QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: DropBook has checked for the presence of Arabic language in the infected machine's settings.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
- T1614.001: System Location Discovery - System Language Discovery
Threat description: HELLOKITTY can enumerate logical drives on a target system.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: KGH_SPY can collect drive information from a compromised host.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: LoudMiner has monitored CPU usage.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Nebulae can discover logical drive information including the drive type, free space, and volume information.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Ryuk has called "GetLogicalDrives" to emumerate all mounted drives, and "GetDriveTypeW" to determine the drive type.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: XAgentOSX contains the getInstalledAPP function to run "ls -la /Applications" to gather what applications are installed.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Zox can enumerate attached drives.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Amadey has searched for folders associated with antivirus software.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: BoxCaon has searched for files on the system, such as documents located in the desktop folder.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: GoldenSpy has included a program "ExeProtector", which monitors for the existence of GoldenSpy on the infected system and redownloads if necessary.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: GravityRAT collects the volumes mapped on the system, and also steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: HOPLIGHT has been observed enumerating system drives and partitions.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: Imminent Monitor has a dynamic debugging feature to check whether it is located in the %TEMP% directory, otherwise it copies itself there.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: Penquin can use the command code "do_vslist" to send file names, size, and status to C2.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: RainyDay can use a file exfiltration tool to collect recently changed files with specific extensions.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: SUGARDUMP can search for and collect data from specific Chrome, Opera, Microsoft Edge, and Firefox files, including any folders that have the string `Profile` in its name.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: Seasalt has the capability to identify the drive type on a victim.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: Shamoon attempts to access the "ADMIN$", "C$\Windows", "D$\Windows", and "E$\Windows" shares on the victim with its current privileges.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: SynAck checks its directory location in an attempt to avoid launching in a sandbox.
MITRE ATT&CK techniques:
- T1497.001: Virtualization/Sandbox Evasion - System Checks
- T1083: File and Directory Discovery
Threat description: TSCookie has the ability to discover drive information on the infected host.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: Tropic Trooper has monitored files' modified time.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: APT29 obtained a list of users and their roles from an Exchange server using "Get-ManagementRoleAssignment".
MITRE ATT&CK techniques:
- T1087: Account Discovery
Threat description: APT1 used the commands "net localgroup","net user", and "net group" to find accounts on the system.
MITRE ATT&CK techniques:
- T1087.001: Account Discovery - Local Account
Threat description: APT3 has used a tool that can obtain info about local and global group users, power users, and administrators.
MITRE ATT&CK techniques:
- T1087.001: Account Discovery - Local Account
Threat description: APT32 enumerated administrative users using the commands "net localgroup administrators".
MITRE ATT&CK techniques:
- T1087.001: Account Discovery - Local Account
Threat description: Bankshot gathers domain and account names/information through process monitoring.
MITRE ATT&CK techniques:
- T1087.001: Account Discovery - Local Account
- T1087.002: Account Discovery - Domain Account
Threat description: BitPaymer can enumerate the sessions for each user logged onto the infected host.
MITRE ATT&CK techniques:
- T1087.001: Account Discovery - Local Account
Threat description: Commands under "net user" can be used in Net to gather information about and manipulate user accounts.
MITRE ATT&CK techniques:
- T1087.001: Account Discovery - Local Account
Threat description: During Operation CuckooBees, the threat actors used the `net user` command to gather account information.
MITRE ATT&CK techniques:
- T1087.001: Account Discovery - Local Account
Threat description: Elise executes "net user" after initial communication is made to the remote server.
MITRE ATT&CK techniques:
- T1087.001: Account Discovery - Local Account
Threat description: HyperStack can enumerate all account names on a remote share.
MITRE ATT&CK techniques:
- T1087.001: Account Discovery - Local Account
Threat description: Kazuar gathers information on local groups and members on the victim’s machine.
MITRE ATT&CK techniques:
- T1087.001: Account Discovery - Local Account
Threat description: Ke3chang performs account discovery using commands such as "net localgroup administrators" and "net group "REDACTED" /domain" on specific permissions groups.
MITRE ATT&CK techniques:
- T1087.001: Account Discovery - Local Account
- T1087.002: Account Discovery - Domain Account
Threat description: MURKYTOP has the capability to retrieve information about users on remote hosts.
MITRE ATT&CK techniques:
- T1087.001: Account Discovery - Local Account
Threat description: OilRig has run "net user", "net user /domain", "net group “domain admins” /domain", and "net group “Exchange Trusted Subsystem” /domain" to get account listings on a victim.
MITRE ATT&CK techniques:
- T1087.001: Account Discovery - Local Account
- T1087.002: Account Discovery - Domain Account
Threat description: PUNCHBUGGY can gather user names.
MITRE ATT&CK techniques:
- T1087.001: Account Discovery - Local Account
Threat description: menuPass has used the Microsoft administration tool csvde.exe to export Active Directory data.
MITRE ATT&CK techniques:
- T1087.002: Account Discovery - Domain Account
Threat description: APT41 used a tool called CLASSFON to covertly proxy network communications.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: Dridex contains a backconnect module for tunneling network traffic through a victim's computer. Infected computers become part of a P2P botnet that can relay C2 traffic to other infected peers.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: For Operation Sharpshooter, the threat actors used the ExpressVPN service to hide their location.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: Gazer identifies a proxy server if it exists and uses it to make HTTP requests.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: HTRAN can proxy TCP socket connections to obfuscate command and control infrastructure.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: LAPSUS$ has leverage NordVPN for its egress points when targeting intended victims.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: POLONIUM has used the AirVPN service for operational activity.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: PoshC2 contains modules that allow for use of proxies in command and control.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: Remcos uses the infected hosts as SOCKS5 proxies to allow for tunneling and proxying.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: SDBbot has the ability to use port forwarding to establish a proxy between a target host and C2.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: SombRAT has the ability to use an embedded SOCKS proxy in C2 communications.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: WarzoneRAT has the capability to act as a reverse proxy.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: APT39 used custom tools to create SOCK5 and custom protocol proxies between infected hosts.
MITRE ATT&CK techniques:
- T1090.001: Proxy - Internal Proxy
Threat description: CHOPSTICK used a proxy server between victims and the C2 server.
MITRE ATT&CK techniques:
- T1090.001: Proxy - Internal Proxy
Threat description: Duqu can be configured to have commands relayed over a peer-to-peer network of infected hosts if some of the hosts do not have Internet access.
MITRE ATT&CK techniques:
- T1090.001: Proxy - Internal Proxy
Threat description: FatDuke can used pipes to connect machines with restricted internet access to remote machines via other infected hosts.
MITRE ATT&CK techniques:
- T1090.001: Proxy - Internal Proxy
Threat description: Higaisa discovered system proxy settings and used them if available.
MITRE ATT&CK techniques:
- T1090.001: Proxy - Internal Proxy
Threat description: MiniDuke can can use a named pipe to forward communications from one compromised machine with internet access to other compromised machines.
MITRE ATT&CK techniques:
- T1090.001: Proxy - Internal Proxy
Threat description: Operation Wocao can proxy traffic through multiple infected systems.
MITRE ATT&CK techniques:
- T1090.001: Proxy - Internal Proxy
Threat description: Pay2Key has designated machines in the compromised network to serve as reverse proxy pivot points to channel communications with C2.
MITRE ATT&CK techniques:
- T1090.001: Proxy - Internal Proxy
Threat description: Strider has used local servers with both local network and Internet access to act as internal proxy nodes to exfiltrate data from other parts of the network without direct Internet access.
MITRE ATT&CK techniques:
- T1090.001: Proxy - Internal Proxy
Threat description: The "ZJ" variant of BACKSPACE allows "ZJ link" infections with Internet access to relay traffic from "ZJ listen" to a command server.
MITRE ATT&CK techniques:
- T1090.001: Proxy - Internal Proxy
Threat description: The Winnti for Windows HTTP/S C2 mode can make use of a local proxy.
MITRE ATT&CK techniques:
- T1090.001: Proxy - Internal Proxy
Threat description: Turla has compromised internal network systems to act as a proxy to forward traffic to C2.
MITRE ATT&CK techniques:
- T1090.001: Proxy - Internal Proxy
Threat description: UNC2452 configured at least one instance of Cobalt Strike to use a network pipe over SMB during the 2020 SolarWinds intrusion.
MITRE ATT&CK techniques:
- T1090.001: Proxy - Internal Proxy
Threat description: An APT3 downloader establishes SOCKS5 connections for its initial C2.
MITRE ATT&CK techniques:
- T1090.002: Proxy - External Proxy
- T1095: Non-Application Layer Protocol
Threat description: GALLIUM used a modified version of HTRAN to redirect connections between networks.
MITRE ATT&CK techniques:
- T1090.002: Proxy - External Proxy
Threat description: Lazarus Group has used multiple proxies to obfuscate network traffic from victims.
MITRE ATT&CK techniques:
- T1090.002: Proxy - External Proxy
Threat description: MuddyWater has controlled POWERSTATS from behind a proxy network to obfuscate the C2 location. MuddyWater has used a series of compromised websites that victims connected to randomly to relay information to command and control (C2).
MITRE ATT&CK techniques:
- T1090.002: Proxy - External Proxy
Threat description: POWERSTATS has connected to C2 servers through proxies.
MITRE ATT&CK techniques:
- T1090.002: Proxy - External Proxy
Threat description: QakBot has a module that can proxy C2 communications.
MITRE ATT&CK techniques:
- T1090.002: Proxy - External Proxy
Threat description: Silence has used ProxyBot, which allows the attacker to redirect traffic from the current node to the backconnect server via Sock4\Socks5.
MITRE ATT&CK techniques:
- T1090.002: Proxy - External Proxy
Threat description: The Winnti for Windows HTTP/S C2 mode can make use of an external proxy.
MITRE ATT&CK techniques:
- T1090.002: Proxy - External Proxy
Threat description: Tonto Team has routed their traffic through an external server in order to obfuscate their location.
MITRE ATT&CK techniques:
- T1090.002: Proxy - External Proxy
Threat description: A backdoor used by APT29 created a Tor hidden service to forward traffic from the Tor client to local ports 3389 (RDP), 139 (Netbios), and 445 (SMB) enabling full remote access from outside the network and has also used TOR.
MITRE ATT&CK techniques:
- T1090.003: Proxy - Multi-hop Proxy
Threat description: APT28 has routed traffic over Tor and VPN servers to obfuscate their activities.
MITRE ATT&CK techniques:
- T1090.003: Proxy - Multi-hop Proxy
Threat description: CostaRicto has used a layer of proxies to manage C2 communications.
MITRE ATT&CK techniques:
- T1090.003: Proxy - Multi-hop Proxy
Threat description: Inception used chains of compromised routers to proxy C2 communications between them and cloud service providers.
MITRE ATT&CK techniques:
- T1090.003: Proxy - Multi-hop Proxy
Threat description: APT30 may have used the SHIPSHAPE malware to move onto air-gapped networks. SHIPSHAPE targets removable drives to spread to other systems by modifying the drive to use Autorun to execute or by hiding legitimate document files and copying an executable to the folder with the same name as the legitimate document.
MITRE ATT&CK techniques:
- T1091: Replication Through Removable Media
Threat description: DustySky searches for removable media and duplicates itself onto it.
MITRE ATT&CK techniques:
- T1091: Replication Through Removable Media
Threat description: FIN7 actors have mailed USB drives to potential victims containing malware that downloads and installs various backdoors, including in some cases for ransomware operations.
MITRE ATT&CK techniques:
- T1091: Replication Through Removable Media
Threat description: USBStealer drops commands for a second victim onto a removable media drive inserted into the first victim, and commands are executed when the drive is inserted into the second victim.
MITRE ATT&CK techniques:
- T1092: Communication Through Removable Media
Threat description: BackdoorDiplomacy has used EarthWorm for network tunneling with a SOCKS5 server and port transfer functionalities.
MITRE ATT&CK techniques:
- T1095: Non-Application Layer Protocol
Threat description: Derusbi binds to a raw socket on a random source port between 31800 and 31900 for C2.
MITRE ATT&CK techniques:
- T1095: Non-Application Layer Protocol
Threat description: PLATINUM has used the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel for command and control.
MITRE ATT&CK techniques:
- T1095: Non-Application Layer Protocol
Threat description: Pay2Key has sent its public key to the C2 server over TCP.
MITRE ATT&CK techniques:
- T1095: Non-Application Layer Protocol
Threat description: SDBbot has the ability to communicate with C2 with TCP over port 443.
MITRE ATT&CK techniques:
- T1095: Non-Application Layer Protocol
Threat description: Some variants of FakeM use SSL to communicate with C2 servers.
MITRE ATT&CK techniques:
- T1095: Non-Application Layer Protocol
Threat description: Lazarus Group malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.
MITRE ATT&CK techniques:
- T1098: Account Manipulation
Threat description: Magic Hound granted compromised email accounts read access to the email boxes of additional targeted accounts. The group then was able to authenticate to the intended victim's OWA (Outlook Web Access) portal and read hundreds of email communications for information on Middle East organizations.
MITRE ATT&CK techniques:
- T1098: Account Manipulation
- T1098.002: Account Manipulation - Additional Email Delegate Permissions
Threat description: The Mimikatz credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality. The "LSADUMP::ChangeNTLM" and "LSADUMP::SetNTLM" modules can also manipulate the password hash of an account without knowing the clear text value.
MITRE ATT&CK techniques:
- T1098: Account Manipulation
Threat description: APT29 has added credentials to OAuth Applications and Service Principals.
MITRE ATT&CK techniques:
- T1098.001: Account Manipulation - Additional Cloud Credentials
Threat description: UNC2452 added credentials to OAuth Applications and Service Principals.
MITRE ATT&CK techniques:
- T1098.001: Account Manipulation - Additional Cloud Credentials
Threat description: APT29 added their own devices as allowed IDs for active sync using "Set-CASMailbox", allowing it to obtain copies of victim mailboxes. It also added additional permissions (such as Mail.Read and Mail.ReadWrite) to compromised Application or Service Principals.
MITRE ATT&CK techniques:
- T1098.002: Account Manipulation - Additional Email Delegate Permissions
Threat description: Skidmap has the ability to add the public key of its handlers to the "authorized_keys" file to maintain persistence on an infected host.
MITRE ATT&CK techniques:
- T1098.004: Account Manipulation - SSH Authorized Keys
Threat description: AADInternals can register a device to Azure AD.
MITRE ATT&CK techniques:
- T1098.005: Account Manipulation - Device Registration
Threat description: APT29 registered devices in order to enable mailbox syncing via the "Set-CASMailbox" command.
MITRE ATT&CK techniques:
- T1098.005: Account Manipulation - Device Registration
Threat description: Doki has used the dogechain.info API to generate a C2 address.
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: Ember Bear has used Discord's content delivery network (CDN) to deliver malware and malicious scripts to a compromised host.
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: FIN6 has used Pastebin and Google Storage to host content for their operations.
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: Gamaredon Group has used GitHub repositories for downloaders which will be obtained by the group's .NET executable on the compromised system.
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: Astaroth can store C2 information on cloud hosting services such as AWS and CloudFlare and websites like YouTube and Facebook.
MITRE ATT&CK techniques:
- T1102.001: Web Service - Dead Drop Resolver
Threat description: BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain a dead drop resolver containing an encoded tag with the IP address of a command and control server.
MITRE ATT&CK techniques:
- T1102.001: Web Service - Dead Drop Resolver
Threat description: Javali can read C2 information from Google Documents and YouTube.
MITRE ATT&CK techniques:
- T1102.001: Web Service - Dead Drop Resolver
Threat description: Xbash can obtain a webpage hosted on Pastebin to update its C2 domain list.
MITRE ATT&CK techniques:
- T1102.001: Web Service - Dead Drop Resolver
Threat description: APT12 has used blogs and WordPress for C2 infrastructure.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: BLUELIGHT can use different cloud providers for its C2.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: BoxCaon has used DropBox for C2 communications.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: Comnie uses blogs and third-party sites (GitHub, tumbler, and BlogSpot) to avoid DNS-based blocking of their communication to the command and control server.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: Empire can use Dropbox and GitHub for C2.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: FIN7 used legitimate services like Google Docs, Google Scripts, and Pastebin for C2.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: Grandoreiro can utilize web services including Google sites to send and receive C2 data.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: HEXANE has used cloud services, including OneDrive, for C2.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: KARAE can use public cloud-based storage providers for command and control.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: LOWBALL uses the Dropbox cloud storage service for command and control.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: MuddyWater has used web services including OneHub to distribute remote access tools.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: SLOWDRIFT uses cloud based services for C2.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: Sandworm Team has used the Telegram Bot API from Telegram Messenger to send and receive commands to its Python backdoor. Sandworm Team also used legitimate M.E.Doc software update check requests for sending and receiving commands and hosted malicious payloads on putdrive.com.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: UBoatRAT has used GitHub and a public blog service in Hong Kong for C2 communications.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: ZIRCONIUM has used Dropbox for C2 allowing upload and download of files as well as execution of arbitrary commands.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: EVILNUM has used a one-way communication method via GitLab and Digital Point to perform C2.
MITRE ATT&CK techniques:
- T1102.003: Web Service - One-Way Communication
Threat description: Leviathan has received C2 instructions from user profiles created on legitimate websites such as Github and TechNet.
MITRE ATT&CK techniques:
- T1102.003: Web Service - One-Way Communication
Threat description: Metamorfo has downloaded a zip file for execution on the system.
MITRE ATT&CK techniques:
- T1102.003: Web Service - One-Way Communication
Threat description: OnionDuke uses Twitter as a backup C2.
MITRE ATT&CK techniques:
- T1102.003: Web Service - One-Way Communication
Threat description: The "tDiscoverer" variant of HAMMERTOSS establishes a C2 channel by downloading resources from Web services like Twitter and GitHub. HAMMERTOSS binaries contain an algorithm that generates a different Twitter handle for the malware to check for instructions every day.
MITRE ATT&CK techniques:
- T1102.003: Web Service - One-Way Communication
Threat description: Lazarus Group has used multi-stage malware components that inject later stages into separate processes.
MITRE ATT&CK techniques:
- T1104: Multi-Stage Channels
Threat description: MuddyWater has used one C2 to obtain enumeration scripts and monitor web logs, but a different C2 to send data back.
MITRE ATT&CK techniques:
- T1104: Multi-Stage Channels
Threat description: The Bazar loader is used to download and execute the Bazar backdoor.
MITRE ATT&CK techniques:
- T1104: Multi-Stage Channels
Threat description: Conficker downloads an HTTP server to the infected machine.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: H1N1 contains a command to download and execute a file from a remotely hosted URL using WinINet HTTP requests.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Milan has received files from C2 and stored them in log folders beginning with the character sequence `a9850d2f`.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Operators deploying Netwalker have used psexec and certutil to retrieve the Netwalker payload.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
- T1569.002: System Services - Service Execution
Threat description: Sidewinder has used LNK files to download remote files to the victim's network.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Squirrelwaffle has downloaded and executed additional encoded payloads.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Cobalt Strike's "beacon" payload is capable of running shell commands without "cmd.exe" and PowerShell commands without "powershell.exe"
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: Goopy has the ability to  enumerate the infected system's user name via "GetUserNameW".
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: Milan can use the API `DnsQuery_A` for DNS resolution.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: Stuxnet uses the SetSecurityDescriptorDacl API to reduce object integrity levels.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: WhisperGate has used the `ExitWindowsEx` API to flush file buffers to disk and stop running processes.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: xCaon has leveraged native OS function calls to retrieve  victim's network adapter's  information using GetAdapterInfo() API.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: FIN5 has has used the tool GET2 Penetrator to look for remote login and hard-coded credentials.
MITRE ATT&CK techniques:
- T1110: Brute Force
Threat description: Fox Kitten has brute forced RDP credentials.
MITRE ATT&CK techniques:
- T1110: Brute Force
Threat description: China Chopper's server component can perform brute force password guessing against authentication portals.
MITRE ATT&CK techniques:
- T1110.001: Brute Force - Password Guessing
Threat description: CrackMapExec can brute force passwords for a specified user on a single target system or across an entire network.
MITRE ATT&CK techniques:
- T1110.001: Brute Force - Password Guessing
Threat description: HermeticWizard can use a list of hardcoded credentials in attempt to authenticate to SMB shares.
MITRE ATT&CK techniques:
- T1110.001: Brute Force - Password Guessing
Threat description: Lucifer has attempted to brute force TCP ports 135 (RPC) and 1433 (MSSQL) with the default username or list of usernames and    passwords.
MITRE ATT&CK techniques:
- T1110.001: Brute Force - Password Guessing
Threat description: APT3 has been known to brute force password hashes to be able to leverage plain text credentials.
MITRE ATT&CK techniques:
- T1110.002: Brute Force - Password Cracking
Threat description: Dragonfly 2.0 dropped and executed tools used for password cracking, including Hydra and CrackMapExec.
MITRE ATT&CK techniques:
- T1110.002: Brute Force - Password Cracking
Threat description: Dragonfly has dropped and executed tools used for password cracking, including Hydra and CrackMapExec.
MITRE ATT&CK techniques:
- T1110.002: Brute Force - Password Cracking
Threat description: Bad Rabbit’s "infpub.dat" file uses NTLM login credentials to brute force Windows machines.
MITRE ATT&CK techniques:
- T1110.003: Brute Force - Password Spraying
Threat description: Lazarus Group malware attempts to connect to Windows shares for lateral movement by using a generated list of usernames, which center around permutations of the username Administrator, and weak passwords.
MITRE ATT&CK techniques:
- T1110.003: Brute Force - Password Spraying
Threat description: Chimera has used credential stuffing against victim's remote services to obtain valid accounts.
MITRE ATT&CK techniques:
- T1110.004: Brute Force - Credential Stuffing
Threat description: TrickBot uses brute-force attack against RDP with rdpscanDll module.
MITRE ATT&CK techniques:
- T1110.004: Brute Force - Credential Stuffing
Threat description: CharmPower can remove persistence-related artifacts from the Registry.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: DCSrv has created Registry keys for persistence.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: Ferocious has the ability to add a Class ID in the current user Registry hive to enable persistence mechanisms.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: Nerex creates a Registry subkey that registers a new service.
MITRE ATT&CK techniques:
- T1112: Modify Registry
- T1543.003: Create or Modify System Process - Windows Service
Threat description: PLAINTEE uses "reg add" to add a Registry Run key for persistence.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: PowerShower has added a registry key so future powershell.exe instances are spawned off-screen by default, and has removed all registry entries that are left behind during the dropper process.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: Rover has functionality to remove Registry Run key persistence as a cleanup procedure.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: copy""."
MITRE ATT&CK techniques:
- T1114.001: Email Collection - Local Email Collection
Threat description: Emotet has been observed leveraging a module that scrapes email data from Outlook.
MITRE ATT&CK techniques:
- T1114.001: Email Collection - Local Email Collection
Threat description: Empire has the ability to collect emails on a target system.
MITRE ATT&CK techniques:
- T1114.001: Email Collection - Local Email Collection
Threat description: Smoke Loader searches through Outlook files and directories (e.g., inbox, sent, templates, drafts, archives, etc.).
MITRE ATT&CK techniques:
- T1114.001: Email Collection - Local Email Collection
Threat description: FIN4 has accessed and hijacked online email communications using stolen credentials.
MITRE ATT&CK techniques:
- T1114.002: Email Collection - Remote Email Collection
Threat description: Leafminer used a tool called MailSniper to search through the Exchange server mailboxes for keywords.
MITRE ATT&CK techniques:
- T1114.002: Email Collection - Remote Email Collection
Threat description: Kimsuky has set auto-forward rules on victim's e-mail accounts.
MITRE ATT&CK techniques:
- T1114.003: Email Collection - Email Forwarding Rule
Threat description: A JHUHUGIT variant accesses a screenshot saved in the clipboard and converts it to a JPG image.
MITRE ATT&CK techniques:
- T1115: Clipboard Data
Threat description: Explosive has a function to use the OpenClipboard wrapper.
MITRE ATT&CK techniques:
- T1115: Clipboard Data
Threat description: A Helminth VBScript receives a batch script to execute a set of commands in a command prompt.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: APT1 used a batch script to perform a series of discovery techniques and saves it to a text file.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: Bankshot recursively generates a list of files within a directory and sends them back to the control server.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: Confucius has used a file stealer to steal documents and images with the following extensions: txt, pdf, png, jpg, doc, xls, xlm, odp, ods, odt, rtf, ppt, xlsx, xlsm, docx, pptx, and jpeg.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: During Frankenstein, the threat actors used Empire to automatically gather the username, domain name, machine name, and other system information.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: During Operation Wocao, threat actors used a script to collect information about the infected system.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: Frankenstein has enumerated hosts via Empire, gathering the username, domain name, machine name, and other system information.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: GoldFinder logged and stored information related to the route or hops a packet took from a compromised machine to a hardcoded C2 server, including the target C2 URL, HTTP response/status code, HTTP response headers and values, and data received from the C2 node.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: InvisiMole can sort and collect specific documents as well as generate a list of all files on a newly inserted drive and store them in an encrypted file.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: MESSAGETAP checks two files, keyword_parm.txt and parm.txt, for instructions on how to target and save data parsed and extracted from SMS message data from the network traffic. If an SMS message contained either a phone number, IMSI number, or keyword that matched the predefined list, it is saved to a CSV file for later theft by the threat actor.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: Micropsia executes an RAR tool to recursively archive files based on a predefined list of file extensions (*.xls, *.xlsx, *.csv, *.odt, *.doc, *.docx, *.ppt, *.pptx, *.pdf, *.mdb, *.accdb, *.accde, *.txt).
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: Patchwork developed a file stealer to search C:\ and collect files with certain extensions. Patchwork also executed a script to enumerate all drives, store them as a list, and upload generated files to the C2 server.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: PoshC2 contains a module for recursively parsing through files and directories to gather valid credit card numbers.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: Ramsay can conduct an initial scan for Microsoft Word documents on the local system, removable media, and connected network drives, before tagging and collecting them. It can continue tagging documents to collect with follow up scans.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: Ferocious can run "GET.WORKSPACE" in Microsoft Excel to check if a mouse is present.
MITRE ATT&CK techniques:
- T1120: Peripheral Device Discovery
Threat description: jRAT can map UPnP ports.
MITRE ATT&CK techniques:
- T1120: Peripheral Device Discovery
Threat description: Empire can use built-in modules to abuse trusted utilities like MSBuild.exe.
MITRE ATT&CK techniques:
- T1127.001: Trusted Developer Utilities Proxy Execution - MSBuild
- T1127: Trusted Developer Utilities Proxy Execution
Threat description: During Frankenstein, the threat actors used MSbuild to execute an actor-created file.
MITRE ATT&CK techniques:
- T1127.001: Trusted Developer Utilities Proxy Execution - MSBuild
Threat description: After encrypting C2 data, BADNEWS converts it into a hexadecimal representation and then encodes it into base64.
MITRE ATT&CK techniques:
- T1132: Data Encoding
Threat description: H1N1 obfuscates C2 traffic with an altered version of base64.
MITRE ATT&CK techniques:
- T1132: Data Encoding
Threat description: Linux Rabbit sends the payload from the C2 server as an encoded URL parameter.
MITRE ATT&CK techniques:
- T1132: Data Encoding
Threat description: Ursnif has used encoded data in HTTP URLs for C2.
MITRE ATT&CK techniques:
- T1132: Data Encoding
Threat description: An APT19 HTTP malware variant used Base64 to encode communications to the C2 server.
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: Astaroth encodes data using Base64 before sending it to the C2 server.
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: AutoIt backdoor has sent a C2 response that was base64-encoded.
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: Bisonal has encoded binary data with Base64 and ASCII.
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding.
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: Elise exfiltrates data using cookie values that are Base64-encoded.
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: Kessel has exfiltrated data via hexadecimal-encoded subdomain fields of DNS queries.
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: Machete has used base64 encoding.
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: Misdat network traffic is Base64-encoded plaintext.
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: MuddyWater has used tools to encode C2 communications including Base64 encoding.
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: Patchwork used Base64 to encode C2 traffic.
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: PingPull can encode C2 traffic with Base64.
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: QakBot can Base64 encode system information sent to C2.
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: Responses from the Pisloader C2 server are base32-encoded.
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: RogueRobin base64 encodes strings that are sent to the C2 over its DNS tunnel.
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: STARWHALE has the ability to hex-encode collected data from an infected host.
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: Sliver can use standard encoding techniques like gzip and hex to ASCII to encode the C2 communication payload.
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: Some Backdoor.Oldrea samples use standard Base64 + bzip2, and some use standard Base64 + reverse XOR + RSA-2048 to decrypt data received from C2 servers.
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: Tropic Trooper has used base64 encoding to hide command strings delivered from the C2.
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: Valak has returned C2 data as encoded ASCII.
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: down_new has the ability to base64 encode C2 communications.
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: Cyclops Blink can use a custom binary scheme to encode messages with specific commands and parameters to be executed.
MITRE ATT&CK techniques:
- T1132.002: Data Encoding - Non-Standard Encoding
Threat description: ShadowPad has encoded data as readable Latin characters.
MITRE ATT&CK techniques:
- T1132.002: Data Encoding - Non-Standard Encoding
Threat description: Small Sieve can use a custom hex byte swapping encoding scheme to obfuscate tasking traffic.
MITRE ATT&CK techniques:
- T1132.002: Data Encoding - Non-Standard Encoding
Threat description: Chimera has used legitimate credentials to login to an external VPN, Citrix, SSH, and other remote services.
MITRE ATT&CK techniques:
- T1133: External Remote Services
Threat description: During CostaRicto, the threat actors set up remote tunneling using an SSH tool to maintain access to a compromised environment.
MITRE ATT&CK techniques:
- T1133: External Remote Services
Threat description: During Operation CuckooBees, the threat actors enabled WinRM over HTTP/HTTPS as a backup persistence mechanism using the following command: `cscript //nologo "C:\Windows\System32\winrm.vbs" set winrm/config/service@{EnableCompatibilityHttpsListener="true"}`.
MITRE ATT&CK techniques:
- T1133: External Remote Services
Threat description: Kimsuky has used RDP to establish persistence.
MITRE ATT&CK techniques:
- T1133: External Remote Services
Threat description: FIN6 has used has used Metasploit’s named-pipe impersonation technique to escalate privileges.
MITRE ATT&CK techniques:
- T1134: Access Token Manipulation
Threat description: BitPaymer can use the tokens of users to create processes on infected systems.
MITRE ATT&CK techniques:
- T1134.001: Access Token Manipulation - Token Impersonation/Theft
Threat description: FinFisher uses token manipulation with NtFilterToken as part of UAC bypass.
MITRE ATT&CK techniques:
- T1134.001: Access Token Manipulation - Token Impersonation/Theft
Threat description: Okrum can impersonate a logged-on user's security context using a call to the ImpersonateLoggedOnUser API.
MITRE ATT&CK techniques:
- T1134.001: Access Token Manipulation - Token Impersonation/Theft
Threat description: Pupy can obtain a list of SIDs and provide the option for selecting process tokens to impersonate.
MITRE ATT&CK techniques:
- T1134.001: Access Token Manipulation - Token Impersonation/Theft
Threat description: SILENTTRINITY can find a process owned by a specific user and impersonate the associated token.
MITRE ATT&CK techniques:
- T1134.001: Access Token Manipulation - Token Impersonation/Theft
Threat description: Shamoon can impersonate tokens using "LogonUser", "ImpersonateLoggedOnUser", and "ImpersonateNamedPipeClient".
MITRE ATT&CK techniques:
- T1134.001: Access Token Manipulation - Token Impersonation/Theft
Threat description: Siloscape impersonates the main thread of "CExecSvc.exe" by calling "NtImpersonateThread".
MITRE ATT&CK techniques:
- T1134.001: Access Token Manipulation - Token Impersonation/Theft
Threat description: Lazarus Group keylogger KiloAlfa obtains user tokens from interactive sessions to execute itself with API call "CreateProcessAsUserA" under that user's context.
MITRE ATT&CK techniques:
- T1134.002: Access Token Manipulation - Create Process with Token
Threat description: PipeMon can attempt to gain administrative privileges using token impersonation.
MITRE ATT&CK techniques:
- T1134.002: Access Token Manipulation - Create Process with Token
Threat description: PoshC2 can use Invoke-RunAs to make tokens.
MITRE ATT&CK techniques:
- T1134.002: Access Token Manipulation - Create Process with Token
Threat description: ZxShell has a command called RunAs, which creates a new process as another user or process context.
MITRE ATT&CK techniques:
- T1134.002: Access Token Manipulation - Create Process with Token
Threat description: Cobalt Strike can make tokens from known credentials.
MITRE ATT&CK techniques:
- T1134.003: Access Token Manipulation - Make and Impersonate Token
Threat description: Cobalt Strike can spawn processes with alternate PPIDs.
MITRE ATT&CK techniques:
- T1134.004: Access Token Manipulation - Parent PID Spoofing
Threat description: KONNI has used parent PID spoofing to spawn a new `cmd` process using `CreateProcessW` and a handle to `Taskmgr.exe`.
MITRE ATT&CK techniques:
- T1134.004: Access Token Manipulation - Parent PID Spoofing
Threat description: Indrik Spider used "wmic.exe" to add a new user to the system.
MITRE ATT&CK techniques:
- T1136: Create Account
Threat description: APT3 has been known to create or enable accounts, such as "support_388945a0".
MITRE ATT&CK techniques:
- T1136.001: Create Account - Local Account
Threat description: APT41 created user accounts and adds them to the User and Admin groups.
MITRE ATT&CK techniques:
- T1136.001: Create Account - Local Account
Threat description: Dragonfly 2.0 created accounts on victims, including administrator accounts, some of which appeared to be tailored to each individual staging target.
MITRE ATT&CK techniques:
- T1136.001: Create Account - Local Account
Threat description: Flame can create backdoor accounts with login “HelpAssistant” on domain connected systems if appropriate rights are available.
MITRE ATT&CK techniques:
- T1136.001: Create Account - Local Account
Threat description: Hildegard has created a user named “monerodaemon”.
MITRE ATT&CK techniques:
- T1136.001: Create Account - Local Account
Threat description: TeamTNT has created local privileged users on victim machines.
MITRE ATT&CK techniques:
- T1136.001: Create Account - Local Account
Threat description: PsExec has the ability to remotely create accounts on target systems.
MITRE ATT&CK techniques:
- T1136.002: Create Account - Domain Account
Threat description: The "net user username \password \domain" commands in Net can be used to create a domain account.
MITRE ATT&CK techniques:
- T1136.002: Create Account - Domain Account
Threat description: APT32 have replaced Microsoft Outlook's VbaProject.OTM file to install a backdoor macro for persistence.
MITRE ATT&CK techniques:
- T1137: Office Application Startup
Threat description: Gamaredon Group has inserted malicious macros into existing documents, providing persistence when they are reopened. Gamaredon Group has loaded the group's previously delivered VBA project by relaunching Microsoft Outlook with the "/altvba" option, once the Application.Startup event is received.
MITRE ATT&CK techniques:
- T1137: Office Application Startup
Threat description: Ruler can be used to automate the abuse of Outlook Rules, Forms, and Home Pages to establish persistence.
MITRE ATT&CK techniques:
- T1137: Office Application Startup
Threat description: BackConfig has the ability to use hidden columns in Excel spreadsheets to store executable files or commands for VBA macros.
MITRE ATT&CK techniques:
- T1137.001: Office Application Startup - Office Template Macros
Threat description: APT28 has used the Office Test persistence mechanism within Microsoft Office by adding the Registry key "HKCU\Software\Microsoft\Office test\Special\Perf" to execute code.
MITRE ATT&CK techniques:
- T1137.002: Office Application Startup - Office Test
Threat description: OilRig has abused the Outlook Home Page feature for persistence. OilRig has also used CVE-2017-11774 to roll back the initial patch designed to protect against Home Page abuse.
MITRE ATT&CK techniques:
- T1137.004: Office Application Startup - Outlook Home Page
Threat description: Ruler can be used to automate the abuse of Outlook Home Pages to establish persistence.
MITRE ATT&CK techniques:
- T1137.004: Office Application Startup - Outlook Home Page
Threat description: Naikon has used the RoyalRoad exploit builder to drop a second stage loader, intel.wll, into the Word Startup folder on the compromised host.
MITRE ATT&CK techniques:
- T1137.006: Office Application Startup - Add-ins
Threat description: During Operation Dust Storm, attackers used VBS code to decode payloads.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Proton uses an encrypted file to store commands and configuration values.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Ramsay can extract its agent from the body of a malicious document.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Volatile Cedar has targeted publicly facing web servers, with both automatic and manual vulnerability discovery.
MITRE ATT&CK techniques:
- T1190: Exploit Public-Facing Application
Threat description: Elderwood has targeted manufacturers in the supply chain for the defense industry.
MITRE ATT&CK techniques:
- T1195: Supply Chain Compromise
Threat description: NotPetya's initial infection vector for the June 27, 2017 compromise was a backdoor in the Ukrainian tax accounting software M.E.Doc.
MITRE ATT&CK techniques:
- T1195: Supply Chain Compromise