QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: EXOTIC LILY has searched for information on targeted individuals on business databases including RocketReach and CrunchBase.
MITRE ATT&CK techniques:
- T1597: Search Closed Sources
Threat description: LAPSUS$ has purchased credentials and session tokens from criminal underground forums.
MITRE ATT&CK techniques:
- T1597.002: Search Closed Sources - Purchase Technical Data
Threat description: APT28 has used spearphishing to compromise credentials.
MITRE ATT&CK techniques:
- T1598: Phishing for Information
Threat description: ZIRCONIUM targeted presidential campaign staffers with credential phishing e-mails.
MITRE ATT&CK techniques:
- T1598: Phishing for Information
Threat description: Astaroth has been delivered via malicious e-mail attachments.
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: Sidewinder has sent e-mails with malicious attachments that lead victims to credential harvesting websites.
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: AADInternals can send phishing emails containing malicious links designed to collect users’ credentials.
MITRE ATT&CK techniques:
- T1598.003: Phishing for Information - Spearphishing Link
Threat description: SMOKEDHAM has been delivered via malicious links in phishing emails.
MITRE ATT&CK techniques:
- T1598.003: Phishing for Information - Spearphishing Link
Threat description: Sidewinder has sent e-mails with malicious links to credential harvesting websites.
MITRE ATT&CK techniques:
- T1598.003: Phishing for Information - Spearphishing Link
Threat description: SYNful Knock is malware that is inserted into a network device by patching the operating system image.
MITRE ATT&CK techniques:
- T1601.001: Modify System Image - Patch System Image
Threat description: BITTER has registered domains to stage payloads.
MITRE ATT&CK techniques:
- T1608.001: Stage Capabilities - Upload Malware
Threat description: During Night Dragon, threat actors uploaded commonly available hacker tools to compromised web servers.
MITRE ATT&CK techniques:
- T1608.001: Stage Capabilities - Upload Malware
Threat description: Gamaredon Group has registered domains to stage payloads.
MITRE ATT&CK techniques:
- T1608.001: Stage Capabilities - Upload Malware
Threat description: For C0010, UNC3890 actors staged tools on their infrastructure to download directly onto a compromised system.
MITRE ATT&CK techniques:
- T1608.002: Stage Capabilities - Upload Tool
Threat description: Lazarus Group has hosted custom and open-source tools on compromised as well as Lazarus Group-controlled servers.
MITRE ATT&CK techniques:
- T1608.002: Stage Capabilities - Upload Tool
Threat description: Threat Group-3390 has staged tools, including gsecdump and WCE, on previously compromised websites.
MITRE ATT&CK techniques:
- T1608.002: Stage Capabilities - Upload Tool
Threat description: For C0010, the threat actors compromised the login page of a legitimate Israeli shipping company and likely established a watering hole that collected visitor information.
MITRE ATT&CK techniques:
- T1608.004: Stage Capabilities - Drive-by Target
Threat description: Threat Group-3390 has embedded malicious code into websites to screen a potential victim's IP address and then exploit their browser if they are of interest.
MITRE ATT&CK techniques:
- T1608.004: Stage Capabilities - Drive-by Target
Threat description: Silent Librarian has cloned victim organization login pages and staged them for later use in credential harvesting campaigns. Silent Librarian has also made use of a variety of URL shorteners for these staged websites.
MITRE ATT&CK techniques:
- T1608.005: Stage Capabilities - Link Target
Threat description: Kinsing was executed with an Ubuntu container entry point that runs shell scripts.
MITRE ATT&CK techniques:
- T1609: Container Administration Command
Threat description: Peirates can deploy a pod that mounts its node’s root file system, then execute a command to create a reverse shell on the node.
MITRE ATT&CK techniques:
- T1610: Deploy Container
Threat description: Hildegard has used the BOtB tool that can break out of containers.
MITRE ATT&CK techniques:
- T1611: Escape to Host
Threat description: Peirates can gain a reverse shell on a host node by mounting the Kubernetes hostPath.
MITRE ATT&CK techniques:
- T1611: Escape to Host
Threat description: Saint Bot has conducted system locale checks to see if the compromised host is in Russia, Ukraine, Belarus, Armenia, Kazakhstan, or Moldova.
MITRE ATT&CK techniques:
- T1614: System Location Discovery
Threat description: Misdat has attempted to detect if a compromised host had a Japanese keyboard via the Windows API call `GetKeyboardType`.
MITRE ATT&CK techniques:
- T1614.001: System Location Discovery - System Language Discovery
Threat description: Donut can generate code modules that enable in-memory execution of VBScript, JScript, EXE, DLL, and dotNET payloads.
MITRE ATT&CK techniques:
- T1620: Reflective Code Loading
Threat description: ROKRAT can check for debugging tools.
MITRE ATT&CK techniques:
- T1622: Debugger Evasion
Threat description: Saint Bot has used `is_debugger_present` as part of its environmental checks.
MITRE ATT&CK techniques:
- T1622: Debugger Evasion
Threat description: ThiefQuest uses a function named "is_debugging" to perform anti-debugging logic. The function invokes "sysctl" checking the returned value of "P_TRACED". ThiefQuest also calls "ptrace" with the "PTRACE_DENY_ATTACH" flag to prevent debugging.
MITRE ATT&CK techniques:
- T1622: Debugger Evasion
Threat description: XCSSET uses the "plutil" command to modify the "LSUIElement", "DFBundleDisplayName", and "CFBundleIdentifier" keys in the "/Contents/Info.plist" file to change how XCSSET is visible on the system.
MITRE ATT&CK techniques:
- T1647: Plist File Modification
Threat description: If the user clicks on the link, he will be prompted to download a RAR file that contains the stage 1 malware/lure, which he will execute afterwards
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
- T1105: Ingress Tool Transfer
Threat description: For both the receiving of C2 commands and exfiltration, Remexi uses the Microsoft Background Intelligent Transfer Service (BITS) mechanism to communicate with the C2 over HTTP
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
- T1071: Application Layer Protocol
- T1132: Data Encoding
- T1041: Exfiltration Over C2 Channel
Threat description: The malware initiates its main function of capturing user keystrokes and sending them to the control server using standard Windows networking APIs
MITRE ATT&CK techniques:
- T1056: Input Capture
- T1056.001: Input Capture - Keylogging
Threat description: f) Hadoop YARN ResourceManager – Command Execution (exploit) g) CVE-2016-3088: Apache ActiveMQ Fileserver File Upload Remote Code Execution Vulnerability
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
- T1105: Ingress Tool Transfer
Threat description: The malware also contains an embedded .NET wrapper DLL for creating and managing scheduled tasks on Windows systems
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: """beacon"" payload can receive C2 from one protocol and respond on another. This is typically a mixture of HTTP, HTTPS, and DNS traffic."
MITRE ATT&CK techniques:
- T1026: Multiband Communication
Threat description: 2 contains a "Destroy" plug-in that destroys data stored on victim hard drives by overwriting file contents.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: abuses NTFS transactions to launch and conceal malicious processes.
MITRE ATT&CK techniques:
- T1055.013: Process Injection - Process Doppelgänging
Threat description: actors leverage legitimate credentials to log into external remote services.
MITRE ATT&CK techniques:
- T1133: External Remote Services
- T1078: Valid Accounts
Threat description: actors use nbtscan to discover vulnerable systems.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: actors use the Hunter tool to conduct network service discovery for vulnerable systems.
MITRE ATT&CK techniques:
- T1046: Network Service Discovery
Threat description: added junk data to outgoing UDP packets to peer implants.
MITRE ATT&CK techniques:
- T1001: Data Obfuscation
Threat description: adds an entry to the rc.common file for persistence.
MITRE ATT&CK techniques:
- T1037.004: Boot or Logon Initialization Scripts - RC Scripts
Threat description: adds a new service named NetAdapter in an apparent attempt to masquerade as a legitimate service.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: A Destover-like variant used by  uses a batch file mechanism to delete its binaries from the system.
MITRE ATT&CK techniques:
- T1064: Scripting
Threat description: Adversaries can instruct  to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
- T1078: Valid Accounts
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: After collecting files and logs from the victim,  encrypts some collected data with Blowfish.
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: After decrypting itself in memory,  downloads a DLL file from its C2 server and loads it in the memory space of a hidden Internet Explorer process. This “downloaded” file is actually not dropped onto the system.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: After encrypting C2 data,  converts it into a hexadecimal representation and then encodes it into base64.
MITRE ATT&CK techniques:
- T1001: Data Obfuscation
Threat description: After encrypting log files, the log encryption module in  deletes the original, unencrypted files from the host.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: After initial compromise,  will download a second stage to establish a more permanent presence on the affected system.
MITRE ATT&CK techniques:
- T1104: Multi-Stage Channels
Threat description: After using raw sockets to communicate with its C2 server,  uses a decrypted string to create HTTP POST requests.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: A  implant file was named ASPNET_FILTER.DLL, mimicking the legitimate ASP.NET ISAPI filter DLL with the same name.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: A  JavaScript backdoor has used Google Apps Script as its C2 server.
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: allows adversaries to modify the way the "beacon" payload communicates. This is called "Malleable C2" in the  manual and is intended to allow a penetration test team to mimic known APT C2 methods.
MITRE ATT&CK techniques:
- T1095: Non-Application Layer Protocol
Threat description: A  malware sample adds persistence on the system by creating a shortcut in the user’s Startup folder.
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: A  malware sample performs reflective DLL injection.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: An  downloader establishes SOCKS5 connections for its initial C2.
MITRE ATT&CK techniques:
- T1090: Proxy
- T1095: Non-Application Layer Protocol
Threat description: An  downloader first establishes a SOCKS5 connection to 192.157.198[.]103 using TCP port 1913; once the server response is verified, it then requests a connection to 192.184.60[.]229 on TCP port 81.
MITRE ATT&CK techniques:
- T1104: Multi-Stage Channels
Threat description: An  HTTP malware variant used Base64 to encode communications to the C2 server.
MITRE ATT&CK techniques:
- T1132: Data Encoding
Threat description: appends a file signature header (randomly selected from six file types) to encrypted data prior to upload or download.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: attempted to trick targets into clicking on a link featuring a seemingly legitimate domain from Adobe.com to download their malware and gain initial access.
MITRE ATT&CK techniques:
- T1598.003: Phishing for Information - Spearphishing Link
Threat description: attempts to access the ADMIN$, C$\Windows, D$\Windows, and E$\Windows shares on the victim with its current privileges.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: attempts to add a shortcut file in the Startup folder to achieve persistence. If this fails, it attempts to add Registry Run keys.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: A  variant uses fake TLS to communicate with the C2 server.
MITRE ATT&CK techniques:
- T1095: Non-Application Layer Protocol
Threat description: A Word document delivering  prompts the user to enable macro execution.
MITRE ATT&CK techniques:
- T1204: User Execution
Threat description: Based on comparison of  versions,  made an effort to obfuscate strings in the malware that could be used as IoCs, including the mutex name and named pipe.
MITRE ATT&CK techniques:
- T1027.005: Obfuscated Files or Information - Indicator Removal from Tools
Threat description: Before being appended to image files,  commands are encrypted with a key composed of both a hard-coded value and a string contained on that day's tweet. To decrypt the commands, an investigator would need access to the intended malware sample, the day's tweet, and the image file containing the command.
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: C2 servers communicated with malware over TCP 8081, 8282, and 8083.
MITRE ATT&CK techniques:
- T1571: Non-Standard Port
Threat description: C2 traffic attempts to evade detection by resembling data generated by legitimate messenger applications, such as MSN and Yahoo! messengers.
MITRE ATT&CK techniques:
- T1001: Data Obfuscation
Threat description: can add or remove applications or ports on the Windows firewall or disable it entirely.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: can alter the victim's proxy configuration.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: can be configured to use multiple network protocols to avoid network-based detection.
MITRE ATT&CK techniques:
- T1026: Multiband Communication
Threat description: can be used as a persistence proxy technique to execute a helper DLL when netsh.exe is executed.
MITRE ATT&CK techniques:
- T1546.007: Event Triggered Execution - Netsh Helper DLL
Threat description: can be used to create  to upload files from a compromised host.
MITRE ATT&CK techniques:
- T1048: Exfiltration Over Alternative Protocol
Threat description: can be used to subvert controls and possibly conceal command execution by not directly invoking .
MITRE ATT&CK techniques:
- T1202: Indirect Command Execution
Threat description: can disable Microsoft Office Protected View by changing Registry keys.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: can download files off the target system to send back to the server.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: can download remote files.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: can establish persistence by creating a .lnk file in the Start menu.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: can establish persistence by creating a .lnk file in the Start menu or by modifying existing .lnk files to execute the malware through cmd.exe.
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: can establish using a AppCertDLLs Registry key.
MITRE ATT&CK techniques:
- T1546.009: Event Triggered Execution - AppCert DLLs
Threat description: can exploit vulnerabilities such as MS14-058.
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
Threat description: can gather browser usernames and passwords.
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: can obtain passwords from common browsers and FTP clients.
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: can obtain the victim user name.
MITRE ATT&CK techniques:
- T1069: Permission Groups Discovery
- T1033: System Owner/User Discovery
Threat description: can overwrite Registry settings to reduce its visibility on the victim.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: can retrieve usernames from compromised hosts.
MITRE ATT&CK techniques:
- T1087: Account Discovery
Threat description: can run a command on another machine using .
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: can scan local network for open SMB.
MITRE ATT&CK techniques:
- T1135: Network Share Discovery
Threat description: can set its "beacon" payload to reach out to the C2 server on an arbitrary and random interval. In addition it will break large data sets into smaller chunks for exfiltration.
MITRE ATT&CK techniques:
- T1029: Scheduled Transfer
Threat description: can sleep for a specific time and be set to communicate at specific intervals.
MITRE ATT&CK techniques:
- T1029: Scheduled Transfer
Threat description: can start a VNC-based remote desktop server and tunnel the connection through the already established C2 channel.
MITRE ATT&CK techniques:
- T1021.001: Remote Services - Remote Desktop Protocol
Threat description: can terminate a specific process by its process id.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: can use the command-line utility cacls.exe to change file permissions.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1222: File and Directory Permissions Modification
Threat description: can use Windows Authentication Packages for persistence.
MITRE ATT&CK techniques:
- T1547.002: Boot or Logon Autostart Execution - Authentication Package
Threat description: captured screenshots and desktop video recordings.
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: captures and DES-encrypts credentials before writing the username and password to a log file, C:\log.txt.
MITRE ATT&CK techniques:
- T1056: Input Capture
Threat description: cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: clears event logs.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: clears the system event logs.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: collects a list of install programs and services on the system’s machine.
MITRE ATT&CK techniques:
- T1007: System Service Discovery
Threat description: collects files with the following extensions: .ppt, .pptx, .pdf, .doc, .docx, .xls, .xlsx, .docm, .rtf, .inp, .xlsm, .csv, .odt, .pps, .vcf and sends them back to the C2 server.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Commands under net user can be used in  to gather information about and manipulate user accounts.
MITRE ATT&CK techniques:
- T1087: Account Discovery
Threat description: communicates over ports 80, 443, 53, and 8080 via raw sockets instead of the protocols usually associated with the ports.
MITRE ATT&CK techniques:
- T1043: Commonly Used Port
Threat description: communicates using HTTPS and uses a custom encryption cipher to encrypt the HTTPS message body.
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: compromised McAfee ePO to move laterally by distributing malware as a software deployment task.
MITRE ATT&CK techniques:
- T1072: Software Deployment Tools
Threat description: connects to a predefined domain on port 443 to exfil gathered information.
MITRE ATT&CK techniques:
- T1048: Exfiltration Over Alternative Protocol
Threat description: connects to external C2 infrastructure over the HTTP port.
MITRE ATT&CK techniques:
- T1043: Commonly Used Port
Threat description: contains a collection of Exfiltration modules that can harvest credentials from Group Policy Preferences, Windows vault credential objects, or using .
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: contains a collection of Privesc-PowerUp modules that can discover and exploit various path interception opportunities in services, processes, and variables.
MITRE ATT&CK techniques:
- T1034: Path Interception
Threat description: contains a command to download and execute a file from a remotely hosted URL using WinINet HTTP requests.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: contains a module to steal credentials from Web browsers on the victim machine.
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: contains the execFile function to execute a specified file on the system using the NSTask:launch method.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: contains the getFirefoxPassword function to attempt to locate Firefox passwords.
MITRE ATT&CK techniques:
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: contains the getInstalledAPP function to run ls -la /Applications to gather what applications are installed.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: copies documents under 15MB found on the victim system to is the user's %temp%\SMB\ folder. It also copies files from USB devices to a predefined directory.
MITRE ATT&CK techniques:
- T1074: Data Staged
Threat description: copies files from removable drives to C:\system.
MITRE ATT&CK techniques:
- T1074: Data Staged
Threat description: creates and uses a VBScript as part of its persistent execution.
MITRE ATT&CK techniques:
- T1064: Scripting
Threat description: creates a new service named “ntssrv” to execute the payload.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
- T1569.002: System Services - Service Execution
Threat description: creates a Registry subkey that registers a new service.
MITRE ATT&CK techniques:
- T1112: Modify Registry
- T1543.003: Create or Modify System Process - Windows Service
Threat description: creates Registry keys to allow itself to run as various services.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: creates valid users to provide access to the system.
MITRE ATT&CK techniques:
- T1078: Valid Accounts
Threat description: credential stealer ZUMKONG emails credentials from the victim using HTTP POST requests.
MITRE ATT&CK techniques:
- T1095: Non-Application Layer Protocol
Threat description: deletes shadow copies from the victim.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: DES-encrypts captured credentials using the key 12345678 before writing the credentials to a log file.
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: downloaded and launched code within a SCT file.
MITRE ATT&CK techniques:
- T1064: Scripting
Threat description: downloads and executes additional PowerShell code and Windows binaries.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: dropper creates VBS scripts on the victim’s machine.
MITRE ATT&CK techniques:
- T1064: Scripting
Threat description: drops commands for a second victim onto a removable media drive inserted into the first victim, and commands are executed when the drive is inserted into the second victim.
MITRE ATT&CK techniques:
- T1092: Communication Through Removable Media
Threat description: dumped the login data database from \AppData\Local\Google\Chrome\User Data\Default\Login Data.
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: dumps usernames and passwords from Firefox, Internet Explorer, and Outlook.
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: employs the same encoding scheme as  for data it stages. Data is compressed with zlib, and bytes are rotated four times before being XOR'ed with 0x23.
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: encodes files before exfiltration.
MITRE ATT&CK techniques:
- T1132: Data Encoding
Threat description: encrypts collected data using a single byte XOR key.
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: encrypts with the 3DES algorithm and a hardcoded key prior to exfiltration.
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: establishes by infecting the Security Accounts Manager (SAM) DLL to load a malicious DLL dropped to disk.
MITRE ATT&CK techniques:
- T1547.008: Boot or Logon Autostart Execution - LSASS Driver
Threat description: establishes persistence by creating a shortcut in the Windows startup folder to run a script each time the user logs in.
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: executes a batch script to store discovery information in %TEMP%\info.dat and then uploads the temporarily file to the remote C2 server.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: executes additional Jscript and VBScript code on the victim's machine.
MITRE ATT&CK techniques:
- T1064: Scripting
Threat description: exfiltrates data by uploading it to accounts created by the actors on Web cloud storage providers for the adversaries to retrieve later.
MITRE ATT&CK techniques:
- T1048: Exfiltration Over Alternative Protocol
Threat description: exfiltrates screenshot files to its C2 server.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: gathers information on local groups and members on the victim’s machine.
MITRE ATT&CK techniques:
- T1087: Account Discovery
Threat description: gathers user names from infected hosts.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: Get-ProcessTokenGroup Privesc-PowerUp module can enumerate all SIDs associated with its current token.
MITRE ATT&CK techniques:
- T1087: Account Discovery
Threat description: has access to destructive malware that is capable of overwriting a machine's Master Boot Record (MBR).
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: has a command to retrieve information about connected users.
MITRE ATT&CK techniques:
- T1087: Account Discovery
Threat description: has a module to clear event logs with PowerShell.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: has attached a malicious document to an email to gain initial access.
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: has cleared logs during post compromise cleanup activities.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: has compressed and encrypted data into password-protected RAR archives prior to exfiltration.
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: has created a scheduled task named “AdobeFlashSync” to establish persistence.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: has delivered zero-day exploits and malware to victims via targeted emails containing a link to malicious content hosted on an uncommon Web server.
MITRE ATT&CK techniques:
- T1598.003: Phishing for Information - Spearphishing Link
Threat description: has deployed backup web shells and obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network.
MITRE ATT&CK techniques:
- T1108: Redundant Access
Threat description: has deployed Meterpreter stagers and SplinterRAT instances in the victim network after moving laterally.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: has disabled host-based firewalls. The group has also globally opened port 3389.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: has distributed targeted emails containing links to malicious documents with embedded macros.
MITRE ATT&CK techniques:
- T1598.003: Phishing for Information - Spearphishing Link
Threat description: has distributed targeted emails containing Word documents with embedded malicious macros.
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: has established persistence by creating autostart extensibility point (ASEP) Registry entries in the Run key and other Registry keys, as well as by creating shortcuts in the Internet Explorer Quick Start folder.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: has exfiltrated data in HTTP POST headers.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: has exploited the CVE-2016-0167 local vulnerability.
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
Threat description: has functionality to copy itself to network shares.
MITRE ATT&CK techniques:
- T1080: Taint Shared Content
Threat description: has interacted with compromised systems to browse and copy files through its graphical user interface in  sessions.
MITRE ATT&CK techniques:
- T1061: Graphical User Interface
Threat description: has obfuscated DLLs and functions using dummy API calls inserted between real instructions.
MITRE ATT&CK techniques:
- T1027.001: Obfuscated Files or Information - Binary Padding
Threat description: has registered a Windows shell script under the Registry key HKCU\Environment\UserInitMprLogonScript to establish persistence.
MITRE ATT&CK techniques:
- T1037: Boot or Logon Initialization Scripts
Threat description: has sent malicious Office documents via email as part of spearphishing campaigns as well as executables disguised as documents.
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: has sent spearphishing emails with malicious attachments, including .rtf, .doc, and .xls files.
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: has sent spearphishing emails with various attachment types to corporate and personal email accounts of victim organizations. Attachment types have included .rtf, .doc, .xls, archives containing LNK files, and password protected archives containing .exe and .scr executables.
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: has targeted victims using spearphishing emails with malicious Microsoft Word attachments.
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: has targeted victims with spearphishing emails containing malicious Microsoft Word documents.
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: has the ability to initiate keylogging and screen captures.
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: has used a Metasploit PowerShell module to download and execute shellcode and to set up a local listener.  has also used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.
MITRE ATT&CK techniques:
- T1064: Scripting
Threat description: has used a Registry Run key to establish persistence by executing JavaScript code within the rundll32.exe process.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: has used a tool known as RemoteExec (similar to ) to remotely execute batch scripts and binaries.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: has used a tool that can obtain info about local and global group users, power users, and administrators.
MITRE ATT&CK techniques:
- T1087: Account Discovery
Threat description: has used CVE-2015-4902 to bypass security features.
MITRE ATT&CK techniques:
- T1211: Exploitation for Defense Evasion
Threat description: has used encoded PowerShell scripts uploaded to  installations to download and install , as well as to evade defenses.
MITRE ATT&CK techniques:
- T1064: Scripting
Threat description: has used JavaScript that communicates over HTTP or HTTPS to attacker controlled domains to download additional frameworks.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: has used legitimate VPN, RDP, Citrix, or VNC credentials to maintain access to a victim environment.
MITRE ATT&CK techniques:
- T1133: External Remote Services
- T1078: Valid Accounts
Threat description: has used macros in Word documents that would download a second stage if executed.
MITRE ATT&CK techniques:
- T1064: Scripting
Threat description: has used malicious macros embedded inside Office documents to execute files.
MITRE ATT&CK techniques:
- T1064: Scripting
Threat description: has used net use to conduct internal discovery of systems. The group has also used quser.exe to identify existing RDP sessions on a victim.
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
Threat description: has used network scanning and enumeration tools, including .
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: has used PowerShell on victim systems to download and run payloads after exploitation.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1064: Scripting
Threat description: has used PowerShell scripts to download and execute programs in memory, without writing to disk.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1064: Scripting
Threat description: has used Putty Secure Copy Client (PSCP) to transfer data.
MITRE ATT&CK techniques:
- T1021: Remote Services
Threat description: has used Putty to access compromised systems.
MITRE ATT&CK techniques:
- T1021: Remote Services
Threat description: has used RAR to stage and compress local folders.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: has used the open source tool Essential NetTools to map the network and build a list of targets.
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: has used  via Web shell to establish redundant access. The group has also used harvested credentials to gain access to Internet-accessible resources such as Outlook Web Access, which could be used for redundant access.
MITRE ATT&CK techniques:
- T1108: Redundant Access
Threat description: has utilized  during and.
MITRE ATT&CK techniques:
- T1078: Valid Accounts
Threat description: hides collected data in password-protected .rar archives.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
- T1486: Data Encrypted for Impact
Threat description: hides from defenders by hooking libc function calls, hiding artifacts that would reveal its presence, such as the user account it creates to provide access and undermining strace, a tool often used to identify malware.
MITRE ATT&CK techniques:
- T1014: Rootkit
Threat description: If an initial connectivity check fails,  attempts to extract proxy details and credentials from Windows Protected Storage and from the IE Credentials Store. This allows the adversary to use the proxy credentials for subsequent requests if they enable outbound HTTP access.
MITRE ATT&CK techniques:
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: If installing itself as a service fails,  instead writes itself as a file named svchost.exe saved in %APPDATA%\Microsoft\Network.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: infected victims using JavaScript code.
MITRE ATT&CK techniques:
- T1064: Scripting
Threat description: installed its payload in the startup programs folder as "Baidu Software Update." The group also adds its second stage payload to the startup programs as “Net Monitor."
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: installs a service pointing to a malicious DLL dropped to disk.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: installs itself as a new service.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: is a RAT that communicates with HTTP.
MITRE ATT&CK techniques:
- T1043: Commonly Used Port
Threat description: is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems.
MITRE ATT&CK techniques:
- T1542.001: Pre-OS Boot - System Firmware
- T1014: Rootkit
Threat description: is capable of accessing locally stored passwords on victims.
MITRE ATT&CK techniques:
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: is capable of deleting Registry keys used for persistence.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: is capable of using its command and control protocol over port 443. However, Duqu is also capable of encapsulating its command protocol over standard application layer protocols. The Duqu command and control protocol implements many of the same features as TCP and is a reliable transport protocol.
MITRE ATT&CK techniques:
- T1095: Non-Application Layer Protocol
Threat description: is initially packed.
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: is known to use RAR with passwords to encrypt data prior to exfiltration.
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: is sometimes signed with an invalid Authenticode certificate in an apparent effort to make it look more legitimate.
MITRE ATT&CK techniques:
- T1553.002: Subvert Trust Controls - Code Signing
Threat description: is used to patch an enterprise domain controller authentication process with a backdoor password. It allows adversaries to bypass the standard authentication system to use a defined password for all accounts authenticating to that domain controller.
MITRE ATT&CK techniques:
- T1098: Account Manipulation
Threat description: kills and disables services by using cmd.exe.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: leveraged several compromised universities as proxies to obscure its origin.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: lower disable security settings by changing Registry keys.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: lured victims to double-click on images in the attachments they sent which would then execute the hidden LNK file.
MITRE ATT&CK techniques:
- T1204: User Execution
Threat description: maintains access to victim environments by using  to access  as well as establishing a backup RDP tunnel by using .
MITRE ATT&CK techniques:
- T1108: Redundant Access
Threat description: makes modifications to open-source scripts from GitHub and executes them on the victim’s machine.
MITRE ATT&CK techniques:
- T1064: Scripting
Threat description: malware attempts to connect to Windows shares for lateral movement by using a generated list of usernames, which center around permutations of the username Administrator, and weak passwords.
MITRE ATT&CK techniques:
- T1110: Brute Force
Threat description: malware can create a .lnk file and add a Registry Run key to establish persistence.
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: malware gathers passwords from multiple sources, including Windows Credential Vault, Internet Explorer, Firefox, Chrome, and Outlook.
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: malware has communicated with C2 servers over port 6667 (for IRC) and port 8080.
MITRE ATT&CK techniques:
- T1043: Commonly Used Port
Threat description: malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.  malware RomeoDelta archives specified directories in .zip format, encrypts the .zip file, and uploads it to its C2 server.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.  malware RomeoDelta archives specified directories in .zip format, encrypts the .zip file, and uploads it to its C2 server. A  malware sample encrypts data using a simple byte based XOR operation prior to exfiltration.
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims.
MITRE ATT&CK techniques:
- T1048: Exfiltration Over Alternative Protocol
Threat description: malware uses cmd.exe to execute commands on victims.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: malware uses PowerShell and WMI to script data collection and command execution on the victim.
MITRE ATT&CK techniques:
- T1064: Scripting
Threat description: malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.
MITRE ATT&CK techniques:
- T1098: Account Manipulation
Threat description: may be used to exfiltrate data separate from the main command and control protocol.
MITRE ATT&CK techniques:
- T1048: Exfiltration Over Alternative Protocol
Threat description: may have used the  malware to move onto air-gapped networks.  targets removable drives to spread to other systems by modifying the drive to use Autorun to execute or by hiding legitimate document files and copying an executable to the folder with the same name as the legitimate document.
MITRE ATT&CK techniques:
- T1091: Replication Through Removable Media
Threat description: may use net group "domain admins" /domain to display accounts in the "domain admins" permissions group and net localgroup "administrators" to list local system administrator group membership.
MITRE ATT&CK techniques:
- T1087: Account Discovery
Threat description: Modules can be pushed to and executed by  that copy data to a staging area, compress it, and XOR encrypt it.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
- T1074: Data Staged
- T1486: Data Encrypted for Impact
Threat description: monitors browsing activity and automatically captures screenshots if a victim browses to a URL matching one of a list of strings.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: a predefined directory."
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: Newer variants of  will encode C2 communications with a custom system.
MITRE ATT&CK techniques:
- T1001: Data Obfuscation
Threat description: New services created by  are made to appear like legitimate Windows services, with names such as "Windows Management Help Service", "Microsoft Support", and "Windows Advanced Task Manager".
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: obtains and saves information about victim network interfaces and addresses.
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
Threat description: One version of  consists of VBScript and PowerShell scripts. The malware also uses batch scripting.
MITRE ATT&CK techniques:
- T1064: Scripting
Threat description: opens a backdoor on TCP ports 6868 and 7777.
MITRE ATT&CK techniques:
- T1571: Non-Standard Port
Threat description: opens the Windows Firewall to modify incoming connections.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: performs BIOS modification and can download and execute a file as well as protect itself from removal.
MITRE ATT&CK techniques:
- T1542.001: Pre-OS Boot - System Firmware
Threat description: performs most of its operations using Windows Script Host (Jscript and VBScript) and runs arbitrary shellcode .
MITRE ATT&CK techniques:
- T1064: Scripting
Threat description: performs several anti-VM and sandbox checks on the victim's machine.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: persists via a login item.
MITRE ATT&CK techniques:
- T1547.015: Boot or Logon Autostart Execution - Login Items
Threat description: probes the system to check for sandbox/virtualized environments and other antimalware processes.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: puts a space after a false .jpg extension so that execution actually goes through the Terminal.app program.
MITRE ATT&CK techniques:
- T1036.006: Masquerading - Space after Filename
Threat description: ran a command to compile an archive of file types of interest from the victim user's directories.
MITRE ATT&CK techniques:
- T1005: Data from Local System
- T1119: Automated Collection
Threat description: RAT is able to wipe event logs.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: registers itself as a service by adding several Registry keys.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: registers itself as a service on the victim’s machine to run as a standalone process.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: renames one of its .dll files to uxtheme.dll in an apparent attempt to masquerade as a legitimate file.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: scans processes on all victim systems in the environment and uses automated scripts to pull back the results.
MITRE ATT&CK techniques:
- T1119: Automated Collection
- T1064: Scripting
Threat description: scans the C-class subnet of the IPs on the victim's interfaces.
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: searches for files named logins.json to parse for credentials and also looks for credentials stored from browsers.
MITRE ATT&CK techniques:
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: searches for files on local drives based on a predefined list of file extensions.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: searches for network drives and removable media and duplicates itself onto them.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: searches recursively for Outlook personal storage tables (PST) files within user directories and sends them back to the C2 server.
MITRE ATT&CK techniques:
- T1114: Email Collection
Threat description: searches through Outlook files and directories (e.g., inbox, sent, templates, drafts, archives, etc.).
MITRE ATT&CK techniques:
- T1114: Email Collection
Threat description: sent malicious attachments to victims over email, including an Excel spreadsheet containing macros to download Pupy.
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: sent shortened URL links over email to victims. The URLs linked to Word documents with malicious macros that execute PowerShells scripts to download Pupy.
MITRE ATT&CK techniques:
- T1598.003: Phishing for Information - Spearphishing Link
Threat description: service-based DLL implant can execute a downloaded file with parameters specified using CreateProcessAsUser.
MITRE ATT&CK techniques:
- T1546.009: Event Triggered Execution - AppCert DLLs