sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
Wizard Spider has utilized tools such as Empire, Cobalt Strike, Cobalt Strike, Rubeus, AdFind, BloodHound, Metasploit, Advanced IP Scanner, Nirsoft PingInfoView, and SoftPerfect Network Scanner for targeting efforts.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
menuPass has used and modified open-source tools like Impacket, Mimikatz, and pwdump.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
During Operation Dream Job, Lazarus Group used code signing certificates issued by Sectigo RSA for some of its malware and tools.
Technique: T1588.003 Obtain Capabilities: Code Signing Certificates, Tactic: TA0042 Resource Development
BlackTech has used stolen code-signing certificates for its malicious payloads.
Technique: T1588.003 Obtain Capabilities: Code Signing Certificates, Tactic: TA0042 Resource Development
Ember Bear has stolen legitimate certificates to sign malicious payloads.
Technique: T1588.003 Obtain Capabilities: Code Signing Certificates, Tactic: TA0042 Resource Development
FIN8 has used an expired open-source X.509 certificate for testing in the OpenSSL repository, to connect to actor-controlled C2 servers.
Technique: T1588.003 Obtain Capabilities: Code Signing Certificates, Tactic: TA0042 Resource Development
Threat Group-3390 has obtained stolen valid certificates, including from VMProtect and the Chinese instant messaging application Youdu, for their operations.
Technique: T1588.003 Obtain Capabilities: Code Signing Certificates, Tactic: TA0042 Resource Development
Wizard Spider has obtained code signing certificates signed by DigiCert, GlobalSign, and COMOOD for malware payloads.
Technique: T1588.003 Obtain Capabilities: Code Signing Certificates, Tactic: TA0042 Resource Development
MegaCortex has used code signing certificates issued to fake companies to bypass security controls.
Technique: T1588.003 Obtain Capabilities: Code Signing Certificates, Tactic: TA0042 Resource Development
For Operation Honeybee, the threat actors stole a digital signature from Adobe Systems to use with their MaoCheng dropper.
Technique: T1588.004 Obtain Capabilities: Digital Certificates, Tactic: TA0042 Resource Development
BlackTech has used valid, stolen digital certificates for some of their malware and tools.
Technique: T1588.004 Obtain Capabilities: Digital Certificates, Tactic: TA0042 Resource Development
Lazarus Group has obtained SSL certificates for their C2 domains.
Technique: T1588.004 Obtain Capabilities: Digital Certificates, Tactic: TA0042 Resource Development
LuminousMoth has used a valid digital certificate for some of their malware.
Technique: T1588.004 Obtain Capabilities: Digital Certificates, Tactic: TA0042 Resource Development
Silent Librarian has obtained free Let's Encrypt SSL certificates for use on their phishing pages.
Technique: T1588.004 Obtain Capabilities: Digital Certificates, Tactic: TA0042 Resource Development
Kimsuky has obtained exploit code for various CVEs.
Technique: T1588.005 Obtain Capabilities: Exploits, Tactic: TA0042 Resource Development
In 2017, Sandworm Team conducted technical research related to vulnerabilities associated with websites used by the Korean Sport and Olympic Committee, a Korean power company, and a Korean airport.
Technique: T1588.006 Obtain Capabilities: Vulnerabilities, Tactic: TA0042 Resource Development
For Operation Dream Job, Lazarus Group conducted extensive reconnaissance research on potential targets.
Technique: T1589 Gather Victim Identity Information, Tactic: TA0043 Reconnaissance
During Operation Wocao, threat actors targeted people based on their organizational roles and privileges.
Technique: T1589 Gather Victim Identity Information, Tactic: TA0043 Reconnaissance
APT32 has conducted targeted surveillance against activists and bloggers.
Technique: T1589 Gather Victim Identity Information, Tactic: TA0043 Reconnaissance
FIN13 has researched employees to target for social engineering attacks.
Technique: T1589 Gather Victim Identity Information, Tactic: TA0043 Reconnaissance
HEXANE has identified specific potential victims at targeted organizations.
Technique: T1589 Gather Victim Identity Information, Tactic: TA0043 Reconnaissance
LAPSUS$ has gathered detailed information of target employees to enhance their social engineering lures.
Technique: T1589 Gather Victim Identity Information, Tactic: TA0043 Reconnaissance
Magic Hound has acquired mobile phone numbers of potential targets, possibly for mobile malware or additional phishing operations.
Technique: T1589 Gather Victim Identity Information, Tactic: TA0043 Reconnaissance
During C0027, Scattered Spider sent phishing messages via SMS to steal credentials.
Technique: T1589.001 Gather Victim Identity Information: Credentials, Tactic: TA0043 Reconnaissance
For the SolarWinds Compromise, APT29 conducted credential theft operations to obtain credentials to be used for access to victim environments.
Technique: T1589.001 Gather Victim Identity Information: Credentials, Tactic: TA0043 Reconnaissance
APT28 has harvested user's login credentials.
Technique: T1589.001 Gather Victim Identity Information: Credentials, Tactic: TA0043 Reconnaissance
To support initial access, APT41 gained access to databases with information about existing accounts as well as plaintext and hashed passwords.
Technique: T1589.001 Gather Victim Identity Information: Credentials, Tactic: TA0043 Reconnaissance
Chimera has collected credentials for the target organization from previous breaches for use in brute force attacks.
Technique: T1589.001 Gather Victim Identity Information: Credentials, Tactic: TA0043 Reconnaissance
LAPSUS$ has gathered user identities and credentials to gain initial access to a victim's organization; the group has also called an organization's help desk to reset a target's credentials.
Technique: T1589.001 Gather Victim Identity Information: Credentials, Tactic: TA0043 Reconnaissance
Leviathan has collected compromised credentials to use for targeting efforts.
Technique: T1589.001 Gather Victim Identity Information: Credentials, Tactic: TA0043 Reconnaissance
Magic Hound gathered credentials from two victims that they then attempted to validate across 75 different websites. Magic Hound has also collected credentials from over 900 Fortinet VPN servers in the US, Europe, and Israel.
Technique: T1589.001 Gather Victim Identity Information: Credentials, Tactic: TA0043 Reconnaissance
APT32 has collected e-mail addresses for activists and bloggers in order to target them with spyware.
Technique: T1589.002 Gather Victim Identity Information: Email Addresses, Tactic: TA0043 Reconnaissance
EXOTIC LILY has gathered targeted individuals' e-mail addresses through open source research and website contact forms.
Technique: T1589.002 Gather Victim Identity Information: Email Addresses, Tactic: TA0043 Reconnaissance
HAFNIUM has collected e-mail addresses for users they intended to target.
Technique: T1589.002 Gather Victim Identity Information: Email Addresses, Tactic: TA0043 Reconnaissance
HEXANE has targeted executives, human resources staff, and IT personnel for spearphishing.
Technique: T1589.002 Gather Victim Identity Information: Email Addresses, Tactic: TA0043 Reconnaissance
Kimsuky has collected valid email addresses that were subsequently used in spearphishing campaigns.
Technique: T1589.002 Gather Victim Identity Information: Email Addresses, Tactic: TA0043 Reconnaissance
LAPSUS$ has gathered employee email addresses, including personal accounts, for social engineering and initial access efforts.
Technique: T1589.002 Gather Victim Identity Information: Email Addresses, Tactic: TA0043 Reconnaissance
Lazarus Group collected email addresses belonging to various departments of a targeted organization which were used in follow-on phishing campaigns.
Technique: T1589.002 Gather Victim Identity Information: Email Addresses, Tactic: TA0043 Reconnaissance
Magic Hound has identified high-value email accounts in academia, journalism, NGO's, foreign policy, and national security for targeting.
Technique: T1589.002 Gather Victim Identity Information: Email Addresses, Tactic: TA0043 Reconnaissance
Sandworm Team has obtained valid emails addresses while conducting research against target organizations that were subsequently used in spearphishing campaigns.
Technique: T1589.002 Gather Victim Identity Information: Email Addresses, Tactic: TA0043 Reconnaissance
Silent Librarian has collected e-mail addresses from targeted organizations from open Internet searches.
Technique: T1589.002 Gather Victim Identity Information: Email Addresses, Tactic: TA0043 Reconnaissance
TA551 has used spoofed company emails that were acquired from email clients on previously infected hosts to target other individuals.
Technique: T1589.002 Gather Victim Identity Information: Email Addresses, Tactic: TA0043 Reconnaissance
AADInternals can check for the existence of user email addresses using public Microsoft APIs.
Technique: T1589.002 Gather Victim Identity Information: Email Addresses, Tactic: TA0043 Reconnaissance
To support initial access, APT41 gained access to databases with information about existing accounts and lists of employees.
Technique: T1589.003 Gather Victim Identity Information: Employee Names, Tactic: TA0043 Reconnaissance
Kimsuky has collected victim employee name information.
Technique: T1589.003 Gather Victim Identity Information: Employee Names, Tactic: TA0043 Reconnaissance
Sandworm Team's research of potential victim organizations included the identification and collection of employee information.
Technique: T1589.003 Gather Victim Identity Information: Employee Names, Tactic: TA0043 Reconnaissance
Silent Librarian has collected lists of names for individuals from targeted organizations.
Technique: T1589.003 Gather Victim Identity Information: Employee Names, Tactic: TA0043 Reconnaissance
HAFNIUM gathered the fully qualified domain names (FQDNs) for targeted Exchange servers in the victim's environment.
Technique: T1590 Gather Victim Network Information, Tactic: TA0043 Reconnaissance
Sandworm Team conducted technical reconnaissance of the Parliament of Georgia's official internet domain prior to its 2019 attack.
Technique: T1590.001 Gather Victim Network Information: Domain Properties, Tactic: TA0043 Reconnaissance
AADInternals can gather information about a tenant’s domains using public Microsoft APIs.
Technique: T1590.001 Gather Victim Network Information: Domain Properties, Tactic: TA0043 Reconnaissance
FIN13 has searched for infrastructure that can provide remote access to an environment for targeting efforts.
Technique: T1590.004 Gather Victim Network Information: Network Topology, Tactic: TA0043 Reconnaissance
Andariel has limited its watering hole attacks to specific IP address ranges.
Technique: T1590.005 Gather Victim Network Information: IP Addresses, Tactic: TA0043 Reconnaissance
HAFNIUM has obtained IP addresses for publicly-accessible Exchange servers.
Technique: T1590.005 Gather Victim Network Information: IP Addresses, Tactic: TA0043 Reconnaissance
Magic Hound has captured the IP addresses of visitors to their phishing sites.
Technique: T1590.005 Gather Victim Network Information: IP Addresses, Tactic: TA0043 Reconnaissance
For Operation Dream Job, Lazarus Group gathered victim organization information to identify specific targets.
Technique: T1591 Gather Victim Org Information, Tactic: TA0043 Reconnaissance
Kimsuky has collected victim organization information including but not limited to organization hierarchy, functions, press releases, and others.
Technique: T1591 Gather Victim Org Information, Tactic: TA0043 Reconnaissance
Lazarus Group has studied publicly available information about a targeted organization to tailor spearphishing efforts against specific departments and/or individuals.
Technique: T1591 Gather Victim Org Information, Tactic: TA0043 Reconnaissance
Magic Hound has collected location information from visitors to their phishing sites.
Technique: T1591.001 Gather Victim Org Information: Determine Physical Locations, Tactic: TA0043 Reconnaissance
Dragonfly has collected open source information to identify relationships between organizations for targeting purposes.
Technique: T1591.002 Gather Victim Org Information: Business Relationships, Tactic: TA0043 Reconnaissance
LAPSUS$ has gathered detailed knowledge of an organization's supply chain relationships.
Technique: T1591.002 Gather Victim Org Information: Business Relationships, Tactic: TA0043 Reconnaissance
In preparation for its attack against the 2018 Winter Olympics, Sandworm Team conducted online research of partner organizations listed on an official PyeongChang Olympics partnership site.
Technique: T1591.002 Gather Victim Org Information: Business Relationships, Tactic: TA0043 Reconnaissance
During Operation Dream Job, Lazarus Group targeted specific individuals within an organization with tailored job vacancy announcements.
Technique: T1591.004 Gather Victim Org Information: Identify Roles, Tactic: TA0043 Reconnaissance
HEXANE has identified executives, HR, and IT staff at victim organizations for further targeting.
Technique: T1591.004 Gather Victim Org Information: Identify Roles, Tactic: TA0043 Reconnaissance
LAPSUS$ has gathered detailed knowledge of team structures within a target organization.
Technique: T1591.004 Gather Victim Org Information: Identify Roles, Tactic: TA0043 Reconnaissance
Andariel has inserted a malicious script within compromised websites to collect potential victim information such as browser type, system language, Flash Player version, and other data.
Technique: T1592.002 Gather Victim Host Information: Software, Tactic: TA0043 Reconnaissance
Magic Hound has captured the user-agent strings from visitors to their phishing sites.
Technique: T1592.002 Gather Victim Host Information: Software, Tactic: TA0043 Reconnaissance
Sandworm Team has researched software code to enable supply-chain operations, most notably for the 2017 NotPetya attack. Sandworm Team also collected a list of computers using specific software as part of its targeting efforts.
Technique: T1592.002 Gather Victim Host Information: Software, Tactic: TA0043 Reconnaissance
HAFNIUM has interacted with Office 365 tenants to gather details regarding target's environments.
Technique: T1592.004 Gather Victim Host Information: Client Configurations, Tactic: TA0043 Reconnaissance
Sandworm Team researched Ukraine's unique legal entity identifier (called an "EDRPOU" number), including running queries on the EDRPOU website, in preparation for the NotPetya attack. Sandworm Team has also researched third-party websites to help it craft credible spearphishing emails.
Technique: T1593 Search Open Websites/Domains, Tactic: TA0043 Reconnaissance
For Operation Dream Job, Lazarus Group used LinkedIn to identify and target employees within a chosen organization.
Technique: T1593.001 Search Open Websites/Domains: Social Media, Tactic: TA0043 Reconnaissance
EXOTIC LILY has copied data from social media sites to impersonate targeted individuals.
Technique: T1593.001 Search Open Websites/Domains: Social Media, Tactic: TA0043 Reconnaissance
Kimsuky has used Twitter to monitor potential victims and to prepare targeted phishing e-mails.
Technique: T1593.001 Search Open Websites/Domains: Social Media, Tactic: TA0043 Reconnaissance
Kimsuky has searched for vulnerabilities, tools, and geopolitical trends on Google to target victims.
Technique: T1593.002 Search Open Websites/Domains: Search Engines, Tactic: TA0043 Reconnaissance
LAPSUS$ has searched public code repositories for exposed credentials.
Technique: T1593.003 Search Open Websites/Domains: Code Repositories, Tactic: TA0043 Reconnaissance
During Cutting Edge, threat actors peformed reconnaissance of victims' internal websites via proxied connections.
Technique: T1594 Search Victim-Owned Websites, Tactic: TA0043 Reconnaissance
EXOTIC LILY has used contact forms on victim websites to generate phishing e-mails.
Technique: T1594 Search Victim-Owned Websites, Tactic: TA0043 Reconnaissance
Kimsuky has searched for information on the target company's website.
Technique: T1594 Search Victim-Owned Websites, Tactic: TA0043 Reconnaissance
Sandworm Team has conducted research against potential victim websites as part of its operational planning.
Technique: T1594 Search Victim-Owned Websites, Tactic: TA0043 Reconnaissance
Silent Librarian has searched victim's websites to identify the interests and academic areas of targeted individuals and to scrape source code, branding, and organizational contact information for phishing pages.
Technique: T1594 Search Victim-Owned Websites, Tactic: TA0043 Reconnaissance
In the Triton Safety Instrumented System Attack, TEMP.Veles engaged in network reconnaissance against targets of interest.
Technique: T1595 Active Scanning, Tactic: TA0043 Reconnaissance
TeamTNT has scanned specific lists of target IP addresses.
Technique: T1595.001 Active Scanning: Scanning IP Blocks, Tactic: TA0043 Reconnaissance
During Cutting Edge, threat actors used the publicly available Interactsh tool to identify Ivanti Connect Secure VPNs vulnerable to CVE-2024-21893.
Technique: T1595.002 Active Scanning: Vulnerability Scanning, Tactic: TA0043 Reconnaissance
APT28 has performed large-scale scans in an attempt to find vulnerable servers.
Technique: T1595.002 Active Scanning: Vulnerability Scanning, Tactic: TA0043 Reconnaissance
APT29 has conducted widespread scanning of target environments to identify vulnerabilities for exploit.
Technique: T1595.002 Active Scanning: Vulnerability Scanning, Tactic: TA0043 Reconnaissance
APT41 used the Acunetix SQL injection vulnerability scanner in target reconnaissance operations, as well as the JexBoss tool to identify vulnerabilities in Java applications.
Technique: T1595.002 Active Scanning: Vulnerability Scanning, Tactic: TA0043 Reconnaissance
Aquatic Panda has used publicly accessible DNS logging services to identify servers vulnerable to Log4j (CVE 2021-44228).
Technique: T1595.002 Active Scanning: Vulnerability Scanning, Tactic: TA0043 Reconnaissance
Dragonfly has scanned targeted systems for vulnerable Citrix and Microsoft Exchange services.
Technique: T1595.002 Active Scanning: Vulnerability Scanning, Tactic: TA0043 Reconnaissance
Earth Lusca has scanned for vulnerabilities in the public-facing servers of their targets.
Technique: T1595.002 Active Scanning: Vulnerability Scanning, Tactic: TA0043 Reconnaissance
Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to CVE-2021-44228 in Log4j and ProxyShell vulnerabilities; CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in on-premises MS Exchange Servers; and CVE-2018-13379 in Fortinet FortiOS SSL VPNs.
Technique: T1595.002 Active Scanning: Vulnerability Scanning, Tactic: TA0043 Reconnaissance
Sandworm Team has scanned network infrastructure for vulnerabilities as part of its operational planning.
Technique: T1595.002 Active Scanning: Vulnerability Scanning, Tactic: TA0043 Reconnaissance
TeamTNT has scanned for vulnerabilities in IoT devices and other related resources such as the Docker API.
Technique: T1595.002 Active Scanning: Vulnerability Scanning, Tactic: TA0043 Reconnaissance
Volatile Cedar has performed vulnerability scans of the target server.
Technique: T1595.002 Active Scanning: Vulnerability Scanning, Tactic: TA0043 Reconnaissance
APT41 leverages various tools and frameworks to brute-force directories on web servers.
Technique: T1595.003 Active Scanning: Wordlist Scanning, Tactic: TA0043 Reconnaissance
Volatile Cedar has used DirBuster and GoBuster to brute force web directories and DNS subdomains.
Technique: T1595.003 Active Scanning: Wordlist Scanning, Tactic: TA0043 Reconnaissance
APT41 uses the Chinese website fofa.su, similar to the Shodan scanning service, for passive scanning of victims.
Technique: T1596.005 Search Open Technical Databases: Scan Databases, Tactic: TA0043 Reconnaissance
EXOTIC LILY has searched for information on targeted individuals on business databases including RocketReach and CrunchBase.
Technique: T1597 Search Closed Sources, Tactic: TA0043 Reconnaissance
LAPSUS$ has purchased credentials and session tokens from criminal underground forums.
Technique: T1597.002 Search Closed Sources: Purchase Technical Data, Tactic: TA0043 Reconnaissance
APT28 has used spearphishing to compromise credentials.
Technique: T1598 Phishing for Information, Tactic: TA0043 Reconnaissance
Scattered Spider has used a combination of credential phishing and social engineering to capture one-time-password (OTP) codes.
Technique: T1598 Phishing for Information, Tactic: TA0043 Reconnaissance
ZIRCONIUM targeted presidential campaign staffers with credential phishing e-mails.
Technique: T1598 Phishing for Information, Tactic: TA0043 Reconnaissance
During C0027, Scattered Spider sent Telegram messages impersonating IT personnel to harvest credentials.
Technique: T1598.001 Phishing for Information: Spearphishing Service, Tactic: TA0043 Reconnaissance
Dragonfly has used spearphishing with Microsoft Office attachments to enable harvesting of user credentials.
Technique: T1598.002 Phishing for Information: Spearphishing Attachment, Tactic: TA0043 Reconnaissance
SideCopy has crafted generic lures for spam campaigns to collect emails and credentials for targeting efforts.
Technique: T1598.002 Phishing for Information: Spearphishing Attachment, Tactic: TA0043 Reconnaissance
Sidewinder has sent e-mails with malicious attachments that lead victims to credential harvesting websites.
Technique: T1598.002 Phishing for Information: Spearphishing Attachment, Tactic: TA0043 Reconnaissance
APT28 has conducted credential phishing campaigns with embedded links to attacker-controlled domains.
Technique: T1598.003 Phishing for Information: Spearphishing Link, Tactic: TA0043 Reconnaissance
APT32 has used malicious links to direct users to web pages designed to harvest credentials.
Technique: T1598.003 Phishing for Information: Spearphishing Link, Tactic: TA0043 Reconnaissance
Dragonfly has used spearphishing with PDF attachments containing malicious links that redirected to credential harvesting websites.
Technique: T1598.003 Phishing for Information: Spearphishing Link, Tactic: TA0043 Reconnaissance
Kimsuky has used links in e-mail to steal account information.
Technique: T1598.003 Phishing for Information: Spearphishing Link, Tactic: TA0043 Reconnaissance
Magic Hound has used SMS and email messages with links designed to steal credentials or track victims.
Technique: T1598.003 Phishing for Information: Spearphishing Link, Tactic: TA0043 Reconnaissance
Mustang Panda has delivered web bugs to profile their intended targets.
Technique: T1598.003 Phishing for Information: Spearphishing Link, Tactic: TA0043 Reconnaissance
Patchwork has used embedded image tags (known as web bugs) with unique, per-recipient tracking links in their emails for the purpose of identifying which recipients opened messages.
Technique: T1598.003 Phishing for Information: Spearphishing Link, Tactic: TA0043 Reconnaissance
Sandworm Team has crafted spearphishing emails with hyperlinks designed to trick unwitting recipients into revealing their account credentials.
Technique: T1598.003 Phishing for Information: Spearphishing Link, Tactic: TA0043 Reconnaissance
Sidewinder has sent e-mails with malicious links to credential harvesting websites.
Technique: T1598.003 Phishing for Information: Spearphishing Link, Tactic: TA0043 Reconnaissance
Silent Librarian has used links in e-mails to direct victims to credential harvesting websites designed to appear like the targeted organization's login page.
Technique: T1598.003 Phishing for Information: Spearphishing Link, Tactic: TA0043 Reconnaissance
ZIRCONIUM has used web beacons in e-mails to track hits to attacker-controlled URL's.
Technique: T1598.003 Phishing for Information: Spearphishing Link, Tactic: TA0043 Reconnaissance
AADInternals can send phishing emails containing malicious links designed to collect users’ credentials.
Technique: T1598.003 Phishing for Information: Spearphishing Link, Tactic: TA0043 Reconnaissance
SMOKEDHAM has been delivered via malicious links in phishing emails.
Technique: T1598.003 Phishing for Information: Spearphishing Link, Tactic: TA0043 Reconnaissance
During C0027, Scattered Spider used phone calls to instruct victims to navigate to credential-harvesting websites.
Technique: T1598.004 Phishing for Information: Spearphishing Voice, Tactic: TA0043 Reconnaissance
LAPSUS$ has called victims' help desk to convince the support personnel to reset a privileged account’s credentials.
Technique: T1598.004 Phishing for Information: Spearphishing Voice, Tactic: TA0043 Reconnaissance
During C0027, Scattered Spider used phone calls to instruct victims to navigate to credential-harvesting websites.

Scattered Spider has also called employees at target organizations and compelled them to navigate to fake login portals using adversary-in-the-middle toolkits.
Technique: T1598.004 Phishing for Information: Spearphishing Voice, Tactic: TA0043 Reconnaissance
SYNful Knock is malware that is inserted into a network device by patching the operating system image.
Technique: T1601.001 Modify System Image: Patch System Image, Tactic: TA0005 Defense Evasion
During the SolarWinds Compromise, APT29 bypassed MFA set on OWA accounts by generating a cookie value from a previously stolen secret key.
Technique: T1606.001 Forge Web Credentials: Web Cookies, Tactic: TA0006 Credential Access
During the SolarWinds Compromise, APT29 created tokens using compromised SAML signing certificates.
Technique: T1606.002 Forge Web Credentials: SAML Tokens, Tactic: TA0006 Credential Access
AADInternals can be used to create SAML tokens using the AD Federated Services token signing certificate.
Technique: T1606.002 Forge Web Credentials: SAML Tokens, Tactic: TA0006 Credential Access
Mustang Panda has used servers under their control to validate tracking pixels sent to phishing victims.
Technique: T1608 Stage Capabilities, Tactic: TA0042 Resource Development
For C0010, UNC3890 actors staged malware on their infrastructure for direct download onto a compromised system.
Technique: T1608.001 Stage Capabilities: Upload Malware, Tactic: TA0042 Resource Development
For C0011, Transparent Tribe hosted malicious documents on domains registered by the group.
Technique: T1608.001 Stage Capabilities: Upload Malware, Tactic: TA0042 Resource Development
For C0021, the threat actors uploaded malware to websites under their control.
Technique: T1608.001 Stage Capabilities: Upload Malware, Tactic: TA0042 Resource Development
During Night Dragon, threat actors uploaded commonly available hacker tools to compromised web servers.
Technique: T1608.001 Stage Capabilities: Upload Malware, Tactic: TA0042 Resource Development
For Operation Dream Job, Lazarus Group used compromised servers to host malware.
Technique: T1608.001 Stage Capabilities: Upload Malware, Tactic: TA0042 Resource Development
For Operation Sharpshooter, the threat actors staged malicious files on Dropbox and other websites.
Technique: T1608.001 Stage Capabilities: Upload Malware, Tactic: TA0042 Resource Development
For Operation Spalax, the threat actors staged malware and malicious files in legitimate hosting services such as OneDrive or MediaFire.
Technique: T1608.001 Stage Capabilities: Upload Malware, Tactic: TA0042 Resource Development
APT32 has hosted malicious payloads in Dropbox, Amazon S3, and Google Drive for use during targeting.
Technique: T1608.001 Stage Capabilities: Upload Malware, Tactic: TA0042 Resource Development
BITTER has registered domains to stage payloads.
Technique: T1608.001 Stage Capabilities: Upload Malware, Tactic: TA0042 Resource Development
EXOTIC LILY  has uploaded malicious payloads to file-sharing services including TransferNow, TransferXL, WeTransfer, and OneDrive.
Technique: T1608.001 Stage Capabilities: Upload Malware, Tactic: TA0042 Resource Development
Earth Lusca has staged malware and malicious files on compromised web servers, GitHub, and Google Drive.
Technique: T1608.001 Stage Capabilities: Upload Malware, Tactic: TA0042 Resource Development
FIN7 has staged legitimate software, that was trojanized to contain an Atera agent installer, on Amazon S3.
Technique: T1608.001 Stage Capabilities: Upload Malware, Tactic: TA0042 Resource Development
Gamaredon Group has registered domains to stage payloads.
Technique: T1608.001 Stage Capabilities: Upload Malware, Tactic: TA0042 Resource Development
HEXANE has staged malware on fraudulent websites set up to impersonate targeted organizations.
Technique: T1608.001 Stage Capabilities: Upload Malware, Tactic: TA0042 Resource Development
Kimsuky has used Blogspot to host malicious content such as beacons, file exfiltrators, and implants.
Technique: T1608.001 Stage Capabilities: Upload Malware, Tactic: TA0042 Resource Development
LazyScripter has hosted open-source remote access Trojans used in its operations in GitHub.
Technique: T1608.001 Stage Capabilities: Upload Malware, Tactic: TA0042 Resource Development
LuminousMoth has hosted malicious payloads on Dropbox.
Technique: T1608.001 Stage Capabilities: Upload Malware, Tactic: TA0042 Resource Development
Mustang Panda has hosted malicious payloads on DropBox including PlugX.
Technique: T1608.001 Stage Capabilities: Upload Malware, Tactic: TA0042 Resource Development
Mustard Tempest has hosted payloads on acquired second-stage servers for periods of either days, weeks, or months.
Technique: T1608.001 Stage Capabilities: Upload Malware, Tactic: TA0042 Resource Development
SideCopy has used compromised domains to host its malicious payloads.
Technique: T1608.001 Stage Capabilities: Upload Malware, Tactic: TA0042 Resource Development
TA2541 has uploaded malware to various platforms including Google Drive, Pastetext, Sharetext, and GitHub.
Technique: T1608.001 Stage Capabilities: Upload Malware, Tactic: TA0042 Resource Development
TA505 has staged malware on actor-controlled domains.
Technique: T1608.001 Stage Capabilities: Upload Malware, Tactic: TA0042 Resource Development
TeamTNT has uploaded backdoored Docker images to Docker Hub.
Technique: T1608.001 Stage Capabilities: Upload Malware, Tactic: TA0042 Resource Development
Threat Group-3390 has hosted malicious payloads on Dropbox.
Technique: T1608.001 Stage Capabilities: Upload Malware, Tactic: TA0042 Resource Development
For C0010, UNC3890 actors staged tools on their infrastructure to download directly onto a compromised system.
Technique: T1608.002 Stage Capabilities: Upload Tool, Tactic: TA0042 Resource Development
For Operation Dream Job, Lazarus Group used multiple servers to host malicious tools.
Technique: T1608.002 Stage Capabilities: Upload Tool, Tactic: TA0042 Resource Development
Threat Group-3390 has staged tools, including gsecdump and WCE, on previously compromised websites.
Technique: T1608.002 Stage Capabilities: Upload Tool, Tactic: TA0042 Resource Development
For C0010, the threat actors compromised the login page of a legitimate Israeli shipping company and likely established a watering hole that collected visitor information.
Technique: T1608.004 Stage Capabilities: Drive-by Target, Tactic: TA0042 Resource Development
APT32 has stood up websites containing numerous articles and content scraped from the Internet to make them appear legitimate, but some of these pages include malicious JavaScript to profile the potential victim or infect them via a fake software update.
Technique: T1608.004 Stage Capabilities: Drive-by Target, Tactic: TA0042 Resource Development
Dragonfly has compromised websites to redirect traffic and to host exploit kits.
Technique: T1608.004 Stage Capabilities: Drive-by Target, Tactic: TA0042 Resource Development
FIN7 has compromised a digital product website and modified multiple download links to point to trojanized versions of offered digital products.
Technique: T1608.004 Stage Capabilities: Drive-by Target, Tactic: TA0042 Resource Development
LuminousMoth has redirected compromised machines to an actor-controlled webpage through HTML injection.
Technique: T1608.004 Stage Capabilities: Drive-by Target, Tactic: TA0042 Resource Development
Mustard Tempest has injected malicious JavaScript into compromised websites to infect victims via drive-by download.
Technique: T1608.004 Stage Capabilities: Drive-by Target, Tactic: TA0042 Resource Development
Threat Group-3390 has embedded malicious code into websites to screen a potential victim's IP address and then exploit their browser if they are of interest.
Technique: T1608.004 Stage Capabilities: Drive-by Target, Tactic: TA0042 Resource Development
Transparent Tribe has set up websites with malicious hyperlinks and iframes to infect targeted victims with Crimson, njRAT, and other malicious tools.
Technique: T1608.004 Stage Capabilities: Drive-by Target, Tactic: TA0042 Resource Development
LuminousMoth has created a link to a Dropbox file that has been used in their spear-phishing operations.
Technique: T1608.005 Stage Capabilities: Link Target, Tactic: TA0042 Resource Development
Silent Librarian has cloned victim organization login pages and staged them for later use in credential harvesting campaigns. Silent Librarian has also made use of a variety of URL shorteners for these staged websites.
Technique: T1608.005 Stage Capabilities: Link Target, Tactic: TA0042 Resource Development
Mustard Tempest has poisoned search engine results to return fake software updates in order to distribute malware.
Technique: T1608.006 Stage Capabilities: SEO Poisoning, Tactic: TA0042 Resource Development
TeamTNT executed Hildegard through the kubelet API run command and by executing commands on running containers.
Technique: T1609 Container Administration Command, Tactic: TA0002 Execution
Hildegard was executed through the kubelet API run command and by executing commands on running containers.
Technique: T1609 Container Administration Command, Tactic: TA0002 Execution
Kinsing was executed with an Ubuntu container entry point that runs shell scripts.
Technique: T1609 Container Administration Command, Tactic: TA0002 Execution
Peirates can use `kubectl` or the Kubernetes API to run commands.
Technique: T1609 Container Administration Command, Tactic: TA0002 Execution
Siloscape can send kubectl commands to victim clusters through an IRC channel and can run kubectl locally to spread once within a victim cluster.
Technique: T1609 Container Administration Command, Tactic: TA0002 Execution
TeamTNT has deployed different types of containers into victim environments to facilitate execution. TeamTNT has also transferred cryptocurrency mining software to Kubernetes clusters discovered within local IP address ranges.
Technique: T1610 Deploy Container, Tactic: TA0005 Defense Evasion TA0002 Execution
Doki was run through a deployed container.
Technique: T1610 Deploy Container, Tactic: TA0005 Defense Evasion TA0002 Execution
Kinsing was run through a deployed Ubuntu container.
Technique: T1610 Deploy Container, Tactic: TA0005 Defense Evasion TA0002 Execution
Peirates can deploy a pod that mounts its node’s root file system, then execute a command to create a reverse shell on the node.
Technique: T1610 Deploy Container, Tactic: TA0005 Defense Evasion TA0002 Execution
TeamTNT has deployed privileged containers that mount the filesystem of victim machine.
Technique: T1611 Escape to Host, Tactic: TA0004 Privilege Escalation
Doki’s container was configured to bind the host root directory.
Technique: T1611 Escape to Host, Tactic: TA0004 Privilege Escalation
Hildegard has used the BOtB tool that can break out of containers.
Technique: T1611 Escape to Host, Tactic: TA0004 Privilege Escalation
Peirates can gain a reverse shell on a host node by mounting the Kubernetes hostPath.
Technique: T1611 Escape to Host, Tactic: TA0004 Privilege Escalation
Siloscape maps the host’s C drive to the container by creating a global symbolic link to the host through the calling of `NtSetInformationSymbolicLink`.
Technique: T1611 Escape to Host, Tactic: TA0004 Privilege Escalation
TeamTNT has checked for running containers with `docker ps` and for specific container names with `docker inspect`. TeamTNT has also searched for Kubernetes pods running in a local network.
Technique: T1613 Container and Resource Discovery, Tactic: TA0007 Discovery
Hildegard has used masscan to search for kubelets and the kubelet API for additional running containers.
Technique: T1613 Container and Resource Discovery, Tactic: TA0007 Discovery
Peirates can enumerate Kubernetes pods in a given namespace.
Technique: T1613 Container and Resource Discovery, Tactic: TA0007 Discovery
SideCopy has identified the country location of a compromised host.
Technique: T1614 System Location Discovery, Tactic: TA0007 Discovery
Amadey does not run any tasks or install additional malware if the victim machine is based in Russia.
Technique: T1614 System Location Discovery, Tactic: TA0007 Discovery
Crimson can identify the geographical location of a victim host.
Technique: T1614 System Location Discovery, Tactic: TA0007 Discovery
DarkGate queries system locale information during execution. Later versions of DarkGate query `GetSystemDefaultLCID` for locale information to determine if the malware is executing in Russian-speaking countries.
Technique: T1614 System Location Discovery, Tactic: TA0007 Discovery
DarkWatchman can identity the OS locale of a compromised host.
Technique: T1614 System Location Discovery, Tactic: TA0007 Discovery
GrimAgent can identify the country code on a compromised host.
Technique: T1614 System Location Discovery, Tactic: TA0007 Discovery
QuasarRAT can determine the country a victim host is located in.
Technique: T1614 System Location Discovery, Tactic: TA0007 Discovery
Before executing malicious code, Ragnar Locker checks the Windows API `GetLocaleInfoW` and doesn't encrypt files if it finds a former Soviet country.
Technique: T1614 System Location Discovery, Tactic: TA0007 Discovery
SDBbot can collected the country code of a compromised machine.
Technique: T1614 System Location Discovery, Tactic: TA0007 Discovery
Saint Bot has conducted system locale checks to see if the compromised host is in Russia, Ukraine, Belarus, Armenia, Kazakhstan, or Moldova.
Technique: T1614 System Location Discovery, Tactic: TA0007 Discovery
SocGholish can use IP-based geolocation to limit infections to victims in North America, Europe, and a small number of Asian-Pacific nations.
Technique: T1614 System Location Discovery, Tactic: TA0007 Discovery
During Operation Dream Job, Lazarus Group deployed malware designed not to run on computers set to Korean, Japanese, or Chinese in Windows language preferences.
Technique: T1614.001 System Location Discovery: System Language Discovery, Tactic: TA0007 Discovery
Ke3chang has used implants to collect the system language ID of a compromised machine.
Technique: T1614.001 System Location Discovery: System Language Discovery, Tactic: TA0007 Discovery
Malteiro will terminate Mispadu's infection process if the language of the victim machine is not Spanish or Portuguese.
Technique: T1614.001 System Location Discovery: System Language Discovery, Tactic: TA0007 Discovery
Avaddon checks for specific keyboard layouts and OS languages to avoid targeting Commonwealth of Independent States (CIS) entities.
Technique: T1614.001 System Location Discovery: System Language Discovery, Tactic: TA0007 Discovery
Bazar can perform a check to ensure that the operating system's keyboard and language settings are not set to Russian.
Technique: T1614.001 System Location Discovery: System Language Discovery, Tactic: TA0007 Discovery
Clop has checked the keyboard language using the GetKeyboardLayout() function to avoid installation on Russian-language or other Commonwealth of Independent States-language machines; it will also check the `GetTextCharset` function.
Technique: T1614.001 System Location Discovery: System Language Discovery, Tactic: TA0007 Discovery
Cuba can check if Russian language is installed on the infected machine by using the function `GetKeyboardLayoutList`.
Technique: T1614.001 System Location Discovery: System Language Discovery, Tactic: TA0007 Discovery
Some versions of DEATHRANSOM have performed language ID and keyboard layout checks; if either of these matched Russian, Kazakh, Belarusian, Ukrainian or Tatar DEATHRANSOM would exit.
Technique: T1614.001 System Location Discovery: System Language Discovery, Tactic: TA0007 Discovery
DropBook has checked for the presence of Arabic language in the infected machine's settings.
Technique: T1614.001 System Location Discovery: System Language Discovery, Tactic: TA0007 Discovery
Flagpro can check whether the target system is using Japanese, Taiwanese, or English through detection of specific Windows Security and Internet Explorer dialog.
Technique: T1614.001 System Location Discovery: System Language Discovery, Tactic: TA0007 Discovery
GrimAgent has used `Accept-Language` to identify hosts in the United Kingdom, United States, France, and Spain.
Technique: T1614.001 System Location Discovery: System Language Discovery, Tactic: TA0007 Discovery
MarkiRAT can use the `GetKeyboardLayout` API to check if a compromised host's keyboard is set to Persian.
Technique: T1614.001 System Location Discovery: System Language Discovery, Tactic: TA0007 Discovery
Maze has checked the language of the machine with function `GetUserDefaultUILanguage` and terminated execution if the language matches with an entry in the predefined list.
Technique: T1614.001 System Location Discovery: System Language Discovery, Tactic: TA0007 Discovery
Misdat has attempted to detect if a compromised host had a Japanese keyboard via the Windows API call `GetKeyboardType`.
Technique: T1614.001 System Location Discovery: System Language Discovery, Tactic: TA0007 Discovery
Mispadu checks and will terminate execution if the compromised system’s language ID is not Spanish or Portuguese.
Technique: T1614.001 System Location Discovery: System Language Discovery, Tactic: TA0007 Discovery
Neoichor can identify the system language on a compromised host.
Technique: T1614.001 System Location Discovery: System Language Discovery, Tactic: TA0007 Discovery
REvil can check the system language using `GetUserDefaultUILanguage` and `GetSystemDefaultUILanguage`. If the language is found in the list, the process terminates.
Technique: T1614.001 System Location Discovery: System Language Discovery, Tactic: TA0007 Discovery
Ryuk has been observed to query the registry key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language` and the value `InstallLanguage`. If the machine has the value 0x419 (Russian), 0x422 (Ukrainian), or 0x423 (Belarusian), it stops execution.
Technique: T1614.001 System Location Discovery: System Language Discovery, Tactic: TA0007 Discovery
S-Type has attempted to determine if a compromised system was using a Japanese keyboard via the `GetKeyboardType` API call.
Technique: T1614.001 System Location Discovery: System Language Discovery, Tactic: TA0007 Discovery
SharpStage  has been used to target Arabic-speaking users and used code that checks if the compromised machine has the Arabic language installed.
Technique: T1614.001 System Location Discovery: System Language Discovery, Tactic: TA0007 Discovery
Spark has checked the results of the `GetKeyboardLayoutList` and the language name returned by `GetLocaleInfoA` to make sure they contain the word “Arabic” before executing.
Technique: T1614.001 System Location Discovery: System Language Discovery, Tactic: TA0007 Discovery
SynAck lists all the keyboard layouts installed on the victim’s system using `GetKeyboardLayoutList` API and checks against a hardcoded language code list. If a match if found, SynAck sleeps for 300 seconds and then exits without encrypting files.
Technique: T1614.001 System Location Discovery: System Language Discovery, Tactic: TA0007 Discovery
XCSSET uses AppleScript to check the host's language and location with the command `user locale of (get system info)`.
Technique: T1614.001 System Location Discovery: System Language Discovery, Tactic: TA0007 Discovery
Zeus Panda queries the system's keyboard mapping to determine the language used on the system. It will terminate execution if it detects LANG_RUSSIAN, LANG_BELARUSIAN, LANG_KAZAK, or LANG_UKRAINIAN.
Technique: T1614.001 System Location Discovery: System Language Discovery, Tactic: TA0007 Discovery
Turla surveys a system upon check-in to discover Group Policy details using the `gpresult` command.
Technique: T1615 Group Policy Discovery, Tactic: TA0007 Discovery
BloodHound has the ability to collect local admin information via GPO.
Technique: T1615 Group Policy Discovery, Tactic: TA0007 Discovery
Emissary has the capability to execute `gpresult`.
Technique: T1615 Group Policy Discovery, Tactic: TA0007 Discovery
Empire includes various modules for enumerating Group Policy.
Technique: T1615 Group Policy Discovery, Tactic: TA0007 Discovery
Pacu can enumerate AWS storage services, such as S3 buckets and Elastic Block Store volumes.
Technique: T1619 Cloud Storage Object Discovery, Tactic: TA0007 Discovery
Peirates can list AWS S3 buckets.
Technique: T1619 Cloud Storage Object Discovery, Tactic: TA0007 Discovery
Lazarus Group has changed memory protection permissions then overwritten in memory DLL function code with shellcode, which was later executed via KernelCallbackTable hijacking. Lazarus Group has also used shellcode within macros to decrypt and manually map DLLs into memory at runtime.
Technique: T1620 Reflective Code Loading, Tactic: TA0005 Defense Evasion
BADHATCH can copy a large byte array of 64-bit shellcode into process memory and execute it with a call to `CreateThread`.
Technique: T1620 Reflective Code Loading, Tactic: TA0005 Defense Evasion
Brute Ratel C4 has used reflective loading to execute malicious DLLs.
Technique: T1620 Reflective Code Loading, Tactic: TA0005 Defense Evasion
Cobalt Strike's `execute-assembly` command can run a .NET executable within the memory of a sacrificial process by loading the CLR.
Technique: T1620 Reflective Code Loading, Tactic: TA0005 Defense Evasion
Cuba loaded the payload into memory using PowerShell.
Technique: T1620 Reflective Code Loading, Tactic: TA0005 Defense Evasion
Donut can generate code modules that enable in-memory execution of VBScript, JScript, EXE, DLL, and dotNET payloads.
Technique: T1620 Reflective Code Loading, Tactic: TA0005 Defense Evasion
Emotet has reflectively loaded payloads into memory.
Technique: T1620 Reflective Code Loading, Tactic: TA0005 Defense Evasion
FoggyWeb's loader has reflectively loaded .NET-based assembly/payloads into memory.
Technique: T1620 Reflective Code Loading, Tactic: TA0005 Defense Evasion
Gelsemium can use custom shellcode to map embedded DLLs into memory.
Technique: T1620 Reflective Code Loading, Tactic: TA0005 Defense Evasion
IceApple can use reflective code loading to load .NET assemblies into `MSExchangeOWAAppPool` on targeted Exchange servers.
Technique: T1620 Reflective Code Loading, Tactic: TA0005 Defense Evasion
Lokibot has reflectively loaded the decoded DLL into memory.
Technique: T1620 Reflective Code Loading, Tactic: TA0005 Defense Evasion
PowerSploit reflectively loads a Windows PE file into a process.
Technique: T1620 Reflective Code Loading, Tactic: TA0005 Defense Evasion
Sardonic has a plugin system that can load specially made DLLs into memory and execute their functions.
Technique: T1620 Reflective Code Loading, Tactic: TA0005 Defense Evasion
ThiefQuest uses various API functions such as `NSCreateObjectFileImageFromMemory` to load and link in-memory payloads.
Technique: T1620 Reflective Code Loading, Tactic: TA0005 Defense Evasion
Uroburos has the ability to load new modules directly into memory using its `Load Modules Mem` command.
Technique: T1620 Reflective Code Loading, Tactic: TA0005 Defense Evasion
WhisperGate's downloader can reverse its third stage file bytes and reflectively load the file as a .NET assembly.
Technique: T1620 Reflective Code Loading, Tactic: TA0005 Defense Evasion
metaMain has reflectively loaded a DLL to read, decrypt, and load an orchestrator file.
Technique: T1620 Reflective Code Loading, Tactic: TA0005 Defense Evasion
During C0027, Scattered Spider attempted to gain access by continuously sending MFA messages to the victim until they accept the MFA push challenge.
Technique: T1621 Multi-Factor Authentication Request Generation, Tactic: TA0006 Credential Access
APT29 has used repeated MFA requests to gain access to victim accounts.
Technique: T1621 Multi-Factor Authentication Request Generation, Tactic: TA0006 Credential Access