sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
dsquery can be used to gather information on domain trusts with `dsquery * -filter "(objectClass=trustedDomain)" -attr *`.
Technique: T1482 Domain Trust Discovery, Tactic: TA0007 Discovery
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Group Policy Objects (GPOs) to deploy and execute malware.
Technique: T1484.001 Domain or Tenant Policy Modification: Group Policy Modification, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Cinnamon Tempest has used Group Policy to deploy batch scripts for ransomware deployment.
Technique: T1484.001 Domain or Tenant Policy Modification: Group Policy Modification, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Indrik Spider has used Group Policy Objects to deploy batch scripts.
Technique: T1484.001 Domain or Tenant Policy Modification: Group Policy Modification, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Egregor can modify the GPO to evade detection.
Technique: T1484.001 Domain or Tenant Policy Modification: Group Policy Modification, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Empire can use `New-GPOImmediateTask` to modify a GPO that will install and execute a malicious Scheduled Task/Job.
Technique: T1484.001 Domain or Tenant Policy Modification: Group Policy Modification, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
HermeticWiper has the ability to deploy through an infected system's default domain policy.
Technique: T1484.001 Domain or Tenant Policy Modification: Group Policy Modification, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Meteor can use group policy to push a scheduled task from the AD to all network machines.
Technique: T1484.001 Domain or Tenant Policy Modification: Group Policy Modification, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Prestige has been deployed using the Default Domain Group Policy Object from an Active Directory Domain Controller.
Technique: T1484.001 Domain or Tenant Policy Modification: Group Policy Modification, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
During the SolarWinds Compromise, APT29 changed domain federation trust settings using Azure AD administrative permissions to configure the domain to accept authorization tokens signed by their own SAML signing certificate.
Technique: T1484.002 Domain or Tenant Policy Modification: Trust Modification, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Scattered Spider adds a federated identity provider to the victim’s SSO tenant and activates automatic account linking.
Technique: T1484.002 Domain or Tenant Policy Modification: Trust Modification, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
AADInternals can create a backdoor by converting a domain to a federated domain which will be able to authenticate any user across the tenant. AADInternals can also modify DesktopSSO information.
Technique: T1484.002 Domain or Tenant Policy Modification: Trust Modification, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed CaddyWiper on the victim’s IT environment systems to wipe files related to the OT capabilities, along with mapped drives, and physical drive partitions.
Technique: T1485 Data Destruction, Tactic: TA0040 Impact
APT38 has used a custom secure delete function to make deleted files unrecoverable.
Technique: T1485 Data Destruction, Tactic: TA0040 Impact
Gamaredon Group has used tools to delete files and folders from victims' desktops and profiles.
Technique: T1485 Data Destruction, Tactic: TA0040 Impact
LAPSUS$ has deleted the target's systems and resources both on-premises and in the cloud.
Technique: T1485 Data Destruction, Tactic: TA0040 Impact
Lazarus Group has used a custom secure delete function to overwrite file contents with data from heap memory.
Technique: T1485 Data Destruction, Tactic: TA0040 Impact
Sandworm Team has used the BlackEnergy KillDisk component to overwrite files on Windows-based Human-Machine Interfaces.
Technique: T1485 Data Destruction, Tactic: TA0040 Impact
AcidRain performs an in-depth wipe of the target filesystem and various attached storage devices through either a data overwrite or calling various IOCTLS to erase it.
Technique: T1485 Data Destruction, Tactic: TA0040 Impact
BlackEnergy 2 contains a "Destroy" plug-in that destroys data stored on victim hard drives by overwriting file contents.
Technique: T1485 Data Destruction, Tactic: TA0040 Impact
CaddyWiper can work alphabetically through drives on a compromised system to take ownership of and overwrite all files.
Technique: T1485 Data Destruction, Tactic: TA0040 Impact
Diavol can delete specified files from a targeted system.
Technique: T1485 Data Destruction, Tactic: TA0040 Impact
HermeticWiper can recursively wipe folders and files in `Windows`, `Program Files`, `Program Files(x86)`, `PerfLogs`, `Boot, System`, `Volume Information`, and `AppData` folders using `FSCTL_MOVE_FILE`. HermeticWiper can also overwrite symbolic links and big files in `My Documents` and on the Desktop with random bytes.
Technique: T1485 Data Destruction, Tactic: TA0040 Impact
Industroyer’s data wiper module clears registry keys and overwrites both ICS configuration and Windows files.
Technique: T1485 Data Destruction, Tactic: TA0040 Impact
Kazuar can overwrite files with random data before deleting them.
Technique: T1485 Data Destruction, Tactic: TA0040 Impact
KillDisk deletes system files to make the OS unbootable. KillDisk also targets and deletes files with 35 different file extensions.
Technique: T1485 Data Destruction, Tactic: TA0040 Impact
Meteor can fill a victim's files and directories with zero-bytes in replacement of real content before deleting them.
Technique: T1485 Data Destruction, Tactic: TA0040 Impact
Olympic Destroyer overwrites files locally and on remote shares.
Technique: T1485 Data Destruction, Tactic: TA0040 Impact
PowerDuke has a command to write random data across a file and delete it.
Technique: T1485 Data Destruction, Tactic: TA0040 Impact
Proxysvc can overwrite files indicated by the attacker before deleting them.
Technique: T1485 Data Destruction, Tactic: TA0040 Impact
REvil has the capability to destroy files and folders.
Technique: T1485 Data Destruction, Tactic: TA0040 Impact
RawDisk was used in Shamoon to write to protected system locations such as the MBR and disk partitions in an effort to destroy data.
Technique: T1485 Data Destruction, Tactic: TA0040 Impact
SDelete deletes data in a way that makes it unrecoverable.
Technique: T1485 Data Destruction, Tactic: TA0040 Impact
Shamoon attempts to overwrite operating system files and disk structures with image files. In a later variant, randomly generated data was used for data overwrites.
Technique: T1485 Data Destruction, Tactic: TA0040 Impact
StoneDrill has a disk wiper module that targets files other than those in the Windows directory.
Technique: T1485 Data Destruction, Tactic: TA0040 Impact
WhisperGate can corrupt files by overwriting the first 1 MB with `0xcc` and appending random extensions.
Technique: T1485 Data Destruction, Tactic: TA0040 Impact
Xbash has destroyed Linux-based databases as part of its ransomware capabilities.
Technique: T1485 Data Destruction, Tactic: TA0040 Impact
During C0015, the threat actors used Conti ransomware to encrypt a compromised network.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
During C0018, the threat actors used AvosLocker ransomware to encrypt files on the compromised network.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
APT38 has used Hermes ransomware to encrypt files with AES256.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
APT41 used a ransomware called Encryptor RaaS to encrypt files on the targeted systems and provide a ransom note to the user.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Akira encrypts files in victim environments as part of ransomware operations.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
FIN7 has encrypted virtual disk volumes on ESXi servers using a version of Darkside ransomware.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
FIN8 has deployed ransomware such as Ragnar Locker, White Rabbit, and attempted to execute Noberus on compromised networks.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Indrik Spider has encrypted domain-controlled systems using BitPaymer.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Magic Hound has used BitLocker and DiskCryptor to encrypt targeted workstations.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Sandworm Team has used Prestige ransomware to encrypt data at targeted organizations in transportation and related logistics industries in Ukraine and Poland.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Scattered Spider has used BlackCat ransomware to encrypt files on VMWare ESXi servers.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
TA505 has used a wide variety of ransomware, such as Clop, Locky, Jaff, Bart, Philadelphia, and GlobeImposter, to encrypt victim files and demand a ransom payment.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Akira encrypts victim filesystems for financial extortion purposes.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Avaddon encrypts the victim system using a combination of AES256 and RSA encryption schemes.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
AvosLocker has encrypted files and network resources using AES-256 and added an `.avos`, `.avos2`, or `.AvosLinux` extension to filenames.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Babuk can use ChaCha8 and ECDH to encrypt data.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Bad Rabbit has encrypted files and disks using AES-128-CBC and RSA-2048.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
BitPaymer can import a hard-coded RSA 1024-bit public key, generate a 128-bit RC4 key for each file, and encrypt the file in place, appending `.locked` to the filename.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Black Basta can encrypt files with the ChaCha20 cypher and using a multithreaded process to increase speed.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
BlackCat has the ability to encrypt Windows devices, Linux devices, and VMWare instances.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Cheerscrypt can encrypt data on victim machines using a Sosemanuk stream cipher with an Elliptic-curve Diffie–Hellman (ECDH) generated key.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Clop can encrypt files using AES, RSA, and RC4 and will add the ".clop" extension to encrypted files.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Conti can use `CreateIoCompletionPort()`, `PostQueuedCompletionStatus()`, and `GetQueuedCompletionPort()` to rapidly encrypt files, excluding those with the extensions of .exe, .dll, and .lnk. It has used a different AES-256 encryption key per file with a bundled RAS-4096 public encryption key that is unique for each victim. Conti can use “Windows Restart Manager” to ensure files are unlocked and open for encryption.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Cuba has the ability to encrypt system data and add the ".cuba" extension to encrypted files.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
DCSrv has encrypted drives using the core encryption mechanism from DiskCryptor.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
DEATHRANSOM can use public and private key pair encryption to encrypt files for ransom payment.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
DarkGate can deploy follow-on ransomware payloads.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Diavol has encrypted files using an RSA key though the `CryptEncrypt` API and has appended filenames with ".lock64".
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
EKANS uses standard encryption library functions to encrypt files.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Egregor can encrypt all non-system files using a hybrid AES-RSA algorithm prior to displaying a ransom note.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
FIVEHANDS can use an embedded NTRU public key to encrypt data for ransom.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
HELLOKITTY can use an embedded RSA-2048 public key to encrypt victim data for ransom.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
JCry has encrypted files and demanded Bitcoin to decrypt those files.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
KillDisk has a ransomware component that encrypts files with an AES key that is also RSA-1028 encrypted.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
LockerGoga has encrypted files, including core Windows OS files, using RSA-OAEP MGF1 and then demanded Bitcoin be paid for the decryption key.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Maze has disrupted systems by encrypting files on targeted machines, claiming to decrypt files if a ransom payment is made. Maze has used the ChaCha algorithm, based on Salsa20, and an RSA algorithm to encrypt files.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
MegaCortex has used the open-source library, Mbed Crypto, and generated AES keys to carry out the file encryption process.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Netwalker can encrypt files on infected machines to extort victims.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
NotPetya encrypts user files and disk structures like the MBR with 2048-bit RSA.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Pay2Key can encrypt data on victim's machines using RSA and AES algorithms in order to extort a ransom payment for decryption.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Prestige has leveraged the CryptoPP C++ library to encrypt files on target systems using AES and appended filenames with `.enc`.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
ProLock can encrypt files on a compromised host with RC6, and encrypts the key with RSA-1024.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Pysa has used RSA and AES-CBC encryption algorithm to encrypt a list of targeted file extensions.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
REvil can encrypt files on victim systems and demands a ransom to decrypt the files.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Ragnar Locker encrypts files on the local machine and mapped drives prior to displaying a note demanding a ransom.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
RobbinHood will search for an RSA encryption key and then perform its encryption process on the system files.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Royal uses a multi-threaded encryption process that can partially encrypt targeted files with the OpenSSL library and the AES256 algorithm.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Ryuk has used a combination of symmetric (AES) and asymmetric (RSA) encryption to encrypt files. Files have been encrypted with their own AES key and given a file extension of .RYK. Encrypted directories have had a ransom note of RyukReadMe.txt written to the directory.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
SamSam encrypts victim files using RSA-2048 encryption and demands a ransom be paid in Bitcoin to decrypt those files.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Seth-Locker can encrypt files on a targeted system, appending them with the suffix .seth.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Shamoon has an operational mode for encrypting data instead of overwriting it.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
SynAck encrypts the victims machine followed by asking the victim to pay a ransom.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
ThiefQuest encrypts a set of file extensions on a host, deletes the original files, and provides a ransom note with no contact information.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
WannaCry encrypts user files and demands that a ransom be paid in Bitcoin to decrypt those files.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
WastedLocker can encrypt data and leave a ransom note.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
XCSSET performs AES-CBC encryption on files under `~/Documents`, `~/Downloads`, and
`~/Desktop` with a fixed key and renames files to give them a `.enc` extension. Only files with sizes 
less than 500MB are encrypted.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Xbash has maliciously encrypted victim's database systems and demanded a cryptocurrency ransom be paid.
Technique: T1486 Data Encrypted for Impact, Tactic: TA0040 Impact
Indrik Spider has used PsExec to stop services prior to the execution of ransomware.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
LAPSUS$ has shut down virtual machines from within a victim's on-premise VMware ESXi infrastructure.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
Lazarus Group has stopped the MSExchangeIS service to render Exchange contents inaccessible to users.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
Wizard Spider has used taskkill.exe and net.exe to stop backup, catalog, cloud, and other services prior to network encryption.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
Avaddon looks for and attempts to stop database processes.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
AvosLocker has terminated specific processes before encryption.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
Babuk can stop specific services related to backups.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
BlackCat has the ability to stop VM services on compromised networks.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
Cheerscrypt has the ability to terminate VM processes on compromised hosts through execution of `esxcli vm process kill`.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
Clop can kill several processes and services related to backups and security solutions.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
Conti can stop up to 146 Windows services related to security, backup, database, and email solutions through the use of `net stop`.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
Cuba has a hardcoded list of services and processes to terminate.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
Diavol will terminate services using the Service Control Manager (SCM) API.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
EKANS stops database, data backup solution, antivirus, and ICS-related processes.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
HermeticWiper has the ability to stop the Volume Shadow Copy service.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
HotCroissant has the ability to stop services on the infected host.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
Industroyer’s data wiper module writes zeros into the registry keys in `SYSTEM\CurrentControlSet\Services` to render a system inoperable.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
KillDisk terminates various processes to get the user to reboot the victim machine.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
LookBack can kill processes and delete services.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
Maze has stopped SQL services to ensure it can encrypt any database.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
MegaCortex can stop and disable services on the system.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
Meteor can disconnect all network adapters on a compromised host using `powershell -Command "Get-WmiObject -class Win32_NetworkAdapter | ForEach { If ($.NetEnabled) { $.Disable() } }" > NUL`.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
Netwalker can terminate system processes and services, some of which relate to backup software.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
Olympic Destroyer uses the API call `ChangeServiceConfigW` to disable all services on the affected system.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
Pay2Key can stop the MS SQL service at the end of the encryption process to release files locked by the service.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
Prestige has attempted to stop the MSSQL Windows service to ensure successful encryption using `C:\Windows\System32\net.exe stop MSSQLSERVER`.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
Pysa can stop services and processes.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
REvil has the capability to stop services and kill processes.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
Ragnar Locker has attempted to stop services associated with business applications and databases to release the lock on files used by these applications so they may be encrypted.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
RobbinHood stops 181 Windows services on the system before beginning the encryption process.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
Royal can use `RmShutDown` to kill  applications and services using the resources that are targeted for encryption.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
Ryuk has called `kill.bat` for stopping services, disabling services and killing processes.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
SLOTHFULMEDIA has the capability to stop processes and services.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
WannaCry attempts to kill processes associated with Exchange, Microsoft SQL Server, and MySQL to make it possible to encrypt their data stores.
Technique: T1489 Service Stop, Tactic: TA0040 Impact
Wizard Spider has used WMIC and vssadmin to manually delete volume shadow copies. Wizard Spider has also used Conti ransomware to delete volume shadow copies automatically with the use of vssadmin.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
Akira will delete system volume shadow copies via PowerShell commands.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
Avaddon deletes backups and shadow copies using native system tools.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
Babuk has the ability to delete shadow volumes using `vssadmin.exe delete shadows /all /quiet`.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
BitPaymer attempts to remove the backup shadow files from the host using `vssadmin.exe Delete Shadows /All /Quiet`.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
Black Basta can delete shadow copies using vssadmin.exe.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
BlackCat can delete shadow copies using `vssadmin.exe delete shadows /all /quiet` and `wmic.exe Shadowcopy Delete`; it can also modify the boot loader using `bcdedit /set {default} recoveryenabled No`.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
Clop can delete the shadow volumes with `vssadmin Delete Shadows /all /quiet` and can use bcdedit to disable recovery options.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
Conficker resets system restore points and deletes backup files.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
Conti can delete Windows Volume Shadow Copies using `vssadmin`.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
DEATHRANSOM can delete volume shadow copies on compromised hosts.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
DarkGate can delete system restore points through the command `cmd.exe /c vssadmin delete shadows /for=c: /all /quiet”`.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
DarkWatchman can delete shadow volumes using `vssadmin.exe`.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
Diavol can delete shadow copies using the `IVssBackupComponents` COM object to call the `DeleteSnapshots` method.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
EKANS removes backups of Volume Shadow Copies to disable any restoration capabilities.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
FIVEHANDS has the ability to delete volume shadow copies on compromised hosts.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
H1N1 disable recovery options and deletes shadow copies from the victim.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
HELLOKITTY can delete volume shadow copies on compromised hosts.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
HermeticWiper can disable the VSS service on a compromised host using the service control manager.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
InvisiMole can can remove all system restore points.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
JCry has been observed deleting shadow copies to ensure that data cannot be restored easily.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
Maze has attempted to delete the shadow volumes of infected machines, once before and once after the encryption process.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
MegaCortex has deleted volume shadow copies using `vssadmin.exe`.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
Meteor can use `bcdedit` to delete different boot identifiers on a compromised host; it can also use `vssadmin.exe delete shadows /all /quiet` and `C:\\Windows\\system32\\wbem\\wmic.exe shadowcopy delete`.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
Netwalker can delete the infected system's Shadow Volumes to prevent recovery.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
Olympic Destroyer uses the native Windows utilities `vssadmin`, `wbadmin`, and `bcdedit` to delete and disable operating system recovery features such as the Windows backup catalog and Windows Automatic Repair.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
Prestige can delete the backup catalog from the target system using: `c:\Windows\System32\wbadmin.exe delete catalog -quiet` and can also delete volume shadow copies using: `\Windows\System32\vssadmin.exe delete shadows /all /quiet`.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
ProLock can use vssadmin.exe to remove volume shadow copies.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
Pysa has the functionality to delete shadow copies.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
REvil can use vssadmin to delete volume shadow copies and bcdedit to disable recovery features.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
Ragnar Locker can delete volume shadow copies using `vssadmin delete shadows /all /quiet`.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
RobbinHood deletes shadow copies to ensure that all the data cannot be restored easily.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
Royal can delete shadow copy backups with vssadmin.exe using the command `delete shadows /all /quiet`.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
Ryuk has used `vssadmin Delete Shadows /all /quiet` to to delete volume shadow copies and `vssadmin resize shadowstorage` to force deletion of shadow copies created by third-party applications.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
WannaCry uses `vssadmin`, `wbadmin`, `bcdedit`, and `wmic` to delete and disable operating system recovery features.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
WastedLocker can delete shadow volumes.
Technique: T1490 Inhibit System Recovery, Tactic: TA0040 Impact
Gamaredon Group has left taunting images and messages on the victims' desktops as proof of system access.
Technique: T1491.001 Defacement: Internal Defacement, Tactic: TA0040 Impact
Lazarus Group replaced the background wallpaper of systems with a threatening image after rendering the system unbootable with a Disk Structure Wipe.
Technique: T1491.001 Defacement: Internal Defacement, Tactic: TA0040 Impact
Black Basta has set the desktop wallpaper on victims' machines to display a ransom note.
Technique: T1491.001 Defacement: Internal Defacement, Tactic: TA0040 Impact
BlackCat can change the desktop wallpaper on compromised hosts.
Technique: T1491.001 Defacement: Internal Defacement, Tactic: TA0040 Impact
After encryption, Diavol will capture the desktop background window, set the background color to black, and change the desktop wallpaper to a newly created bitmap image with the text “All your files are encrypted! For more information see “README-FOR-DECRYPT.txt".
Technique: T1491.001 Defacement: Internal Defacement, Tactic: TA0040 Impact
Meteor can change both the desktop wallpaper and the lock screen image to a custom image.
Technique: T1491.001 Defacement: Internal Defacement, Tactic: TA0040 Impact
Sandworm Team defaced approximately 15,000 websites belonging to Georgian government, non-government, and private sector organizations in 2019.
Technique: T1491.002 Defacement: External Defacement, Tactic: TA0040 Impact
Bad Rabbit has used an executable that installs a modified bootloader to prevent normal boot-up.
Technique: T1495 Firmware Corruption, Tactic: TA0040 Impact
TrickBot module "Trickboot" can write or erase the UEFI/BIOS firmware of a compromised device.
Technique: T1495 Firmware Corruption, Tactic: TA0040 Impact
APT41 deployed a Monero cryptocurrency mining tool in a victim’s environment.
Technique: T1496 Resource Hijacking, Tactic: TA0040 Impact
Blue Mockingbird has used XMRIG to mine cryptocurrency on victim systems.
Technique: T1496 Resource Hijacking, Tactic: TA0040 Impact
Rocke has distributed cryptomining malware.
Technique: T1496 Resource Hijacking, Tactic: TA0040 Impact
TeamTNT has deployed XMRig Docker images to mine cryptocurrency. TeamTNT has also infected Docker containers and Kubernetes clusters with XMRig, and used RainbowMiner and lolMiner for mining cryptocurrency.
Technique: T1496 Resource Hijacking, Tactic: TA0040 Impact
Bonadan can download an additional module which has a cryptocurrency mining extension.
Technique: T1496 Resource Hijacking, Tactic: TA0040 Impact
CookieMiner has loaded coinmining software onto systems to mine for Koto cryptocurrency.
Technique: T1496 Resource Hijacking, Tactic: TA0040 Impact
DarkGate can deploy follow-on cryptocurrency mining payloads.
Technique: T1496 Resource Hijacking, Tactic: TA0040 Impact
Hildegard has used xmrig to mine cryptocurrency.
Technique: T1496 Resource Hijacking, Tactic: TA0040 Impact
Imminent Monitor has the capability to run a cryptocurrency miner on the victim machine.
Technique: T1496 Resource Hijacking, Tactic: TA0040 Impact
Kinsing has created and run a Bitcoin cryptocurrency miner.
Technique: T1496 Resource Hijacking, Tactic: TA0040 Impact
LoudMiner harvested system resources to mine cryptocurrency, using XMRig to mine Monero.
Technique: T1496 Resource Hijacking, Tactic: TA0040 Impact
Lucifer can use system resources to mine cryptocurrency, dropping XMRig to mine Monero.
Technique: T1496 Resource Hijacking, Tactic: TA0040 Impact
Skidmap is a kernel-mode rootkit used for cryptocurrency mining.
Technique: T1496 Resource Hijacking, Tactic: TA0040 Impact
During Operation Spalax, the threat actors used droppers that would run anti-analysis checks before executing malware on a compromised host.
Technique: T1497 Virtualization/Sandbox Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Darkhotel malware has employed just-in-time decryption of strings to evade sandbox detection.
Technique: T1497 Virtualization/Sandbox Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Agent Tesla has the ability to perform anti-sandboxing and anti-virtualization checks.
Technique: T1497 Virtualization/Sandbox Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Bazar can attempt to overload sandbox analysis by sending 1550 calls to `printf`.
Technique: T1497 Virtualization/Sandbox Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Bisonal can check to determine if the compromised system is running on VMware.
Technique: T1497 Virtualization/Sandbox Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Black Basta can make a random number of calls to the `kernel32.beep` function to hinder log analysis.
Technique: T1497 Virtualization/Sandbox Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Bumblebee has the ability to perform anti-virtualization checks.
Technique: T1497 Virtualization/Sandbox Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
CHOPSTICK  includes runtime checks to identify an analysis environment and prevent execution on it.
Technique: T1497 Virtualization/Sandbox Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Carberp has removed various hooks before installing the trojan or bootkit to evade sandbox analysis or other analysis software.
Technique: T1497 Virtualization/Sandbox Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Some versions of CozyCar will check to ensure it is not being executed inside a virtual machine or a known malware analysis sandbox environment. If it detects that it is, it will exit.
Technique: T1497 Virtualization/Sandbox Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Egregor has used multiple anti-analysis and anti-sandbox techniques to prevent automated analysis by sandboxes.
Technique: T1497 Virtualization/Sandbox Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Gelsemium can use junk code to generate random activity to obscure malware behavior.
Technique: T1497 Virtualization/Sandbox Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Hancitor has used a macro to check that an ActiveDocument shape object in the lure message is present. If this object is not found, the macro will exit without downloading additional payloads.
Technique: T1497 Virtualization/Sandbox Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Kevin can sleep for a time interval between C2 communication attempts.
Technique: T1497 Virtualization/Sandbox Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Metamorfo has embedded a "vmdetect.exe" executable to identify virtual machines at the beginning of execution.
Technique: T1497 Virtualization/Sandbox Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Pteranodon has the ability to use anti-detection functions to identify sandbox environments.
Technique: T1497 Virtualization/Sandbox Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
RTM can detect if it is running within a sandbox or other virtualized analysis environment.
Technique: T1497 Virtualization/Sandbox Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Squirrelwaffle has contained a hardcoded list of IP addresses to block that belong to sandboxes and analysis platforms.
Technique: T1497 Virtualization/Sandbox Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
StoneDrill has used several anti-emulation techniques to prevent automated analysis by emulators or sandboxes.
Technique: T1497 Virtualization/Sandbox Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
During Frankenstein, the threat actors used a script that ran WMI queries to check if a VM or sandbox was running, including VMWare and Virtualbox. The script would also call WMI to determine the number of cores allocated to the system; if less than two the script would stop execution.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
During Operation Dream Job, Lazarus Group used tools that conducted a variety of system checks to detect sandboxes or VMware services.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
Darkhotel malware has used a series of checks to determine if it's being analyzed; checks include the length of executable names, if a filename ends with `.Md5.exe`, and if the program is executed from the root of the C:\ drive, as well as checks for sandbox-related libraries.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
Evilnum has used a component called TerraLoader to check certain hardware and file information to detect sandboxed environments.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
OilRig has used macros to verify if a mouse is connected to a compromised machine.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
Volt Typhoon has run system checks to determine if they were operating in a virtualized environment.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
Astaroth can check for Windows product ID's used by sandboxes and usernames and disk serial numbers associated with analyst environments.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
AsyncRAT can identify strings such as Virtual, vmware, or VirtualBox to detect virtualized environments.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
Attor can detect whether it is executed in some virtualized or emulated environment by searching for specific artifacts, such as communication with I/O ports and using VM-specific instructions.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
BLUELIGHT can check to see if the infected machine has VM tools running.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
BadPatch attempts to detect if it is being run in a Virtual Machine (VM) using a WMI query for disk drive name, BIOS, and motherboard information.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
Black Basta can check system flags and libraries, process timing, and API's to detect code emulation or sandboxing.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
Bumblebee has the ability to search for designated file paths and Registry keys that indicate a virtualized environment from multiple products.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
CSPY Downloader can search loaded modules, PEB structure, file paths, Registry keys, and memory to determine if it is being debugged or running in a virtual environment.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
DarkGate queries system resources on an infected machine to identify if it is executing in a sandbox or virtualized environment.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
DarkTortilla can search a compromised system's running processes and services to detect Hyper-V, QEMU, Virtual PC, Virtual Box, and VMware, as well as Sandboxie.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
Denis ran multiple system checks, looking for processor and register characteristics, to evade emulation and analysis.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
Dyre can detect sandbox analysis environments by inspecting the process list and Registry.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
EvilBunny's dropper has checked the number of processes and the length and strings of its own file name to identify if the malware is in a sandbox environment.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
Ferocious can run anti-sandbox checks using the Microsoft Excel 4.0 function `GET.WORKSPACE` to determine the OS version, if there is a mouse present, and if the host is capable of playing sounds.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
FinFisher obtains the hardware device list and checks if the MD5 of the vendor ID is equal to a predefined list in order to check for sandbox/virtualized environments.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
GoldMax will check if it is being run in a virtualized environment by comparing the collected MAC address to `c8:27:cc:c2:37:5a`.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
Grandoreiro can detect VMWare via its I/O port and Virtual PC via the `vpcext` instruction.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
GravityRAT uses WMI to check the BIOS and manufacturer information for strings like "VMWare", "Virtual", and "XEN" and another WMI request to get the current temperature of the hardware to determine if it's a virtual machine environment.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
GuLoader has the ability to perform anti-VM and anti-sandbox checks using string hashing, the API call `EnumWindows`, and checking for Qemu guest agent.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
InvisiMole can check for artifacts of VirtualBox, Virtual PC and VMware environment, and terminate itself if they are detected.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
Lucifer can check for specific usernames, computer names, device drivers, DLL's, and virtual devices associated with sandboxed environments and can enter an infinite loop and stop itself if any are detected.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
MegaCortex has checked the number of CPUs in the system to avoid being run in a sandbox or emulator.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
Mispadu can run checks to verify if it is running within a virtualized environments including Hyper-V, VirtualBox or VMWare and will terminate execution if the computer name is “JOHN-PC.”
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
NativeZone has checked if Vmware or VirtualBox VM is running on a compromised host.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
OSX_OCEANLOTUS.D checks a number of system parameters to see if it is being run on real hardware or in a virtual machine environment, such as `sysctl hw.model` and the kernel boot time.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
ObliqueRAT can halt execution if it identifies processes belonging to virtual machine software or analysis tools.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
Okrum's loader can check the amount of physical memory and terminates itself if the host has less than 1.5 Gigabytes of physical memory in total.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
OopsIE performs several anti-VM and sandbox checks on the victim's machine. One technique the group has used was to perform a WMI query `SELECT * FROM MSAcpi_ThermalZoneTemperature` to check the temperature to see if it’s running in a virtual environment.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
P8RAT can check the compromised host for processes associated with VMware or VirtualBox environments.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
PlugX checks if VMware tools is running in the background by searching for any process named "vmtoolsd".
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
PoetRAT checked the size of the hard drive to determine if it was being run in a sandbox environment. In the event of sandbox detection, it would delete itself by overwriting the malware scripts with the contents of "License.txt" and exiting.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
Pupy has a module that checks a number of indicators on the system to determine if its running on a virtual machine.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
QakBot can check the compromised host for the presence of multiple executables associated with analysis tools and halt execution if any are found.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
ROKRAT can check for VMware-related files and DLLs related to sandboxes.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
Remcos searches for Sandboxie and VMware on the system.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
RogueRobin uses WMI to check BIOS version for VBOX, bochs, qemu, virtualbox, and vm to check for evidence that the script might be executing within an analysis environment.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
SUNBURST checked the domain name of the compromised host to verify it was running in a real environment.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
SVCReady has the ability to determine if its runtime environment is virtualized.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
Saint Bot has run several virtual machine and sandbox checks, including checking if `Sbiedll.dll` is present in a list of loaded modules, comparing the machine name to `HAL9TH` and the user name to `JohnDoe`, and checking the BIOS version for known virtual machine identifiers.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
Shark can stop execution if the screen width of the targeted machine is not over 600 pixels.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
Smoke Loader scans processes to perform anti-VM checks.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
Snip3 has the ability to detect Windows Sandbox, VMWare, or VirtualBox by querying `Win32_ComputerSystem` to extract the `Manufacturer` string.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
SodaMaster can check for the presence of the Registry key `HKEY_CLASSES_ROOT\\Applications\\VMwareHostOpen.exe` before proceeding to its main functionality.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
SynAck checks its directory location in an attempt to avoid launching in a sandbox.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery