QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: Monero miner scripts are downloaded from TeamTNT’s server and piped to “bash” using a SSH session on the underlying host as the “root” user by supplying the private key from “/tmp/TeamTNT.” Later, the private key “/tmp/TeamTNT” is removed as well.
MITRE ATT&CK techniques:
- T1098.004: Account Manipulation - SSH Authorized Keys
- T1021.004: Remote Services - SSH
- T1588.001: Obtain Capabilities - Malware
- T1588.002: Obtain Capabilities - Tool
- T1195: Supply Chain Compromise
- T1552.004: Unsecured Credentials - Private Keys
- T1059.004: Command and Scripting Interpreter - Unix Shell
Threat description: the filename changed from tru.dll to kibuyuink.exe, even though it remained a DLL and still required regsvr32.exe to run. Changing the filename extension is a common tactic seen in various malware infections.
MITRE ATT&CK techniques:
- T1546.001: Event Triggered Execution - Change Default File Association
- T1587.001: Develop Capabilities - Malware
Threat description: The C&C domain android[.]viral91[.]xyz, where the malware was connecting to also shows that it is very likely that the APT team uses subdomains to host or connect to Android malware. In previous years, some CrimsonRAT samples were also found to be hosted on the viral91[.]xyz domain.
MITRE ATT&CK techniques:
- T1584.001: Compromise Infrastructure - Domains
- T1588.001: Obtain Capabilities - Malware
- T1583.001: Acquire Infrastructure - Domains
- T1587.001: Develop Capabilities - Malware
Threat description: In one instance, FIN13 deployed a backdoor called MAILSLOT, which communicates over SMTP/POP over SSL, sending and receiving emails to and from a configured attacker-controlled email account for its command and control. MAILSLOT makes FIN13 a rare case of a threat actor who has used email communications for C2.
MITRE ATT&CK techniques:
- T1102.003: Web Service - One-Way Communication
Threat description: In this intrusion from December 2021, the threat actors utilized IcedID as the initial access vector. IcedID is a banking trojan that first appeared in 2017, usually, it is delivered via malspam campaigns and has been widely used as an initial access vector in multiple ransomware intrusions. Upon execution of… .
MITRE ATT&CK techniques:
- T1219: Remote Access Software
Threat description: Emotet occasionally takes a break from delivering malicious emails. Emotet's longest absence from the threat landscape occurred in early February 2020 and lasted more than five months. Emotet resumed operations in mid-July 2020, and it quickly surpassed other threats in sheer volume of malicious spam.
MITRE ATT&CK techniques:
- T1566: Phishing
- T1098.002: Account Manipulation - Additional Email Delegate Permissions
Threat description: When issuing a beacon to its C2, PingPull will send an Echo Request packet to the C2 server with total and current set to 0 and will include no encoded and encrypted data, as seen in Figure 1.
MITRE ATT&CK techniques:
- T1132: Data Encoding
- T1041: Exfiltration Over C2 Channel
Threat description: Mettle: A malicious campaign based on IP addresses in Vietnam (C2 210.245.26.180:4441, scanner 118.70.80.143) and mettle open source control module.. Hajime: This round of update from Hajime also includes GPON exploits.. Two Mirai variants: At least two malicious campaigns are actively exploiting this vulnerability to propagate mirai variants. The second one is already known as Omni.. Imgay: This looks like a botnet under development. We only observe its download behavior and no more follow-up actions.
MITRE ATT&CK techniques:
- T1595.002: Active Scanning - Vulnerability Scanning
- T1203: Exploitation for Client Execution
- T1587.004: Develop Capabilities - Exploits
- T1588.006: Obtain Capabilities - Vulnerabilities
Threat description: CVE-2015-1197 is a directory traversal vulnerability: extracting specially crafted archives containing symbolic links can cause files to be placed at an arbitrary location in the file system.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: The ransomware payload is copied to the ADMIN$ share of a remote system, and Impacket is used to remotely invoke an encoded PowerShell command on target systems to execute the payload
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1570: Lateral Tool Transfer
Threat description: Attempts to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking.
MITRE ATT&CK techniques:
- T1110.002: Brute Force - Password Cracking
- T1003.008: OS Credential Dumping - /etc/passwd and /etc/shadow
Threat description: Unit 42 has been tracking an APT campaign we name TiltedTemple, which we first identified in connection with its use of the Zoho ManageEngine ADSelfService Plus vulnerability CVE-2021-40539 and ServiceDesk Plus vulnerability CVE-2021-44077.
MITRE ATT&CK techniques:
- T1588.006: Obtain Capabilities - Vulnerabilities
Threat description: Vidar is an info-stealer. It downloads DLL files freebl3.dll, mozglue.dll, msvcp140.dll, nss3.dll, softokn3.dll and vcruntime140.dll from its C&C for use in password-grabbing routines.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
Threat description: DanaBot is a modular malware that includes various additional modules; the most popular functionalities of these modules are stealing information from compromised machines and injecting fake forms into popular ecommerce and social media sites to collect payment data. It can also provide full access to infected systems with remote desktop, or mouse and keyboard access by utilizing a VNC plugin.
MITRE ATT&CK techniques:
- T1021.005: Remote Services - VNC
- T1592: Gather Victim Host Information
Threat description: QAKBOT can use Regsvr32 to execute malicious DLLs
MITRE ATT&CK techniques:
- T1588.002: Obtain Capabilities - Tool
- T1218.010: System Binary Proxy Execution - Regsvr32
Threat description: LockBit 2.0 has been seen utilizing numerous tools to dump passwords from password stores and Chrome using GrabChrome and GrabRFF.
MITRE ATT&CK techniques:
- T1555: Credentials from Password Stores
Threat description: Further reconnaissance is performed in the environment to identify privileged users. First, the built-in net.exe and nltest.exe are used.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: Volexity reported yesterday that its analysts had identified approximately 1,600 ZCS servers that they believe were compromised by threat actors leveraging CVE-2022-41352 to plant webshells
MITRE ATT&CK techniques:
- T1588.006: Obtain Capabilities - Vulnerabilities
Threat description: PrivateLoader is yet another example of a Pay-Per-Install malicious loader like LgoogLoader and SmokeLoader. It uses a single-byte XOR encryption key to receive URLs from the control center.
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: MedusaLocker is a ransomware family that was first seen in the wild in early October 2019. In January 2020, a fork of MedusaLocker named Ako was observed, which has been updated to support the use of a Tor hidden service to facilitate a RaaS model. Operators of the Ako version of the malware have since implemented a DLS (Figure 12). At least nine victims have been published to the site since its inception.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
Threat description: However, the program turned out not to be a Gpcode variant. This new version of Bancos.aam turned out to be the first Trojan spy program designed to steal data from users of the Russian QUIK system. 
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: CVE-2018-4878 was the second most commonly observed vulnerability and is the only Adobe Flash Player vulnerability on this year’s top 10. Like CVE-2018-8174, this vulnerability was included in multiple exploit kits, most notably the Fallout exploit kit, which was used to distribute GandCrab ransomware. Fallout took its name and URI patterns from the now defunct Nuclear exploit kit, which had been associated with CVE-2015-7645, one of 2016’s top 10 vulnerabilities. In 2018, Fallout was last selling for $300 a week and $1,100 a month, as seen below.
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
- T1588.005: Obtain Capabilities - Exploits
Threat description: In early February 2018, FireEye iSIGHT Intelligence observed Dridex botnet ID 2040 download a Monero cryptocurrency miner based on the open-source XMRig miner.. On Feb. 12, 2018, FireEye iSIGHT Intelligence observed the banking malware IcedID injecting Monero-mining JavaScript into webpages for specific, targeted URLs. The IcedID injects launched an anonymous miner using the mining code from Coinhive's AuthedMine.. In late 2017, Bleeping Computer reported that security researchers with Radware observed the hacking group CodeFork leveraging the popular downloader Andromeda (aka Gamarue) to distribute a miner module to their existing botnets.. In late 2017, FireEye researchers observed Trickbot operators deploy a new module named "testWormDLL" that is a statically compiled copy of the popular XMRig Monero miner.. On Aug. 29, 2017, Security Week reported on a variant of the popular Neutrino banking Trojan, including a Monero miner module. According to their reporting, the new variant no longer aims at stealing bank card data, but instead is limited to downloading and executing modules from a remote server.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
Threat description: Kaspersky Lab detections for Blue, Black, and Green Lamberts have been triggered by a relatively small set of victims from around the world.  While investigating one of these infections involving White Lambert (network-driven implant) and Blue Lambert (active implant), we found yet another family of tools that appear to be related.  We called this new family ‘Pink Lambert’.
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: In most cases, UNC2165 has stolen data from its victims to use as leverage for extortion after it has deployed ransomware across an environment. In intrusions where the data exfiltration method could be identified, there is evidence to suggest the group used either Rclone or MEGASync to transfer data from the victims' environments prior to encryption. The Rclone utility is used by many financially motivated actors to synchronize sensitive files with cloud storage providers, and MEGASync synchronizes data to the MEGA cloud hosting service.
MITRE ATT&CK techniques:
- T1537: Transfer Data to Cloud Account
Threat description: The Ryuk group went from an email to domain wide ransomware in 29 hours and asked for over $6 million to unlock our systems. They used tools such as Cobalt Strike, AdFind, WMI, vsftpd, PowerShell, PowerView, and Rubeus to accomplish their objective.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1588.002: Obtain Capabilities - Tool
Threat description: Uploads a file on the victim’s computer to the C&C server
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Uses Mimikatz to harvest credentials.
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: Uses legitimate VPN or Citrix credentials to maintain access to an environment.
MITRE ATT&CK techniques:
- T1133: External Remote Services
Threat description: The group abuses common cloud services such as Dropbox, OneDrive, and Mega for C&C communications (receive commands and exfiltrate data).
MITRE ATT&CK techniques:
- T1136.003: Create Account - Cloud Account
Threat description: Uses 7-Zip to compress stolen data for exfiltration.
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: Stolen digital certificate re-use
MITRE ATT&CK techniques:
- T1588.004: Obtain Capabilities - Digital Certificates
Threat description: Exploits Print Nightmare vulnerability.
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
Threat description: Even more, this tiny bootkit with a size of only 80 kb on disk after installation can disable built-in Windows security protection such as Hypervisor-Protected Code Integrity (HVCI) and Windows Defender and bypass User Account Control (UAC).
MITRE ATT&CK techniques:
- T1548.002: Abuse Elevation Control Mechanism - Bypass User Account Control
Threat description: Most PowerShell scripts involved in LockBit 2.0 cases are Base64 encoded.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Although Cobalt Strike has many capabilities beneficial to threat actors in ransomware attacks, it was mainly seen in LockBit 2.0 investigations acting as a command and control beacon, a method of lateral movement and a tool for downloading/executing files.
MITRE ATT&CK techniques:
- T1021: Remote Services
Threat description: Chinese state-sponsored cyber actors have been observed:  Using cmd.exe, JavaScript/Jscript Interpreter, and network device command line interpreters (CLI).  Using PowerShell to conduct reconnaissance, enumeration, and discovery of the victim network.  Employing Python scripts to exploit vulnerable servers.  Using a UNIX shell in order to conduct discovery, enumeration, and lateral movement on Linux® servers in the victim network.
MITRE ATT&CK techniques:
- T1059.007: Command and Scripting Interpreter - JavaScript
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
- T1059.008: Command and Scripting Interpreter - Network Device CLI
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1059.006: Command and Scripting Interpreter - Python
- T1059.004: Command and Scripting Interpreter - Unix Shell
Threat description: Chinese state-sponsored cyber actors have been observed deleting files using rm or del commands. Several files that the cyber actors target would be timestomped, in order to show different times compared to when those files were created/used.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: The actors used a variety of utilities, including publicly available versions of WinRAR® , to archive collected data with password protection.
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: The actors used certutil.exe, a known Living Off the Land" technique, to transfer a file into a target environment."
MITRE ATT&CK techniques:
- T1115: Clipboard Data
Threat description: The part of the malicious code that drops and executes a payload is nearly identical between the two samples. The legitimate Windows executable C:\Windows\System32\colorcpl.exe is copied to the new directory C:\ProgramData\PackageColor and the embedded payload is written to C:\ProgramData\PackageColor\colorui.dll.
MITRE ATT&CK techniques:
- T1218: System Binary Proxy Execution
Threat description: Either via the LNK after startup, or directly via the VBS, the command line “wscript.exe //B //E:vbs C:\Users\Public\Favorites\desktop.ini” is executed, referencing the helper file dropped by the sample mentioned above. Finally, the file C:\Users\Public\ignit.vbs is deleted after execution.
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: “desktop.ini” is used to invoke regasm.exe to launch the payload found in C:\Users\Public\Libraries\core.dll as a hidden window without returning any error codes.
MITRE ATT&CK techniques:
- T1622: Debugger Evasion
Threat description: The Chrome extension is installed and maintained by a number of plist files written to the user directory ~/Library/LaunchAgent/. To conceal the malicious behavior, the underlying commands in the plist files are obfuscated with Base64 encoding.
MITRE ATT&CK techniques:
- T1647: Plist File Modification
Threat description: The first plist, ~/Library/LaunchAgents/com.safarii.extension.plist, does not use a StartInterval value like the Chrome variant, but instead uses RunAtLoad. The RunAtLoad parameter is executed when the user logs into their computer. Note that the plist file does not use the correct spelling of Safari. 
MITRE ATT&CK techniques:
- T1647: Plist File Modification
Threat description: An attacker runs the MimiKatz tool and launches a DCShadow attack (lsadump::dcshadow)
MITRE ATT&CK techniques:
- T1207: Rogue Domain Controller
Threat description: The Nefilim ransomware uses a batch file to stop services and kill processes in the local host. This batch file abuses taskill.exe using CMD to kill predefined services and processes in the target host. Nefilim distributes this batch file to multiple hosts using two batch files. One of the batch files uses the ‘copy’ command, and the other one uses WMI with hard-coded admin credentials.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: To facilitate the staging of BEACON on remote systems APT29 utilized a malicious certificate that allowed the group to impersonate a privileged user.
MITRE ATT&CK techniques:
- T1588.004: Obtain Capabilities - Digital Certificates
Threat description: We believe that the modified library file, which we’ve named LOCKPICK, could weaken encryption for communications used by the appliance, but do not have enough evidence to confirm this
MITRE ATT&CK techniques:
- T1600: Weaken Encryption
Threat description: In the second variation, FireEye observed APT41 leverage the Microsoft BITSAdmin command-line tool to download install.bat (MD5: 7966c2c546b71e800397a67f942858d0) from known APT41 infrastructure 66.42.98[.]220 on port 12345.
MITRE ATT&CK techniques:
- T1571: Non-Standard Port
Threat description: FunnyDream can send compressed and obfuscated packets to C2.
MITRE ATT&CK techniques:
- T1001: Data Obfuscation
Threat description: Operation Wocao has encrypted IP addresses used for "Agent" proxy hops with RC4.
MITRE ATT&CK techniques:
- T1001: Data Obfuscation
Threat description: POWRUNER can use base64 encoded C2 communications.
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
- T1001: Data Obfuscation
Threat description: RDAT has used encoded data within subdomains as AES ciphertext to communicate from the host to the C2.
MITRE ATT&CK techniques:
- T1001: Data Obfuscation
Threat description: SideTwist can embed C2 responses in the source code of a fake Flickr webpage.
MITRE ATT&CK techniques:
- T1001: Data Obfuscation
Threat description: TrailBlazer can masquerade its C2 traffic as legitimate Google Notifications HTTP requests.
MITRE ATT&CK techniques:
- T1001: Data Obfuscation
Threat description: TrailBlazer has used random identifier strings to obscure its C2 operations and result codes.
MITRE ATT&CK techniques:
- T1001.001: Data Obfuscation - Junk Data
Threat description: RDAT can process steganographic images attached to email messages to send and receive C2 commands. RDAT can also embed additional messages within BMP images to communicate with the RDAT operator.
MITRE ATT&CK techniques:
- T1001.002: Data Obfuscation - Steganography
Threat description: Lazarus Group malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, potentially evading SSL traffic inspection/decryption.
MITRE ATT&CK techniques:
- T1001.003: Data Obfuscation - Protocol Impersonation
Threat description: Okrum mimics HTTP protocol for C2 communication, while hiding the actual messages in the Cookie and Set-Cookie headers of the HTTP requests.
MITRE ATT&CK techniques:
- T1001.003: Data Obfuscation - Protocol Impersonation
Threat description: Frankenstein has harvested credentials from the victim's machine using Empire.
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: KONNI can steal profiles (containing credential information) from Firefox, Chrome, and Opera.
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
- T1003: OS Credential Dumping
Threat description: PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated many sources such as WinInet Credential Cache, and Lightweight Directory Access Protocol (LDAP).
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: Suckfly used a signed credential-dumping tool to obtain victim account credentials.
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: APT39 has used Mimikatz, Windows Credential Editor and ProcDump to dump credentials.
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: APT41 has used hashdump, Mimikatz, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: Daserf leverages Mimikatz and Windows Credential Editor to steal credentials.
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: FIN8 harvests credentials using Invoke-Mimikatz or Windows Credentials Editor (WCE).
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: GALLIUM used a modified version of Mimikatz along with a PowerShell-based Mimikatz to dump credentials on the victim machines.
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: Kimsuky has gathered credentials using Mimikatz and ProcDump.
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: Leafminer used several tools for retrieving login and password information, including LaZagne and Mimikatz.
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSASS Memory.
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: OilRig has used credential dumping tools such as Mimikatz to steal credentials to accounts logged into the compromised system and to Outlook Web Access.
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: PLATINUM has used keyloggers that are also capable of dumping credentials.
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.
MITRE ATT&CK techniques:
- T1003.002: OS Credential Dumping - Security Account Manager
- T1003.001: OS Credential Dumping - LSASS Memory
- T1003.004: OS Credential Dumping - LSA Secrets
Threat description: Windows Credential Editor can dump credentials.
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: Cobalt Strike can recover hashed passwords.
MITRE ATT&CK techniques:
- T1003.002: OS Credential Dumping - Security Account Manager
Threat description: Dragonfly has dropped and executed SecretsDump to dump password hashes.
MITRE ATT&CK techniques:
- T1003.002: OS Credential Dumping - Security Account Manager
- T1003.004: OS Credential Dumping - LSA Secrets
Threat description: During Night Dragon, threat actors dumped account hashes using gsecdump.
MITRE ATT&CK techniques:
- T1003.002: OS Credential Dumping - Security Account Manager
Threat description: During Operation CuckooBees, the threat actors leveraged a custom tool to dump OS credentials and used following commands: `reg save HKLM\\SYSTEM system.hiv`, `reg save HKLM\\SAM sam.hiv`, and `reg save HKLM\\SECURITY security.hiv`, to dump SAM, SYSTEM and SECURITY hives.
MITRE ATT&CK techniques:
- T1003.002: OS Credential Dumping - Security Account Manager
Threat description: Fgdump can dump Windows password hashes.
MITRE ATT&CK techniques:
- T1003.002: OS Credential Dumping - Security Account Manager
Threat description: Ke3chang has dumped credentials, including by using gsecdump.
MITRE ATT&CK techniques:
- T1003.002: OS Credential Dumping - Security Account Manager
- T1003.004: OS Credential Dumping - LSA Secrets
Threat description: Koadic can gather hashed passwords by dumping SAM/SECURITY hive.
MITRE ATT&CK techniques:
- T1003.002: OS Credential Dumping - Security Account Manager
Threat description: Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the SAM table.
MITRE ATT&CK techniques:
- T1003.002: OS Credential Dumping - Security Account Manager
Threat description: Mivast has the capability to gather NTLM password information.
MITRE ATT&CK techniques:
- T1003.002: OS Credential Dumping - Security Account Manager
Threat description: Night Dragon has dumped account hashes with Carbanak and cracked them with Cain & Abel.
MITRE ATT&CK techniques:
- T1003.002: OS Credential Dumping - Security Account Manager
Threat description: POWERTON has the ability to dump password hashes.
MITRE ATT&CK techniques:
- T1003.002: OS Credential Dumping - Security Account Manager
Threat description: Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.
MITRE ATT&CK techniques:
- T1003.002: OS Credential Dumping - Security Account Manager
- T1003.004: OS Credential Dumping - LSA Secrets
Threat description: Wizard Spider has acquired credentials from the SAM/SECURITY registry hives.
MITRE ATT&CK techniques:
- T1003.002: OS Credential Dumping - Security Account Manager
Threat description: gsecdump can dump Windows password hashes from the SAM.
MITRE ATT&CK techniques:
- T1003.002: OS Credential Dumping - Security Account Manager
Threat description: Ke3chang has used NTDSDump and other password dumping tools to gather credentials.
MITRE ATT&CK techniques:
- T1003.003: OS Credential Dumping - NTDS
Threat description: Wizard Spider has gained access to credentials via exported copies of the ntds.dit Active Directory database.
MITRE ATT&CK techniques:
- T1003.003: OS Credential Dumping - NTDS
Threat description: APT33 has used a variety of publicly available tools like LaZagne to gather credentials.
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
- T1003.004: OS Credential Dumping - LSA Secrets
- T1555: Credentials from Password Stores
- T1552.001: Unsecured Credentials - Credentials In Files
- T1003.005: OS Credential Dumping - Cached Domain Credentials
Threat description: CosmicDuke collects LSA secrets.
MITRE ATT&CK techniques:
- T1003.004: OS Credential Dumping - LSA Secrets
Threat description: IceApple's Credential Dumper module can dump LSA secrets from registry keys, including: `HKLM\SECURITY\Policy\PolEKList\default`, `HKLM\SECURITY\Policy\Secrets\*\CurrVal`, and `HKLM\SECURITY\Policy\Secrets\*\OldVal`.
MITRE ATT&CK techniques:
- T1003.004: OS Credential Dumping - LSA Secrets
Threat description: Leafminer used several tools for retrieving login and password information, including LaZagne.
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
- T1003.004: OS Credential Dumping - LSA Secrets
- T1555: Credentials from Password Stores
- T1552.001: Unsecured Credentials - Credentials In Files
- T1003.005: OS Credential Dumping - Cached Domain Credentials
Threat description: MuddyWater has performed credential dumping with LaZagne.
MITRE ATT&CK techniques:
- T1003.004: OS Credential Dumping - LSA Secrets
- T1003.005: OS Credential Dumping - Cached Domain Credentials
Threat description: OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.
MITRE ATT&CK techniques:
- T1552.001: Unsecured Credentials - Credentials In Files
- T1003.004: OS Credential Dumping - LSA Secrets
- T1003.005: OS Credential Dumping - Cached Domain Credentials
- T1555: Credentials from Password Stores
Threat description: LaZagne can perform credential dumping from MSCache to obtain account and password information.
MITRE ATT&CK techniques:
- T1003.005: OS Credential Dumping - Cached Domain Credentials
Threat description: Okrum was seen using modified Quarks PwDump to perform credential dumping.
MITRE ATT&CK techniques:
- T1003.005: OS Credential Dumping - Cached Domain Credentials
Threat description: LaZagne can obtain credential information running Linux processes.
MITRE ATT&CK techniques:
- T1003.007: OS Credential Dumping - Proc Filesystem
Threat description: MimiPenguin can dump process memory and extract clear-text credentials.
MITRE ATT&CK techniques:
- T1003.007: OS Credential Dumping - Proc Filesystem
Threat description: LaZagne can obtain credential information from /etc/shadow using the shadow.py module.
MITRE ATT&CK techniques:
- T1003.008: OS Credential Dumping - /etc/passwd and /etc/shadow
Threat description: Bumblebee can capture and compress stolen credentials from the Registry and volume shadow copies.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Frankenstein has enumerated hosts via Empire, gathering various local system information.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: KGH_SPY can send a file containing victim system information to C2.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: KONNI has stored collected information and discovered processes in a tmp file.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Machete searches the File system for files of interest.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Magic Hound has used a web shell to exfiltrate a ZIP file containing a dump of LSASS memory on a compromised machine.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Ramsay can collect Microsoft Word documents from the target's file system, as well as ".txt", ".doc", and ".xls" files from the Internet Explorer cache.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: SDBbot has the ability to access the file system on a compromised host.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.
MITRE ATT&CK techniques:
- T1005: Data from Local System
- T1119: Automated Collection
Threat description: WellMess can send files from the victim machine to C2.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: During Operation Wocao, threat actors used the `tasklist` command to search for one of its backdoors.
MITRE ATT&CK techniques:
- T1007: System Service Discovery
Threat description: Earth Lusca has used Tasklist to obtain information from a compromised host.
MITRE ATT&CK techniques:
- T1007: System Service Discovery
- T1057: Process Discovery
Threat description: SILENTTRINITY can search for modifiable services that could be used for privilege escalation.
MITRE ATT&CK techniques:
- T1007: System Service Discovery
Threat description: CharmPower can change its C2 channel once every 360 loops by retrieving a new domain from the actors’ S3 bucket.
MITRE ATT&CK techniques:
- T1008: Fallback Channels
Threat description: Crutch has used a hardcoded GitHub repository as a fallback channel.
MITRE ATT&CK techniques:
- T1008: Fallback Channels
Threat description: During Night Dragon, threat actors used company extranet servers as secondary C2 servers.
MITRE ATT&CK techniques:
- T1008: Fallback Channels
Threat description: SideTwist has primarily used port 443 for C2 but can use port 80 as a fallback.
MITRE ATT&CK techniques:
- T1008: Fallback Channels
Threat description: Bazar can query "Windows\CurrentVersion\Uninstall" for installed applications.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: APT28 has used a UEFI (Unified Extensible Firmware Interface) rootkit known as LoJax.
MITRE ATT&CK techniques:
- T1014: Rootkit
Threat description: Hacking Team UEFI Rootkit is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems.
MITRE ATT&CK techniques:
- T1542.001: Pre-OS Boot - System Firmware
- T1014: Rootkit
Threat description: LoJax is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems.
MITRE ATT&CK techniques:
- T1542.001: Pre-OS Boot - System Firmware
- T1014: Rootkit
Threat description: Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.
MITRE ATT&CK techniques:
- T1014: Rootkit
- T1574.006: Hijack Execution Flow - Dynamic Linker Hijacking
Threat description: Cobalt Strike can determine the NetBios name and  the IP addresses of targets machines including domain controllers.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: Threat Group-3390 actors use NBTscan to discover vulnerable systems.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: GoldFinder performed HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request traveled through.
MITRE ATT&CK techniques:
- T1016.001: System Network Configuration Discovery - Internet Connection Discovery
Threat description: Neoichor can check for Internet connectivity by contacting bing[.]com with the request format `bing[.]com?id=<GetTickCount>`.
MITRE ATT&CK techniques:
- T1016.001: System Network Configuration Discovery - Internet Connection Discovery
Threat description: QakBot can measure the download speed on a targeted host.
MITRE ATT&CK techniques:
- T1016.001: System Network Configuration Discovery - Internet Connection Discovery
Threat description: QuietSieve can check C2 connectivity with a `ping` to 8.8.8.8 (Google public DNS).
MITRE ATT&CK techniques:
- T1016.001: System Network Configuration Discovery - Internet Connection Discovery
Threat description: Rising Sun can test a connection to a specified network IP address over a specified port number.
MITRE ATT&CK techniques:
- T1016.001: System Network Configuration Discovery - Internet Connection Discovery
Threat description: SUGARUSH has checked for internet connectivity from an infected host before attempting to establish a new TCP connection.
MITRE ATT&CK techniques:
- T1016.001: System Network Configuration Discovery - Internet Connection Discovery
Threat description: FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
- T1046: Network Service Discovery
Threat description: PoetRAT used Nmap for remote system discovery.
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: RATANKBA runs the "net view /domain" and "net view" commands.
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: Silence has used Nmap to scan the corporate network, build a network topology, and identify vulnerable hosts.
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: The TAINTEDSCRIBE command and execution module can perform target system enumeration.
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: Doki has used a script that gathers information from a hardcoded list of IP addresses and uploads to an Ngrok URL.
MITRE ATT&CK techniques:
- T1020: Automated Exfiltration
Threat description: Frankenstein has collected information via Empire, which is automatically sent the data back to the adversary's C2.
MITRE ATT&CK techniques:
- T1020: Automated Exfiltration
- T1041: Exfiltration Over C2 Channel
Threat description: DarkComet can open an active screen of the victim’s machine and take control of the mouse and keyboard.
MITRE ATT&CK techniques:
- T1021.001: Remote Services - Remote Desktop Protocol
Threat description: Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
- T1078: Valid Accounts
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: Blue Mockingbird has used Windows Explorer to manually copy malicious files to remote hosts over SMB.
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
Threat description: HermeticWizard can use a list of hardcoded credentials to to authenticate via NTLMSSP to the SMB shares on remote systems.
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
Threat description: Turla used "net use" commands to connect to lateral systems within a network.
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
Threat description: TEMP.Veles has relied on encrypted SSH-based tunnels to transfer tools and for remote command/program execution.
MITRE ATT&CK techniques:
- T1021.004: Remote Services - SSH
Threat description: a predefined directory."
MITRE ATT&CK techniques:
- T1025: Data from Removable Media
Threat description: Explosive can scan all .exe files located in the USB drive.
MITRE ATT&CK techniques:
- T1025: Data from Removable Media
Threat description: Machete had a module in its malware to find, encrypt, and upload files from fixed and removable drives.
MITRE ATT&CK techniques:
- T1025: Data from Removable Media
Threat description: Ramsay can collect data from removable media and stage it for exfiltration.
MITRE ATT&CK techniques:
- T1025: Data from Removable Media
Threat description: AppleJeus has XOR-encrypted collected system information prior to sending to a C2. AppleJeus has also used the open source ADVObfuscation library for its components.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: BoomBox can encrypt data using AES prior to exfiltration.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Dtrack has used a dropper that embeds an encrypted payload as extra data.
MITRE ATT&CK techniques:
- T1027.009: Obfuscated Files or Information - Embedded Payloads
- T1027: Obfuscated Files or Information
Threat description: Goopy's decrypter have been inflated with junk code in between legitimate API functions, and also included infinite loops to avoid analysis.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: If the victim is using PowerShell 3.0 or later, POWERSOURCE writes its decoded payload to an Alternate Data Stream (ADS) named kernel32.dll that is saved in "%PROGRAMDATA%\Windows\".
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: MCMD can Base64 encode output strings prior to sending to C2.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Maze has decrypted strings and other important information during the encryption process. Maze also calls certain functions dynamically to hinder analysis.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Moses Staff has used obfuscated web shells in their operations.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: PowerStallion uses a XOR cipher to encrypt command output written to its OneDrive C2 server.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: ROKRAT can encrypt data prior to exfiltration by using an RSA public key.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: ShimRatReporter encrypted gathered information with a combination of shifting and XOR using a static key.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: SoreFang has the ability to encode and RC6 encrypt data sent to C2.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Trojan.Karagany can base64 encode and AES-128-CBC encrypt data prior to transmission.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Javali can use large obfuscated libraries to hinder detection and analysis.
MITRE ATT&CK techniques:
- T1027.001: Obfuscated Files or Information - Binary Padding
Threat description: Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.
MITRE ATT&CK techniques:
- T1027.005: Obfuscated Files or Information - Indicator Removal from Tools
- T1027.001: Obfuscated Files or Information - Binary Padding
Threat description: ZeroT has obfuscated DLLs and functions using dummy API calls inserted between real instructions.
MITRE ATT&CK techniques:
- T1027.001: Obfuscated Files or Information - Binary Padding
Threat description: Bisonal has used the MPRESS packer and similar tools for obfuscation.
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: CostaBricks can implement a custom-built virtual machine mechanism to obfuscate its code.
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: Egregor's payloads are custom-packed, archived and encrypted to prevent analysis.
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: QakBot can encrypt and pack malicious payloads.
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: BRONZE BUTLER has used steganography in multiple operations to conceal malicious payloads.
MITRE ATT&CK techniques:
- T1027.003: Obfuscated Files or Information - Steganography
Threat description: Leviathan has used steganography to hide stolen data inside other files stored on Github.
MITRE ATT&CK techniques:
- T1027.003: Obfuscated Files or Information - Steganography
Threat description: RDAT can also embed data within a BMP image prior to exfiltration.
MITRE ATT&CK techniques:
- T1027.003: Obfuscated Files or Information - Steganography
Threat description: RegDuke can hide data in images, including use of the Least Significant Bit (LSB).
MITRE ATT&CK techniques:
- T1027.003: Obfuscated Files or Information - Steganography
Threat description: Gamaredon Group has compiled the source code for a downloader directly on the infected system using the built-in "Microsoft.CSharp.CSharpCodeProvider" class.
MITRE ATT&CK techniques:
- T1027.004: Obfuscated Files or Information - Compile After Delivery
Threat description: Deep Panda has updated and modified its malware, resulting in different hash values that evade detection.
MITRE ATT&CK techniques:
- T1027.005: Obfuscated Files or Information - Indicator Removal from Tools
Threat description: InvisiMole has undergone regular technical improvements in an attempt to evade detection.
MITRE ATT&CK techniques:
- T1027.005: Obfuscated Files or Information - Indicator Removal from Tools
Threat description: SUNBURST source code used generic variable names and pre-obfuscated strings, and was likely sanitized of developer comments before being added to SUNSPOT.
MITRE ATT&CK techniques:
- T1027.005: Obfuscated Files or Information - Indicator Removal from Tools
Threat description: APT29 has embedded an ISO file within an HTML attachment that contained JavaScript code to initiate malware execution.
MITRE ATT&CK techniques:
- T1027.006: Obfuscated Files or Information - HTML Smuggling
Threat description: EnvyScout contains JavaScript code that can extract an encoded blob from its HTML body and write it to disk.
MITRE ATT&CK techniques:
- T1027.006: Obfuscated Files or Information - HTML Smuggling
Threat description: Bazar can hash then resolve API calls at runtime.
MITRE ATT&CK techniques:
- T1027.007: Obfuscated Files or Information - Dynamic API Resolution
Threat description: Lazarus Group has used a custom hashing method to resolve APIs used in shellcode.
MITRE ATT&CK techniques:
- T1027.007: Obfuscated Files or Information - Dynamic API Resolution
Threat description: Pteranodon can use a dynamic Windows hashing algorithm to map API components.
MITRE ATT&CK techniques:
- T1027.007: Obfuscated Files or Information - Dynamic API Resolution
Threat description: macOS.OSAMiner has used run-only Applescripts, a compiled and stripped version of AppleScript, to remove human readable indicators to evade detection.
MITRE ATT&CK techniques:
- T1027.008: Obfuscated Files or Information - Stripped Payloads
Threat description: macOS.OSAMiner has embedded Stripped Payloads within another run-only Stripped Payloads.
MITRE ATT&CK techniques:
- T1027.009: Obfuscated Files or Information - Embedded Payloads
Threat description: ADVSTORESHELL collects, compresses, encrypts, and exfiltrates data to the C2 server every 10 minutes.
MITRE ATT&CK techniques:
- T1029: Scheduled Transfer
Threat description: Cobalt Strike can set its Beacon payload to reach out to the C2 server on an arbitrary and random interval.
MITRE ATT&CK techniques:
- T1029: Scheduled Transfer
Threat description: LightNeuron can be configured to exfiltrate data during nighttime or working hours.
MITRE ATT&CK techniques:
- T1029: Scheduled Transfer
Threat description: POWERSTATS can sleep for a given number of seconds.
MITRE ATT&CK techniques:
- T1029: Scheduled Transfer
Threat description: APT39 used Remexi to collect usernames from the system.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: BloodHound can collect information on user sessions.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: Caterpillar WebShell can obtain a list of user accounts from a victim's machine.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: DRATzarus can obtain a list of users from an infected machine.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: During Night Dragon, threat actors used password cracking and pass-the-hash tools to discover usernames and passwords.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: FIN10 has used Meterpreter to enumerate users on remote systems.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: Linux Rabbit opens a socket on port 22 and if it receives a response it attempts to obtain the machine's hostname and Top-Level Domain.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: Mis-Type runs tests to determine the privilege level of the compromised user.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: EnvyScout has used folder icons for malicious files to lure victims into opening them.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: LazyScripter has used several different security software icons to disguise executables.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: Mustang Panda has used an additional filename extension to hide the true file type.
MITRE ATT&CK techniques:
- T1036.007: Masquerading - Double File Extension
- T1036: Masquerading
Threat description: NativeZone has, upon execution, displayed a message box that appears to be related to a Ukrainian electronic document management system.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: Nomadic Octopus attempted to make Octopus appear as a  Telegram Messenger with a Russian interface.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: NotPetya drops PsExec with the filename dllhost.dat.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: QuasarRAT has dropped binaries as files named microsoft_network.exe and crome.exe.
MITRE ATT&CK techniques:
- T1036: Masquerading