QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: Raindrop was built to include a modified version of 7-Zip source code (including associated export names) and Far Manager source code.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: TrailBlazer has used filenames that match the name of the compromised system in attempt to avoid detection.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: UNC2452 set the hostnames of its C2 infrastructure to match legitimate hostnames in the victim environment. They also primarily used IP addresses originating from the same country as the victim for their VPN infrastructure.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: WhisperGate has been disguised as a JPG extension to avoid detection as a malicious PE file.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: XCSSET builds a malicious application bundle to resemble Safari through using the Safari icon and "Info.plist".
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: APT37 has signed its malware with an invalid digital certificates listed as “Tencent Technology (Shenzhen) Company Limited.”
MITRE ATT&CK techniques:
- T1036.001: Masquerading - Invalid Code Signature
Threat description: Gelsemium has used unverified signatures on malicious DLLs.
MITRE ATT&CK techniques:
- T1036.001: Masquerading - Invalid Code Signature
Threat description: PcShare has used an invalid certificate in attempt to appear legitimate.
MITRE ATT&CK techniques:
- T1036.001: Masquerading - Invalid Code Signature
Threat description: WindTail has been incompletely signed with revoked certificates.
MITRE ATT&CK techniques:
- T1036.001: Masquerading - Invalid Code Signature
Threat description: BlackTech has used right-to-left-override to obfuscate the filenames of malicious e-mail attachments.
MITRE ATT&CK techniques:
- T1036.002: Masquerading - Right-to-Left Override
Threat description: Scarlet Mimic has used the left-to-right override character in self-extracting RAR archive spearphishing attachment file names.
MITRE ATT&CK techniques:
- T1036.002: Masquerading - Right-to-Left Override
Threat description: APT32 has moved and renamed pubprn.vbs to a .txt file to avoid detection.
MITRE ATT&CK techniques:
- T1036.003: Masquerading - Rename System Utilities
Threat description: Kevin has renamed an image of `cmd.exe` with a random name followed by a `.tmpl` extension.
MITRE ATT&CK techniques:
- T1036.003: Masquerading - Rename System Utilities
Threat description: Lazarus Group has renamed system utilities such as "wscript.exe" and "mshta.exe".
MITRE ATT&CK techniques:
- T1036.003: Masquerading - Rename System Utilities
Threat description: The CozyCar dropper has masqueraded a copy of the infected system's rundll32.exe executable that was moved to the malware's install directory and renamed according to a predefined configuration file.
MITRE ATT&CK techniques:
- T1036.003: Masquerading - Rename System Utilities
Threat description: A Lazarus Group custom backdoor implant included a custom PE loader named "Security Package" that was added into the lsass.exe process via registry key.
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: APT41 has created services to appear as benign system tools.
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: Carbanak has copied legitimate service names to use for malicious services.
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: Catchamas adds a new service named NetAdapter in an apparent attempt to masquerade as a legitimate service.
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: DCSrv has masqueraded its service as a legitimate svchost.exe process.
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: Green Lambert has created a new executable named `Software Update Check` to appear legitimate.
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: Heyoka Backdoor has been named `srvdll.dll` to appear as a legitimate service.
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: Higaisa named a shellcode loader binary "svchast.exe" to spoof the legitimate "svchost.exe".
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: Hildegard has disguised itself as a known Linux process.
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: Kimsuky has disguised services to appear as benign software or related to operating system functions.
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: Machete renamed task names to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python tasks.
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: OSX_OCEANLOTUS.D has disguised its app bundle by adding special characters to the filename and using the icon for legitimate Word documents.
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: PingPull can mimic the names and descriptions of legitimate services such as `iphlpsvc`, `IP Helper`,  and `Onedrive` to evade detection.
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: Tarrask creates a scheduled task called “WinUpdate” to re-establish any dropped  C2 connections.
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: UNC2452 named tasks "\Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager" in order to appear legitimate.
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: Wizard Spider has used scheduled tasks to install TrickBot, using task names to appear legitimate such as WinDotNet, GoogleTask, or Sysnetsf. It has also used common document file names for other malware binaries.
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: build_downer has added itself to the Registry Run key as "NVIDIA" to appear legitimate.
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: BADNEWS attempts to hide its payloads using legitimate filenames.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: BLINDINGCAN has attempted to hide its payload by using legitimate file names such as "iconcache.db".
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Bad Rabbit has masqueraded as a Flash Player installer through the executable file "install_flash_player.exe".
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Bundlore has disguised a malicious .app file as a Flash Player update.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: ChChes copies itself to an .exe file with a filename that is likely intended to imitate Norton Antivirus but has several letters reversed (e.g. notron.exe).
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Chaes has used an unsigned, crafted DLL module named "hha.dll" that was designed to look like a legitimate 32-bit Windows DLL.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: DRATzarus has been named `Flash.exe`, and its dropper has been named `IExplorer`.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: DanBot files have been named `UltraVNC.exe` and `WINVNC.exe` to appear as legitimate VNC tools.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: During Operation CuckooBees, the threat actors renamed a malicious executable to `rundll32.exe` to allow it to blend in with other Windows system files.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: During Operation Honeybee, the threat actors used a legitimate Windows executable and secure directory for their payloads to bypass UAC.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: During Operation Wocao, the threat actors renamed some tools and executables to appear as legitimate programs.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Earth Lusca used the command `move [file path] c:\windows\system32\spool\prtprocs\x64\spool.dll` to move and register a malicious DLL name as a Windows print processor, which eventually was loaded by the Print Spooler service.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: FIN7 has attempted to run Darkside ransomware with the filename sleep.exe.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Felismus has masqueraded as legitimate Adobe Content Management System files.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Ferocious Kitten has named malicious files "update.exe" and loaded them into the compromise host's “Public” folder.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Fox Kitten has named binaries and configuration files svhost and dllhost respectively to appear legitimate.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Gamaredon Group has used legitimate process names to hide malware including "svchosst".
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: GoldenSpy's setup file installs initial executables under the folder "%WinDir%\System32\PluginManager".
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Goopy has impersonated the legitimate goopdate.dll, which was dropped on the target system with a legitimate GoogleUpdate.exe.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Grandoreiro has named malicious browser extensions and update files to appear legitimate.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Green Lambert has been disguised as a Growl help file.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: HTTPBrowser's installer contains a malicious file named navlu.dll to decrypt and run the RAT. navlu.dll is also the name of a legitimate Symantec DLL.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: If installing itself as a service fails, Elise instead writes itself as a file named svchost.exe saved in %APPDATA%\Microsoft\Network.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Indrik Spider used fake updates for FlashPlayer plugin and Google Chrome as initial infection vectors.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Lazarus Group has renamed malicious code to disguise it as Microsoft's narrator and other legitimate files.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: LookBack has a C2 proxy tool that masquerades as "GUP.exe", which is software used by Notepad++.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: MCMD has been named Readme.txt to appear legitimate.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Machete renamed payloads to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python executables.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Machete's Machete MSI installer has masqueraded as a legitimate Adobe Acrobat Reader installer.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Metamorfo has disguised an MSI file as the Adobe Acrobat Reader Installer and has masqueraded payloads as OneDrive, WhatsApp, or Spotify, for example.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Misdat saves itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Mustang Panda has used names like `adobeupdate.dat` and `PotPlayerDB.dat` to disguise PlugX, and a file named `OneDrive.exe` to load a Cobalt Strike payload.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Naikon has disguised malicious programs as Google Chrome, Adobe, and VMware executables.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: OSX/Shlayer can masquerade as a Flash Player update.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: OwaAuth uses the filename owaauth.dll, which is a legitimate file that normally resides in "%ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\Auth\"; the malicious file by the same name is saved in "%ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\bin\".
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Patchwork installed its payload in the startup programs folder as "Baidu Software Update." The group also adds its second stage payload to the startup programs as “Net Monitor." They have also dropped QuasarRAT binaries as files named microsoft_network.exe and crome.exe.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: PlugX has been disguised as legitimate Adobe and PotPlayer files.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Poseidon Group tools attempt to spoof anti-virus processes as a means of self-defense.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Pysa has executed a malicious executable by naming it svchost.exe.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: QUADAGENT used the PowerShell filenames "Office365DCOMCheck.ps1" and "SystemDiskClean.ps1".
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: REvil can mimic the names of known executables.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Ryuk has constructed legitimate appearing installation folder paths by calling "GetWindowsDirectoryW" and then inserting a null byte at the fourth character of the path. For Windows Vista or higher, the path would appear as "C:\Users\Public".
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: S-Type may save itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Sandworm Team has avoided detection by naming a malicious binary explorer.exe.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Shark binaries have been named `audioddg.pdb` and `Winlangdb.pdb` in order to appear legitimate.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: ShimRatReporter spoofed itself as "AlphaZawgyl_font.exe", a specialized Unicode font.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: StrongPity has been bundled with legitimate software installation files for disguise.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: TRITON disguised itself as the legitimate Triconex Trilog application.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: TeamTNT has replaced .dockerd and .dockerenv with their own scripts and cryptocurrency mining software.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: The TAINTEDSCRIBE main executable has disguised itself as Microsoft’s Narrator.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: ThreatNeedle chooses its payload creation path from a randomly selected service name from netsvc.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: TinyTurla has been deployed as `w64time.dll` to appear legitimate.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
- T1036.005: Masquerading - Match Legitimate Name or Location
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Tropic Trooper has hidden payloads in Flash directories and fake installer files.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: USBStealer mimics a legitimate Russian program called USB Disk Security.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Ursnif has used strings from legitimate system files and existing folders for its file, folder, and Registry entry names.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: WIRTE has named a first stage dropper `Kaspersky Update Agent` in order to appear legitimate.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: ZLib mimics the resource version information of legitimate Realtek Semiconductor, Nvidia, or Synaptics modules.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: menuPass has been seen changing malicious files to appear legitimate.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Keydnap puts a space after a false .jpg extension so that execution actually goes through the Terminal.app program.
MITRE ATT&CK techniques:
- T1036.006: Masquerading - Space after Filename
Threat description: Cyclops Blink has the ability to execute on device startup, using a modified RC script named S51armled.
MITRE ATT&CK techniques:
- T1037.004: Boot or Logon Initialization Scripts - RC Scripts
Threat description: Green Lambert can add "init.d" and "rc.d" files in the "/etc" folder to establish persistence.
MITRE ATT&CK techniques:
- T1037.004: Boot or Logon Initialization Scripts - RC Scripts
Threat description: jRAT can list and manage startup entries.
MITRE ATT&CK techniques:
- T1037.005: Boot or Logon Initialization Scripts - Startup Items
Threat description: Egregor can collect any files found in the enumerated drivers before sending it to its C2 channel.
MITRE ATT&CK techniques:
- T1039: Data from Network Shared Drive
Threat description: MESSAGETAP uses the libpcap library to listen to all traffic and parses network protocols starting with Ethernet and IP layers. It continues parsing protocol layers including SCTP, SCCP, and TCAP and finally extracts SMS message data and routing metadata.
MITRE ATT&CK techniques:
- T1040: Network Sniffing
Threat description: Bumblebee can send collected data in JSON format to C2.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Caterpillar WebShell can upload files over the C2 channel.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Doki has used Ngrok to establish C2 and exfiltrate data.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: During Operation Honeybee, the threat actors uploaded stolen files to their C2 servers.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Dyre has the ability to send information staged on a compromised host externally to C2.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Ebury can exfiltrate SSH credentials through custom DNS queries.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Emotet has been seen exfiltrating system information stored within cookies sent within an HTTP GET request back to its C2 servers.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: FoggyWeb can remotely exfiltrate sensitive information from a compromised AD FS server.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: FunnyDream can execute commands, including gathering user information, and send the results to C2.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Tomiris can upload files matching a hardcoded set of extensions, such as .doc, .docx, .pdf, and .rar, to its C2 server.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: njRAT has used HTTP to receive stolen information from the infected machine.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Conficker scans for other machines to infect.
MITRE ATT&CK techniques:
- T1046: Network Service Discovery
Threat description: NBTscan can be used to scan IP networks.
MITRE ATT&CK techniques:
- T1046: Network Service Discovery
Threat description: During C0015, the threat actors used `wmic` and `rundll32` to load Cobalt Strike onto a target host.
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: HELLOKITTY can use WMI to delete volume shadow copies.
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
- T1047: Windows Management Instrumentation
Threat description: Wizard Spider has used WMI and LDAP queries for network discovery and to move laterally.
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: Bundlore uses the "curl -s -L -o" command to exfiltrate archived data to a URL.
MITRE ATT&CK techniques:
- T1048: Exfiltration Over Alternative Protocol
Threat description: FrameworkPOS can use DNS tunneling for exfiltration of credit card data.
MITRE ATT&CK techniques:
- T1048: Exfiltration Over Alternative Protocol
Threat description: Hydraq connects to a predefined domain on port 443 to exfil gathered information.
MITRE ATT&CK techniques:
- T1048: Exfiltration Over Alternative Protocol
Threat description: Kobalos can exfiltrate credentials over the network via UDP.
MITRE ATT&CK techniques:
- T1048: Exfiltration Over Alternative Protocol
Threat description: APT28 has exfiltrated archives of collected data previously staged on a target's OWA server via HTTPS.
MITRE ATT&CK techniques:
- T1048.002: Exfiltration Over Alternative Protocol - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
Threat description: UNC2452 exfiltrated collected data over a simple HTTPS request to a password-protected archive staged on a victim's OWA servers.
MITRE ATT&CK techniques:
- T1048.002: Exfiltration Over Alternative Protocol - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
Threat description: APT32's backdoor can exfiltrate data by encoding it in the subdomain field of DNS packets.
MITRE ATT&CK techniques:
- T1048.003: Exfiltration Over Alternative Protocol - Exfiltration Over Unencrypted Non-C2 Protocol
Threat description: Agent Tesla has routines for exfiltration over SMTP, FTP, and HTTP.
MITRE ATT&CK techniques:
- T1048.003: Exfiltration Over Alternative Protocol - Exfiltration Over Unencrypted Non-C2 Protocol
Threat description: Carbon uses HTTP to send data to the C2 server.
MITRE ATT&CK techniques:
- T1048.003: Exfiltration Over Alternative Protocol - Exfiltration Over Unencrypted Non-C2 Protocol
Threat description: Cherry Picker exfiltrates files over FTP.
MITRE ATT&CK techniques:
- T1048.003: Exfiltration Over Alternative Protocol - Exfiltration Over Unencrypted Non-C2 Protocol
Threat description: CookieMiner has used the "curl --upload-file" command to exfiltrate data over HTTP.
MITRE ATT&CK techniques:
- T1048.003: Exfiltration Over Alternative Protocol - Exfiltration Over Unencrypted Non-C2 Protocol
Threat description: CosmicDuke exfiltrates collected files over FTP or WebDAV. Exfiltration servers can be separately configured from C2 servers.
MITRE ATT&CK techniques:
- T1048.003: Exfiltration Over Alternative Protocol - Exfiltration Over Unencrypted Non-C2 Protocol
Threat description: Kessel can exfiltrate credentials and other information via HTTP POST request, TCP, and DNS.
MITRE ATT&CK techniques:
- T1048.003: Exfiltration Over Alternative Protocol - Exfiltration Over Unencrypted Non-C2 Protocol
Threat description: Lazarus Group malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims.
MITRE ATT&CK techniques:
- T1048.003: Exfiltration Over Alternative Protocol - Exfiltration Over Unencrypted Non-C2 Protocol
Threat description: Remsec can exfiltrate data via a DNS tunnel or email, separately from its C2 channel.
MITRE ATT&CK techniques:
- T1048.003: Exfiltration Over Alternative Protocol - Exfiltration Over Unencrypted Non-C2 Protocol
Threat description: Some Brave Prince variants have used South  Korea's Daum email service to exfiltrate information, and later variants have posted the data to a web server via an HTTP post command.
MITRE ATT&CK techniques:
- T1048.003: Exfiltration Over Alternative Protocol - Exfiltration Over Unencrypted Non-C2 Protocol
Threat description: Thrip has used WinSCP to exfiltrate data from a targeted organization over FTP.
MITRE ATT&CK techniques:
- T1048.003: Exfiltration Over Alternative Protocol - Exfiltration Over Unencrypted Non-C2 Protocol
Threat description: ftp may be used to exfiltrate data separate from the main command and control protocol.
MITRE ATT&CK techniques:
- T1048.003: Exfiltration Over Alternative Protocol - Exfiltration Over Unencrypted Non-C2 Protocol
Threat description: Babuk can use “WNetOpenEnumW” and “WNetEnumResourceW” to enumerate files in network resources for encryption.
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
Threat description: NETWIRE can capture session logon details from a compromised host.
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
Threat description: Tropic Trooper has tested if the localhost network is available and other connection capability on an infected system using command scripts.
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
Threat description: Agent.btz creates a file named thumb.dd on all USB flash drives connected to the victim. This file contains information about the infected system and activity logs.
MITRE ATT&CK techniques:
- T1052.001: Exfiltration Over Physical Medium - Exfiltration over USB
Threat description: SPACESHIP copies staged data to removable drives when they are inserted into the system.
MITRE ATT&CK techniques:
- T1052.001: Exfiltration Over Physical Medium - Exfiltration over USB
Threat description: Dragonfly has used a scheduled task to execute a malicious file.
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
Threat description: Earth Lusca used the command "schtasks /Create /SC ONLOgon /TN WindowsUpdateCheck /TR “[file path]” /ru system" for persistence.
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
Threat description: CrackMapExec can set a scheduled task on the target system to execute commands remotely using at.
MITRE ATT&CK techniques:
- T1053.002: Scheduled Task/Job - At
Threat description: at can be used to schedule a task on a system to be executed at a specific date or time.
MITRE ATT&CK techniques:
- T1053.002: Scheduled Task/Job - At
Threat description: APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: APT41 used a compromised account to create a scheduled task on a system.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: Saint Bot has created a scheduled task named "Maintenance" to establish persistence.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: Clambling can inject into the `svchost.exe` process for execution.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: GuLoader has the ability to inject shellcode into a donor processes that is started in a suspended state. GuLoader has previously used RegAsm as a donor process.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: HiddenWasp adds itself to the LD_PRELOAD path and sets a series of environment variables.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: Honeybee uses a batch file to load a DLL into the svchost.exe process.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: JHUHUGIT performs code injection injecting its own functions to browser processes.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: Lizar can migrate the loader into another process.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: NavRAT copies itself into a running Internet Explorer process to evade detection.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: Turla has also used PowerSploit's "Invoke-ReflectivePEInjection.ps1" to reflectively load a PowerShell payload into a random process on the victim system.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: WarzoneRAT has the ability to inject malicious DLLs into a specific process for privilege escalation.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: A Lazarus Group malware sample performs reflective DLL injection.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Carbon has a command to inject code into a process.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Duqu will inject itself into different processes to evade detection. The selection of the target process is influenced by the security software that is installed on the system (Duqu will inject into different processes depending on which security suite is installed on the infected host).
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: During C0015, the threat actors used a DLL named `D8B3.dll` that was injected into the Winlogon process.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Dyre injects into other processes to load modules.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Elise injects DLL files into iexplore.exe.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Emissary injects its DLL file into a newly spawned Internet Explorer process.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Emotet has been observed injecting in to Explorer.exe and other processes.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Gelsemium has the ability to inject DLLs into specific processes.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Get2 has the ability to inject DLLs into processes.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: If running in a Windows environment, Kazuar saves a DLL to disk that is injected into the explorer.exe process to execute the payload. Kazuar can also be configured to inject and execute within specific processes.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Koadic can perform process injection by using a reflective DLL.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Leviathan has utilized techniques like reflective DLL loading to write a DLL into memory and load a shell that provides backdoor access to the victim.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Maze has injected the malware DLL into a target process.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: MegaCortex loads "injecthelper.dll" into a newly created "rundll32.exe" process.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Metamorfo has injected a malicious DLL into the Windows Media Player process (wmplayer.exe).
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Mongall can inject a DLL into `rundll32.exe` for execution.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: PS1 can inject its payload DLL Into memory.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: PoisonIvy can inject a malicious DLL into a process.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Pupy can migrate into another process using reflective DLL injection.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: RATANKBA performs a reflective DLL injection using a given pid.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Remsec can perform DLL injection.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Saint Bot has injected its DLL component into `EhStorAurhn.exe`.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Socksbot creates a suspended svchost process and injects its DLL into it.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: SombRAT can execute "loadfromfile", "loadfromstorage", and "loadfrommem" to inject a DLL  from disk, storage, or memory respectively.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Sykipot injects itself into running instances of outlook.exe, iexplore.exe, or firefox.exe.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Taidoor can perform DLL loading.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: The Bumblebee loader can support the `Dij` command which gives it the ability to inject DLLs into the memory of other processes.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: The FunnyDream FilepakMonitor component can inject into the Bka.exe process using the `VirtualAllocEx`, `WriteProcessMemory` and `CreateRemoteThread` APIs to load the DLL component.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: The Netwalker DLL has been injected reflectively into the memory of a legitimate running process.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Tropic Trooper has injected a DLL backdoor into dllhost.exe and svchost.exe.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Turla has used Metasploit to perform reflective DLL injection in order to escalate privileges.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Wizard Spider has injected malicious DLLs into memory with read, write, and execute permissions.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: ZxShell is injected into a shared SVCHOST process.
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: Carbanak downloads an executable and injects it directly into a new process.
MITRE ATT&CK techniques:
- T1055.002: Process Injection - Portable Executable Injection
Threat description: GreyEnergy has a module to inject a PE binary into a remote process.
MITRE ATT&CK techniques:
- T1055.002: Process Injection - Portable Executable Injection
Threat description: Lizar can execute PE files in the address space of the specified process.
MITRE ATT&CK techniques:
- T1055.002: Process Injection - Portable Executable Injection
Threat description: Rocke's miner, "TermsHost.exe", evaded defenses by injecting itself into Windows processes, including Notepad.exe.
MITRE ATT&CK techniques:
- T1055.002: Process Injection - Portable Executable Injection
Threat description: Zeus Panda checks processes on the system and if they meet the necessary requirements, it injects into that process.
MITRE ATT&CK techniques:
- T1055.002: Process Injection - Portable Executable Injection
Threat description: Gazer performs thread execution hijacking to inject its orchestrator into a running thread from a remote process.
MITRE ATT&CK techniques:
- T1055.003: Process Injection - Thread Execution Hijacking
Threat description: Trojan.Karagany can inject a suspended thread of its own process into a new process and initiate via the "ResumeThread" API.
MITRE ATT&CK techniques:
- T1055.003: Process Injection - Thread Execution Hijacking
Threat description: Waterbear can use thread injection to inject shellcode into the process of security software.
MITRE ATT&CK techniques:
- T1055.003: Process Injection - Thread Execution Hijacking
Threat description: FIN8 has injected malicious code into a new svchost.exe process.
MITRE ATT&CK techniques:
- T1055.004: Process Injection - Asynchronous Procedure Call
Threat description: Saint Bot has written its payload into a newly-created `EhStorAuthn.exe` process using `ZwWriteVirtualMemory` and executed it using `NtQueueApcThread` and `ZwAlertResumeThread`.
MITRE ATT&CK techniques:
- T1055.004: Process Injection - Asynchronous Procedure Call
Threat description: Epic has overwritten the function pointer in the extra window memory of Explorer's Shell_TrayWnd in order to execute malicious code in the context of the explorer.exe process.
MITRE ATT&CK techniques:
- T1055.011: Process Injection - Extra Window Memory Injection
Threat description: Power Loader overwrites Explorer’s Shell_TrayWnd extra window memory to redirect execution to a NTDLL function that is abused to assemble and execute a return-oriented programming (ROP) chain and create a malicious thread within Explorer.exe.
MITRE ATT&CK techniques:
- T1055.011: Process Injection - Extra Window Memory Injection
Threat description: A Threat Group-3390 tool can spawn svchost.exe and inject the payload into that process.
MITRE ATT&CK techniques:
- T1055.012: Process Injection - Process Hollowing
Threat description: TrickBot injects into the svchost.exe process.
MITRE ATT&CK techniques:
- T1055.012: Process Injection - Process Hollowing
Threat description: WhisperGate has the ability to inject its fourth stage into a suspended process created by the legitimate Windows utility `InstallUtil.exe`.
MITRE ATT&CK techniques:
- T1055.012: Process Injection - Process Hollowing
Threat description: Leafminer has used Process Doppelgänging to evade security software while deploying tools on compromised systems.
MITRE ATT&CK techniques:
- T1055.013: Process Injection - Process Doppelgänging
Threat description: SynAck abuses NTFS transactions to launch and conceal malicious processes.
MITRE ATT&CK techniques:
- T1055.013: Process Injection - Process Doppelgänging
Threat description: InvisiMole has used ListPlanting to inject code into a trusted process.
MITRE ATT&CK techniques:
- T1055.015: Process Injection - ListPlanting
Threat description: APT3 has used a keylogging tool that records keystrokes in encrypted files.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: APT39 has used tools for capturing keystrokes.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: Agent Tesla can log keystrokes on the victim’s machine.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: AppleSeed can use "GetKeyState" and "GetKeyboardState" to capture keystrokes on the victim’s machine.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: Astaroth logs keystrokes from the victim's machine.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: BlackEnergy has run a keylogger plug-in on a victim.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: Catchamas collects keystrokes from the victim’s machine.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: FIN4 has captured credentials via fake Outlook Web App (OWA) login pages and has also used a .NET based keylogger.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: Grandoreiro can log keystrokes on the victim's machine.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: HTTPBrowser is capable of capturing keystrokes on victims.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: KeyBoy installs a keylogger for intercepting credentials and keystrokes.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: Matryoshka is capable of keylogging.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: Metamorfo has a command to launch a keylogger and capture keystrokes on the victim’s machine.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: NavRAT logs the keystrokes on the targeted system.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: Okrum was seen using a keylogger tool to capture keystrokes.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: Peppy can log keystrokes on compromised hosts.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: Prikormka contains a keylogger module that collects keystrokes and the titles of foreground windows.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: QakBot can capture keystrokes on a compromised host.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: Remexi gathers and exfiltrates keystrokes from the machine.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: SMOKEDHAM can continuously capture keystrokes.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: Sykipot contains keylogging functionality to steal passwords.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: The executable version of Helminth has a module to log keystrokes.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: Threat Group-3390 actors installed a credential logger on Microsoft Exchange servers. Threat Group-3390 also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: Tonto Team has used keylogging tools in their operations.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: XAgentOSX contains keylogging functionality that will monitor for active application windows and write them to the log, it can handle special characters, and it will buffer by default 50 characters before sending them out over the C2 infrastructure.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: jRAT has the capability to log keystrokes from the victim’s machine, both offline and online.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: menuPass has used key loggers to steal usernames and passwords.
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: Dok prompts the user for credentials.
MITRE ATT&CK techniques:
- T1056.002: Input Capture - GUI Input Capture
Threat description: Metamorfo has displayed fake forms on top of banking sites to intercept credentials from victims.
MITRE ATT&CK techniques:
- T1056.002: Input Capture - GUI Input Capture
Threat description: XCSSET prompts the user to input credentials using a native macOS dialog box leveraging the system process "/Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment".
MITRE ATT&CK techniques:
- T1056.002: Input Capture - GUI Input Capture
Threat description: TrickBot has the ability to capture RDP credentials by capturing the "CredEnumerateA" API
MITRE ATT&CK techniques:
- T1056.004: Input Capture - Credential API Hooking
Threat description: Zebrocy installs an application-defined Windows hook to get notified when a network drive has been attached, so it can then use the hook to call its RecordToFile file stealing method.
MITRE ATT&CK techniques:
- T1056.004: Input Capture - Credential API Hooking
Threat description: Kwampirs collects a list of running services with the command "tasklist /v".
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: TeamTNT has searched for rival malware and removes it if found. TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: APT19 downloaded and launched code within a SCT file.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: APT28 uses cmd.exe to execute commands and custom backdoors.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: APT32 has used COM scriptlets to download Cobalt Strike beacons.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: APT37 has used Ruby scripts to execute payloads.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter