QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: APT39 has utilized AutoIt and custom scripts to perform internal reconnaissance.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: Astaroth spawns a CMD process to execute commands.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Bonadan can create bind and reverse shells on the infected system.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: Denis can launch a remote shell to execute arbitrary commands on the victim’s machine.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Donut can generate shellcode outputs that execute via Ruby.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: Emotet has used cmd.exe to run a PowerShell script.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Exaramel for Windows has a command to launch a remote shell and executes commands on the victim’s machine.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: FIN6 has used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: FIN7 used SQL scripts to help perform tasks on the victim's machine.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: FIVEHANDS can receive a command line argument to limit file encryption to specified directories.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: Fox Kitten has used a Perl reverse shell to communicate with C2.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: Get2 has the ability to run executables with command-line arguments.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: Lazarus Group malware uses cmd.exe to execute commands on victims.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: Molerats used various implants, including those built on .NET, on target machines.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: MoonWind can execute commands via an interactive command shell.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: OilRig has used the command-line interface for execution.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: OilRig has used various types of scripting for execution.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: P.A.S. Webshell has the ability to create reverse shells with Perl scripts.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: PoetRAT has executed a Lua script through a Lua interpreter for Windows.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: SpeakUp uses Perl scripts.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: Stealth Falcon malware uses WMI to script data collection and command execution on the victim.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: WINERACK can create a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: CrackMapExec can execute PowerShell commands via WMI.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: KOCTOPUS has used PowerShell commands to download additional files.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: Meteor can use PowerShell commands to disable the network adapters on a victim machines.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: SeaDuke uses a module to execute Mimikatz with PowerShell to perform Pass the Ticket.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: StrongPity can use PowerShell to add files to the Windows Defender exclusions list.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: 4H RAT has the capability to create a remote shell.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: APT37 has used the command-line interface.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: APT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: BISCUIT has a command to launch a command shell on the system.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: BLACKCOFFEE has the capability to create a reverse shell.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Bankshot uses the command-line interface to execute arbitrary commands.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: BoxCaon can execute arbitrary commands and utilize the "ComSpec" environment variable.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Cardinal RAT can execute commands.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: China Chopper's server component is capable of opening a command terminal.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Darkhotel has dropped an mspaint.lnk shortcut to disk which launches a shell script that downloads and executes a file.
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Dipsind can spawn remote shells.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: DownPaper uses the command line.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Dragonfly 2.0 used various types of scripting to perform operations, including batch scripts.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and run command-line shells.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Ember Bear had used `cmd.exe` and Windows Script Host (wscript) to execute malicious code.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Emissary has the capability to create a remote shell and execute specified commands.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: EvilBunny has an integrated scripting engine to download and execute Lua scripts.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: FIN10 has executed malicious .bat files containing PowerShell commands.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: FIN7 used the command prompt to launch commands on the victim’s machine.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Felismus uses command line for execution.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Following exploitation with LOWBALL malware, admin@338 actors created a file containing a list of commands to be executed on the compromised computer.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Frankenstein has run a command script to set up persistence as a scheduled task named "WinUpdate", as well as other encoded commands from the command-line.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: GravityRAT executes commands remotely on the infected host.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: HAWKBALL has created a cmd.exe reverse shell, executed commands, and uploaded output via the command line.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: HTTPBrowser is capable of spawning a reverse shell on a victim.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Hi-Zor has the ability to create a reverse shell.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: JPIN can use the command-line utility cacls.exe to change file permissions.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
- T1222.001: File and Directory Permissions Modification - Windows File and Directory Permissions Modification
Threat description: KGH_SPY has the ability to set a Registry key to run a cmd.exe command.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: KOMPROGO is capable of creating a reverse shell.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Ke3chang has used batch scripts in its malware to install persistence mechanisms.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Leviathan uses a backdoor known as BADFLICK that is is capable of generating a reverse shell, and has used multiple types of scripting for execution, including JavaScript and JavaScript Scriptlets in XML..
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Linfo creates a backdoor through which remote attackers can start a remote shell.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Lizar has a command to open the command-line on the infected system.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: LookBack executes the "cmd.exe" command.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Magic Hound has used the command-line interface.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: MirageFox has the capability to execute commands using cmd.exe.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Mis-Type has used `cmd.exe` to run commands on a compromised host.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Misdat is capable of providing shell functionality to the attacker to execute commands.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Mivast has the capability to open a remote shell and run basic commands.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Mosquito executes cmd.exe and uses a pipe to read the results and send back the output to the C2 server.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: NanoCore can open a remote command-line interface and execute commands. NanoCore uses JavaScript files.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Nebulae can use CMD to execute a process.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: OopsIE uses the command prompt to execute commands on the victim's machine.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Orz can execute shell commands. Orz can execute commands with JavaScript.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Out1 can use native command line for execution.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: PHOREAL is capable of creating reverse shell.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: PLEAD has the ability to execute shell commands on the compromised host.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: RTM uses the command line and rundll32.exe to execute.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Revenge RAT uses cmd.exe to execute commands and run scripts on the victim's machine.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: RunningRAT uses a batch file to kill a security program task and then attempts to remove itself.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: S-Type has provided the ability to execute shell commands on a compromised host.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: SDBbot has the ability to use the command shell to execute commands on a compromised host.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: SNUGRIDE is capable of executing commands and spawning a reverse shell.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: SamSam uses custom batch scripts to execute some of its components.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: ShimRat can be issued a command shell function from the C2.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: TDTESS provides a reverse shell on the victim.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Tarrask may abuse the Windows schtasks command-line tool to create "hidden" scheduled tasks.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Threat Group-1314 actors spawned shells on remote systems on a victim network to execute commands.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Threat Group-3390 has used command-line interfaces for execution.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: TrickBot has used macros in Excel documents to download and deploy the malware on the user’s machine.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Turian can create a remote shell and execute commands using cmd.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Volgmer can execute commands on the victim's machine.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Wiarp creates a backdoor through which remote attackers can open a command line interface.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: cmd is used to execute programs and other actions at the command-line interface.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: hcdLoader provides command-line access to the compromised system.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: httpclient opens cmd.exe on the victim.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: jRAT has command line access.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: njRAT can launch a command shell interface for executing commands.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: xCaon has a command to start an interactive shell.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: CallMe has the capability to create a reverse shell on victims.
MITRE ATT&CK techniques:
- T1059.004: Command and Scripting Interpreter - Unix Shell
Threat description: Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
- T1059.004: Command and Scripting Interpreter - Unix Shell
Threat description: Drovorub can execute arbitrary commands as root on a compromised system.
MITRE ATT&CK techniques:
- T1059.004: Command and Scripting Interpreter - Unix Shell
Threat description: Fysbis has the ability to create and execute commands in a remote shell for CLI.
MITRE ATT&CK techniques:
- T1059.004: Command and Scripting Interpreter - Unix Shell
Threat description: Kobalos can spawn a new pseudo-terminal and execute arbitrary commands at the command prompt.
MITRE ATT&CK techniques:
- T1059.004: Command and Scripting Interpreter - Unix Shell
Threat description: MacMa can execute supplied shell commands and uses bash scripts to perform additional actions.
MITRE ATT&CK techniques:
- T1059.004: Command and Scripting Interpreter - Unix Shell
Threat description: APT37 executes shellcode and a VBA script to decode Base64 strings.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: During C0015, the threat actors used a malicious HTA file that contained a mix of HTML and JavaScript/VBScript code.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: During Operation CuckooBees, the threat actors executed an encoded VBScript file using `wscript` and wrote the decoded output to a text file.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: Emotet has sent Microsoft Word documents with embedded macros that will invoke scripts to download additional payloads.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.
MITRE ATT&CK techniques:
- T1071.003: Application Layer Protocol - Mail Protocols
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: Machete has embedded malicious macros within spearphishing attachments to download additional files.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: NanHaiShu executes additional VBScript code on the victim's machine.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: OSX_OCEANLOTUS.D uses Word macros for execution.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: Remexi uses AutoIt and VBS scripts throughout its execution process.
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: CoinTicker executes a Python script to download its second stage.
MITRE ATT&CK techniques:
- T1059.006: Command and Scripting Interpreter - Python
- T1105: Ingress Tool Transfer
Threat description: AppleSeed has the ability to use JavaScript to execute PowerShell.
MITRE ATT&CK techniques:
- T1059.007: Command and Scripting Interpreter - JavaScript
Threat description: Earth Lusca has manipulated legitimate websites to inject malicious JavaScript code as part of their watering hole operations.
MITRE ATT&CK techniques:
- T1059.007: Command and Scripting Interpreter - JavaScript
Threat description: jRAT has been distributed as HTA files with JScript.
MITRE ATT&CK techniques:
- T1059.007: Command and Scripting Interpreter - JavaScript
Threat description: Empire can exploit vulnerabilities such as MS16-032 and MS16-135.
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
Threat description: APT29 used the "Get-ManagementRoleAssignment" PowerShell cmdlet to enumerate Exchange management role assignments through an Exchange Management Shell.
MITRE ATT&CK techniques:
- T1069: Permission Groups Discovery
Threat description: APT3 has a tool that can enumerate the permissions associated with Windows groups.
MITRE ATT&CK techniques:
- T1069: Permission Groups Discovery
Threat description: IcedID has the ability to identify Workgroup membership.
MITRE ATT&CK techniques:
- T1069: Permission Groups Discovery
Threat description: MURKYTOP has the capability to retrieve information about groups.
MITRE ATT&CK techniques:
- T1069: Permission Groups Discovery
Threat description: PUNCHBUGGY can gather domain and workgroup information.
MITRE ATT&CK techniques:
- T1069: Permission Groups Discovery
Threat description: UNC2452 used the "Get-ManagementRoleAssignment" PowerShell cmdlet to enumerate Exchange management role assignments through an Exchange Management Shell.
MITRE ATT&CK techniques:
- T1069: Permission Groups Discovery
Threat description: Commands such as "net group" and "net localgroup" can be used in Net to gather information about and manipulate groups.
MITRE ATT&CK techniques:
- T1069.001: Permission Groups Discovery - Local Groups
Threat description: During Operation CuckooBees, the threat actors used the `net group` command as part of their advanced reconnaissance.
MITRE ATT&CK techniques:
- T1069.001: Permission Groups Discovery - Local Groups
Threat description: JPIN can obtain the permissions of the victim user.
MITRE ATT&CK techniques:
- T1069.001: Permission Groups Discovery - Local Groups
Threat description: Kwampirs collects a list of users belonging to the local users and administrators groups with the commands "net localgroup administrators" and "net localgroup users".
MITRE ATT&CK techniques:
- T1069.001: Permission Groups Discovery - Local Groups
Threat description: OilRig has used "net localgroup administrators" to find local administrators on compromised systems.
MITRE ATT&CK techniques:
- T1069.001: Permission Groups Discovery - Local Groups
Threat description: Tonto Team has used the "ShowLocalGroupDetails" command to identify administrator, user, and guest accounts on a compromised host.
MITRE ATT&CK techniques:
- T1069.001: Permission Groups Discovery - Local Groups
Threat description: Dragonfly 2.0 used batch scripts to enumerate administrators and users in the domain.
MITRE ATT&CK techniques:
- T1069.002: Permission Groups Discovery - Domain Groups
Threat description: Helminth has checked for the domain admin group and Exchange Trusted Subsystem groups using the commands "net group Exchange Trusted Subsystem /domain" and "net group domain admins /domain".
MITRE ATT&CK techniques:
- T1069.002: Permission Groups Discovery - Domain Groups
Threat description: LAPSUS$ has used the AD Explorer tool to enumerate groups on a victim's network.
MITRE ATT&CK techniques:
- T1069.002: Permission Groups Discovery - Domain Groups
Threat description: Turla has used "net group "Domain Admins" /domain" to identify domain administrators.
MITRE ATT&CK techniques:
- T1069.002: Permission Groups Discovery - Domain Groups
Threat description: Wizard Spider has used "AdFind.exe" to collect information about Active Directory groups and accounts.
MITRE ATT&CK techniques:
- T1069.002: Permission Groups Discovery - Domain Groups
Threat description: AADInternals can enumerate Azure AD groups.
MITRE ATT&CK techniques:
- T1069.003: Permission Groups Discovery - Cloud Groups
Threat description: ROADTools can enumerate Azure AD groups.
MITRE ATT&CK techniques:
- T1069.003: Permission Groups Discovery - Cloud Groups
Threat description: APT29 temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: APT29 used SDelete to remove artifacts from victims.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: Bankshot deletes all artifacts associated with the malware from the infected machine.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: Bazar's loader can delete scheduled tasks created by a previous instance of the malware.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
- T1070.009: Indicator Removal - Clear Persistence
Threat description: BlackEnergy has removed the watermark associated with enabling the "TESTSIGNING" boot configuration option by removing the relevant strings in the "user32.dll.mui" of the system.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: Donut can erase file references to payloads in-memory after being reflectively loaded and executed.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: EVILNUM has a function called "DeleteLeftovers" to remove certain artifacts of the attack.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: Goopy has the ability to delete emails used for C2 once the content has been copied.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
- T1070.008: Indicator Removal - Clear Mailbox Data
Threat description: GrimAgent can delete previously created tasks on a compromised host.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
- T1070.009: Indicator Removal - Clear Persistence
Threat description: HermeticWiper can disable pop-up information about folders and desktop items and delete Registry keys to hide malicious services.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: KOCTOPUS can delete created registry keys as part of its cleanup procedure.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: Lazarus Group has restored malicious KernelCallbackTable code to its original state after the process execution flow has been hijacked.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: Maze has used the “Wow64RevertWow64FsRedirection” function following attempts to delete the shadow volumes, in order to leave the system in the same state as it was prior to redirection.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: Misdat is capable of deleting Registry keys used for persistence.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
- T1070.009: Indicator Removal - Clear Persistence
Threat description: Neoichor can clear the browser history on a compromised host by changing the `ClearBrowsingHistoryOnExit` value to 1 in the `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy` Registry key.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: Orz can overwrite Registry settings to reduce its visibility on the victim.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: Pillowmint can uninstall the malicious service from an infected machine.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
- T1070.009: Indicator Removal - Clear Persistence
Threat description: Rising Sun can clear a memory blog in the process by overwriting it with junk bytes.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: ShadowPad has deleted arbitrary Registry values.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: UNC2452 removed evidence of email export requests using "Remove-MailboxExportRequest". They temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: njRAT is capable of manipulating and deleting registry keys.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: APT32 has cleared select event log entries.
MITRE ATT&CK techniques:
- T1070.001: Indicator Removal - Clear Windows Event Logs
Threat description: Dragonfly 2.0 cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.
MITRE ATT&CK techniques:
- T1070.001: Indicator Removal - Clear Windows Event Logs
Threat description: Dragonfly has cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.
MITRE ATT&CK techniques:
- T1070.001: Indicator Removal - Clear Windows Event Logs
Threat description: During Operation Wocao, the threat actors deleted all Windows system and security event logs using `/Q /c wevtutil cl system` and `/Q /c wevtutil cl security`.
MITRE ATT&CK techniques:
- T1070.001: Indicator Removal - Clear Windows Event Logs
Threat description: Indrik Spider has used Cobalt Strike to empty log files.
MITRE ATT&CK techniques:
- T1070.001: Indicator Removal - Clear Windows Event Logs
Threat description: KillDisk deletes Application, Security, Setup, and System Windows Event Logs.
MITRE ATT&CK techniques:
- T1070.001: Indicator Removal - Clear Windows Event Logs
Threat description: RunningRAT contains code to clear event logs.
MITRE ATT&CK techniques:
- T1070.001: Indicator Removal - Clear Windows Event Logs
Threat description: MacMa can clear possible malware traces such as application logs.
MITRE ATT&CK techniques:
- T1070.002: Indicator Removal - Clear Linux or Mac System Logs
Threat description: Lazarus Group has routinely deleted log files on a compromised router, including automatic log deletion through the use of the logrotate utility.
MITRE ATT&CK techniques:
- T1070.003: Indicator Removal - Clear Command History
Threat description: Magic Hound has removed mailbox export requests from compromised Exchange servers.
MITRE ATT&CK techniques:
- T1070.003: Indicator Removal - Clear Command History
Threat description: APT29 routinely removed their tools, including custom backdoors, once remote access was achieved. APT29 has also used SDelete to remove artifacts from victims.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: FIN5 uses SDelete to clean up the environment and attempt to prevent detection.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: RainyDay has the ability to uninstall itself by deleting its service and files.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: Recent versions of Cherry Picker delete files and registry keys created by the malware.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: APT29 removed evidence of email export requests using "Remove-MailboxExportRequest".
MITRE ATT&CK techniques:
- T1070.008: Indicator Removal - Clear Mailbox Data
Threat description: MCMD has the ability to remove set Registry Keys, including those used for persistence.
MITRE ATT&CK techniques:
- T1070.009: Indicator Removal - Clear Persistence
Threat description: RTM has the ability to remove Registry entries that it created for persistence.
MITRE ATT&CK techniques:
- T1070.009: Indicator Removal - Clear Persistence
Threat description: SUNBURST removed IFEO registry values to clean up traces of persistence.
MITRE ATT&CK techniques:
- T1070.009: Indicator Removal - Clear Persistence
Threat description: njRAT is capable of manipulating and deleting registry keys, including those used for persistence.
MITRE ATT&CK techniques:
- T1070.009: Indicator Removal - Clear Persistence
Threat description: APT34 malware often uses HTTP and DNS for C2. The group has also used the Plink utility and other tools to create tunnels to C2 servers.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: Adversaries can also use NETEAGLE to establish an RDP connection with a controller over TCP/7519.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: Duqu uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1572: Protocol Tunneling
Threat description: Exaramel uses HTTPS for C2 communications.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: Siloscape connects to an IRC server for C2.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: The Regin malware platform supports many standard protocols, including SMB.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: BBSRAT uses GET and POST requests over HTTP or HTTPS for command and control to obtain commands and send ZLIB compressed data back to the C2 server.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: Cobalt Strike can use a custom command and control protocol that can be encapsulated in HTTP or HTTPS. All protocols use their standard assigned ports.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: Dark Caracal's version of Bandook communicates with their server over a TCP port using HTTP payloads Base64 encoded and suffixed with the string “&&&”.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: FIN4 has used HTTP POST requests to transmit data.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: Pony has sent collected information to the C2 via HTTP POST request.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: PowerShower has sent HTTP GET and POST requests to C2 servers to send information and receive instructions.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: The "Uploader" variant of HAMMERTOSS visits a hard-coded server over HTTP/S to download the images HAMMERTOSS uses to receive commands.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: httpclient uses HTTP for command and control.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: Kimsuky has used FTP to download additional malware to the target machine.
MITRE ATT&CK techniques:
- T1071.002: Application Layer Protocol - File Transfer Protocols
Threat description: NOKKI has used FTP for C2 communications.
MITRE ATT&CK techniques:
- T1071.002: Application Layer Protocol - File Transfer Protocols
Threat description: XAgentOSX contains the ftpUpload function to use the FTPManager:uploadFile method to upload files from the target system.
MITRE ATT&CK techniques:
- T1071.002: Application Layer Protocol - File Transfer Protocols
Threat description: A SUGARDUMP variant used SMTP for C2.
MITRE ATT&CK techniques:
- T1071.003: Application Layer Protocol - Mail Protocols
Threat description: APT28 has used IMAP, POP3, and SMTP for a communication channel in various implants, including using self-registered Google Mail accounts and later compromised email servers of its victims.
MITRE ATT&CK techniques:
- T1071.003: Application Layer Protocol - Mail Protocols
Threat description: RDAT can use email attachments for C2 communications.
MITRE ATT&CK techniques:
- T1071.003: Application Layer Protocol - Mail Protocols
Threat description: Zebrocy uses SMTP and POP3 for C2.
MITRE ATT&CK techniques:
- T1071.003: Application Layer Protocol - Mail Protocols
Threat description: Chimera has used Cobalt Strike to encapsulate C2 in DNS traffic.
MITRE ATT&CK techniques:
- T1071.004: Application Layer Protocol - DNS
Threat description: LazyScripter has leveraged dynamic DNS providers for C2 communications.
MITRE ATT&CK techniques:
- T1071.004: Application Layer Protocol - DNS
Threat description: SOUNDBITE communicates via DNS for C2.
MITRE ATT&CK techniques:
- T1071.004: Application Layer Protocol - DNS
Threat description: SombRAT can communicate over DNS with the C2 server.
MITRE ATT&CK techniques:
- T1071.004: Application Layer Protocol - DNS
Threat description: APT32 compromised McAfee ePO to move laterally by distributing malware as a software deployment task.
MITRE ATT&CK techniques:
- T1072: Software Deployment Tools
Threat description: Threat Group-1314 actors used a victim's endpoint management platform, Altiris, for lateral movement.
MITRE ATT&CK techniques:
- T1072: Software Deployment Tools
Threat description: Kobalos can write captured SSH connection credentials to a file under the "/var/run" directory with a ".pid" extension for exfiltration.
MITRE ATT&CK techniques:
- T1074: Data Staged
Threat description: Shark has stored information in folders named `U1` and `U2` prior to exfiltration.
MITRE ATT&CK techniques:
- T1074: Data Staged
Threat description: ADVSTORESHELL stores output from command execution in a .dat file in the %TEMP% directory.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: Calisto uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.
MITRE ATT&CK techniques:
- T1564.001: Hide Artifacts - Hidden Files and Directories
- T1074.001: Data Staged - Local Data Staging
Threat description: Exaramel for Windows specifies a path to store files scheduled for exfiltration.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: FunnyDream can stage collected information including screen captures and logged keystrokes locally.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: GALLIUM compressed and staged files in multi-part archives in the Recycle Bin prior to exfiltration.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: Gold Dragon stores information gathered from the endpoint in a file named 1.hwp.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: Indrik Spider has stored collected date in a .tmp file.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: Machete created their own directories to drop files into.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: Machete stores files and logs in a folder on the local drive.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: ObliqueRAT can copy specific files, webcam captures, and screenshots to local directories.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: PUNCHTRACK aggregates collected data in a tmp file.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: Patchwork copied all targeted files to a directory called index that was eventually uploaded to the C&C server.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: Prikormka creates a directory, "%USERPROFILE%\AppData\Local\SKC\", which is used to store collected log files.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: SUGARDUMP has stored collected data under `%<malware_execution_folder>%\\CrashLog.txt`.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: ccf32 can temporarily store files in a hidden directory on the local host.
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: FIN8 aggregates staged data from a network into a single location.
MITRE ATT&CK techniques:
- T1074.002: Data Staged - Remote Data Staging
Threat description: UNC2452 staged data and files in password-protected archives on a victim's OWA server.
MITRE ATT&CK techniques:
- T1074.002: Data Staged - Remote Data Staging
Threat description: APT18 actors leverage legitimate credentials to log into external remote services.
MITRE ATT&CK techniques:
- T1133: External Remote Services
- T1078: Valid Accounts
Threat description: During Night Dragon, threat actors used compromised VPN accounts to gain access to victim systems.
MITRE ATT&CK techniques:
- T1133: External Remote Services
- T1078: Valid Accounts
Threat description: Industroyer can use supplied user credentials to execute processes and stop services.
MITRE ATT&CK techniques:
- T1078: Valid Accounts
Threat description: Kinsing has used valid SSH credentials to access remote hosts.
MITRE ATT&CK techniques:
- T1078: Valid Accounts
Threat description: Some SeaDuke samples have a module to extract email from Microsoft Exchange servers using compromised credentials.
MITRE ATT&CK techniques:
- T1078: Valid Accounts
- T1114.002: Email Collection - Remote Email Collection
Threat description: TEMP.Veles has used compromised VPN accounts.
MITRE ATT&CK techniques:
- T1078: Valid Accounts
Threat description: HyperStack can use default credentials to connect to IPC$ shares on remote machines.
MITRE ATT&CK techniques:
- T1078.001: Valid Accounts - Default Accounts
Threat description: Stuxnet infected WinCC machines via a hardcoded database server password.
MITRE ATT&CK techniques:
- T1078.001: Valid Accounts - Default Accounts
Threat description: APT29 has used valid accounts, including administrator accounts, to help facilitate lateral movement on compromised networks.
MITRE ATT&CK techniques:
- T1078.002: Valid Accounts - Domain Accounts
Threat description: Chimera has used compromised domain accounts to gain access to the target environment.
MITRE ATT&CK techniques:
- T1078.002: Valid Accounts - Domain Accounts
Threat description: CreepySnail can use stolen credentials to authenticate on target networks.
MITRE ATT&CK techniques:
- T1078.002: Valid Accounts - Domain Accounts
Threat description: During Night Dragon, threat actors used domain accounts to gain further access to victim systems.
MITRE ATT&CK techniques:
- T1078.002: Valid Accounts - Domain Accounts
Threat description: During Operation CuckooBees, the threat actors used compromised domain administrator credentials as part of their lateral movement.
MITRE ATT&CK techniques:
- T1078.002: Valid Accounts - Domain Accounts
Threat description: If Shamoon cannot access shares using current privileges, it attempts access using hard coded, domain-specific credentials gathered earlier in the intrusion.
MITRE ATT&CK techniques:
- T1078.002: Valid Accounts - Domain Accounts
Threat description: Naikon has used administrator credentials for lateral movement in compromised networks.
MITRE ATT&CK techniques:
- T1078.002: Valid Accounts - Domain Accounts
Threat description: Sandworm Team has used stolen credentials to access administrative accounts within the domain.
MITRE ATT&CK techniques:
- T1078.002: Valid Accounts - Domain Accounts
Threat description: Stuxnet attempts to access network resources with a domain account’s credentials.
MITRE ATT&CK techniques:
- T1078.002: Valid Accounts - Domain Accounts
Threat description: Threat Group-1314 actors used compromised domain credentials for the victim's endpoint management platform, Altiris, to move laterally.
MITRE ATT&CK techniques:
- T1078.002: Valid Accounts - Domain Accounts
Threat description: Wizard Spider has used administrative accounts, including Domain Admin, to move laterally within a victim network.
MITRE ATT&CK techniques:
- T1078.002: Valid Accounts - Domain Accounts
Threat description: APT29 has used compromised local accounts to access victims' networks.
MITRE ATT&CK techniques:
- T1078.003: Valid Accounts - Local Accounts
Threat description: APT32 has used legitimate local admin account credentials.
MITRE ATT&CK techniques:
- T1078.003: Valid Accounts - Local Accounts
Threat description: Emotet can brute force a local admin password, then use it to facilitate lateral movement.
MITRE ATT&CK techniques:
- T1078.003: Valid Accounts - Local Accounts
Threat description: Kimsuky has used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP.
MITRE ATT&CK techniques:
- T1078.003: Valid Accounts - Local Accounts
Threat description: NotPetya can use valid credentials with PsExec or "wmic" to spread itself to remote systems.
MITRE ATT&CK techniques:
- T1078.003: Valid Accounts - Local Accounts
Threat description: PROMETHIUM has created admin accounts on a compromised host.
MITRE ATT&CK techniques:
- T1078.003: Valid Accounts - Local Accounts
Threat description: Stolen Pencil has a tool to add a Windows admin account in order to allow them to ensure continued access via RDP.
MITRE ATT&CK techniques:
- T1078.003: Valid Accounts - Local Accounts
Threat description: Tropic Trooper has used known administrator account credentials to execute the backdoor directly.
MITRE ATT&CK techniques:
- T1078.003: Valid Accounts - Local Accounts
Threat description: APT28 has used compromised Office 365 service accounts with Global Administrator privileges to collect email from user inboxes.
MITRE ATT&CK techniques:
- T1078.004: Valid Accounts - Cloud Accounts
Threat description: APT33 has used compromised Office 365 accounts in tandem with Ruler in an attempt to gain control of endpoints.
MITRE ATT&CK techniques:
- T1078.004: Valid Accounts - Cloud Accounts
Threat description: Ke3chang has used compromised credentials to sign into victims’ Microsoft 365 accounts.
MITRE ATT&CK techniques:
- T1078.004: Valid Accounts - Cloud Accounts
Threat description: Peirates can use stolen service account tokens to perform its operations.
MITRE ATT&CK techniques:
- T1078.004: Valid Accounts - Cloud Accounts
Threat description: H1N1 has functionality to copy itself to network shares.
MITRE ATT&CK techniques:
- T1080: Taint Shared Content
Threat description: APT28 has enumerated installed applications on macOS devices with built-in utilities such as "ls -al /Applications".
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: CaddyWiper can use `DsRoleGetPrimaryDomainInformation` to determine the role of the infected machine. CaddyWiper can also halt execution if the compromised host is identified as a domain controller.
MITRE ATT&CK techniques:
- T1082: System Information Discovery