QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: XCSSET adds malicious code to a host's Xcode projects by enumerating CocoaPods "target_integrator.rb" files under the "/Library/Ruby/Gems" folder or enumerates all ".xcodeproj" folders under a given directory. XCSSET then downloads a script and Mach-O file into the Xcode project folder.
MITRE ATT&CK techniques:
- T1195.001: Supply Chain Compromise - Compromise Software Dependencies and Development Tools
Threat description: APT29 gained initial network access to some victims via a trojanized update of SolarWinds Orion software.
MITRE ATT&CK techniques:
- T1195.002: Supply Chain Compromise - Compromise Software Supply Chain
Threat description: Dragonfly has placed trojanized installers for control system software on legitimate vendor app stores.
MITRE ATT&CK techniques:
- T1195.002: Supply Chain Compromise - Compromise Software Supply Chain
Threat description: GOLD SOUTHFIELD has distributed ransomware by backdooring software installers via a strategic web compromise of the site hosting Italian WinRAR.
MITRE ATT&CK techniques:
- T1195.002: Supply Chain Compromise - Compromise Software Supply Chain
Threat description: Gelsemium has compromised software supply chains to gain access to victims.
MITRE ATT&CK techniques:
- T1195.002: Supply Chain Compromise - Compromise Software Supply Chain
Threat description: GoldenSpy has been packaged with a legitimate tax preparation software.
MITRE ATT&CK techniques:
- T1195.002: Supply Chain Compromise - Compromise Software Supply Chain
Threat description: APT39 has used the BITS protocol to exfiltrate stolen data from a compromised host.
MITRE ATT&CK techniques:
- T1197: BITS Jobs
Threat description: BITSAdmin can be used to create BITS Jobs to launch a malicious process.
MITRE ATT&CK techniques:
- T1197: BITS Jobs
Threat description: UBoatRAT takes advantage of the /SetNotifyCmdLine option in BITSAdmin to ensure it stays running on a system to maintain persistence.
MITRE ATT&CK techniques:
- T1197: BITS Jobs
Threat description: LAPSUS$ has accessed internet-facing identity providers such as Azure Active Directory and Okta to target specific organizations.
MITRE ATT&CK techniques:
- T1199: Trusted Relationship
Threat description: Lazarus Group persistence mechanisms have used "forfiles.exe" to execute .htm files.
MITRE ATT&CK techniques:
- T1202: Indirect Command Execution
Threat description: SUPERNOVA was installed via exploitation of a SolarWinds Orion API authentication bypass vulnerability (CVE-2020-10148).
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
Threat description: Magic Hound has attempted to get users to execute malware via social media and spearphishing emails.
MITRE ATT&CK techniques:
- T1204: User Execution
Threat description: APT29 has used various forms of spearphishing attempting to get a user to click on a malicous link.
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
Threat description: Earth Lusca  has sent spearphishing emails that required the user to click on a malicious link and subsequently open a decoy document with a malicious loader.
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
Threat description: TSCookie has been executed via malicious links embedded in e-mails spoofing the Ministries of Education, Culture, Sports, Science and Technology of Japan.
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
Threat description: Windshift has used links embedded in e-mails to lure victims into executing malicious code.
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
Threat description: APT28 attempted to get users to click on Microsoft Office attachments containing malicious macro scripts.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: APT32 has attempted to lure users to execute a malicious dropper delivered via a spearphishing attachment.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: APT37 has sent spearphishing attachments attempting to get a user to open them.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: Windshift has used e-mail attachments to lure victims into executing malicious code.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: Kobalos is triggered by an incoming TCP connection to a legitimate service from a specific source port.
MITRE ATT&CK techniques:
- T1205: Traffic Signaling
Threat description: Pandora can identify if incoming HTTP traffic contains a token and if so it will intercept the traffic and process the received command.
MITRE ATT&CK techniques:
- T1205: Traffic Signaling
Threat description: Ryuk has used Wake-on-Lan to power on turned off systems for lateral movement.
MITRE ATT&CK techniques:
- T1205: Traffic Signaling
Threat description: SYNful Knock can be sent instructions via special packets to change its functionality. Code for new functionality can be included in these messages.
MITRE ATT&CK techniques:
- T1205: Traffic Signaling
Threat description: Umbreon provides additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet
MITRE ATT&CK techniques:
- T1205: Traffic Signaling
Threat description: PROMETHIUM has used a script that configures the knockd service and firewall to only accept C2 connections from systems that use a specified sequence of knock ports.
MITRE ATT&CK techniques:
- T1205.001: Traffic Signaling - Port Knocking
Threat description: Penquin installs a `TCP` and `UDP` filter on the `eth0` interface.
MITRE ATT&CK techniques:
- T1205.002: Traffic Signaling - Socket Filters
Threat description: Conficker exploited the MS08-067 Windows vulnerability for remote code execution through a crafted RPC request.
MITRE ATT&CK techniques:
- T1210: Exploitation of Remote Services
Threat description: Empire has a limited number of built-in modules for exploiting remote SMB, JBoss, and Jenkins servers.
MITRE ATT&CK techniques:
- T1210: Exploitation of Remote Services
Threat description: Fox Kitten has exploited known vulnerabilities in remote services including RDP.
MITRE ATT&CK techniques:
- T1210: Exploitation of Remote Services
Threat description: PoshC2 contains a module for exploiting SMB via EternalBlue.
MITRE ATT&CK techniques:
- T1210: Exploitation of Remote Services
Threat description: Stuxnet propagates using the MS10-061 Print Spooler and MS08-067 Windows Server Service vulnerabilities.
MITRE ATT&CK techniques:
- T1210: Exploitation of Remote Services
Threat description: Wizard Spider has exploited or attempted to exploit Zerologon (CVE-2020-1472) and EternalBlue (MS17-010) vulnerabilities.
MITRE ATT&CK techniques:
- T1210: Exploitation of Remote Services
Threat description: LAPSUS$ has searched a victim's network for organization collaboration channels like MS Teams or Slack to discover further high-privilege account credentials.
MITRE ATT&CK techniques:
- T1213: Data from Information Repositories
Threat description: LAPSUS$ has searched a victim's network for collaboration platforms like Confluence and JIRA to discover further high-privilege account credentials.
MITRE ATT&CK techniques:
- T1213.001: Data from Information Repositories - Confluence
Threat description: Ke3chang used a SharePoint enumeration and data dumping tool known as spwebmember.
MITRE ATT&CK techniques:
- T1213.002: Data from Information Repositories - Sharepoint
Threat description: spwebmember is used to enumerate and dump information from Microsoft SharePoint.
MITRE ATT&CK techniques:
- T1213.002: Data from Information Repositories - Sharepoint
Threat description: APT29 has downloaded source code from code repositories.
MITRE ATT&CK techniques:
- T1213.003: Data from Information Repositories - Code Repositories
Threat description: APT32 has used PubPrn.vbs within execution scripts to execute malware, possibly bypassing defenses.
MITRE ATT&CK techniques:
- T1216.001: System Script Proxy Execution - PubPrn
Threat description: PowerLess can use a .NET browser information stealer module.
MITRE ATT&CK techniques:
- T1217: Browser Information Discovery
Threat description: Astaroth uses ActiveX objects for file execution and manipulation.
MITRE ATT&CK techniques:
- T1218.001: System Binary Proxy Execution - Compiled HTML File
Threat description: InvisiMole can register itself for execution and persistence via the Control Panel.
MITRE ATT&CK techniques:
- T1218.002: System Binary Proxy Execution - Control Panel
Threat description: Chaes has used Installutill to download content.
MITRE ATT&CK techniques:
- T1218.004: System Binary Proxy Execution - InstallUtil
Threat description: IcedID can inject itself into a suspended msiexec.exe process to send beacons to C2 while appearing as a normal msi application.
MITRE ATT&CK techniques:
- T1218.007: System Binary Proxy Execution - Msiexec
Threat description: Javali has used the MSI installer to download and execute malicious payloads.
MITRE ATT&CK techniques:
- T1218.007: System Binary Proxy Execution - Msiexec
Threat description: Agent Tesla has dropped RegAsm.exe onto systems for performing malicious activity.
MITRE ATT&CK techniques:
- T1218.009: System Binary Proxy Execution - Regsvcs/Regasm
Threat description: Some Orz versions have an embedded DLL known as MockDll that uses Process Hollowing and regsvr32 to execute another payload.
MITRE ATT&CK techniques:
- T1218.010: System Binary Proxy Execution - Regsvr32
Threat description: Sandworm Team has used remote administration tools or remote industrial control system client software to maliciously release electricity breakers.
MITRE ATT&CK techniques:
- T1219: Remote Access Software
Threat description: Lazarus Group has used WMIC to execute a remote XSL script to establish persistence.
MITRE ATT&CK techniques:
- T1220: XSL Script Processing
Threat description: DarkHydrus used an open-source tool, Phishery, to inject malicious remote template URLs into Microsoft Word documents and then sent them to victims to enable Forced Authentication.
MITRE ATT&CK techniques:
- T1221: Template Injection
Threat description: Dragonfly has injected SMB URLs into malicious Word spearphishing attachments to initiate Forced Authentication.
MITRE ATT&CK techniques:
- T1221: Template Injection
Threat description: Tropic Trooper delivered malicious documents with the XLSX extension, typically used by OpenXML documents, but the file itself was actually an OLE (XLS) document.
MITRE ATT&CK techniques:
- T1221: Template Injection
Threat description: SUNSPOT only replaces SolarWinds Orion source code if the MD5 checksums of both the original source code file and backdoored replacement source code match hardcoded values.
MITRE ATT&CK techniques:
- T1480: Execution Guardrails
Threat description: Small Sieve can only execute correctly if the word `Platypus` is passed to it on the command line.
MITRE ATT&CK techniques:
- T1480: Execution Guardrails
Threat description: Torisma is only delivered to a compromised host if the victim's IP address is on an allow-list.
MITRE ATT&CK techniques:
- T1480: Execution Guardrails
Threat description: The Winnti for Windows dropper component can verify the existence of a single command line parameter and either terminate if it is not found or later use it as a decryption key.
MITRE ATT&CK techniques:
- T1480.001: Execution Guardrails - Environmental Keying
Threat description: UNC2452 used the "Get-AcceptedDomain" PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell. They also used AdFind to enumerate domains and to discover trust between federated domains.
MITRE ATT&CK techniques:
- T1482: Domain Trust Discovery
Threat description: Empire can use "New-GPOImmediateTask" to modify a GPO that will install and execute a malicious Scheduled Task/Job.
MITRE ATT&CK techniques:
- T1484.001: Domain or Tenant Policy Modification - Group Policy Modification
Threat description: HermeticWiper has the ability to deploy through an infected system's default domain policy.
MITRE ATT&CK techniques:
- T1484.001: Domain or Tenant Policy Modification - Group Policy Modification
Threat description: AADInternals can create a backdoor by converting a domain to a federated domain which will be able to authenticate any user across the tenant. AADInternals can also modify DesktopSSO information.
MITRE ATT&CK techniques:
- T1484.002: Domain or Tenant Policy Modification - Trust Modification
Threat description: Kazuar can overwrite files with random data before deleting them.
MITRE ATT&CK techniques:
- T1485: Data Destruction
Threat description: RawDisk was used in Shamoon to write to protected system locations such as the MBR and disk partitions in an effort to destroy data.
MITRE ATT&CK techniques:
- T1485: Data Destruction
Threat description: EKANS uses standard encryption library functions to encrypt files.
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: Industroyer’s data wiper module writes zeros into the registry keys in "SYSTEM\CurrentControlSet\Services" to render a system inoperable.
MITRE ATT&CK techniques:
- T1489: Service Stop
Threat description: Meteor can disconnect all network adapters on a compromised host using `powershell -Command "Get-WmiObject -class Win32_NetworkAdapter | ForEach { If ($.NetEnabled) { $.Disable() } }" > NUL`.
MITRE ATT&CK techniques:
- T1489: Service Stop
Threat description: Sandworm Team defaced approximately 15,000 websites belonging to Georgian government, non-government, and private sector organizations in 2019.
MITRE ATT&CK techniques:
- T1491.002: Defacement - External Defacement
Threat description: Bad Rabbit has used an executable that installs a modified bootloader to prevent normal boot-up.
MITRE ATT&CK techniques:
- T1495: Firmware Corruption
Threat description: Skidmap is a kernel-mode rootkit used for cryptocurrency mining.
MITRE ATT&CK techniques:
- T1496: Resource Hijacking
Threat description: Agent Tesla has he ability to perform anti-sandboxing and anti-virtualization checks.
MITRE ATT&CK techniques:
- T1497: Virtualization/Sandbox Evasion
Threat description: Bumblebee has the ability to perform anti-virtualization checks.
MITRE ATT&CK techniques:
- T1497: Virtualization/Sandbox Evasion
Threat description: CHOPSTICK  includes runtime checks to identify an analysis environment and prevent execution on it.
MITRE ATT&CK techniques:
- T1497: Virtualization/Sandbox Evasion
Threat description: Carberp has removed various hooks before installing the trojan or bootkit to evade sandbox analysis or other analysis software.
MITRE ATT&CK techniques:
- T1497: Virtualization/Sandbox Evasion
Threat description: During Operation Spalax, the threat actors used droppers that would run anti-analysis checks before executing malware on a compromised host.
MITRE ATT&CK techniques:
- T1497: Virtualization/Sandbox Evasion
Threat description: Gelsemium can use junk code to generate random activity to obscure malware behavior.
MITRE ATT&CK techniques:
- T1497: Virtualization/Sandbox Evasion
Threat description: HAWKBALL has methods to check if the process the malware uses is being debugged.
MITRE ATT&CK techniques:
- T1497: Virtualization/Sandbox Evasion
Threat description: Kevin can sleep for a time interval between C2 communication attempts.
MITRE ATT&CK techniques:
- T1497: Virtualization/Sandbox Evasion
Threat description: Lucifer can crash a debugger by passing a format string to "OutputDebugStringA()".
MITRE ATT&CK techniques:
- T1497: Virtualization/Sandbox Evasion
Threat description: Metamorfo has embedded a "vmdetect.exe" executable to identify virtual machines at the beginning of execution.
MITRE ATT&CK techniques:
- T1497: Virtualization/Sandbox Evasion
Threat description: Pteranodon has the ability to use anti-detection functions to identify sandbox environments.
MITRE ATT&CK techniques:
- T1497: Virtualization/Sandbox Evasion
Threat description: Some versions of CozyCar will check to ensure it is not being executed inside a virtual machine or a known malware analysis sandbox environment. If it detects that it is, it will exit.
MITRE ATT&CK techniques:
- T1497: Virtualization/Sandbox Evasion
Threat description: The White Company has performed anti-analysis checks to determine if its malware was in a debugging environment.
MITRE ATT&CK techniques:
- T1497: Virtualization/Sandbox Evasion
Threat description: BadPatch attempts to detect if it is being run in a Virtual Machine (VM) using a WMI query for disk drive name, BIOS, and motherboard information.
MITRE ATT&CK techniques:
- T1497.001: Virtualization/Sandbox Evasion - System Checks
Threat description: Frankenstein has used WMI queries to check if various security applications were running, including VMWare and Virtualbox.
MITRE ATT&CK techniques:
- T1497.001: Virtualization/Sandbox Evasion - System Checks
Threat description: InvisiMole can check for artifacts of VirtualBox, Virtual PC and VMware environment, and terminate itself if they are detected.
MITRE ATT&CK techniques:
- T1497.001: Virtualization/Sandbox Evasion - System Checks
Threat description: Okrum's loader can check the amount of physical memory and terminates itself if the host has less than 1.5 Gigabytes of physical memory in total.
MITRE ATT&CK techniques:
- T1497.001: Virtualization/Sandbox Evasion - System Checks
Threat description: PoetRAT checked the size of the hard drive to determine if it was being run in a sandbox environment. In the event of sandbox detection, it would delete itself by overwriting the malware scripts with the contents of "License.txt" and exiting.
MITRE ATT&CK techniques:
- T1497.001: Virtualization/Sandbox Evasion - System Checks
Threat description: WastedLocker checked if UCOMIEnumConnections and IActiveScriptParseProcedure32 Registry keys were detected as part of its anti-analysis technique.
MITRE ATT&CK techniques:
- T1497.001: Virtualization/Sandbox Evasion - System Checks
Threat description: Sandworm Team temporarily disrupted service to Georgian government, non-government, and private sector websites after compromising a Georgian web hosting provider in 2019.
MITRE ATT&CK techniques:
- T1499: Endpoint Denial of Service
Threat description: Industroyer uses a custom DoS tool that leverages CVE-2015-5374 and targets hardcoded IP addresses of Siemens SIPROTEC devices.
MITRE ATT&CK techniques:
- T1499.004: Endpoint Denial of Service - Application or System Exploitation
Threat description: Sandworm Team has used various MS-SQL stored procedures.
MITRE ATT&CK techniques:
- T1505.001: Server Software Component - SQL Stored Procedures
Threat description: Stuxnet used xp_cmdshell to store and execute SQL code.
MITRE ATT&CK techniques:
- T1505.001: Server Software Component - SQL Stored Procedures
Threat description: LightNeuron has used a malicious Microsoft Exchange transport agent for persistence.
MITRE ATT&CK techniques:
- T1505.002: Server Software Component - Transport Agent
Threat description: IceApple is an IIS post-exploitation framework, consisting of 18 modules that provide several functionalities.
MITRE ATT&CK techniques:
- T1505.004: Server Software Component - IIS Components
Threat description: RGDoor establishes persistence on webservers as an IIS module.
MITRE ATT&CK techniques:
- T1505.004: Server Software Component - IIS Components
Threat description: ComRAT can check the victim's default browser to determine which process to inject its communications module into.
MITRE ATT&CK techniques:
- T1518: Software Discovery
Threat description: MarkiRAT can check for the Telegram installation directory by enumerating the files on disk.
MITRE ATT&CK techniques:
- T1518: Software Discovery
Threat description: MuddyWater has used a PowerShell backdoor to check for Skype connectivity on the target machine.
MITRE ATT&CK techniques:
- T1518: Software Discovery
Threat description: TajMahal has the ability to identify the Internet Explorer (IE) version on an infected host.
MITRE ATT&CK techniques:
- T1518: Software Discovery
Threat description: XCSSET uses "ps aux" with the "grep" command to enumerate common browsers and system processes potentially impacting XCSSET's exfiltration capabilities.
MITRE ATT&CK techniques:
- T1518: Software Discovery
Threat description: FIN8 has used Registry keys to detect and avoid executing in potential sandboxes.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: Frankenstein has used WMI queries to detect if virtualization environments or analysis tools were running on the system.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: Netwalker can detect and terminate active security software-related processes on infected systems.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
- T1518.001: Software Discovery - Security Software Discovery
Threat description: RTM can obtain information about security software on the victim.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: Rocke used scripts which detected and uninstalled antivirus software.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
- T1518.001: Software Discovery - Security Software Discovery
Threat description: ThiefQuest uses the "kill_unwanted" function to get a list of running processes, compares each process with an encrypted list of “unwanted” security related programs, and kills the processes for security related programs.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: AADInternals can enumerate information about a variety of cloud services, such as Office 365 and Sharepoint instances or OpenID Configurations.
MITRE ATT&CK techniques:
- T1526: Cloud Service Discovery
Threat description: APT28 has used several malicious applications to steal user OAuth access tokens including applications masquerading as "Google Defender" "Google Email Protection," and "Google Scanner" for Gmail users. They also targeted Yahoo users with applications masquerading as "Delivery Service" and "McAfee Email Protection".
MITRE ATT&CK techniques:
- T1528: Steal Application Access Token
Threat description: Peirates gathers Kubernetes service account tokens using a variety of techniques.
MITRE ATT&CK techniques:
- T1528: Steal Application Access Token
Threat description: Peirates can dump the contents of AWS S3 buckets. It can also retrieve service account tokens from kOps buckets in Google Cloud Storage or S3.
MITRE ATT&CK techniques:
- T1530: Data from Cloud Storage
Threat description: Exaramel for Linux has a hardcoded location that it uses to achieve persistence if the startup system is Upstart or System V and it is running as root.
MITRE ATT&CK techniques:
- T1543: Create or Modify System Process
Threat description: Hildegard has started a monero service.
MITRE ATT&CK techniques:
- T1543.002: Create or Modify System Process - Systemd Service
Threat description: Bankshot can terminate a specific process by its process id.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: Conficker copies itself into the "%systemroot%\system32" directory and registers as a service.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: Dyre registers itself as a service by adding several Registry keys.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: Emissary is capable of configuring itself as a service.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: LoudMiner can automatically launch a Linux virtual machine as a service at startup if the AutoStart option is enabled in the VBoxVmService configuration file.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: Ragnar Locker has used sc.exe to create a new service for the VirtualBox driver.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: Volgmer installs a copy of itself in a randomly selected service, then overwrites the ServiceDLL entry in the service's Registry entry. Some Volgmer variants also install .dll files as services with names generated by a list of hard-coded strings.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: ZLib creates Registry keys to allow itself to run as various services.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: Linux Rabbit maintains persistence on an infected machine through rc.local and .bashrc files.
MITRE ATT&CK techniques:
- T1546.004: Event Triggered Execution - Unix Shell Configuration Modification
Threat description: Empire can leverage WMI debugging to remotely replace binaries like sethc.exe, Utilman.exe, and Magnify.exe with cmd.exe.
MITRE ATT&CK techniques:
- T1546.008: Event Triggered Execution - Accessibility Features
Threat description: Honeybee's service-based DLL implant can execute a downloaded file with parameters specified using "CreateProcessAsUser".
MITRE ATT&CK techniques:
- T1546.009: Event Triggered Execution - AppCert DLLs
Threat description: PUNCHBUGGY can establish using a AppCertDLLs Registry key.
MITRE ATT&CK techniques:
- T1546.009: Event Triggered Execution - AppCert DLLs
Threat description: ShimRat has installed shim databases in the "AppPatch" folder.
MITRE ATT&CK techniques:
- T1546.011: Event Triggered Execution - Application Shimming
Threat description: KONNI has modified ComSysApp service to load the malicious DLL payload.
MITRE ATT&CK techniques:
- T1546.015: Event Triggered Execution - Component Object Model Hijacking
Threat description: BoxCaon established persistence by setting the "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load" registry key to point to its executable.
MITRE ATT&CK techniques:
- T1547: Boot or Logon Autostart Execution
Threat description: Dtrack’s RAT makes a persistent target file with auto execution on the host start.
MITRE ATT&CK techniques:
- T1547: Boot or Logon Autostart Execution
Threat description: LoudMiner can automatically launch at startup if the AutoStart option is enabled in the VBoxVmService configuration file.
MITRE ATT&CK techniques:
- T1547: Boot or Logon Autostart Execution
Threat description: Misdat has created registry keys for persistence, including `HKCU\Software\dnimtsoleht\StubPath`, `HKCU\Software\snimtsOleht\StubPath`, `HKCU\Software\Backtsaleht\StubPath`, `HKLM\SOFTWARE\Microsoft\Active Setup\Installed. Components\{3bf41072-b2b1-21c8-b5c1-bd56d32fbda7}`, and `HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{3ef41072-a2f1-21c8-c5c1-70c2c3bc7905}`.
MITRE ATT&CK techniques:
- T1547: Boot or Logon Autostart Execution
Threat description: xCaon has added persistence via the Registry key "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load" which causes the malware to run each time any user logs in.
MITRE ATT&CK techniques:
- T1547: Boot or Logon Autostart Execution
Threat description: A version of KONNI has dropped a Windows shortcut into the Startup folder to establish persistence.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: BBSRAT has been loaded through DLL side-loading of a legitimate Citrix executable that is set to persist through the Registry Run key location "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ssonsvr.exe".
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: FELIXROOT adds a shortcut file to the startup folder for persistence.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Gazer can establish persistence by creating a .lnk file in the Start menu.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Honeybee uses a batch file that configures the ComSysApp service to autostart in order to establish persistence.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: JHUHUGIT has used a Registry Run key to establish persistence by executing JavaScript code within the rundll32.exe process.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: LoJax has modified the Registry key "‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’" from "‘autocheck autochk *’" to "‘autocheck autoche *’" in order to execute its payload during Windows startup.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Maze has created a file named "startup_vrun.bat" in the Startup folder of a virtual machine to establish persistence.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: NanHaiShu modifies the %regrun% Registry to point itself to an autostart mechanism.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: ObliqueRAT can gain persistence by a creating a shortcut in the infected user's Startup directory.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Okrum establishes persistence by creating a .lnk shortcut to itself in the Startup folder.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence. If this fails, it attempts to add Registry Run keys.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Revenge RAT creates a Registry key at "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell" to survive a system reboot.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: S-Type may create a .lnk file to itself that is saved in the Start menu folder. It may also create the Registry key "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ IMJPMIJ8.1{3 characters of Unique Identifier}".
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: SILENTTRINITY can establish a LNK file in the startup folder for persistence.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: SPACESHIP achieves persistence by creating a shortcut in the current user's Startup folder.
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: TeamTNT has added batch scripts to the startup folder.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Tropic Trooper has created shortcuts in the Startup folder to establish persistence.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Windshift has created LNK files in the Startup folder to establish persistence.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Winnti for Windows can add a service named "wind0ws" to the Registry to achieve persistence after reboot.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: The Mimikatz credential dumper contains an implementation of an SSP.
MITRE ATT&CK techniques:
- T1547.005: Boot or Logon Autostart Execution - Security Support Provider
Threat description: During Operation CuckooBees, attackers used a signed kernel rootkit to establish additional persistence.
MITRE ATT&CK techniques:
- T1547.006: Boot or Logon Autostart Execution - Kernel Modules and Extensions
Threat description: Pasam establishes by infecting the Security Accounts Manager (SAM) DLL to load a malicious DLL dropped to disk.
MITRE ATT&CK techniques:
- T1547.008: Boot or Logon Autostart Execution - LSASS Driver
Threat description: Wingbird drops a malicious file (sspisrv.dll) alongside a copy of lsass.exe, which is used to register a service that loads sspisrv.dll as a driver. The payload of the malicious driver (located in its entry-point function) is executed when loaded by lsass.exe before the spoofed service becomes unstable and crashes.
MITRE ATT&CK techniques:
- T1547.008: Boot or Logon Autostart Execution - LSASS Driver
Threat description: APT29 drops a Windows shortcut file for execution.
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: Comnie establishes persistence via a .lnk file in the victim’s startup path.
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: Gazer can establish persistence by creating a .lnk file in the Start menu or by modifying existing .lnk files to execute the malware through cmd.exe.
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: Kazuar adds a .lnk file to the Windows startup folder.
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: S-Type may create the file "%HOMEPATH%\Start Menu\Programs\Startup\Realtek {Unique Identifier}.lnk", which points to the malicious `msdtc.exe` file already created in the `%CommonFiles%` directory.
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: Earth Lusca has added the Registry key `HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Print Processors\UDPrint” /v Driver /d “spool.dll /f` to load malware as a Print Processor.
MITRE ATT&CK techniques:
- T1547.012: Boot or Logon Autostart Execution - Print Processors
Threat description: Gelsemium can drop itself in "C:\Windows\System32\spool\prtprocs\x64\winprint.dll" to be loaded automatically by the spoolsv Windows service.
MITRE ATT&CK techniques:
- T1547.012: Boot or Logon Autostart Execution - Print Processors
Threat description: The PipeMon installer has modified the Registry key "HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors" to install PipeMon as a Print Processor.
MITRE ATT&CK techniques:
- T1547.012: Boot or Logon Autostart Execution - Print Processors
Threat description: Fysbis has installed itself as an autostart entry under "~/.config/autostart/dbus-inotifier.desktop" to establish persistence.
MITRE ATT&CK techniques:
- T1547.013: Boot or Logon Autostart Execution - XDG Autostart Entries
Threat description: Dok uses AppleScript to install a login Item by sending Apple events to the "System Events" process.
MITRE ATT&CK techniques:
- T1547.015: Boot or Logon Autostart Execution - Login Items
Threat description: H1N1 bypasses user access control by using a DLL hijacking vulnerability in the Windows Update Standalone Installer (wusa.exe).
MITRE ATT&CK techniques:
- T1548.002: Abuse Elevation Control Mechanism - Bypass User Account Control
Threat description: Cobalt Strike can use "sudo" to run a command.
MITRE ATT&CK techniques:
- T1548.003: Abuse Elevation Control Mechanism - Sudo and Sudo Caching
Threat description: OSX/Shlayer can escalate privileges to root by asking the user for credentials.
MITRE ATT&CK techniques:
- T1548.004: Abuse Elevation Control Mechanism - Elevated Execution with Prompt
Threat description: FoggyWeb can allow abuse of a compromised AD FS server's SAML token.
MITRE ATT&CK techniques:
- T1550: Use Alternate Authentication Material
Threat description: CreepyDrive can use legitimate OAuth refresh tokens to authenticate with OneDrive.
MITRE ATT&CK techniques:
- T1550.001: Use Alternate Authentication Material - Application Access Token
Threat description: Chimera has dumped password hashes for use in pass the hash authentication attacks.
MITRE ATT&CK techniques:
- T1550.002: Use Alternate Authentication Material - Pass the Hash
Threat description: HOPLIGHT has been observed loading several APIs associated with Pass the Hash.
MITRE ATT&CK techniques:
- T1550.002: Use Alternate Authentication Material - Pass the Hash
Threat description: BRONZE BUTLER has created forged Kerberos Ticket Granting Ticket (TGT) and Ticket Granting Service (TGS) tickets to maintain administrative access.
MITRE ATT&CK techniques:
- T1550.003: Use Alternate Authentication Material - Pass the Ticket
Threat description: Mimikatz’s "LSADUMP::DCSync" and "KERBEROS::PTT" modules implement the three steps required to extract the krbtgt account hash and create/use Kerberos tickets.
MITRE ATT&CK techniques:
- T1550.003: Use Alternate Authentication Material - Pass the Ticket
Threat description: Astaroth uses an external software known as NetPass to recover passwords.
MITRE ATT&CK techniques:
- T1552: Unsecured Credentials
- T1555: Credentials from Password Stores
Threat description: Hildegard has searched for SSH keys, Docker credentials, and Kubernetes service tokens.
MITRE ATT&CK techniques:
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: LaZagne can obtain credentials from chats, databases, mail, and WiFi.
MITRE ATT&CK techniques:
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: QuasarRAT can obtain passwords from FTP clients.
MITRE ATT&CK techniques:
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: Stolen Pencil has used tools that are capable of obtaining credentials from saved mail.
MITRE ATT&CK techniques:
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: TrickBot can obtain passwords stored in files from several applications such as Outlook, Filezilla, OpenSSH, OpenVPN and WinSCP. Additionally, it searches for the ".vnc.lnk" affix to steal VNC credentials.
MITRE ATT&CK techniques:
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: XTunnel is capable of accessing locally stored passwords on victims.
MITRE ATT&CK techniques:
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: jRAT can capture passwords from common chat applications such as MSN Messenger, AOL, Instant Messenger, and and Google Talk.
MITRE ATT&CK techniques:
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: APT29 obtained PKI keys, certificate files and the private encryption key from an Active Directory Federation Services (AD FS) container to decrypt corresponding SAML signing certificates.
MITRE ATT&CK techniques:
- T1552.004: Unsecured Credentials - Private Keys
Threat description: During Operation Wocao, threat actors used Mimikatz to dump certificates and private keys from the Windows certificate store.
MITRE ATT&CK techniques:
- T1552.004: Unsecured Credentials - Private Keys
Threat description: Ebury has intercepted unencrypted private keys as well as private key pass-phrases.
MITRE ATT&CK techniques:
- T1552.004: Unsecured Credentials - Private Keys
Threat description: Mimikatz's "CRYPTO::Extract" module can extract keys by interacting with Windows cryptographic application programming interface (API) functions.
MITRE ATT&CK techniques:
- T1552.004: Unsecured Credentials - Private Keys
Threat description: Rocke has used SSH private keys on the infected machine to spread its coinminer throughout a network.
MITRE ATT&CK techniques:
- T1552.004: Unsecured Credentials - Private Keys
Threat description: APT33 has used a variety of publicly available tools like Gpppassword to gather credentials.
MITRE ATT&CK techniques:
- T1552.006: Unsecured Credentials - Group Policy Preferences
Threat description: PowerSploit contains a collection of Exfiltration modules that can harvest credentials from Group Policy Preferences.
MITRE ATT&CK techniques:
- T1552.006: Unsecured Credentials - Group Policy Preferences
Threat description: Axiom has used digital certificates to deliver malware.
MITRE ATT&CK techniques:
- T1553: Subvert Trust Controls
Threat description: Darkhotel has used code-signing certificates on its malware that are either forged due to weak keys or stolen. Darkhotel has also stolen certificates and signed backdoors and downloaders with them.
MITRE ATT&CK techniques:
- T1553.002: Subvert Trust Controls - Code Signing
Threat description: RTM can add a certificate to the Windows store.
MITRE ATT&CK techniques:
- T1553.004: Subvert Trust Controls - Install Root Certificate
Threat description: certutil can be used to install browser root certificates as a precursor to performing Adversary-in-the-Middle between connections to banking websites. Example command: "certutil -addstore -f -user ROOT ProgramData\cert512121.der".
MITRE ATT&CK techniques:
- T1553.004: Subvert Trust Controls - Install Root Certificate
Threat description: APT29 has embedded ISO images and VHDX files in HTML to evade Mark-of-the-Web.
MITRE ATT&CK techniques:
- T1553.005: Subvert Trust Controls - Mark-of-the-Web Bypass
Threat description: Kobalos replaced the SSH client with a trojanized SSH client to steal credentials on compromised systems.
MITRE ATT&CK techniques:
- T1554: Compromise Host Software Binary
Threat description: ThiefQuest searches through the "/Users/" folder looking for executable files. For each executable, ThiefQuest prepends a copy of itself to the beginning of the file. When the file is executed, the ThiefQuest code is executed first. ThiefQuest creates a hidden file, copies the original target executable to the file, then executes the new hidden file to maintain the appearance of normal behavior.
MITRE ATT&CK techniques:
- T1554: Compromise Host Software Binary
Threat description: XCSSET uses a malicious browser application to replace the legitimate browser in order to continuously capture credentials, monitor web traffic, and download additional modules.
MITRE ATT&CK techniques:
- T1554: Compromise Host Software Binary
Threat description: A module in Prikormka collects passwords stored in applications installed on the victim.
MITRE ATT&CK techniques:
- T1555: Credentials from Password Stores
Threat description: APT39 has used the Smartftp Password Decryptor tool to decrypt FTP passwords.
MITRE ATT&CK techniques:
- T1555: Credentials from Password Stores
Threat description: Agent Tesla has the ability to steal credentials from FTP clients and wireless profiles.
MITRE ATT&CK techniques:
- T1555: Credentials from Password Stores
Threat description: CosmicDuke collects user credentials, including passwords, for various programs including popular instant messaging applications and email clients as well as WLAN keys.
MITRE ATT&CK techniques:
- T1555: Credentials from Password Stores
Threat description: FIN6 has used the Stealer One credential stealer to target e-mail and file transfer utilities including FTP.
MITRE ATT&CK techniques:
- T1555: Credentials from Password Stores
Threat description: KGH_SPY can collect credentials from WINSCP.
MITRE ATT&CK techniques:
- T1555: Credentials from Password Stores
Threat description: Matryoshka is capable of stealing Outlook passwords.
MITRE ATT&CK techniques:
- T1555: Credentials from Password Stores
Threat description: Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the credential vault and DPAPI.
MITRE ATT&CK techniques:
- T1555: Credentials from Password Stores
Threat description: NETWIRE can retrieve passwords from messaging and mail client applications.
MITRE ATT&CK techniques:
- T1555: Credentials from Password Stores
Threat description: OLDBAIT collects credentials from several email clients.
MITRE ATT&CK techniques:
- T1555: Credentials from Password Stores
Threat description: PLEAD has the ability to steal saved passwords from Microsoft Outlook.
MITRE ATT&CK techniques:
- T1555: Credentials from Password Stores
Threat description: PoshC2 can decrypt passwords stored in the RDCMan configuration file.
MITRE ATT&CK techniques:
- T1555: Credentials from Password Stores
Threat description: Stealth Falcon malware gathers passwords from multiple sources, including Windows Credential Vault and Outlook.
MITRE ATT&CK techniques:
- T1555: Credentials from Password Stores
Threat description: UNC2452 used account credentials they obtained to attempt access to Group Managed Service Account (gMSA) passwords.
MITRE ATT&CK techniques:
- T1555: Credentials from Password Stores
Threat description: Inception used a browser plugin to steal passwords and sessions from Internet Explorer, Chrome, Opera, Firefox, Torch, and Yandex.
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
Threat description: KGH_SPY has the ability to steal data from the Chrome, Edge, Firefox, Thunderbird, and Opera browsers.
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
Threat description: RedLeaves can gather browser usernames and passwords.
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
Threat description: WarzoneRAT has the capability to grab passwords from numerous web browsers as well as from Outlook and Thunderbird email clients.
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
Threat description: XAgentOSX contains the getFirefoxPassword function to attempt to locate Firefox passwords.
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
Threat description: RainyDay can use the QuarksPwDump tool to obtain local passwords and domain cached credentials.
MITRE ATT&CK techniques:
- T1555.004: Credentials from Password Stores - Windows Credential Manager
Threat description: SILENTTRINITY can create a backdoor in KeePass using a malicious config file and in TortoiseSVN using a registry hook.
MITRE ATT&CK techniques:
- T1556: Modify Authentication Process
Threat description: Chimera's malware has altered the NTLM authentication program on domain controllers to allow Chimera to login without a valid credential.
MITRE ATT&CK techniques:
- T1556.001: Modify Authentication Process - Domain Controller Authentication
Threat description: Strider has registered its persistence module on domain controllers as a Windows LSA (Local System Authority) password filter to acquire credentials any time a domain, local user, or administrator logs in or changes a password.
MITRE ATT&CK techniques:
- T1556.002: Modify Authentication Process - Password Filter DLL
Threat description: Ebury can deactivate PAM modules to tamper with the sshd configuration.
MITRE ATT&CK techniques:
- T1556.003: Modify Authentication Process - Pluggable Authentication Modules
Threat description: Skidmap has the ability to replace the pam_unix.so file on an infected machine with its own malicious version that accepts a specific backdoor password for all users.
MITRE ATT&CK techniques:
- T1556.003: Modify Authentication Process - Pluggable Authentication Modules
Threat description: SYNful Knock has the capability to add its own custom backdoor password when it modifies the operating system of the affected network device.
MITRE ATT&CK techniques:
- T1556.004: Modify Authentication Process - Network Device Authentication