threat description: downloads another dropper from its C2 server.
MITRE ATT&CK techniques:
T1105
Threat description: DPAPI module can harvest protected credentials stored and/or cached by browsers and other user applications by interacting with Windows cryptographic application programming interface (API) functions.
MITRE ATT&CK techniques:
T1552.001
Threat description: drops a malicious file (sspisrv.dll) alongside a copy of lsass.exe, which is used to register a service that loads sspisrv.dll as a driver. The payload of the malicious driver (located in its entry-point function) is executed when loaded by lsass.exe before the spoofed service becomes unstable and crashes.
MITRE ATT&CK techniques:
T1547.008
Threat description: drops and executes a malicious CPL file as its payload.
MITRE ATT&CK techniques:
T1218.002
Threat description: drops files with base64-encoded data.
MITRE ATT&CK techniques:
T1027
Threat description: enables concurrent Remote Desktop Protocol (RDP).
MITRE ATT&CK techniques:
T1021.001
Threat description: encodes C2 communications with base64.
MITRE ATT&CK techniques:
T1001
Threat description: encodes C2 traffic with single-byte XOR keys.
MITRE ATT&CK techniques:
T1573
Threat description: encrypts C2 data with AES256 in ECB mode.
MITRE ATT&CK techniques:
T1573
Threat description: encrypts data using Base64 before being sent to the command and control server.
MITRE ATT&CK techniques:
T1486
Threat description: enumerates all running processes.
MITRE ATT&CK techniques:
T1057
Threat description: enumerates Registry keys associated with event logs.
MITRE ATT&CK techniques:
T1012
Threat description: enumerates registry keys with the command regkeyenum and obtains information for the Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
MITRE ATT&CK techniques:
T1012
Threat description: enumerates running processes to search for Wireshark and Windows Sysinternals suite.
MITRE ATT&CK techniques:
T1518.001
Threat description: establishes persistence by creating a shortcut in the Start Menu folder.
MITRE ATT&CK techniques:
T1547.001
Threat description: establishes persistence via a .lnk file in the victim’s startup path.
MITRE ATT&CK techniques:
T1547.009
Threat description: executes batch scripts on the victim’s machine.
MITRE ATT&CK techniques:
T1064
Threat description: exfiltrates data collected from the victim mobile device.
MITRE ATT&CK techniques:
T1005
Threat description: exfiltrates data over its C2 channel.
MITRE ATT&CK techniques:
T1041
Threat description: exfiltrates data to its C2 server over the same protocol as C2 communications.
MITRE ATT&CK techniques:
T1041
Threat description: exfiltrates files over FTP.
MITRE ATT&CK techniques:
T1048
Threat description: extracts basic information about the operating system.
MITRE ATT&CK techniques:
T1082
Threat description: For C2 over HTTP,  encodes data with base64 and sends it via the "Cookie" field of HTTP requests. For C2 over DNS,  converts ASCII characters into their hexadecimal values and sends the data in cleartext.
MITRE ATT&CK techniques:
T1132
Threat description: Freenki malware lists running processes using the Microsoft Windows API.
MITRE ATT&CK techniques:
T1057
Threat description: functions as a proxy server between the victim and C2 server.
MITRE ATT&CK techniques:
T1090
Threat description: gathers and beacons the MAC and IP addresses during installation.
MITRE ATT&CK techniques:
T1016
Threat description: gathers computer name and information using the systeminfo command.
MITRE ATT&CK techniques:
T1082
Threat description: gathers credentials in files for chrome, 1password, and keychains.
MITRE ATT&CK techniques:
T1552.001
Threat description: gathers information about the OS architecture, OS name, and OS version/Service pack.
MITRE ATT&CK techniques:
T1082
Threat description: gathers information on the system and local drives.
MITRE ATT&CK techniques:
T1082
Threat description: gathers information on victim’s drives and has a plugin for document listing.
MITRE ATT&CK techniques:
T1083
Threat description: gathers the local IP address.
MITRE ATT&CK techniques:
T1016
Threat description: generates a false TLS handshake using a public certificate to disguise C2 network communications.
MITRE ATT&CK techniques:
T1001
Threat description: Get-MicrophoneAudio Exfiltration module can record system microphone audio.
MITRE ATT&CK techniques:
T1123
Threat description: Get-TimedScreenshot Exfiltration module can take screenshots at regular intervals.
MITRE ATT&CK techniques:
T1113
Threat description: harvests plain-text credentials as a password filter registered on domain controllers.
MITRE ATT&CK techniques:
T1556.002
Threat description: has a command named $screenshot that may be responsible for taking screenshots of the victim machine.
MITRE ATT&CK techniques:
T1113
Threat description: has a command to collect victim system information, including the system name and OS version.
MITRE ATT&CK techniques:
T1082
Threat description: has a command to create, set, copy, or delete a specified Registry key or value.
MITRE ATT&CK techniques:
T1112
Threat description: has a command to create Registry entries for storing data under HKEY_CURRENT_USER\SOFTWARE\Microsoft\WABE\DataPath.
MITRE ATT&CK techniques:
T1112
Threat description: has a command to return a directory listing for a specified directory.
MITRE ATT&CK techniques:
T1083
Threat description: has a command to upload to its C2 server information about files on the victim mobile device, including SD card size, installed app list, SMS content, contacts, and calling history.
MITRE ATT&CK techniques:
T1083
Threat description: has a feature to list the available services on the system.
MITRE ATT&CK techniques:
T1007
Threat description: has a hard-coded primary and backup C2 string.
MITRE ATT&CK techniques:
T1008
Threat description: has a module named BeetleJuice that contains Bluetooth functionality that may be used in different ways, including transmitting encoded information from the infected system over the Bluetooth protocol, acting as a Bluetooth beacon, and identifying other Bluetooth devices in the vicinity.
MITRE ATT&CK techniques:
T1011
Threat description: has a plugin for VNC and Ammyy Admin Tool.
MITRE ATT&CK techniques:
T1219
Threat description: has a tool that can delete files.
MITRE ATT&CK techniques:
T1070.004
Threat description: has a tool that can obtain information about the local system.
MITRE ATT&CK techniques:
T1082
Threat description: has a tool that creates a new service for persistence.
MITRE ATT&CK techniques:
T1543.003
Threat description: has a VBScript for execution.
MITRE ATT&CK techniques:
T1064
Threat description: has batch files that modify the system service COMSysApp to load a malicious DLL.
MITRE ATT&CK techniques:
T1543.003
Threat description: has been known to dump credentials.
MITRE ATT&CK techniques:
T1003
Threat description: has been known to side load DLLs with a valid version of Chrome with one of their tools.
MITRE ATT&CK techniques:
T1574.002
Threat description: has been seen persisting via COM hijacking through replacement of the COM object for MruPidlList {42aedc87-2188-41fd-b9a3-0c966feabec1} or Microsoft WBEM New Event Subsystem {F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} depending on the system's CPU architecture.
MITRE ATT&CK techniques:
T1546.015
Threat description: has cleared event logs, including by using the commands wevtutil cl System and wevtutil cl Security.
MITRE ATT&CK techniques:
T1070
Threat description: has cleared event logs from victims.
MITRE ATT&CK techniques:
T1070
Threat description: has collected data from remote systems by mounting network shares with net use and using Robocopy to transfer data.
MITRE ATT&CK techniques:
T1039
Threat description: has created password-protected RAR, WinImage, and zip archives to be exfiltrated.
MITRE ATT&CK techniques:
T1560
T1486
Threat description: has created scheduled tasks that run a VBScript to execute a payload on victim machines.
MITRE ATT&CK techniques:
T1053.005
Threat description: has delivered zero-day exploits and malware to victims by injecting malicious code into specific public Web pages visited by targets within a particular sector.
MITRE ATT&CK techniques:
T1189
Threat description: has downloaded and executed additional plugins.
MITRE ATT&CK techniques:
T1105
Threat description: has dropped binaries as files named microsoft_network.exe and crome.exe.
MITRE ATT&CK techniques:
T1036
Threat description: has encrypted its payload with RC4.
MITRE ATT&CK techniques:
T1027
Threat description: has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.
MITRE ATT&CK techniques:
T1203
Threat description: has functionality to copy itself to removable media.
MITRE ATT&CK techniques:
T1091
Threat description: has gathered a process list by using .exe.
MITRE ATT&CK techniques:
T1057
Threat description: has gathered information about network IP configurations using .exe and about routing tables using .exe.
MITRE ATT&CK techniques:
T1016
Threat description: has has extensively used strategic Web compromises to target victims.
MITRE ATT&CK techniques:
T1189
Threat description: has leveraged both Spearphishing Link and Spearphishing Attachment attempting to gain User Execution.
MITRE ATT&CK techniques:
T1204
Threat description: has lured users to click links to malicious HTML applications delivered via spearphishing emails.
MITRE ATT&CK techniques:
T1204
Threat description: has obfuscated a script with Crypto Obfuscator.
MITRE ATT&CK techniques:
T1027
Threat description: has run ipconfig /all on a victim.
MITRE ATT&CK techniques:
T1016
Threat description: has sent spearphishing emails links and attachments attempting to get a user to click.
MITRE ATT&CK techniques:
T1204
Threat description: has sent spearphishing emails with attachments to victims as its primary initial access vector.
MITRE ATT&CK techniques:
T1598.002
Threat description: has sent spearphishing emails with password-protected RAR archives containing malicious Excel Web Query files (.iqy). The group has also sent spearphishing emails that contained malicious Microsoft Office documents that use the “attachedTemplate” technique to load a template from a remote server.
MITRE ATT&CK techniques:
T1598.002
Threat description: has sent spearphising emails with malicious attachments to potential victims using compromised and/or spoofed email accounts.
MITRE ATT&CK techniques:
T1598.002
Threat description: has sent spearphising emails with malicious links to potential victims.
MITRE ATT&CK techniques:
T1598.003
Threat description: has targeted manufacturers in the supply chain for the defense industry.
MITRE ATT&CK techniques:
T1195
Threat description: has the ability to enumerate files and drives.
MITRE ATT&CK techniques:
T1083
Threat description: has the ability to obtain a victim's system name and operating system version.
MITRE ATT&CK techniques:
T1082
Threat description: has the ability to remotely execute commands.
MITRE ATT&CK techniques:
T1059
Threat description: has the ability to search for a given process name in processes currently running in the system.
MITRE ATT&CK techniques:
T1057
Threat description: has the capability to delete files.
MITRE ATT&CK techniques:
T1070.004
Threat description: has the capability to download files to execute on the victim’s machine.
MITRE ATT&CK techniques:
T1105
Threat description: has the capability to execute the command net localgroup administrators.
MITRE ATT&CK techniques:
T1069
Threat description: has the capability to gather the OS version and computer name.
MITRE ATT&CK techniques:
T1082
Threat description: has the capability to obtain the time zone information and current timestamp of the victim’s machine.
MITRE ATT&CK techniques:
T1124
Threat description: has the capability to upload and download files to the victim's machine.
MITRE ATT&CK techniques:
T1105
Threat description: has used a credential stealer known as ZUMKONG that can harvest usernames and passwords stored in browsers.
MITRE ATT&CK techniques:
T1003
Threat description: has used a plug-in to gather credentials stored in files on the host by various software programs, including The Bat! email client, Mozilla password manager, Google Chrome password manager, Outlook, Internet Explorer, and Windows Credential Store.
MITRE ATT&CK techniques:
T1552.001
Threat description: has used a tool called RarStar that encodes data with a custom XOR algorithm when posting it to a C2 server.
MITRE ATT&CK techniques:
T1573
Threat description: has used a VBScript named "ggldr" that uses Google Apps Script, Sheets, and Forms services for C2.
MITRE ATT&CK techniques:
T1102
Threat description: has used both HTTP and HTTPS for C2.
MITRE ATT&CK techniques:
T1071
Threat description: has used CHM files to move concealed payloads as part of.
MITRE ATT&CK techniques:
T1218.001
Threat description: has used command-line interfaces for execution.
MITRE ATT&CK techniques:
T1059
Threat description: has used CVE-2016-7255 to escalate privileges.
MITRE ATT&CK techniques:
T1068
Threat description: has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as .
MITRE ATT&CK techniques:
T1574.002
Threat description: has used FTP to exfiltrate collected data.
MITRE ATT&CK techniques:
T1048
Threat description: has used HTTP and HTTPS for C2 communications.
MITRE ATT&CK techniques:
T1071
Threat description: has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.
MITRE ATT&CK techniques:
T1547.001
T1547.009
Threat description: has used local servers with both local network and Internet access to act as internal proxy nodes to exfiltrate data from other parts of the network without direct Internet access.
MITRE ATT&CK techniques:
T1090
Threat description: has used net user to conduct internal discovery of systems.
MITRE ATT&CK techniques:
T1087
Threat description: has used net use to conduct connectivity checks to machines.
MITRE ATT&CK techniques:
T1049
Threat description: has used PowerShell Empire.
MITRE ATT&CK techniques:
T1059.001
Threat description: has used RAR to compress, encrypt, and password-protect files prior to exfiltration.
MITRE ATT&CK techniques:
T1560
T1486
Threat description: has used RAR to compress files before moving them outside of the victim network.
MITRE ATT&CK techniques:
T1560
Threat description: has used Registry keys to detect and avoid executing in potential sandboxes.
MITRE ATT&CK techniques:
T1518.001
Threat description: has used Registry Run keys to establish persistence for its downloader tools known as HARDTACK and SHIPBREAD.
MITRE ATT&CK techniques:
T1547.001
Threat description: has used remote code execution to download subsequent payloads.
MITRE ATT&CK techniques:
T1105
Threat description: has used rundll32.exe in a Registry value to establish persistence.
MITRE ATT&CK techniques:
T1218.011
Threat description: has used scheduled task raw XML with a backdated timestamp of June 2, 2016.
MITRE ATT&CK techniques:
T1070.006
Threat description: has used spearphishing with a link to trick victims into clicking on a link to a zip file containing malicious files.
MITRE ATT&CK techniques:
T1598.003
Threat description: has used spearphishing with links to deliver files with exploits to initial victims. The group has used embedded image tags (known as web bugs) with unique, per-recipient tracking links in their emails for the purpose of identifying which recipients opened messages.
MITRE ATT&CK techniques:
T1598.003
Threat description: has used TCP port 8080 for C2.
MITRE ATT&CK techniques:
T1043
Threat description: has used the command cmstp.exe /s /ns C:\Users\ADMINI~W\AppData\Local\Temp\XKNqbpzl.txt to bypass AppLocker and launch a malicious script.
MITRE ATT&CK techniques:
T1218.003
Threat description: has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.
MITRE ATT&CK techniques:
T1046
Threat description: has used  to gather the OS version, as well as information on the system configuration, BIOS, the motherboard, and the processor.
MITRE ATT&CK techniques:
T1082
Threat description: has used  to get information on processes.
MITRE ATT&CK techniques:
T1057
Threat description: has used tools to exploit Windows vulnerabilities in order to escalate privileges. The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.
MITRE ATT&CK techniques:
T1068
Threat description: has used tools to perform keylogging.
MITRE ATT&CK techniques:
T1056
Threat description: has used to use DLL side-loading to evade anti-virus and to maintain persistence on a victim.
MITRE ATT&CK techniques:
T1574.002
Threat description: has used valid accounts for privilege escalation.
MITRE ATT&CK techniques:
T1078
Threat description: has used watering holes to deliver files with exploits to initial victims.
MITRE ATT&CK techniques:
T1189
Threat description: has used WMI for execution.
MITRE ATT&CK techniques:
T1047
Threat description: hooks processes by modifying IAT pointers to CreateWindowEx.
MITRE ATT&CK techniques:
T1056.004
Threat description: identified and extracted all Word documents on a server by using a command containing * .doc and *.docx. The actors also searched for documents based on a specific date range and attempted to identify all installed software on a victim.
MITRE ATT&CK techniques:
T1083
Threat description: identifies files with certain extensions from USB devices, then copies them to a predefined directory.
MITRE ATT&CK techniques:
T1083
Threat description: If running in a Windows environment,  saves a DLL to disk that is injected into the explorer.exe process to execute the payload.  can also be configured to inject and execute within specific processes.
MITRE ATT&CK techniques:
T1055
Threat description: If the victim is using PowerShell 3.0 or later,  writes its decoded payload to an alternate data stream (ADS) named kernel32.dll that is saved in %PROGRAMDATA%\Windows\.
MITRE ATT&CK techniques:
T1564.004
Threat description: injects itself into the secure shell (SSH) process.
MITRE ATT&CK techniques:
T1055
Threat description: In one instance,  added  as a service with a display name of "Corel Writing Tools Utility."
MITRE ATT&CK techniques:
T1036
Threat description: installer/uninstaller component deletes itself if it encounters a version of Windows earlier than Windows XP or identifies security-related processes running.
MITRE ATT&CK techniques:
T1070.004
Threat description: installer uses WMI to search for antivirus display names.
MITRE ATT&CK techniques:
T1047
Threat description: installs a service on the remote system, executes the command, then uninstalls the service.
MITRE ATT&CK techniques:
T1569.002
Threat description: installs itself as a service for persistence.
MITRE ATT&CK techniques:
T1543.003
Threat description: installs itself as a service to maintain persistence.
MITRE ATT&CK techniques:
T1543.003
Threat description: installs itself in %ALLUSERPROFILE%\\Application Data\Microsoft\MediaPlayer\updatewindws.exe; the directory name is missing a space and the file name is missing the letter "o."
MITRE ATT&CK techniques:
T1036
Threat description: installs VNC server software that executes through rundll32.
MITRE ATT&CK techniques:
T1218.011
Threat description: is a Web shell that appears to be exclusively used by . It is installed as an ISAPI filter on Exchange servers and shares characteristics with the  Web shell.
MITRE ATT&CK techniques:
T1505.003
Threat description: is capable of capturing keystrokes on victims.
MITRE ATT&CK techniques:
T1056
Threat description: is capable of capturing screenshots.
MITRE ATT&CK techniques:
T1113
Threat description: is capable of capturing video.
MITRE ATT&CK techniques:
T1125
Threat description: is capable of downloading a file from a specified URL.
MITRE ATT&CK techniques:
T1105
Threat description: is capable of enumerating Registry keys and values.
MITRE ATT&CK techniques:
T1012
Threat description: is capable of gathering system information.
MITRE ATT&CK techniques:
T1082
Threat description: is capable of leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex for C2.
MITRE ATT&CK techniques:
T1102
Threat description: is capable of modifying the Registry.
MITRE ATT&CK techniques:
T1112
Threat description: is capable of providing Meterpreter shell access.
MITRE ATT&CK techniques:
T1059
Threat description: is capable of spawning a reverse shell on a victim.
MITRE ATT&CK techniques:
T1059
Threat description: is known to use PowerShell.
MITRE ATT&CK techniques:
T1059.001
Threat description: is loaded and executed by a highly obfuscated launcher.
MITRE ATT&CK techniques:
T1027
Threat description: is used for proxying connections to obfuscate command and control infrastructure.
MITRE ATT&CK techniques:
T1090
Threat description: It is believed that a patch management system for an anti-virus product commonly installed among targeted companies was used to distribute the  malware.
MITRE ATT&CK techniques:
T1072
Threat description: kills antimalware running process.
MITRE ATT&CK techniques:
T1562.001
Threat description: launched an HTTP malware variant and a Port 22 malware variant using a legitimate executable that loaded the malicious DLL.
MITRE ATT&CK techniques:
T1574.002
Threat description: launches a DLL file that gets executed as a service using svchost.exe
MITRE ATT&CK techniques:
T1569.002
Threat description: leverages a known zero-day vulnerability in Adobe Flash to execute the implant into the victims’ machines.
MITRE ATT&CK techniques:
T1203
Threat description: leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.
MITRE ATT&CK techniques:
T1106
Threat description: lists local users and session information.
MITRE ATT&CK techniques:
T1033
Threat description: lists the current processes running.
MITRE ATT&CK techniques:
T1057
Threat description: lists the running processes on the system.
MITRE ATT&CK techniques:
T1057
Threat description: looked for a specific process running on infected servers.
MITRE ATT&CK techniques:
T1057
Threat description: malware can download a remote access tool, NanoCore, and inject into another process.
MITRE ATT&CK techniques:
T1055
Threat description: malware can use cmd.exe to download and execute payloads and to execute commands on the system.
MITRE ATT&CK techniques:
T1059
Threat description: malware can use PowerShell commands to download and execute a payload and open a decoy document on the victim’s machine.
MITRE ATT&CK techniques:
T1059.001
Threat description: malware gathers system information via WMI, including the system directory, build number, serial number, version, manufacturer, model, and total physical memory.
MITRE ATT&CK techniques:
T1082
Threat description: malware IndiaIndia saves information gathered about the victim to a file that is uploaded to one of its 10 C2 servers.  malware RomeoDelta copies specified directories from the victim's machine, then archives and encrypts the directories before uploading to its C2 server.
MITRE ATT&CK techniques:
T1005
Threat description: malware is capable of keylogging.
MITRE ATT&CK techniques:
T1056
Threat description: Malware used by  is capable of watching the victim's screen.
MITRE ATT&CK techniques:
T1113
Threat description: may collect process information by running tasklist on a victim.
MITRE ATT&CK techniques:
T1057
Threat description: may collect user account information by running net user /domain or a series of other commands on a victim.
MITRE ATT&CK techniques:
T1087
Threat description: may create a .lnk file to itself that is saved in the Start menu folder. It may also create the Registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ IMJPMIJ8.1{3 characters of Unique Identifier}.
MITRE ATT&CK techniques:
T1547.001
Threat description: may query the Registry by running reg query on a victim.
MITRE ATT&CK techniques:
T1012
Threat description: may use net start to display running services.
MITRE ATT&CK techniques:
T1007
Threat description: may use netstat -ano to display active network connections.
MITRE ATT&CK techniques:
T1049
Threat description: MISC::AddSid module can appended any SID or user/group account to a user's SID-History.  also utilizes  to expand the scope of other components such as generated Kerberos Golden Tickets and DCSync beyond a single domain.
MITRE ATT&CK techniques:
T1134.005
Threat description: modified the Registry to perform multiple techniques through the use of .
MITRE ATT&CK techniques:
T1112
Threat description: modifies the tty_tickets line in the sudoers file.
MITRE ATT&CK techniques:
T1548.003
Threat description: monitors victims for insertion of removable drives. When dropped onto a second victim, it also enumerates drives connected to the system.
MITRE ATT&CK techniques:
T1120
Threat description: obfuscates C2 traffic with an altered version of base64.
MITRE ATT&CK techniques:
T1001
Threat description: obtains a build identifier as well as victim hard drive information from Windows registry key HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum. Another  variant gathers the victim storage volume serial number and the storage device name.
MITRE ATT&CK techniques:
T1082
Threat description: obtains the target's IP address and local network segment.
MITRE ATT&CK techniques:
T1016
Threat description: One persistence mechanism used by  is to set itself to be executed at system startup by adding a Registry value under one of the following Registry keys: <br>HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ <br>HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ <br>HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run <br>HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
MITRE ATT&CK techniques:
T1547.001
Threat description: One  variant connected to its C2 server over port 8080.
MITRE ATT&CK techniques:
T1043
Threat description: One  variant decrypts an archive using an RC4 key, then decompresses and installs the decrypted malicious DLL module. Another variant decodes the embedded file by XORing it with the value "0x35".
MITRE ATT&CK techniques:
T1140
Threat description: One variant of  locates existing driver services that have been disabled and drops its driver component into one of those service's paths, replacing the legitimate executable. The malware then sets the hijacked service to start automatically to establish persistence.
MITRE ATT&CK techniques:
T1574.010
Threat description: packed an executable by base64 encoding the PE file and breaking it up into numerous lines.
MITRE ATT&CK techniques:
T1027.002
Threat description: performs a connection test to discover remote systems in the network
MITRE ATT&CK techniques:
T1018
Threat description: performs code injection injecting its own functions to browser processes.
MITRE ATT&CK techniques:
T1055
Threat description: performs local network configuration discovery using ipconfig.
MITRE ATT&CK techniques:
T1016
Threat description: performs XOR encryption.
MITRE ATT&CK techniques:
T1573
Threat description: persists by creating a Registry entry in HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.
MITRE ATT&CK techniques:
T1547.001
Threat description: persists through a scheduled task that executes it every minute.
MITRE ATT&CK techniques:
T1053.005
Threat description: places scripts in the startup folder for persistence.
MITRE ATT&CK techniques:
T1547.001
Threat description: presents an input prompt asking for the user's login and password.
MITRE ATT&CK techniques:
T1056
Threat description: prompts the user for credentials.
MITRE ATT&CK techniques:
T1056
Threat description: prompts the users for credentials.
MITRE ATT&CK techniques:
T1056
Threat description: provides command-line access to the compromised system.
MITRE ATT&CK techniques:
T1059
Threat description: queried the Registry to identify victim information.
MITRE ATT&CK techniques:
T1012
Threat description: regained access after eviction via the corporate VPN solution with a stolen VPN certificate, which they had extracted from a compromised host.
MITRE ATT&CK techniques:
T1133
Threat description: regularly deploys both publicly available and custom password retrieval tools on victims.
MITRE ATT&CK techniques:
T1003
Threat description: removed certain files and replaced them so they could not be retrieved.
MITRE ATT&CK techniques:
T1070.004
Threat description: Responses from the  C2 server are base32-encoded.
MITRE ATT&CK techniques:
T1132
Threat description: runs the command net start on a victim.
MITRE ATT&CK techniques:
T1007
Threat description: saves information from its keylogging routine as a .zip file in the present working directory.
MITRE ATT&CK techniques:
T1074
Threat description: saves itself with a leading "." to make it a hidden file.
MITRE ATT&CK techniques:
T1564.001
Threat description: saves one of its files as mpr.dll in the Windows folder, masquerading as a legitimate library file.
MITRE ATT&CK techniques:
T1036
Threat description: scans the victim for files that contain certain keywords from a list that is obtained from the C2 as a text file. It also collects information about installed software.
MITRE ATT&CK techniques:
T1083
Threat description: scans to identify open ports on the victim.
MITRE ATT&CK techniques:
T1046
Threat description: scrapes memory for properly formatted payment card data.
MITRE ATT&CK techniques:
T1005
Threat description: searches and reads the value of the Windows Update Registry Run key.
MITRE ATT&CK techniques:
T1012
Threat description: searches for files on the victim's machine.
MITRE ATT&CK techniques:
T1083
Threat description: searches for interesting files (either a default or customized set of file extensions) on the local system.  will scan the My Recent Documents, Desktop, Temporary Internet Files, and TEMP directories.  also collects information stored in the Windows Address Book.
MITRE ATT&CK techniques:
T1005
Threat description: searches through connected drives for removable storage devices.
MITRE ATT&CK techniques:
T1120
Threat description: searches through the drive containing the OS, then all drive letters C through to Z, for documents matching certain extensions.
MITRE ATT&CK techniques:
T1083
Threat description: selective infector modifies executables stored on removable media as a method of spreading across computers.
MITRE ATT&CK techniques:
T1091
Threat description: sends collected files back over same C2 channel.
MITRE ATT&CK techniques:
T1041
Threat description: sent emails to victims with malicious Microsoft Office documents attached.
MITRE ATT&CK techniques:
T1598.002
Threat description: sent spearphishing emails with malicious attachments in RTF and XLSM formats to deliver initial exploits.
MITRE ATT&CK techniques:
T1598.002