sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
Machete is written in Python and is used in conjunction with additional Python scripts.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
MechaFlounder uses a python-based payload.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
PUNCHBUGGY has used python scripts.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
PoetRAT was executed with a Python script and worked in conjunction with additional Python-based post-exploitation tools.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
Pupy can use an add on feature when creating payloads that allows you to create custom Python scripts (“scriptlets”) to perform tasks offline (without requiring a session) such as sandbox detection, adding persistence, etc.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
PyDCrypt, along with its functions, is written in Python.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
Pysa has used Python scripts to deploy ransomware.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
Remcos uses Python scripts.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
SILENTTRINITY is written in Python and can use multiple Python scripts for execution on targeted systems.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
Small Sieve can use Python scripts to execute commands.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
SpeakUp uses Python scripts.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
Turian has the ability to use Python to spawn a Unix shell.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
During C0015, the threat actors used a malicious HTA file that contained a mix of encoded HTML and JavaScript/VBScript code.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
During C0017, APT41 deployed JScript web shells on compromised systems.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
During Operation Dust Storm, the threat actors used JavaScript code.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
APT32 has used JavaScript for drive-by downloads and C2 communications.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
Cobalt Group has executed JavaScript scriptlets on the victim's machine.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
Earth Lusca has manipulated legitimate websites to inject malicious JavaScript code as part of their watering hole operations.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
Ember Bear has used JavaScript to execute malicious code on a victim's machine.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
Evilnum has used malicious JavaScript files on the victim's machine.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
FIN6 has used malicious JavaScript to steal payment card data from e-commerce sites.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
FIN7 used JavaScript scripts to help perform tasks on the victim's machine.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
Higaisa used JavaScript to execute additional files.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
Indrik Spider has used malicious JavaScript files for several components of their attack.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
Kimsuky has used JScript for logging and downloading additional tools.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
LazyScripter has used JavaScript in its attacks.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
Leafminer infected victims using JavaScript code.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
Molerats used various implants, including those built with JS, on target machines.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
MoustachedBouncer has used JavaScript to deliver malware hosted on HTML pages.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
MuddyWater has used JavaScript files to execute its POWERSTATS payload.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
Sidewinder has used JavaScript to drop and execute malware loaders.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
Silence has used JS scripts.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
TA505 has used JavaScript for code execution.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
Turla has used various JavaScript-based backdoors.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
AppleSeed has the ability to use JavaScript to execute PowerShell.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
Astaroth uses JavaScript to perform its core functionalities.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
Avaddon has been executed through a malicious JScript downloader.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
Bundlore can execute JavaScript by injecting it into the victim's browser.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
Chaes has used JavaScript and Node.Js information stealer script that exfiltrates data using the node process.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
The Cobalt Strike System Profiler can use JavaScript to perform reconnaissance actions.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
DarkWatchman uses JavaScript to perform its core functionalities.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
Donut can generate shellcode outputs that execute via JavaScript or JScript.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
EnvyScout can write files to disk with JavaScript using a modified version of the open-source tool FileSaver.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
GRIFFON is written in and executed as JavaScript.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
InvisiMole can use a JavaScript file as part of its execution chain.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
JSS Loader can download and execute JavaScript files.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
KONNI has executed malicious JavaScript code.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
KOPILUWAK had used Javascript to perform its core functions.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
Metamorfo includes payloads written in JavaScript.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
NanHaiShu executes additional Jscript code on the victim's machine.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
POWERSTATS can use JavaScript code for execution.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
The QakBot web inject module can inject Java Script into web banking pages visited by the victim.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
The SocGholish payload is executed as JavaScript.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
SpicyOmelette has the ability to execute arbitrary JavaScript code on a compromised host.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
Valak can execute JavaScript containing configuration data for establishing persistence.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
WARPWIRE is a credential harvester written in JavaScript.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
Xbash can execute malicious JavaScript payloads on the victim’s machine.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
jRAT has been distributed as HTA files with JScript.
Technique: T1059.007 Command and Scripting Interpreter: JavaScript, Tactic: TA0002 Execution
APT29 has leveraged the Microsoft Graph API to perform various actions across Azure and M365 environments. They have also utilized AADInternals PowerShell Modules to access the API
Technique: T1059.009 Command and Scripting Interpreter: Cloud API, Tactic: TA0002 Execution
TeamTNT has leveraged AWS CLI to enumerate cloud environments with compromised credentials.
Technique: T1059.009 Command and Scripting Interpreter: Cloud API, Tactic: TA0002 Execution
Pacu leverages the AWS CLI for its operations.
Technique: T1059.009 Command and Scripting Interpreter: Cloud API, Tactic: TA0002 Execution
APT39 has utilized AutoIt malware scripts embedded in Microsoft Office documents or malicious links.
Technique: T1059.010 Command and Scripting Interpreter: AutoHotKey & AutoIT, Tactic: TA0002 Execution
DarkGate uses AutoIt scripts dropped to a hidden directory during initial installation phases, such as `test.au3`.
Technique: T1059.010 Command and Scripting Interpreter: AutoHotKey & AutoIT, Tactic: TA0002 Execution
Melcoz has been distributed through an AutoIt loader script.
Technique: T1059.010 Command and Scripting Interpreter: AutoHotKey & AutoIT, Tactic: TA0002 Execution
During C0017, APT41 abused named pipe impersonation for privilege escalation.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
APT28 has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263 to escalate privileges.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
APT29 has exploited CVE-2021-36934 to escalate privileges on a compromised host.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
APT32 has used CVE-2016-7255 to escalate privileges.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
APT33 has used a publicly available exploit for CVE-2017-0213 to escalate privileges on a local system.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
BITTER has exploited CVE-2021-1732 for privilege escalation.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
Cobalt Group has used exploits to increase their levels of rights and privileges.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
FIN6 has used tools to exploit Windows vulnerabilities in order to escalate privileges. The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
FIN8 has exploited the CVE-2016-0167 local vulnerability.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
LAPSUS$ has exploited unpatched vulnerabilities on internally accessible servers including JIRA, GitLab, and Confluence for privilege escalation.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
MoustachedBouncer has exploited CVE-2021-1732 to execute malware components with elevated rights.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
PLATINUM has leveraged a zero-day vulnerability to escalate privileges.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
Scattered Spider has deployed a malicious kernel driver through exploitation of CVE-2015-2291 in the Intel Ethernet diagnostics driver for Windows (iqvw64.sys).
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
Threat Group-3390 has used CVE-2014-6324 and CVE-2017-0213 to escalate privileges.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
Tonto Team has exploited CVE-2019-0803 and MS16-032 to escalate privileges.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
Turla has exploited vulnerabilities in the VBoxDrv.sys driver to obtain kernel mode privileges.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
Whitefly has used an open-source tool to exploit a known Windows privilege escalation vulnerability (CVE-2016-0051) on unpatched computers.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
ZIRCONIUM has exploited CVE-2017-0005 for local privilege escalation.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
Carberp has exploited multiple Windows vulnerabilities (CVE-2010-2743, CVE-2010-3338, CVE-2010-4398, CVE-2008-1084) and a .NET Runtime Optimization vulnerability for privilege escalation.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
Cobalt Strike can exploit vulnerabilities such as MS14-058.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
CosmicDuke attempts to exploit privilege escalation vulnerabilities CVE-2010-0232 or CVE-2010-4398.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
Empire can exploit vulnerabilities such as MS16-032 and MS16-135.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
Hildegard has used the BOtB tool which exploits CVE-2019-5736.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
InvisiMole has exploited CVE-2007-5633 vulnerability in the speedfan.sys driver to obtain kernel mode privileges.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
JHUHUGIT has exploited CVE-2015-1701 and CVE-2015-2387 to escalate privileges.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
Pandora can use CVE-2017-15303 to bypass Windows Driver Signature Enforcement (DSE) protection and load its driver.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
PoshC2 contains modules for local privilege escalation exploits such as CVE-2016-9192 and CVE-2016-0099.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
ProLock can use CVE-2019-0859 to escalate privileges on a compromised host.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
Remsec has a plugin to drop and execute vulnerable Outpost Sandbox or avast! Virtualization drivers in order to gain kernel mode privileges.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
Siloscape has leveraged a vulnerability in Windows containers to perform an Escape to Host.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
Stuxnet used MS10-073 and an undisclosed Task Scheduler vulnerability to escalate privileges on local Windows machines.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
Wingbird exploits CVE-2016-4117 to allow an executable to gain escalated privileges.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
XCSSET has used a zero-day exploit in the ssh launchdaemon to elevate privileges and bypass SIP.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
Zox has the ability to leverage local and remote exploits to escalate privileges.
Technique: T1068 Exploitation for Privilege Escalation, Tactic: TA0004 Privilege Escalation
During the SolarWinds Compromise, APT29 used the `Get-ManagementRoleAssignment` PowerShell cmdlet to enumerate Exchange management role assignments through an Exchange Management Shell.
Technique: T1069 Permission Groups Discovery, Tactic: TA0007 Discovery
APT3 has a tool that can enumerate the permissions associated with Windows groups.
Technique: T1069 Permission Groups Discovery, Tactic: TA0007 Discovery
APT41 used `net group` commands to enumerate various Windows user groups and permissions.
Technique: T1069 Permission Groups Discovery, Tactic: TA0007 Discovery
FIN13 has enumerated all users and roles from a victim's main treasury system.
Technique: T1069 Permission Groups Discovery, Tactic: TA0007 Discovery
TA505 has used TinyMet to enumerate members of privileged groups. TA505 has also run `net group /domain`.
Technique: T1069 Permission Groups Discovery, Tactic: TA0007 Discovery
Carbon uses the `net group` command.
Technique: T1069 Permission Groups Discovery, Tactic: TA0007 Discovery
IcedID has the ability to identify Workgroup membership.
Technique: T1069 Permission Groups Discovery, Tactic: TA0007 Discovery
MURKYTOP has the capability to retrieve information about groups.
Technique: T1069 Permission Groups Discovery, Tactic: TA0007 Discovery
ShimRatReporter gathered the local privileges for the infected host.
Technique: T1069 Permission Groups Discovery, Tactic: TA0007 Discovery
Siloscape checks for Kubernetes node permissions.
Technique: T1069 Permission Groups Discovery, Tactic: TA0007 Discovery
TrickBot can identify the groups the user on a compromised host belongs to.
Technique: T1069 Permission Groups Discovery, Tactic: TA0007 Discovery
During C0015, the threat actors used the command `net localgroup "adminstrator" ` to identify accounts with local administrator rights.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
During Operation CuckooBees, the threat actors used the `net group` command as part of their advanced reconnaissance.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
During Operation Wocao, threat actors used the command `net localgroup administrators` to list all administrators part of a local group.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
Chimera has used `net localgroup administrators` to identify  accounts with local administrative rights.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
HEXANE has run `net localgroup` to enumerate local groups.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
OilRig has used `net localgroup administrators` to find local administrators on compromised systems.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
Tonto Team has used the `ShowLocalGroupDetails` command to identify administrator, user, and guest accounts on a compromised host.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
Turla has used `net localgroup` and `net localgroup Administrators` to enumerate group information, including members of the local administrators group.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
Volt Typhoon has run `net localgroup administrators` in compromised environments to enumerate accounts.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: `net localgroup administrator >> %temp%\download`
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
BloodHound can collect information about local groups and members.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
Caterpillar WebShell can obtain a list of local groups of users from a system.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
Cobalt Strike can use `net localgroup` to list local groups on a system.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
Emissary has the capability to execute the command `net localgroup administrators`.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
Epic gathers information on local group names.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
Flagpro has been used to execute the `net localgroup administrators` command on a targeted system.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
FlawedAmmyy enumerates the privilege level of the victim during the initial infection.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
Helminth has checked the local administrators group.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
JPIN can obtain the permissions of the victim user.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
Kazuar gathers information about local groups and members.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
Kwampirs collects a list of users belonging to the local users and administrators groups with the commands `net localgroup administrators` and `net localgroup users`.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
Commands such as `net group` and `net localgroup` can be used in Net to gather information about and manipulate groups.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
OSInfo has enumerated the local administrators group.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
POWRUNER may collect local group information by running `net localgroup administrators` or a series of other commands on a victim.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
PoshC2 contains modules, such as `Get-LocAdm` for enumerating permission groups.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
QakBot can use `net localgroup` to enable discovery of local groups.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
SILENTTRINITY can obtain a list of local groups and members.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
Sys10 collects the group name of the logged-in user and sends it to the C2.
Technique: T1069.001 Permission Groups Discovery: Local Groups, Tactic: TA0007 Discovery
During C0015, the threat actors use the command `net group "domain admins" /dom` to enumerate domain groups.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
During the SolarWinds Compromise, APT29 used AdFind to enumerate domain groups.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
Dragonfly has used batch scripts to enumerate administrators and users in the domain.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
FIN7 has used the command `net group "domain admins" /domain` to enumerate domain groups.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
Inception has used specific malware modules to gather domain membership.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
Ke3chang performs discovery of permission groups `net group /domain`.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
LAPSUS$ has used the AD Explorer tool to enumerate groups on a victim's network.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
OilRig has used `net group /domain`, `net group “domain admins” /domain`, and `net group “Exchange Trusted Subsystem” /domain` to find domain group permission settings.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
ToddyCat has executed `net group "domain admins" /dom` for discovery on compromised machines.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
Turla has used `net group "Domain Admins" /domain` to identify domain administrators.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
Volt Typhoon has run `net group` in compromised environments to discover domain groups.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
AdFind can enumerate domain groups.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
BADHATCH can use `net.exe group "domain admins" /domain` to identify Domain Administrators.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
BlackCat can determine if a user on a compromised host has domain admin privileges.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
BloodHound can collect information about domain groups and members.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
Brute Ratel C4 can use `net group` for discovery on targeted domains.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
Cobalt Strike can identify targets by querying account groups on a domain contoller.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
CrackMapExec can gather the user accounts within domain groups.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
Egregor can conduct Active Directory reconnaissance using tools such as Sharphound or AdFind.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
GRIFFON has used a reconnaissance module that can be used to retrieve Windows domain membership information.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
Helminth has checked for the domain admin group and Exchange Trusted Subsystem groups using the commands `net group Exchange Trusted Subsystem /domain` and `net group domain admins /domain`.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
Kwampirs collects a list of domain groups with the command `net localgroup /domain`.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
Commands such as `net group /domain` can be used in Net to gather information about and manipulate groups.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
OSInfo specifically looks for Domain Admins and power users within the domain.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
POWRUNER may collect domain group information by running `net group /domain` or a series of other commands on a victim.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
REvil can identify the domain membership of a compromised host.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
SILENTTRINITY can use `System.DirectoryServices` namespace to retrieve domain group information.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
SoreFang can enumerate domain groups by executing `net.exe group /domain`.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
WellMess can identify domain group membership for the current user.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
dsquery can be used to gather information on permission groups within a domain.
Technique: T1069.002 Permission Groups Discovery: Domain Groups, Tactic: TA0007 Discovery
During C0027, Scattered Spider accessed Azure AD to download bulk lists of group members and their Active Directory attributes.
Technique: T1069.003 Permission Groups Discovery: Cloud Groups, Tactic: TA0007 Discovery
AADInternals can enumerate Azure AD groups.
Technique: T1069.003 Permission Groups Discovery: Cloud Groups, Tactic: TA0007 Discovery
Pacu can enumerate IAM permissions.
Technique: T1069.003 Permission Groups Discovery: Cloud Groups, Tactic: TA0007 Discovery
ROADTools can enumerate Azure AD groups.
Technique: T1069.003 Permission Groups Discovery: Cloud Groups, Tactic: TA0007 Discovery
During Cutting Edge, threat actors cleared logs to remove traces of their activity and restored compromised systems to a clean state to bypass manufacturer mitigations for CVE-2023-46805 and CVE-2024-21887.
Technique: T1070 Indicator Removal, Tactic: TA0005 Defense Evasion
During the SolarWinds Compromise, APT29 temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.
Technique: T1070 Indicator Removal, Tactic: TA0005 Defense Evasion
APT5 has used the THINBLOOD utility to clear SSL VPN log files located at `/home/runtime/logs`.
Technique: T1070 Indicator Removal, Tactic: TA0005 Defense Evasion
Lazarus Group has restored malicious KernelCallbackTable code to its original state after the process execution flow has been hijacked.
Technique: T1070 Indicator Removal, Tactic: TA0005 Defense Evasion
Bankshot deletes all artifacts associated with the malware from the infected machine.
Technique: T1070 Indicator Removal, Tactic: TA0005 Defense Evasion
BlackEnergy has removed the watermark associated with enabling the `TESTSIGNING` boot configuration option by removing the relevant strings in the `user32.dll.mui` of the system.
Technique: T1070 Indicator Removal, Tactic: TA0005 Defense Evasion
CSPY Downloader has the ability to remove values it writes to the Registry.
Technique: T1070 Indicator Removal, Tactic: TA0005 Defense Evasion
DarkWatchman can uninstall malicious components from the Registry, stop processes, and clear the browser history.
Technique: T1070 Indicator Removal, Tactic: TA0005 Defense Evasion
Donut can erase file references to payloads in-memory after being reflectively loaded and executed.
Technique: T1070 Indicator Removal, Tactic: TA0005 Defense Evasion
EVILNUM has a function called "DeleteLeftovers" to remove certain artifacts of the attack.
Technique: T1070 Indicator Removal, Tactic: TA0005 Defense Evasion
Flagpro can close specific Windows Security and Internet Explorer dialog boxes to mask external connections.
Technique: T1070 Indicator Removal, Tactic: TA0005 Defense Evasion
FunnyDream has the ability to clean traces of malware deployment.
Technique: T1070 Indicator Removal, Tactic: TA0005 Defense Evasion
HermeticWiper can disable pop-up information about folders and desktop items and delete Registry keys to hide malicious services.
Technique: T1070 Indicator Removal, Tactic: TA0005 Defense Evasion
Maze has used the “Wow64RevertWow64FsRedirection” function following attempts to delete the shadow volumes, in order to leave the system in the same state as it was prior to redirection.
Technique: T1070 Indicator Removal, Tactic: TA0005 Defense Evasion
Metamorfo has a command to delete a Registry key it uses, `\Software\Microsoft\Internet Explorer\notes`.
Technique: T1070 Indicator Removal, Tactic: TA0005 Defense Evasion
Neoichor can clear the browser history on a compromised host by changing the `ClearBrowsingHistoryOnExit` value to 1 in the `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy` Registry key.
Technique: T1070 Indicator Removal, Tactic: TA0005 Defense Evasion
Orz can overwrite Registry settings to reduce its visibility on the victim.
Technique: T1070 Indicator Removal, Tactic: TA0005 Defense Evasion
Rising Sun can clear a memory blog in the process by overwriting it with junk bytes.
Technique: T1070 Indicator Removal, Tactic: TA0005 Defense Evasion
SDBbot has the ability to clean up and remove data structures from a compromised host.
Technique: T1070 Indicator Removal, Tactic: TA0005 Defense Evasion
SILENTTRINITY can remove artifacts from the compromised host, including created Registry keys.
Technique: T1070 Indicator Removal, Tactic: TA0005 Defense Evasion
SUNBURST removed HTTP proxy registry values to clean up traces of execution.
Technique: T1070 Indicator Removal, Tactic: TA0005 Defense Evasion
Sardonic has the ability to delete created WMI objects to evade detections.
Technique: T1070 Indicator Removal, Tactic: TA0005 Defense Evasion
ShadowPad has deleted arbitrary Registry values.
Technique: T1070 Indicator Removal, Tactic: TA0005 Defense Evasion
Sibot will delete an associated registry key if a certain server response is received.
Technique: T1070 Indicator Removal, Tactic: TA0005 Defense Evasion
Stuxnet can delete OLE Automation and SQL stored procedures used to store malicious payloads.
Technique: T1070 Indicator Removal, Tactic: TA0005 Defense Evasion
During Operation Wocao, the threat actors deleted all Windows system and security event logs using `/Q /c wevtutil cl system` and `/Q /c wevtutil cl security`.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
APT28 has cleared event logs, including by using the commands `wevtutil cl System` and `wevtutil cl Security`.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
APT32 has cleared select event log entries.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
APT38 clears Window Event logs and Sysmon logs from the system.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
APT41 attempted to remove evidence of some of its activity by clearing Windows security and system events.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
Chimera has cleared event logs on compromised hosts.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
Dragonfly has cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
FIN5 has cleared event logs from victims.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
FIN8 has cleared logs during post compromise cleanup activities.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
Indrik Spider has used Cobalt Strike to empty log files.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
BlackCat can clear Windows event logs using `wevtutil.exe`.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
The BlackEnergy component KillDisk is capable of deleting Windows Event Logs.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
FinFisher clears the system event logs using ` OpenEventLog/ClearEventLog APIs `.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
HermeticWiper can overwrite the `C:\Windows\System32\winevt\Logs` file on a targeted system.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
HermeticWizard has the ability to use `wevtutil cl system` to clear event logs.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
Hydraq creates a backdoor through which remote attackers can clear all system event logs.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
KillDisk deletes Application, Security, Setup, and System Windows Event Logs.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
Lucifer can clear and remove event logs.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
Mafalda can delete Windows Event logs by invoking the `OpenEventLogW` and `ClearEventLogW` functions.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
Meteor can use Wevtutil to remove Security, System and Application Event Viewer logs.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
NotPetya uses `wevtutil` to clear the Windows event logs.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
Olympic Destroyer will attempt to clear the System and Security event logs using `wevtutil`.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
Pupy has a module to clear event logs with PowerShell.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
RunningRAT contains code to clear event logs.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
SynAck clears event logs.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
Wevtutil can be used to clear system and security event logs from the system.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
ZxShell has a command to clear system event logs.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
gh0st RAT is able to wipe event logs.
Technique: T1070.001 Indicator Removal: Clear Windows Event Logs, Tactic: TA0005 Defense Evasion
Rocke has cleared log files within the /var/log/ folder.
Technique: T1070.002 Indicator Removal: Clear Linux or Mac System Logs, Tactic: TA0005 Defense Evasion
TeamTNT has removed system logs from `/var/log/syslog`.
Technique: T1070.002 Indicator Removal: Clear Linux or Mac System Logs, Tactic: TA0005 Defense Evasion
MacMa can clear possible malware traces such as application logs.
Technique: T1070.002 Indicator Removal: Clear Linux or Mac System Logs, Tactic: TA0005 Defense Evasion
Proton removes logs from `/var/logs` and `/Library/logs`.
Technique: T1070.002 Indicator Removal: Clear Linux or Mac System Logs, Tactic: TA0005 Defense Evasion
APT41 attempted to remove evidence of some of its activity by deleting Bash histories.
Technique: T1070.003 Indicator Removal: Clear Command History, Tactic: TA0005 Defense Evasion
APT5 has cleared the command history on targeted ESXi servers.
Technique: T1070.003 Indicator Removal: Clear Command History, Tactic: TA0005 Defense Evasion
Lazarus Group has routinely deleted log files on a compromised router, including automatic log deletion through the use of the logrotate utility.
Technique: T1070.003 Indicator Removal: Clear Command History, Tactic: TA0005 Defense Evasion
Magic Hound has removed mailbox export requests from compromised Exchange servers.
Technique: T1070.003 Indicator Removal: Clear Command History, Tactic: TA0005 Defense Evasion
TeamTNT has cleared command history with `history -c`.
Technique: T1070.003 Indicator Removal: Clear Command History, Tactic: TA0005 Defense Evasion
menuPass has used Wevtutil to remove PowerShell execution logs.
Technique: T1070.003 Indicator Removal: Clear Command History, Tactic: TA0005 Defense Evasion
Hildegard has used history -c to clear script shell logs.
Technique: T1070.003 Indicator Removal: Clear Command History, Tactic: TA0005 Defense Evasion
Kobalos can remove all command history on compromised hosts.
Technique: T1070.003 Indicator Removal: Clear Command History, Tactic: TA0005 Defense Evasion
During the 2015 Ukraine Electric Power Attack, vba_macro.exe deletes itself after `FONTCACHE.DAT`, `rundll32.exe`, and the associated .lnk file is delivered.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
During the C0032 campaign, TEMP.Veles routinely deleted tools, logs, and other files after they were finished with them.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
During Cutting Edge, threat actors deleted `/tmp/test1.txt` on compromised Ivanti Connect Secure VPNs which was used to hold stolen configuration and cache files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
During Operation Dream Job, Lazarus Group removed all previously delivered files from a compromised computer.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
During Operation Honeybee, the threat actors used batch files that reduced their fingerprint on a compromised system by deleting malware-related files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
During Operation Wocao, the threat actors consistently removed traces of their activity by first overwriting a file using `/c cd /d c:\windows\temp\ & copy \\<IP ADDRESS>\c$\windows\system32\devmgr.dll \\<IP ADDRESS>\c$\windows\temp\LMAKSW.ps1 /y` and then deleting the overwritten file using `/c cd /d c:\windows\temp\ & del \\<IP ADDRESS>\c$\windows\temp\LMAKSW.ps1`.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
During the SolarWinds Compromise, APT29 routinely removed their tools, including custom backdoors, once remote access was achieved.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
APT18 actors deleted tools and batch files from victim systems.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
APT28 has intentionally deleted computer files to cover their tracks, including with use of the program CCleaner.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
APT29 has used SDelete to remove artifacts from victim networks.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
APT3 has a tool that can delete files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
APT32's macOS backdoor can receive a “delete” command.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
APT38 has used a utility called CLOSESHAVE that can securely delete a file from the system. They have also removed malware, tools, or other non-native files used during the intrusion to reduce their footprint or as part of the post-intrusion cleanup process.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
APT39 has used malware to delete files after they are deployed on a compromised host.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
APT41 deleted files from the system.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
APT5 has deleted scripts and web shells to evade detection.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Aquatic Panda has deleted malicious executables from compromised machines.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
The BRONZE BUTLER uploader or malware the uploader uses `command` to delete the RAR archives after they have been exfiltrated.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Chimera has performed file deletion to evade detection.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Cobalt Group deleted the DLL dropper from the victim’s machine to cover their tracks.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Dragonfly has deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Evilnum has deleted files used during infection.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
FIN10 has used batch scripts and scheduled tasks to delete critical system files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
FIN5 uses SDelete to clean up the environment and attempt to prevent detection.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
FIN6 has removed files from victim machines.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
FIN8 has deleted tmp and prefetch files during post compromise cleanup activities. FIN8 has also deleted PowerShell scripts to evade detection on compromised machines.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Gamaredon Group tools can delete files used during an operation.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Malware used by Group5 is capable of remotely deleting files from victims.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Kimsuky has deleted the exfiltrated data on disk after transmission. Kimsuky has also used an instrumentor script to terminate browser processes running on an infected system and then delete the cookie files on disk.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Lazarus Group malware has deleted files in various ways, including "suicide scripts" to delete malware binaries from the victim. Lazarus Group also uses secure file deletion to delete files from the victim.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Magic Hound has deleted and overwrote files to cover tracks.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Metador has quickly deleted `cbd.exe` from a compromised host following the successful deployment of their malware.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Mustang Panda will delete their tools and files, and kill processes after their objectives are reached.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
OilRig has deleted files associated with their payload after execution.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Patchwork removed certain files and replaced them so they could not be retrieved.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Rocke has deleted files on infected machines.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Sandworm Team has used backdoors that can delete files used in an attack from an infected system.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Silence has deleted artifacts, including scheduled tasks, communicates files from the C2 and other logs.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion