QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: APT29 has edited the `Microsoft.IdentityServer.Servicehost.exe.config` file to load a malicious DLL into the AD FS process, thereby enabling persistent access to any service federated with AD FS for a user with a specified User Principal Name.
MITRE ATT&CK techniques:
- T1556.007: Modify Authentication Process - Hybrid Identity
Threat description: Dok proxies web traffic to potentially monitor and alter victim HTTP(S) traffic.
MITRE ATT&CK techniques:
- T1557: Adversary-in-the-Middle
Threat description: Impacket modules like ntlmrelayx and smbrelayx can be used in conjunction with Network Sniffing and LLMNR/NBT-NS Poisoning and SMB Relay to gather NetNTLM credentials for Brute Force or relay attacks that can gain code execution.
MITRE ATT&CK techniques:
- T1557.001: Adversary-in-the-Middle - LLMNR/NBT-NS Poisoning and SMB Relay
Threat description: Lazarus Group executed Responder using the command "[Responder file path] -i [IP address] -rPv" on a compromised host to harvest credentials and move laterally.
MITRE ATT&CK techniques:
- T1557.001: Adversary-in-the-Middle - LLMNR/NBT-NS Poisoning and SMB Relay
Threat description: Wizard Spider has used the Invoke-Inveigh PowerShell cmdlets, likely for name service poisoning.
MITRE ATT&CK techniques:
- T1557.001: Adversary-in-the-Middle - LLMNR/NBT-NS Poisoning and SMB Relay
Threat description: Empire can leverage its implementation of Mimikatz to obtain and use golden tickets.
MITRE ATT&CK techniques:
- T1558.001: Steal or Forge Kerberos Tickets - Golden Ticket
Threat description: AADInternals can be used to forge Kerberos tickets using the password hash of the AZUREADSSOACC account.
MITRE ATT&CK techniques:
- T1558.002: Steal or Forge Kerberos Tickets - Silver Ticket
Threat description: Empire can leverage its implementation of Mimikatz to obtain and use silver tickets.
MITRE ATT&CK techniques:
- T1558.002: Steal or Forge Kerberos Tickets - Silver Ticket
Threat description: FIN7 has used Kerberoasting for credential access and to enable lateral movement.
MITRE ATT&CK techniques:
- T1558.003: Steal or Forge Kerberos Tickets - Kerberoasting
Threat description: HyperStack can connect to the IPC$ share on remote machines.
MITRE ATT&CK techniques:
- T1559: Inter-Process Communication
Threat description: Gamaredon Group malware can insert malicious macros into documents using a "Microsoft.Office.Interop" object.
MITRE ATT&CK techniques:
- T1559.001: Inter-Process Communication - Component Object Model
Threat description: Ramsay can use the Windows COM API to schedule tasks and maintain persistence.
MITRE ATT&CK techniques:
- T1559.001: Inter-Process Communication - Component Object Model
Threat description: RTM can search for specific strings within browser tabs using a Dynamic Data Exchange mechanism.
MITRE ATT&CK techniques:
- T1559.002: Inter-Process Communication - Dynamic Data Exchange
Threat description: ADVSTORESHELL encrypts with the 3DES algorithm and a hardcoded key prior to exfiltration.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: Aria-body has used ZIP to compress data gathered on a compromised host.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: BloodHound can compress data collected by its SharpHound ingestor into a ZIP file to be written to disk.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: Cadelspy has the ability to compress stolen data into a .cab file.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: Chrommme can encrypt and store on disk collected data before exfiltration.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: Daserf hides collected data in password-protected .rar archives.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: Gold Dragon encrypts data using Base64 before being sent to the command and control server.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: Kessel can RC4-encrypt credentials before sending to the C2.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: VERMIN encrypts the collected files using 3-DES.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: APT3 has used tools to compress data before exfilling it.
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: APT39 has used WinRAR and 7-Zip to compress an archive stolen data.
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: BRONZE BUTLER has compressed data into password-protected RAR archives prior to exfiltration.
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: Calisto uses the "zip -r" command to compress the data collected on the local system.
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: Chimera has used gzip for Linux OS and a modified RAR software to archive data on Windows hosts.
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: Crutch has used the WinRAR utility to compress and encrypt stolen files.
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: During Operation Honeybee, the threat actors uses zip to pack collected files before exfiltration.
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: During Operation Wocao, threat actors archived collected files with WinRAR, prior to exfiltration.
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: DustySky can compress files via RAR while staging data to be exfiltrated.
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: IceApple can encrypt and compress files using Gzip prior to exfiltration.
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: Octopus has compressed data before exfiltrating it using a tool called Abbrevia.
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: PUNCHBUGGY has Gzipped information and saved it to a random temp file before exfil.
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: PoetRAT has the ability to compress files with zip.
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: PoshC2 contains a module for compressing data using ZIP.
MITRE ATT&CK techniques:
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: BADFLICK has compressed data using the aPLib compression library.
MITRE ATT&CK techniques:
- T1560.002: Archive Collected Data - Archive via Library
Threat description: Epic compresses the collected data with bzip2 before sending it to the C2 server.
MITRE ATT&CK techniques:
- T1560.002: Archive Collected Data - Archive via Library
Threat description: Gelsemium can compress embedded executables with the zlib library.
MITRE ATT&CK techniques:
- T1560.002: Archive Collected Data - Archive via Library
Threat description: InvisiMole can use zlib to compress and decompress data.
MITRE ATT&CK techniques:
- T1560.002: Archive Collected Data - Archive via Library
Threat description: Threat Group-3390 has used RAR to compress, encrypt, and password-protect files prior to exfiltration.
MITRE ATT&CK techniques:
- T1560.002: Archive Collected Data - Archive via Library
Threat description: Agent.btz saves system information into an XML file that is then XOR-encoded.
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: CopyKittens encrypts data with a substitute cipher prior to exfiltration.
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: FLASHFLOOD employs the same encoding scheme as SPACESHIP for data it stages. Data is compressed with zlib, and bytes are rotated four times before being XOR'ed with 0x23.
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: FunnyDream has compressed collected files with zLib and encrypted them using an XOR operation with the string key from the command line or `qwerasdf` if the command line argument doesn’t contain the key. File names are obfuscated using XOR with the same key as the compressed file content.
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: HAWKBALL has encrypted data with XOR before sending it over the C2 channel.
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: MESSAGETAP has XOR-encrypted and stored contents of SMS messages that matched its target list.
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: Machete's collected data is encrypted with AES before exfiltration.
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: OopsIE compresses collected files with a simple character replacement scheme before sending them to its C2 server.
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: OwaAuth DES-encrypts captured credentials using the key 12345678 before writing the credentials to a log file.
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: RGDoor encrypts files with XOR before sending them back to the C2 server.
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: Ramsay can store collected documents in a custom container after encrypting and compressing them using RC4 and WinRAR.
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: Reaver encrypts collected data with an incremental XOR key prior to exfiltration.
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: Rising Sun can archive data using RC4 encryption and Base64 encoding prior to exfiltration.
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: StrongPity can compress and encrypt archived files into multiple .sft files with a repeated xor encryption scheme.
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: Stuxnet encrypts exfiltrated data via C2 with static 31-byte long XOR keys.
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: Magic Hound has disabled LSA protection on compromised hosts using `"reg" add HKLM\SYSTEM\CurrentControlSet\Control\LSA /v RunAsPPL /t REG_DWORD /d 0 /f`.
MITRE ATT&CK techniques:
- T1562: Impair Defenses
Threat description: Stuxnet reduces the integrity level of objects to allow write actions.
MITRE ATT&CK techniques:
- T1562: Impair Defenses
Threat description: JPIN can lower security settings by changing Registry keys.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: KOCTOPUS will attempt to delete or disable all Registry keys and scheduled tasks related to Microsoft Security Defender and Security Essentials.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: POWERSTATS can disable Microsoft Office Protected View by changing Registry keys.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: macOS.OSAMiner has searched for the Activity Monitor process in the System Events process list and kills the process if running. macOS.OSAMiner also searches the operating system's `install.log` for apps matching its hardcoded list, killing all matching process names.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: The "ZR" variant of BACKSPACE will check to see if known host-based firewalls are installed on the infected systems. BACKSPACE will attempt to establish a C2 channel, then will examine open windows to identify a pop-up from the firewall software and will simulate a mouse-click to allow the connection to proceed.
MITRE ATT&CK techniques:
- T1562.004: Impair Defenses - Disable or Modify System Firewall
Threat description: Waterbear can hook the "ZwOpenProcess" and "GetExtendedTcpTable" APIs called by the process of a security product to hide PIDs and TCP records from detection.
MITRE ATT&CK techniques:
- T1562.006: Impair Defenses - Indicator Blocking
Threat description: Axiom has targeted victims with remote administration tools including RDP.
MITRE ATT&CK techniques:
- T1563.002: Remote Service Session Hijacking - RDP Hijacking
Threat description: WannaCry enumerates current remote desktop sessions and tries to execute the malware on each session.
MITRE ATT&CK techniques:
- T1563.002: Remote Service Session Hijacking - RDP Hijacking
Threat description: Bundlore uses the "mktemp" utility to make unique file and directory names for payloads, such as "TMP_DIR=`mktemp -d -t x".
MITRE ATT&CK techniques:
- T1564: Hide Artifacts
Threat description: OSX/Shlayer has used the "mktemp" utility to make random and unique filenames for payloads, such as "export tmpDir="$(mktemp -d /tmp/XXXXXXXXXXXX)"" or "mktemp -t Installer".
MITRE ATT&CK techniques:
- T1564: Hide Artifacts
Threat description: Carberp has created a hidden file in the Startup folder of the current user.
MITRE ATT&CK techniques:
- T1564.001: Hide Artifacts - Hidden Files and Directories
Threat description: Machete has the capability to exfiltrate stolen data to a hidden folder on a removable drive.
MITRE ATT&CK techniques:
- T1564.001: Hide Artifacts - Hidden Files and Directories
Threat description: WastedLocker has copied a random file from the Windows System32 folder to the "%APPDATA%" location under a different hidden filename.
MITRE ATT&CK techniques:
- T1564.001: Hide Artifacts - Hidden Files and Directories
Threat description: QuasarRAT can hide process windows and make web requests invisible to the compromised user. Requests marked as invisible have been sent with user-agent string `Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A` though QuasarRAT can only be run on Windows systems.
MITRE ATT&CK techniques:
- T1564.003: Hide Artifacts - Hidden Window
Threat description: LoJax has loaded an embedded NTFS DXE driver to be able to access and write to NTFS partitions.
MITRE ATT&CK techniques:
- T1564.004: Hide Artifacts - NTFS File Attributes
Threat description: BOOTRASH has used unallocated disk space between partitions for a hidden file system that stores components of the Nemesis bootkit.
MITRE ATT&CK techniques:
- T1564.005: Hide Artifacts - Hidden File System
Threat description: ComRAT has used a portable FAT16 partition image placed in %TEMP% as a hidden file system.
MITRE ATT&CK techniques:
- T1564.005: Hide Artifacts - Hidden File System
Threat description: Regin has used a hidden file system to store some of its components.
MITRE ATT&CK techniques:
- T1564.005: Hide Artifacts - Hidden File System
Threat description: Strider has used a hidden file system that is stored as a file on disk.
MITRE ATT&CK techniques:
- T1564.005: Hide Artifacts - Hidden File System
Threat description: Ragnar Locker has used VirtualBox and a stripped Windows XP virtual machine to run itself. The use of a shared folder specified in the configuration enables Ragnar Locker to encrypt files on the host operating system, including files on any mapped drives.
MITRE ATT&CK techniques:
- T1564.006: Hide Artifacts - Run Virtual Instance
Threat description: FIN4 has created rules in victims' Microsoft Outlook accounts to automatically delete emails containing words such as “hacked," "phish," and “malware" in a likely attempt to prevent organizations from communicating about their activities.
MITRE ATT&CK techniques:
- T1564.008: Hide Artifacts - Email Hiding Rules
Threat description: Cobalt Strike can use spoof arguments in spawned processes that execute beacon commands.
MITRE ATT&CK techniques:
- T1564.010: Hide Artifacts - Process Argument Spoofing
Threat description: APT38 has used DYEPACK to create, delete, and alter records in databases used for SWIFT transactions.
MITRE ATT&CK techniques:
- T1565.001: Data Manipulation - Stored Data Manipulation
Threat description: SUNSPOT created a copy of the SolarWinds Orion software source file with a ".bk" extension to backup the original content, wrote SUNBURST using the same filename but with a ".tmp" extension, and then moved SUNBURST using "MoveFileEx" to the original filename with a ".cs" extension so it could be compiled within Orion software.
MITRE ATT&CK techniques:
- T1565.001: Data Manipulation - Stored Data Manipulation
Threat description: APT38 has used DYEPACK to manipulate SWIFT messages en route to a printer.
MITRE ATT&CK techniques:
- T1565.002: Data Manipulation - Transmitted Data Manipulation
Threat description: Melcoz can monitor the clipboard for cryptocurrency addresses and change the intended address to one controlled by the adversary.
MITRE ATT&CK techniques:
- T1565.002: Data Manipulation - Transmitted Data Manipulation
Threat description: APT38 has used DYEPACK.FOX to manipulate PDF data as it is accessed to remove traces of fraudulent SWIFT transactions from the data displayed to the end user.
MITRE ATT&CK techniques:
- T1565.003: Data Manipulation - Runtime Data Manipulation
Threat description: Dragonfly has used spearphising campaigns to gain access to victims.
MITRE ATT&CK techniques:
- T1566: Phishing
Threat description: APT30 has used spearphishing emails with malicious DOC attachments.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: Bumblebee has gained execution through luring users into opening malicious attachments.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: Cobalt Group has sent spearphishing emails with various attachment types to corporate and personal email accounts of victim organizations. Attachment types have included .rtf, .doc, .xls, archives containing LNK files, and password protected archives containing .exe and .scr executables.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: EnvyScout has been distributed via spearphishing as an email attachment.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: Flagpro has been distributed via spearphishing as an email attachment.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: IndigoZebra sent spearphishing emails containing malicious password-protected RAR attachments.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: JSS Loader has been delivered by phishing emails containing malicious Microsoft Excel attachments.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: PLATINUM has sent spearphishing emails with attachments to victims as its primary initial access vector.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: Patchwork has used spearphishing with an attachment to deliver files with exploits to initial victims.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: PoetRAT was distributed via malicious Word documents.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: Sharpshooter has sent malicious attachments via emails to targets.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: TA459 has targeted victims using spearphishing emails with malicious Microsoft Word attachments.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: Tropic Trooper sent spearphishing emails that contained malicious Microsoft Office and fake installer file attachments.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: Windshift has sent spearphishing emails with attachment to harvest credentials and deliver malware.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: ZxxZ has been distributed via spearphishing emails, usually containing a malicious RTF or Excel attachment.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: AADInternals can send "consent phishing" emails containing malicious links designed to steal users’ access tokens.
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: Dragonfly 2.0 used spearphishing with PDF attachments containing malicious links that redirected to credential harvesting websites.
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: During C0011, Transparent Tribe sent emails containing a malicious link to student targets in India.
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: EXOTIC LILY has relied on victims to open malicious links in e-mails for execution.
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: Ember Bear has sent spearphishing emails containing malicious links.
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: Kimsuky has sent spearphishing emails containing a link to a document that contained malicious macros or took the victim to an actor-controlled domain.
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: Magic Hound has sent malicious URL links through email to victims. In some cases the URLs were shortened or linked to Word documents with malicious macros that executed PowerShells scripts to download Pupy.
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: Sidewinder has sent e-mails with malicious links often crafted for specific targets.
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: Turla attempted to trick targets into clicking on a link featuring a seemingly legitimate domain from Adobe.com to download their malware and gain initial access.
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: APT29 has used the legitimate mailing service Constant Contact to send phishing e-mails.
MITRE ATT&CK techniques:
- T1566.003: Phishing - Spearphishing via Service
Threat description: Magic Hound used various social media channels (such as LinkedIn) as well as messaging services (such as WhatsApp) to spearphish victims.
MITRE ATT&CK techniques:
- T1566.003: Phishing - Spearphishing via Service
Threat description: APT28 can exfiltrate data over Google Drive.
MITRE ATT&CK techniques:
- T1567: Exfiltration Over Web Service
Threat description: AppleSeed has exfiltrated files using web services.
MITRE ATT&CK techniques:
- T1567: Exfiltration Over Web Service
Threat description: DropBook has used legitimate web services to exfiltrate data.
MITRE ATT&CK techniques:
- T1567: Exfiltration Over Web Service
Threat description: For Operation Spalax, the threat actors used dynamic DNS services, including Duck DNS and DNS Exit, as part of their C2 infrastructure.
MITRE ATT&CK techniques:
- T1568: Dynamic Resolution
Threat description: Gamaredon Group has incorporated dynamic DNS domains in its infrastructure.
MITRE ATT&CK techniques:
- T1568: Dynamic Resolution
Threat description: Gelsemium can use dynamic DNS domain names in C2.
MITRE ATT&CK techniques:
- T1568: Dynamic Resolution
Threat description: NETEAGLE can use HTTP to download resources that contain an IP address and port number pair to connect to for C2.
MITRE ATT&CK techniques:
- T1568: Dynamic Resolution
Threat description: Tomiris has connected to a signalization server that provides a URL and port, and then Tomiris sends a GET request to that URL to establish C2.
MITRE ATT&CK techniques:
- T1568: Dynamic Resolution
Threat description: UNC2452 used dynamic DNS resolution to construct and resolve to randomly-generated subdomains for C2.
MITRE ATT&CK techniques:
- T1568: Dynamic Resolution
Threat description: Machete has used free dynamic DNS domains for C2.
MITRE ATT&CK techniques:
- T1568.001: Dynamic Resolution - Fast Flux DNS
Threat description: gh0st RAT operators have used dynamic DNS to mask the true location of their C2 behind rapidly changing IP addresses.
MITRE ATT&CK techniques:
- T1568.001: Dynamic Resolution - Fast Flux DNS
Threat description: CHOPSTICK can use a DGA for Fallback Channels, domains are generated by concatenating words from lists.
MITRE ATT&CK techniques:
- T1568.002: Dynamic Resolution - Domain Generation Algorithms
Threat description: TeamTNT has created system services to execute cryptocurrency mining software.
MITRE ATT&CK techniques:
- T1569: System Services
Threat description: AppleJeus has loaded a plist file using the "launchctl" command.
MITRE ATT&CK techniques:
- T1569.001: System Services - Launchctl
Threat description: XCSSET loads a system level launchdaemon using the "launchctl load -w" command from "/System/Librarby/LaunchDaemons/ssh.plist".
MITRE ATT&CK techniques:
- T1569.001: System Services - Launchctl
Threat description: APT38 has created new services or modified existing ones to run executables, commands, or scripts.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: Anchor can create and execute services to load its payload.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: FIN6 has created Windows services to execute encoded PowerShell commands.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: HOPLIGHT has used svchost.exe to execute a malicious DLL .
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: HermeticWiper can create system services to aid in executing the payload.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: Honeybee launches a DLL file that gets executed as a service using svchost.exe
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: InvisiMole has used Windows services as a way to execute its malicious payload.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: LoudMiner started the cryptomining virtual machine as a service on the infected machine.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: NotPetya can use PsExec to help propagate itself across a network.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: Okrum's loader can create a new service named NtmsSvc to execute the payload.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: Olympic Destroyer utilizes PsExec to help propagate itself across a network.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: Proxysvc registers itself as a service on the victim’s machine to run as a standalone process.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: Shamoon creates a new service named “ntssrv” to execute the payload. Shamoon can also spread via PsExec.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: TinyTurla can install itself as a service on compromised machines.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: WastedLocker can execute itself as a service.
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: Aoqin Dragon has spread malware in target networks by copying modules to folders masquerading as removable devices.
MITRE ATT&CK techniques:
- T1570: Lateral Tool Transfer
Threat description: Kerrdown can download additional software including Cobalt Strike from servers on the victim's network.
MITRE ATT&CK techniques:
- T1570: Lateral Tool Transfer
Threat description: LockerGoga has been observed moving around the victim network via SMB, indicating the actors behind this ransomware are manually copying files form computer to computer instead of self-propagating.
MITRE ATT&CK techniques:
- T1570: Lateral Tool Transfer
Threat description: Wizard Spider has used stolen credentials to copy tools into the "%TEMP%" directory of domain controllers.
MITRE ATT&CK techniques:
- T1570: Lateral Tool Transfer
Threat description: An APT32 backdoor can use HTTP over a non-standard TCP port (e.g 14146) which is specified in the backdoor configuration.
MITRE ATT&CK techniques:
- T1571: Non-Standard Port
Threat description: BADCALL communicates on ports 443 and 8000 with a FakeTLS method.
MITRE ATT&CK techniques:
- T1571: Non-Standard Port
Threat description: Bankshot binds and listens on port 1058 for HTTP traffic while also utilizing a FakeTLS method.
MITRE ATT&CK techniques:
- T1571: Non-Standard Port
Threat description: BendyBear has used a custom RC4 and XOR encrypted protocol over port 443 for C2.
MITRE ATT&CK techniques:
- T1571: Non-Standard Port
Threat description: Derusbi has used unencrypted HTTP on port 443 for C2.
MITRE ATT&CK techniques:
- T1571: Non-Standard Port
Threat description: GoldenSpy has used HTTP over ports 9005 and 9006 for network traffic, 9002 for C2 requests, 33666 as a WebSocket, and 8090 to download files.
MITRE ATT&CK techniques:
- T1571: Non-Standard Port
Threat description: HARDRAIN binds and listens on port 443 with a FakeTLS method.
MITRE ATT&CK techniques:
- T1571: Non-Standard Port
Threat description: Magic Hound malware has communicated with its C2 server over TCP port 4443 using HTTP.
MITRE ATT&CK techniques:
- T1571: Non-Standard Port
Threat description: PoetRAT used TLS to encrypt communications over port 143
MITRE ATT&CK techniques:
- T1571: Non-Standard Port
Threat description: Chimera has encapsulated Cobalt Strike's C2 protocol in DNS and HTTPS.
MITRE ATT&CK techniques:
- T1572: Protocol Tunneling
Threat description: Cobalt Group has used the Plink utility to create SSH tunnels.
MITRE ATT&CK techniques:
- T1573.002: Encrypted Channel - Asymmetric Cryptography
- T1572: Protocol Tunneling
Threat description: APT28 installed a Delphi backdoor that used a custom algorithm for C2 communications.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: Attor has encrypted data symmetrically using a randomly generated Blowfish (OFB) key which is encrypted with a public RSA key.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: Before being appended to image files, HAMMERTOSS commands are encrypted with a key composed of both a hard-coded value and a string contained on that day's tweet. To decrypt the commands, an investigator would need access to the intended malware sample, the day's tweet, and the image file containing the command.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: Bonadan can XOR-encrypt C2 communications.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: CORESHELL C2 messages are encrypted with custom stream ciphers using six-byte or eight-byte keys.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: Cobalt Strike has the ability to use AES-256 symmetric encryption in CBC mode with HMAC-SHA-256 to encrypt task commands and XOR to encrypt shell code and configuration data.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: Ebury has encrypted C2 traffic using the client IP address, then encoded it as a hexadecimal string.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: HyperStack has used RSA encryption for C2 communications.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: Machete has used AES to exfiltrate documents.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: Mosquito uses a custom encryption algorithm, which consists of XOR and a stream that is similar to the Blum Blum Shub algorithm.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: PLAINTEE encodes C2 beacons using XOR.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: Rifdoor has encrypted command and control (C2) communications with a stream cipher.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: SeaDuke C2 traffic has been encrypted with RC4 and AES.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: SombRAT has encrypted its C2 communications with AES.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: Stuxnet encodes the payload of system information sent to the command and control servers using a one byte 0xFF XOR key. Stuxnet also uses a 31-byte long static byte string to XOR data sent to command and control servers. The servers use a different static key to encrypt replies to the implant.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: Winnti for Linux has used a custom TCP protocol with four-byte XOR for command and control (C2).
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: down_new has the ability to AES encrypt C2 communications.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: gh0st RAT uses RC4 and XOR to encrypt C2 traffic.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: CHOPSTICK encrypts C2 communications with TLS.
MITRE ATT&CK techniques:
- T1573.002: Encrypted Channel - Asymmetric Cryptography
Threat description: GoldMax has RSA-encrypted its communication with the C2 server.
MITRE ATT&CK techniques:
- T1573.002: Encrypted Channel - Asymmetric Cryptography
Threat description: Machete has used TLS-encrypted FTP to exfiltrate data.
MITRE ATT&CK techniques:
- T1573.002: Encrypted Channel - Asymmetric Cryptography
Threat description: OilRig used the Plink utility and other tools to create tunnels to C2 servers.
MITRE ATT&CK techniques:
- T1573.002: Encrypted Channel - Asymmetric Cryptography
Threat description: POSHSPY encrypts C2 traffic with AES and RSA.
MITRE ATT&CK techniques:
- T1573.002: Encrypted Channel - Asymmetric Cryptography
Threat description: Sliver can use mutual TLS and RSA  cryptography to exchange a session key.
MITRE ATT&CK techniques:
- T1573.002: Encrypted Channel - Asymmetric Cryptography
Threat description: Sykipot uses SSL for encrypting C2 communications.
MITRE ATT&CK techniques:
- T1573.002: Encrypted Channel - Asymmetric Cryptography
Threat description: Trojan.Karagany can secure C2 communications with SSL and TLS.
MITRE ATT&CK techniques:
- T1573.002: Encrypted Channel - Asymmetric Cryptography
Threat description: WannaCry uses Tor for command and control traffic and routes a custom cryptographic protocol over the Tor circuit.
MITRE ATT&CK techniques:
- T1573.002: Encrypted Channel - Asymmetric Cryptography
Threat description: WellMess can communicate to C2 with mutual TLS where client and server mutually check certificates.
MITRE ATT&CK techniques:
- T1573.002: Encrypted Channel - Asymmetric Cryptography
Threat description: XTunnel uses SSL/TLS and RC4 to encrypt traffic.
MITRE ATT&CK techniques:
- T1573.002: Encrypted Channel - Asymmetric Cryptography
Threat description: adbupd contains a copy of the OpenSSL library to encrypt C2 traffic.
MITRE ATT&CK techniques:
- T1573.002: Encrypted Channel - Asymmetric Cryptography
Threat description: ShimRat can hijack the cryptbase.dll within migwiz.exe to escalate privileges and bypass UAC controls.
MITRE ATT&CK techniques:
- T1574: Hijack Execution Flow
Threat description: WastedLocker has performed DLL hijacking before execution.
MITRE ATT&CK techniques:
- T1574.001: Hijack Execution Flow - DLL Search Order Hijacking
Threat description: XCSSET adds malicious file paths to the "DYLD_FRAMEWORK_PATH" and "DYLD_LIBRARY_PATH" environment variables to execute malicious code.
MITRE ATT&CK techniques:
- T1574.006: Hijack Execution Flow - Dynamic Linker Hijacking
Threat description: Empire contains modules that can discover and exploit search order hijacking vulnerabilities.
MITRE ATT&CK techniques:
- T1574.008: Hijack Execution Flow - Path Interception by Search Order Hijacking
Threat description: Empire contains modules that can discover and exploit unquoted path vulnerabilities.
MITRE ATT&CK techniques:
- T1574.009: Hijack Execution Flow - Path Interception by Unquoted Path
Threat description: One variant of BlackEnergy locates existing driver services that have been disabled and drops its driver component into one of those service's paths, replacing the legitimate executable. The malware then sets the hijacked service to start automatically to establish persistence.
MITRE ATT&CK techniques:
- T1574.010: Hijack Execution Flow - Services File Permissions Weakness
Threat description: Lazarus Group has abused the "KernelCallbackTable" to hijack process control flow and execute shellcode.
MITRE ATT&CK techniques:
- T1574.013: Hijack Execution Flow - KernelCallbackTable
Threat description: LAPSUS$ has created new virtual machines within the target's cloud environment after leveraging credential access to cloud assets.
MITRE ATT&CK techniques:
- T1578.002: Modify Cloud Compute Infrastructure - Create Cloud Instance
Threat description: LAPSUS$ has deleted the target's systems and resources in the cloud to trigger the organization's incident and crisis response process.
MITRE ATT&CK techniques:
- T1578.003: Modify Cloud Compute Infrastructure - Delete Cloud Instance
Threat description: APT32 has set up and operated websites to gather information and deliver malware.
MITRE ATT&CK techniques:
- T1583.001: Acquire Infrastructure - Domains
Threat description: Axiom has acquired dynamic DNS services for use in the targeting of intended victims.
MITRE ATT&CK techniques:
- T1583.002: Acquire Infrastructure - DNS Server
Threat description: Axiom has used VPS hosting providers in targeting of intended victims.
MITRE ATT&CK techniques:
- T1583.003: Acquire Infrastructure - Virtual Private Server
Threat description: Dragonfly has acquired VPS infrastructure for use in malicious campaigns.
MITRE ATT&CK techniques:
- T1583.003: Acquire Infrastructure - Virtual Private Server
Threat description: HAFNIUM has operated from leased virtual private servers (VPS) in the United States.
MITRE ATT&CK techniques:
- T1583.003: Acquire Infrastructure - Virtual Private Server
Threat description: For Operation Sharpshooter, the threat actors used Dropbox to host lure documents and their first-stage downloader.
MITRE ATT&CK techniques:
- T1583.006: Acquire Infrastructure - Web Services
Threat description: HAFNIUM has acquired web services for use in C2 and exfiltration.
MITRE ATT&CK techniques:
- T1583.006: Acquire Infrastructure - Web Services
Threat description: ZIRCONIUM has used GitHub to host malware linked in spearphishing e-mails.
MITRE ATT&CK techniques:
- T1583.006: Acquire Infrastructure - Web Services
Threat description: APT16 has compromised otherwise legitimate sites as staging servers for second-stage payloads.
MITRE ATT&CK techniques:
- T1584.004: Compromise Infrastructure - Server
Threat description: Dragonfly has compromised legitimate websites to host C2 and malware modules.
MITRE ATT&CK techniques:
- T1584.004: Compromise Infrastructure - Server
Threat description: Indrik Spider has served fake updates via legitimate websites that have been compromised.
MITRE ATT&CK techniques:
- T1584.004: Compromise Infrastructure - Server
Threat description: Sandworm Team has used a large-scale botnet to target Small Office/Home Office (SOHO) network devices.
MITRE ATT&CK techniques:
- T1584.005: Compromise Infrastructure - Botnet
Threat description: Turla has frequently used compromised WordPress sites for C2 infrastructure.
MITRE ATT&CK techniques:
- T1584.006: Compromise Infrastructure - Web Services
Threat description: Leviathan has compromised social media accounts to conduct social engineering attacks.
MITRE ATT&CK techniques:
- T1586.001: Compromise Accounts - Social Media Accounts
Threat description: HEXANE has used compromised accounts to send spearphishing emails.
MITRE ATT&CK techniques:
- T1586.002: Compromise Accounts - Email Accounts
Threat description: Kimsuky has compromised email accounts to send spearphishing e-mails.
MITRE ATT&CK techniques:
- T1586.002: Compromise Accounts - Email Accounts
Threat description: Kimsuky created and used a mailing toolkit to use in spearphishing attacks.
MITRE ATT&CK techniques:
- T1587: Develop Capabilities
Threat description: Cleaver has created customized tools and payloads for functions including ARP poisoning, encryption, credential dumping, ASP.NET shells, web backdoors, process enumeration, WMI querying, HTTP and SMB communications, network interface sniffing, and keystroke logging.
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: PROMETHIUM has created self-signed certificates to sign malicious installers.
MITRE ATT&CK techniques:
- T1587.002: Develop Capabilities - Code Signing Certificates
Threat description: Patchwork has created self-signed certificates from fictitious and spoofed legitimate software companies that were later used to sign malware.
MITRE ATT&CK techniques:
- T1587.002: Develop Capabilities - Code Signing Certificates
Threat description: APT1 used publicly available malware for privilege escalation.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
Threat description: For C0015, the threat actors used Cobalt Strike and Conti ransomware.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
Threat description: For FunnyDream, the threat actors used a new backdoor named FunnyDream.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
Threat description: APT-C-36 obtained and used a modified variant of Imminent Monitor.
MITRE ATT&CK techniques:
- T1588.002: Obtain Capabilities - Tool
Threat description: Ember Bear has stolen legitimate certificates to sign malicious payloads.
MITRE ATT&CK techniques:
- T1588.003: Obtain Capabilities - Code Signing Certificates
Threat description: Lazarus Group has used code signing certificates issued by Sectigo RSA for some of its malware and tools.
MITRE ATT&CK techniques:
- T1588.003: Obtain Capabilities - Code Signing Certificates
Threat description: MegaCortex has used code signing certificates issued to fake companies to bypass security controls.
MITRE ATT&CK techniques:
- T1588.003: Obtain Capabilities - Code Signing Certificates
Threat description: BlackTech has used valid, stolen digital certificates for some of their malware and tools.
MITRE ATT&CK techniques:
- T1588.004: Obtain Capabilities - Digital Certificates
Threat description: Kimsuky has obtained exploit code for various CVEs.
MITRE ATT&CK techniques:
- T1588.005: Obtain Capabilities - Exploits
Threat description: APT32 has conducted targeted surveillance against activists and bloggers.
MITRE ATT&CK techniques:
- T1589: Gather Victim Identity Information
Threat description: HEXANE has identified specific potential victims at targeted organizations.
MITRE ATT&CK techniques:
- T1589: Gather Victim Identity Information
Threat description: LAPSUS$ has gathered detailed information of target employees to enhance their social engineering lures.
MITRE ATT&CK techniques:
- T1589: Gather Victim Identity Information
Threat description: APT28 has harvested user's login credentials.
MITRE ATT&CK techniques:
- T1589.001: Gather Victim Identity Information - Credentials
Threat description: Chimera has collected credentials for the target organization from previous breaches for use in brute force attacks.
MITRE ATT&CK techniques:
- T1589.001: Gather Victim Identity Information - Credentials
Threat description: LAPSUS$ has gathered user identities and credentials to gain initial access to a victim's organization; the group has also called an organization's help desk to reset a target's credentials.
MITRE ATT&CK techniques:
- T1589.001: Gather Victim Identity Information - Credentials
Threat description: Magic Hound gathered credentials from two victims that they then attempted to validate across 75 different websites.
MITRE ATT&CK techniques:
- T1589.001: Gather Victim Identity Information - Credentials
Threat description: HEXANE has targeted executives, human resources staff, and IT personnel for spearphishing.
MITRE ATT&CK techniques:
- T1589.002: Gather Victim Identity Information - Email Addresses
Threat description: Sandworm Team's research of potential victim organizations included the identification and collection of employee information.
MITRE ATT&CK techniques:
- T1589.003: Gather Victim Identity Information - Employee Names
Threat description: Silent Librarian has collected lists of names for individuals from targeted organizations.
MITRE ATT&CK techniques:
- T1589.003: Gather Victim Identity Information - Employee Names
Threat description: Sandworm Team conducted technical reconnaissance of the Parliament of Georgia's official internet domain prior to its 2019 attack.
MITRE ATT&CK techniques:
- T1590.001: Gather Victim Network Information - Domain Properties
Threat description: Andariel has limited its watering hole attacks to specific IP address ranges.
MITRE ATT&CK techniques:
- T1590.005: Gather Victim Network Information - IP Addresses
Threat description: Lazarus Group has studied publicly available information about a targeted organization to tailor spearphishing efforts against specific departments and/or individuals.
MITRE ATT&CK techniques:
- T1591: Gather Victim Org Information
Threat description: HEXANE has identified executives, HR, and IT staff at victim organizations for further targeting.
MITRE ATT&CK techniques:
- T1591.004: Gather Victim Org Information - Identify Roles
Threat description: Lazarus Group has targeted specific individuals within an organization with tailored job vacancy announcements.
MITRE ATT&CK techniques:
- T1591.004: Gather Victim Org Information - Identify Roles
Threat description: Andariel has inserted a malicious script within compromised websites to collect potential victim information such as browser type, system language, Flash Player version, and other data.
MITRE ATT&CK techniques:
- T1592.002: Gather Victim Host Information - Software
Threat description: HAFNIUM has interacted with Office 365 tenants to gather details regarding target's environments.
MITRE ATT&CK techniques:
- T1592.004: Gather Victim Host Information - Client Configurations
Threat description: EXOTIC LILY has copied data from social media sites to impersonate targeted individuals.
MITRE ATT&CK techniques:
- T1593.001: Search Open Websites/Domains - Social Media
Threat description: LAPSUS$ has searched public code repositories for exposed credentials.
MITRE ATT&CK techniques:
- T1593.003: Search Open Websites/Domains - Code Repositories
Threat description: EXOTIC LILY has used contact forms on victim websites to generate phishing e-mails.
MITRE ATT&CK techniques:
- T1594: Search Victim-Owned Websites
Threat description: TeamTNT has scanned specific lists of target IP addresses.
MITRE ATT&CK techniques:
- T1595.001: Active Scanning - Scanning IP Blocks
Threat description: Volatile Cedar has used DirBuster and GoBuster to brute force web directories and DNS subdomains.
MITRE ATT&CK techniques:
- T1595.003: Active Scanning - Wordlist Scanning