sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
Gamaredon Group has used `mshta.exe` to execute malicious HTA files.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
Inception has used malicious HTA files to drop and execute malware.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
Kimsuky has used mshta.exe to run malicious scripts on the system.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
Lazarus Group has used `mshta.exe` to execute HTML pages downloaded by initial access documents.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
LazyScripter has used `mshta.exe` to execute Koadic stagers.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
MuddyWater has used mshta.exe to execute its POWERSTATS payload and to pass a PowerShell one-liner for execution.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
Mustang Panda has used mshta.exe to launch collection scripts.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
SideCopy has utilized `mshta.exe` to execute a malicious hta file.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
Sidewinder has used `mshta.exe` to execute malicious payloads.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
TA2541 has used `mshta` to execute scripts including VBS.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
TA551 has used mshta.exe to execute malicious payloads.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
BabyShark has used mshta.exe to download and execute applications from a remote server.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
Koadic can use mshta to serve additional payloads and to help schedule tasks for persistence.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
Metamorfo has used mshta.exe to execute a HTA payload.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
NanHaiShu uses mshta.exe to load its program and files.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
POWERSTATS can use Mshta.exe to execute additional payloads on compromised hosts.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
Pteranodon can use mshta.exe to execute an HTA file hosted on a remote server.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
Revenge RAT uses mshta.exe to run malicious scripts on the system.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
Sibot has been executed via MSHTA application.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
Xbash can use mshta for executing scripts.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
Machete has used msiexec to install the Machete malware.
Technique: T1218.007 System Binary Proxy Execution: Msiexec, Tactic: TA0005 Defense Evasion
Molerats has used msiexec.exe to execute an MSI payload.
Technique: T1218.007 System Binary Proxy Execution: Msiexec, Tactic: TA0005 Defense Evasion
Rancor has used `msiexec` to download and execute malicious installer files over HTTP.
Technique: T1218.007 System Binary Proxy Execution: Msiexec, Tactic: TA0005 Defense Evasion
TA505 has used `msiexec` to download and execute malicious Windows Installer files.
Technique: T1218.007 System Binary Proxy Execution: Msiexec, Tactic: TA0005 Defense Evasion
ZIRCONIUM has used the msiexec.exe command-line utility to download and execute malicious MSI files.
Technique: T1218.007 System Binary Proxy Execution: Msiexec, Tactic: TA0005 Defense Evasion
AppleJeus has been installed via MSI installer.
Technique: T1218.007 System Binary Proxy Execution: Msiexec, Tactic: TA0005 Defense Evasion
Chaes has used .MSI files as an initial way to start the infection chain.
Technique: T1218.007 System Binary Proxy Execution: Msiexec, Tactic: TA0005 Defense Evasion
Clop can use msiexec.exe to disable security tools on the system.
Technique: T1218.007 System Binary Proxy Execution: Msiexec, Tactic: TA0005 Defense Evasion
DEADEYE can use `msiexec.exe` for execution of malicious DLL.
Technique: T1218.007 System Binary Proxy Execution: Msiexec, Tactic: TA0005 Defense Evasion
Duqu has used `msiexec` to execute malicious Windows Installer packages. Additionally, a PROPERTY=VALUE pair containing a 56-bit encryption key has been used to decrypt the main payload from the installer packages.
Technique: T1218.007 System Binary Proxy Execution: Msiexec, Tactic: TA0005 Defense Evasion
FlawedAmmyy has been installed via `msiexec.exe`.
Technique: T1218.007 System Binary Proxy Execution: Msiexec, Tactic: TA0005 Defense Evasion
Grandoreiro can use MSI files to execute DLLs.
Technique: T1218.007 System Binary Proxy Execution: Msiexec, Tactic: TA0005 Defense Evasion
IcedID can inject itself into a suspended msiexec.exe process to send beacons to C2 while appearing as a normal msi application.
Technique: T1218.007 System Binary Proxy Execution: Msiexec, Tactic: TA0005 Defense Evasion
Javali has used the MSI installer to download and execute malicious payloads.
Technique: T1218.007 System Binary Proxy Execution: Msiexec, Tactic: TA0005 Defense Evasion
LoudMiner used an MSI installer to install the virtualization software.
Technique: T1218.007 System Binary Proxy Execution: Msiexec, Tactic: TA0005 Defense Evasion
Maze has delivered components for its ransomware attacks using MSI files, some of which have been executed from the command-line using `msiexec`.
Technique: T1218.007 System Binary Proxy Execution: Msiexec, Tactic: TA0005 Defense Evasion
Melcoz can use MSI files with embedded VBScript for execution.
Technique: T1218.007 System Binary Proxy Execution: Msiexec, Tactic: TA0005 Defense Evasion
Metamorfo has used MsiExec.exe to automatically execute files.
Technique: T1218.007 System Binary Proxy Execution: Msiexec, Tactic: TA0005 Defense Evasion
Mispadu has been installed via MSI installer.
Technique: T1218.007 System Binary Proxy Execution: Msiexec, Tactic: TA0005 Defense Evasion
QakBot can use MSIExec to spawn multiple cmd.exe processes.
Technique: T1218.007 System Binary Proxy Execution: Msiexec, Tactic: TA0005 Defense Evasion
RCSession has the ability to execute inside the msiexec.exe process.
Technique: T1218.007 System Binary Proxy Execution: Msiexec, Tactic: TA0005 Defense Evasion
Ragnar Locker has been delivered as an unsigned MSI package that was executed with `msiexec.exe`.
Technique: T1218.007 System Binary Proxy Execution: Msiexec, Tactic: TA0005 Defense Evasion
RemoteUtilities can use Msiexec to install a service.
Technique: T1218.007 System Binary Proxy Execution: Msiexec, Tactic: TA0005 Defense Evasion
Cobalt Group has used `odbcconf` to proxy the execution of malicious DLL files.
Technique: T1218.008 System Binary Proxy Execution: Odbcconf, Tactic: TA0005 Defense Evasion
Bumblebee can use `odbcconf.exe` to run DLLs on targeted hosts.
Technique: T1218.008 System Binary Proxy Execution: Odbcconf, Tactic: TA0005 Defense Evasion
Agent Tesla has dropped RegAsm.exe onto systems for performing malicious activity.
Technique: T1218.009 System Binary Proxy Execution: Regsvcs/Regasm, Tactic: TA0005 Defense Evasion
During C0015, the threat actors employed code that used `regsvr32` for execution.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
During Operation Dream Job, Lazarus Group used `regsvr32` to execute malware.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
APT19 used Regsvr32 to bypass application control techniques.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory. The group has also used regsvr32 to run their backdoor.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using regsvr32.exe.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
Cobalt Group has used regsvr32.exe to execute scripts.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
Deep Panda has used regsvr32.exe to execute a server variant of Derusbi in victim networks.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
Inception has ensured persistence at system boot by setting the value `regsvr32 %path%\ctfmonrn.dll /s`.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
Kimsuky has executed malware with `regsvr32s`.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
Leviathan has used regsvr32 for execution.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
TA551 has used regsvr32.exe to load malicious DLLs.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
WIRTE has used `regsvr32.exe` to trigger the execution of a malicious script.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
AppleSeed can call regsvr32.exe for execution.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
Astaroth can be loaded through regsvr32.exe.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
Derusbi variants have been seen that use Registry persistence to proxy execution through regsvr32.exe.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
Dridex can use `regsvr32.exe` to initiate malicious code.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
EVILNUM can run a remote scriptlet that drops a file and executes it via regsvr32.exe.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
Egregor has used regsvr32.exe to execute malicious DLLs.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
HermeticWizard has used `regsvr32.exe /s /i` to execute malicious payloads.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
Hi-Zor executes using regsvr32.exe called from the Registry Run Keys / Startup Folder persistence mechanism.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
Koadic can use Regsvr32 to execute additional payloads.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
More_eggs has used regsvr32.exe to execute the malicious DLL.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
Mori can use `regsvr32.exe` for DLL execution.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
Some Orz versions have an embedded DLL known as MockDll that uses Process Hollowing and regsvr32 to execute another payload.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
QakBot can use Regsvr32 to execute malicious DLLs.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
Ragnar Locker has used regsvr32.exe to execute components of VirtualBox.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
RogueRobin uses regsvr32.exe to run a .sct file for execution.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
Saint Bot has used `regsvr32` to execute scripts.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
Squirrelwaffle has been executed using `regsvr32.exe`.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
Valak has used `regsvr32.exe` to launch malicious DLLs.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
Xbash can use regsvr32 for executing scripts.
Technique: T1218.010 System Binary Proxy Execution: Regsvr32, Tactic: TA0005 Defense Evasion
During the 2015 Ukraine Electric Power Attack, Sandworm Team used a backdoor which could execute a supplied DLL using `rundll32.exe`.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
During C0015, the threat actors loaded DLLs via `rundll32` using the `svchost` process.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
During C0018, the threat actors used `rundll32` to run Mimikatz.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
During C0021, the threat actors used `rundll32.exe` to execute the Cobalt Strike Beacon loader DLL.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
During Operation Dream Job, Lazarus Group executed malware with `C:\\windows\system32\rundll32.exe "C:\ProgramData\ThumbNail\thumbnail.db"`, `CtrlPanel S-6-81-3811-75432205-060098-6872 0 0 905`.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
During Operation Spalax, the threat actors used `rundll32.exe` to execute malicious installers.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
During the SolarWinds Compromise, APT29 used `Rundll32.exe` to execute payloads.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
APT19 configured its payload to inject into the rundll32.exe.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
APT28 executed CHOPSTICK by using rundll32 commands such as `rundll32.exe “C:\Windows\twain_64.dll”`. APT28 also executed a .dll for a first stage dropper using rundll32.exe. An APT28 loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
APT3 has a tool that can run DLLs.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
APT32 malware has used rundll32.exe to execute an initial infection process.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
APT38 has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
APT41 has used rundll32.exe to execute a loader.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using rundll32.exe.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Carbanak installs VNC server software that executes through rundll32.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
CopyKittens uses rundll32 to load various tools on victims, including a lateral movement tool named Vminst, Cobalt Strike, and shellcode.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
FIN7 has used `rundll32.exe` to execute malware on a compromised network.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Gamaredon Group malware has used rundll32 to launch additional malicious components.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
HAFNIUM has used `rundll32` to load malicious DLLs.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Kimsuky has used `rundll32.exe` to execute malicious scripts and malware on a victim's network.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Lazarus Group has used rundll32 to execute malicious payloads on a compromised host.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
LazyScripter has used `rundll32.exe` to execute Koadic stagers.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Magic Hound has used rundll32.exe to execute MiniDump from comsvcs.dll when dumping LSASS memory.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
MuddyWater has used malware that leveraged rundll32.exe in a Registry Run key to execute a .dll.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Sandworm Team used a backdoor which could execute a supplied DLL using rundll32.exe.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
TA505 has leveraged `rundll32.exe` to execute malicious DLLs.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
TA551 has used rundll32.exe to load malicious DLLs.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Wizard Spider has utilized `rundll32.exe` to deploy ransomware commands with the use of WebDAV.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
ADVSTORESHELL has used rundll32.exe in a Registry value to establish persistence.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Attor's installer plugin can schedule rundll32.exe to load the dispatcher.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
BLINDINGCAN has used Rundll32 to load a malicious DLL.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Backdoor.Oldrea can use rundll32 for execution on compromised hosts.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Bad Rabbit has used rundll32 to launch a malicious DLL as `C:Windowsinfpub.dat`.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Bisonal has used rundll32.exe to execute as part of the Registry Run key it adds: `HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Run\”vert” = “rundll32.exe c:\windows\temp\pvcu.dll , Qszdez”`.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
BoomBox can use RunDLL32 for execution.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Briba uses rundll32 within Registry Run Keys / Startup Folder entries to execute malicious DLLs.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Bumblebee has used `rundll32` for execution of the loader component.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
CORESHELL is installed via execution of rundll32 with an export named "init" or "InitW."
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Cobalt Strike can use `rundll32.exe` to load DLL from the command line.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Comnie uses Rundll32 to load a malicious DLL.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
The CozyCar dropper copies the system file rundll32.exe to the install location for the malware, then uses the copy of rundll32.exe to load and execute the main CozyCar component.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
DDKONG uses Rundll32 to ensure only a single instance of itself is running at once.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
DEADEYE can use `rundll32.exe` for execution of living off the land binaries (lolbin) such as `SHELL32.DLL`.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
EVILNUM can execute commands and scripts through rundll32.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Egregor has used rundll32 during execution.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
After copying itself to a DLL file, a variant of Elise calls the DLL file using rundll32.exe.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Variants of Emissary have used rundll32.exe in Registry values added to establish persistence.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
EnvyScout has the ability to proxy execution of malicious files with Rundll32.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
FELIXROOT uses Rundll32 for executing the dropper program.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
FatDuke can execute via rundll32.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Rundll32.exe is used as a way of executing Flame at the command-line.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
FlawedAmmyy has used `rundll32` for execution.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
FunnyDream can use `rundll32` for execution of its components.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
GreyEnergy uses PsExec locally in order to execute rundll32.exe at the highest privileges (NTAUTHORITY\SYSTEM).
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
HermeticWizard has the ability to create a new process using `rundll32`.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Heyoka Backdoor can use rundll32.exe to gain execution.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
InvisiMole has used rundll32.exe for execution.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
JHUHUGIT is executed using rundll32.exe.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
KONNI has used Rundll32 to execute its loader for privilege escalation purposes.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Koadic can use Rundll32 to execute additional payloads.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Kwampirs uses rundll32.exe in a Registry value added to establish persistence.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Matryoshka uses rundll32.exe in a Registry Run key value for execution as part of its persistence mechanism.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
MegaCortex has used `rundll32.exe` to load a DLL for file encryption.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Mispadu uses RunDLL32 for execution via its injector DLL.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Mongall can use `rundll32.exe` for execution.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Mosquito's launcher uses rundll32.exe in a Registry Key value to start the main backdoor capability.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
NOKKI has used rundll32 for execution.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
NativeZone has used rundll32 to execute a malicious DLL.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Ninja loader components can be executed through rundll32.exe.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
NotPetya uses `rundll32.exe` to install itself on remote systems when accessed via PsExec or `wmic`.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
PUNCHBUGGY can load a DLL using Rundll32.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
PcShare has used `rundll32.exe` for execution.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
PolyglotDuke can be executed using rundll32.exe.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
PowerDuke uses rundll32.exe to load.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Prikormka uses rundll32.exe to load its DLL.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Pteranodon executes functions using rundll32.exe.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
QakBot has used Rundll32.exe to drop malicious DLLs including Brute Ratel C4 and to enable C2 communication.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
RTM runs its core DLL file using rundll32.exe.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Ragnar Locker has used rundll32.exe to execute components of VirtualBox.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
SDBbot has used rundll32.exe to execute DLLs.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
SUNBURST used Rundll32 to execute payloads.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
SVCReady has used `rundll32.exe` for execution.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Sakula calls cmd.exe to run various DLL files via rundll32.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
ServHelper contains a module for downloading and executing DLLs that leverages `rundll32.exe`.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Sibot has executed downloaded DLLs with `rundll32.exe`.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Squirrelwaffle has been executed using `rundll32.exe`.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
StreamEx uses rundll32 to call an exported function.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
USBferry can execute rundll32.exe in memory to avoid detection.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
The Winnti for Windows installer loads a DLL using rundll32.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
ZxShell has used rundll32.exe to execute other DLLs and named pipes.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
A gh0st RAT variant has used rundll32 for execution.
Technique: T1218.011 System Binary Proxy Execution: Rundll32, Tactic: TA0005 Defense Evasion
Hancitor has used verclsid.exe to download and execute a malicious script.
Technique: T1218.012 System Binary Proxy Execution: Verclsid, Tactic: TA0005 Defense Evasion
During C0015, the threat actors installed the AnyDesk remote desktop application onto the compromised network.
Technique: T1219 Remote Access Software, Tactic: TA0011 Command and Control
During C0018, the threat actors used AnyDesk to transfer tools between systems.
Technique: T1219 Remote Access Software, Tactic: TA0011 Command and Control
During C0027, Scattered Spider directed victims to run remote monitoring and management (RMM) tools.
Technique: T1219 Remote Access Software, Tactic: TA0011 Command and Control
During Night Dragon, threat actors used several remote administration tools as persistent infiltration channels.
Technique: T1219 Remote Access Software, Tactic: TA0011 Command and Control
Akira uses legitimate utilities such as AnyDesk and PuTTy for maintaining remote access to victim environments.
Technique: T1219 Remote Access Software, Tactic: TA0011 Command and Control
Carbanak used legitimate programs such as AmmyyAdmin and Team Viewer for remote interactive C2 to target systems.
Technique: T1219 Remote Access Software, Tactic: TA0011 Command and Control
Cobalt Group used the Ammyy Admin tool as well as TeamViewer for remote access, including to preserve remote access if a Cobalt Strike module was lost.
Technique: T1219 Remote Access Software, Tactic: TA0011 Command and Control
DarkVishnya used DameWare Mini Remote Control for lateral movement.
Technique: T1219 Remote Access Software, Tactic: TA0011 Command and Control
EVILNUM has used the malware variant, TerraTV, to run a legitimate TeamViewer application to connect to compromrised machines.
Technique: T1219 Remote Access Software, Tactic: TA0011 Command and Control
FIN7 has utilized the remote management tool Atera to download malware to a compromised system.
Technique: T1219 Remote Access Software, Tactic: TA0011 Command and Control
GOLD SOUTHFIELD has used the cloud-based remote management and monitoring tool "ConnectWise Control" to deploy REvil.
Technique: T1219 Remote Access Software, Tactic: TA0011 Command and Control
Kimsuky has used a modified TeamViewer client as a command and control channel.
Technique: T1219 Remote Access Software, Tactic: TA0011 Command and Control
MuddyWater has used legitimate applications ScreenConnect and AteraAgent to manage systems remotely and move laterally.
Technique: T1219 Remote Access Software, Tactic: TA0011 Command and Control
Mustang Panda has installed TeamViewer on targeted systems.
Technique: T1219 Remote Access Software, Tactic: TA0011 Command and Control
RTM has used a modified version of TeamViewer and Remote Utilities for remote access.
Technique: T1219 Remote Access Software, Tactic: TA0011 Command and Control
Sandworm Team has used remote administration tools or remote industrial control system client software for execution and to maliciously release electricity breakers.
Technique: T1219 Remote Access Software, Tactic: TA0011 Command and Control
During C0027, Scattered Spider directed victims to run remote monitoring and management (RMM) tools.

In addition to directing victims to run remote software, Scattered Spider members themselves also deploy RMM software including AnyDesk, LogMeIn, and ConnectWise Control to establish persistence on the compromised network.
Technique: T1219 Remote Access Software, Tactic: TA0011 Command and Control
TeamTNT has established tmate sessions for C2 communications.
Technique: T1219 Remote Access Software, Tactic: TA0011 Command and Control
Thrip used a cloud-based remote access software called LogMeIn for their attacks.
Technique: T1219 Remote Access Software, Tactic: TA0011 Command and Control
Carbanak has a plugin for VNC and Ammyy Admin Tool.
Technique: T1219 Remote Access Software, Tactic: TA0011 Command and Control
Dridex contains a module for VNC.
Technique: T1219 Remote Access Software, Tactic: TA0011 Command and Control
Egregor has checked for the LogMein event log in an attempt to encrypt files in remote machines.
Technique: T1219 Remote Access Software, Tactic: TA0011 Command and Control
Hildegard has established tmate sessions for C2 communications.
Technique: T1219 Remote Access Software, Tactic: TA0011 Command and Control
RTM has the capability to download a VNC module from command and control (C2).
Technique: T1219 Remote Access Software, Tactic: TA0011 Command and Control
TrickBot uses vncDll module to remote control the victim machine.
Technique: T1219 Remote Access Software, Tactic: TA0011 Command and Control
During Operation Dream Job, Lazarus Group used a remote XSL script to download a Base64-encoded DLL custom downloader.
Technique: T1220 XSL Script Processing, Tactic: TA0005 Defense Evasion
Cobalt Group used msxsl.exe to bypass AppLocker and to invoke Jscript code from an XSL file.
Technique: T1220 XSL Script Processing, Tactic: TA0005 Defense Evasion
Higaisa used an XSL file to run VBScript code.
Technique: T1220 XSL Script Processing, Tactic: TA0005 Defense Evasion
Astaroth executes embedded JScript or VBScript in an XSL stylesheet located on a remote domain.
Technique: T1220 XSL Script Processing, Tactic: TA0005 Defense Evasion
During Frankenstein, the threat actors used trojanized documents that retrieved remote templates from an adversary-controlled website.
Technique: T1221 Template Injection, Tactic: TA0005 Defense Evasion
During Operation Dream Job, Lazarus Group used DOCX files to retrieve a malicious document template/DOTM file.
Technique: T1221 Template Injection, Tactic: TA0005 Defense Evasion
APT28 used weaponized Microsoft Word documents abusing the remote template function to retrieve a malicious macro.
Technique: T1221 Template Injection, Tactic: TA0005 Defense Evasion
Confucius has used a weaponized Microsoft Word document with an embedded RTF exploit.
Technique: T1221 Template Injection, Tactic: TA0005 Defense Evasion
DarkHydrus used an open-source tool, Phishery, to inject malicious remote template URLs into Microsoft Word documents and then sent them to victims to enable Forced Authentication.
Technique: T1221 Template Injection, Tactic: TA0005 Defense Evasion
Dragonfly has injected SMB URLs into malicious Word spearphishing attachments to initiate Forced Authentication.
Technique: T1221 Template Injection, Tactic: TA0005 Defense Evasion
Gamaredon Group has used DOCX files to download malicious DOT document templates and has used RTF template injection to download malicious payloads. Gamaredon Group can also inject malicious macros or remote templates into documents already present on compromised systems.
Technique: T1221 Template Injection, Tactic: TA0005 Defense Evasion
Inception has used decoy documents to load malicious remote payloads via HTTP.
Technique: T1221 Template Injection, Tactic: TA0005 Defense Evasion
Tropic Trooper delivered malicious documents with the XLSX extension, typically used by OpenXML documents, but the file itself was actually an OLE (XLS) document.
Technique: T1221 Template Injection, Tactic: TA0005 Defense Evasion
Chaes changed the template target of the settings.xml file embedded in the Word document and populated that field with the downloaded URL of the next payload.
Technique: T1221 Template Injection, Tactic: TA0005 Defense Evasion
WarzoneRAT has been install via template injection through a malicious DLL embedded within a template RTF in a Word document.
Technique: T1221 Template Injection, Tactic: TA0005 Defense Evasion
Wizard Spider has used the icacls command to modify access control to backup servers, providing them with full control of all the system folders.
Technique: T1222.001 File and Directory Permissions Modification: Windows File and Directory Permissions Modification, Tactic: TA0005 Defense Evasion
BitPaymer can use `icacls /reset` and `takeown /F` to reset a targeted executable's permissions and then take ownership.
Technique: T1222.001 File and Directory Permissions Modification: Windows File and Directory Permissions Modification, Tactic: TA0005 Defense Evasion
BlackCat can use Windows commands such as `fsutil behavior set SymLinkEvaluation R2L:1` to redirect file system access to a different location after gaining access into compromised networks.
Technique: T1222.001 File and Directory Permissions Modification: Windows File and Directory Permissions Modification, Tactic: TA0005 Defense Evasion
CaddyWiper can modify ACL entries to take ownership of files.
Technique: T1222.001 File and Directory Permissions Modification: Windows File and Directory Permissions Modification, Tactic: TA0005 Defense Evasion
Grandoreiro can modify the binary ACL to prevent security tools from running.
Technique: T1222.001 File and Directory Permissions Modification: Windows File and Directory Permissions Modification, Tactic: TA0005 Defense Evasion
JPIN can use the command-line utility cacls.exe to change file permissions.
Technique: T1222.001 File and Directory Permissions Modification: Windows File and Directory Permissions Modification, Tactic: TA0005 Defense Evasion
Ryuk can launch `icacls <path> /grant Everyone:F /T /C /Q` to delete every access-based restrictions on files and directories.
Technique: T1222.001 File and Directory Permissions Modification: Windows File and Directory Permissions Modification, Tactic: TA0005 Defense Evasion
WannaCry uses `attrib +h` and `icacls . /grant Everyone:F /T /C /Q` to make some of its files hidden and grant all users full access controls.
Technique: T1222.001 File and Directory Permissions Modification: Windows File and Directory Permissions Modification, Tactic: TA0005 Defense Evasion
WastedLocker has a command to take ownership of a file and reset the ACL permissions using the `takeown.exe /F filepath` command.
Technique: T1222.001 File and Directory Permissions Modification: Windows File and Directory Permissions Modification, Tactic: TA0005 Defense Evasion
APT32's macOS backdoor changes the permission of the file it wants to execute to 755.
Technique: T1222.002 File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification, Tactic: TA0005 Defense Evasion
Rocke has changed file permissions of files so they could not be modified.
Technique: T1222.002 File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification, Tactic: TA0005 Defense Evasion
TeamTNT has modified the permissions on binaries with `chattr`.
Technique: T1222.002 File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification, Tactic: TA0005 Defense Evasion
The Black Basta binary can use `chmod` to gain full permissions to targeted files.
Technique: T1222.002 File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification, Tactic: TA0005 Defense Evasion
Bundlore changes the permissions of a payload using the command `chmod -R 755`.
Technique: T1222.002 File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification, Tactic: TA0005 Defense Evasion
COATHANGER will set the GID of `httpsd` to 90 when infected.
Technique: T1222.002 File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification, Tactic: TA0005 Defense Evasion
Dok gives all users execute permissions for the application using the command `chmod +x /Users/Shared/AppStore.app`.
Technique: T1222.002 File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification, Tactic: TA0005 Defense Evasion
Kinsing has used chmod to modify permissions on key files for use.
Technique: T1222.002 File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification, Tactic: TA0005 Defense Evasion
OSX/Shlayer can use the `chmod` utility to set a file as executable, such as `chmod 777` or `chmod +x`.
Technique: T1222.002 File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification, Tactic: TA0005 Defense Evasion
OSX_OCEANLOTUS.D has changed permissions of a second-stage payload to an executable via `chmod`.
Technique: T1222.002 File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification, Tactic: TA0005 Defense Evasion
P.A.S. Webshell has the ability to modify file permissions.
Technique: T1222.002 File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification, Tactic: TA0005 Defense Evasion
Penquin can add the executable flag to a downloaded file.
Technique: T1222.002 File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification, Tactic: TA0005 Defense Evasion
XCSSET uses the `chmod +x` command to grant executable permissions to the malicious file.
Technique: T1222.002 File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification, Tactic: TA0005 Defense Evasion
Anchor can terminate itself if specific execution flags are not present.
Technique: T1480 Execution Guardrails, Tactic: TA0005 Defense Evasion
BitPaymer compares file names and paths to a list of excluded names and directory names during encryption.
Technique: T1480 Execution Guardrails, Tactic: TA0005 Defense Evasion
BoomBox can check its current working directory and for the presence of a specific file and terminate if specific values are not found.
Technique: T1480 Execution Guardrails, Tactic: TA0005 Defense Evasion
DEADEYE can ensure it executes only on intended systems by identifying the victim's volume serial number, hostname, and/or DNS domain.
Technique: T1480 Execution Guardrails, Tactic: TA0005 Defense Evasion
DarkGate uses per-victim links for hosting malicious archives, such as ZIP files, in services such as SharePoint to prevent other entities from retrieving them.
Technique: T1480 Execution Guardrails, Tactic: TA0005 Defense Evasion
EnvyScout can call `window.location.pathname` to ensure that embedded files are being executed from the C: drive, and will terminate if they are not.
Technique: T1480 Execution Guardrails, Tactic: TA0005 Defense Evasion
NativeZone can check for the presence of KM.EkeyAlmaz1C.dll and will halt execution unless it is in the same directory as the rest of the malware's components.
Technique: T1480 Execution Guardrails, Tactic: TA0005 Defense Evasion
SUNSPOT only replaces SolarWinds Orion source code if the MD5 checksums of both the original source code file and backdoored replacement source code match hardcoded values.
Technique: T1480 Execution Guardrails, Tactic: TA0005 Defense Evasion
Small Sieve can only execute correctly if the word `Platypus` is passed to it on the command line.
Technique: T1480 Execution Guardrails, Tactic: TA0005 Defense Evasion
Stuxnet checks for specific operating systems on 32-bit machines, Registry keys, and dates for vulnerabilities, and will exit execution if the values are not met.
Technique: T1480 Execution Guardrails, Tactic: TA0005 Defense Evasion
Torisma is only delivered to a compromised host if the victim's IP address is on an allow-list.
Technique: T1480 Execution Guardrails, Tactic: TA0005 Defense Evasion
VaporRage has the ability to check for the presence of a specific DLL and terminate if it is not found.
Technique: T1480 Execution Guardrails, Tactic: TA0005 Defense Evasion
APT41 has encrypted payloads using the Data Protection API (DPAPI), which relies on keys tied to specific user accounts on specific machines. APT41 has also environmentally keyed second stage malware with an RC5 key derived in part from the infected system's volume serial number.
Technique: T1480.001 Execution Guardrails: Environmental Keying, Tactic: TA0005 Defense Evasion
Equation has been observed utilizing environmental keying in payload delivery.
Technique: T1480.001 Execution Guardrails: Environmental Keying, Tactic: TA0005 Defense Evasion
InvisiMole can use Data Protection API to encrypt its components on the victim’s computer, to evade detection, and to make sure the payload can only be decrypted and loaded on one specific compromised computer.
Technique: T1480.001 Execution Guardrails: Environmental Keying, Tactic: TA0005 Defense Evasion
Ninja can store its final payload in the Registry under `$HKLM\SOFTWARE\Classes\Interface\` encrypted with a dynamically generated key based on the drive’s serial number.
Technique: T1480.001 Execution Guardrails: Environmental Keying, Tactic: TA0005 Defense Evasion
PowerPunch can use the volume serial number from a target host to generate a unique XOR key for the next stage payload.
Technique: T1480.001 Execution Guardrails: Environmental Keying, Tactic: TA0005 Defense Evasion
ROKRAT relies on a specific victim hostname to execute and decrypt important strings.
Technique: T1480.001 Execution Guardrails: Environmental Keying, Tactic: TA0005 Defense Evasion
The Winnti for Windows dropper component can verify the existence of a single command line parameter and either terminate if it is not found or later use it as a decryption key.
Technique: T1480.001 Execution Guardrails: Environmental Keying, Tactic: TA0005 Defense Evasion
During C0015, the threat actors used the command `nltest /domain_trusts /all_trusts` to enumerate domain trusts.
Technique: T1482 Domain Trust Discovery, Tactic: TA0007 Discovery
During the SolarWinds Compromise, APT29 used the `Get-AcceptedDomain` PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell. They also used AdFind to enumerate domains and to discover trust between federated domains.
Technique: T1482 Domain Trust Discovery, Tactic: TA0007 Discovery
Akira uses the built-in Nltest utility or tools such as AdFind to enumerate Active Directory trusts in victim environments.
Technique: T1482 Domain Trust Discovery, Tactic: TA0007 Discovery
Chimera has `nltest /domain_trusts` to identify domain trust relationships.
Technique: T1482 Domain Trust Discovery, Tactic: TA0007 Discovery
Earth Lusca has used Nltest to obtain information about domain controllers.
Technique: T1482 Domain Trust Discovery, Tactic: TA0007 Discovery
FIN8 has retrieved a list of trusted domains by using `nltest.exe /domain_trusts`.
Technique: T1482 Domain Trust Discovery, Tactic: TA0007 Discovery
Magic Hound has used a web shell to execute `nltest /trusted_domains` to identify trust relationships.
Technique: T1482 Domain Trust Discovery, Tactic: TA0007 Discovery
AdFind can gather information about organizational units (OUs) and domain trusts from Active Directory.
Technique: T1482 Domain Trust Discovery, Tactic: TA0007 Discovery
BADHATCH can use `nltest.exe /domain_trusts` to discover domain trust relationships on a compromised machine.
Technique: T1482 Domain Trust Discovery, Tactic: TA0007 Discovery
Bazar can use Nltest tools to obtain information about the domain.
Technique: T1482 Domain Trust Discovery, Tactic: TA0007 Discovery
BloodHound has the ability to map domain trusts and identify misconfigurations for potential abuse.
Technique: T1482 Domain Trust Discovery, Tactic: TA0007 Discovery
Brute Ratel C4 can use LDAP queries and `nltest /domain_trusts` for domain trust discovery.
Technique: T1482 Domain Trust Discovery, Tactic: TA0007 Discovery
Empire has modules for enumerating domain trusts.
Technique: T1482 Domain Trust Discovery, Tactic: TA0007 Discovery
Nltest may be used to enumerate trusted domains by using commands such as `nltest /domain_trusts`.
Technique: T1482 Domain Trust Discovery, Tactic: TA0007 Discovery
PoshC2 has modules for enumerating domain trusts.
Technique: T1482 Domain Trust Discovery, Tactic: TA0007 Discovery
PowerSploit has modules such as `Get-NetDomainTrust` and `Get-NetForestTrust` to enumerate domain and forest trusts.
Technique: T1482 Domain Trust Discovery, Tactic: TA0007 Discovery
QakBot can run `nltest /domain_trusts /all_trusts` for domain trust discovery.
Technique: T1482 Domain Trust Discovery, Tactic: TA0007 Discovery
Rubeus can gather information about domain trusts.
Technique: T1482 Domain Trust Discovery, Tactic: TA0007 Discovery
SocGholish can profile compromised systems to identify domain trust relationships.
Technique: T1482 Domain Trust Discovery, Tactic: TA0007 Discovery
TrickBot can gather information about domain trusts by utilizing Nltest.
Technique: T1482 Domain Trust Discovery, Tactic: TA0007 Discovery