sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
Windigo has used a script to gather credentials in files left on disk by OpenSSH backdoors.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Wizard Spider has collected data from a compromised host prior to exfiltration.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
menuPass has collected various files from the compromised computers.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Action RAT can collect local data from an infected machine.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Amadey can collect information from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
AppleSeed can collect data on a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
AuTo Stealer can collect data such as PowerPoint files, Word documents, Excel files, PDF files, text files, database files, and image files from an infected machine.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
BADFLICK has uploaded files from victims' machines.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
When it first starts, BADNEWS crawls the victim's local drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
BLINDINGCAN has uploaded files from victim machines.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
BadPatch collects files from the local system that have the following extensions, then prepares them for exfiltration: .xls, .xlsx, .pdf, .mdb, .rar, .zip, .doc, .docx.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Bandook can collect local files from the system .
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Bankshot collects files from the local system.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Bazar can retrieve information from the infected machine.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Bisonal has collected information from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
BlackMould can copy files on a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
BoxCaon can upload files from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Brute Ratel C4 has the ability to upload files from a compromised system.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Bumblebee can capture and compress stolen credentials from the Registry and volume shadow copies.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Calisto can collect data from user directories.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Caterpillar WebShell has a module to collect information from the local database.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
CharmPower can collect data and files from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
China Chopper's server component can upload local files.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Chrommme can collect data from a local system.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Clambling can collect information from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Cobalt Strike can collect data from a local system.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
CookieMiner has retrieved iPhone text messages from iTunes phone backup files.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
CosmicDuke steals user files from local hard drives with file extensions that match a predefined list.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
CreepyDrive can upload files to C2 from victim machines.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Crimson can collect information from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Crutch can exfiltrate files from compromised systems.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Cryptoistic can retrieve files from the local file system.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Cyclops Blink can upload files from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
DRATzarus can collect information from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
DanBot can upload files from compromised hosts.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
DarkWatchman can collect files from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
DnsSystem can upload files from infected machines after receiving a command with `uploaddd` in the string.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Drovorub can transfer files from the victim machine.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Dtrack can collect a variety of information from victim machines.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
EnvyScout can collect sensitive NTLM material from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system. FLASHFLOOD will scan the My Recent Documents, Desktop, Temporary Internet Files, and TEMP directories. FLASHFLOOD also collects information stored in the Windows Address Book.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
FatDuke can copy files and directories from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Flagpro can collect data from a compromised host, including Windows authentication information.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
FlawedAmmyy has collected information and files from a compromised machine.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
FoggyWeb can retrieve configuration data from a compromised AD FS server.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Forfiles can be used to act on (ex: copy, move, etc.) files/directories in a system during (ex: copy files into a staging area before).
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
FrameworkPOS can collect elements related to credit card data from process memory.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
FunnyDream can upload files from victims' machines.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Gelsemium can collect data from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Goopy has the ability to exfiltrate documents from infected systems.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
GravityRAT steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Green Lambert can collect data from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
GrimAgent can collect data and files from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Hikit can upload files from compromised machines.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Hydraq creates a backdoor through which remote attackers can read data from files.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
IceApple can collect files, passwords, and other data from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
InvisiMole can collect data from the system, and can monitor changes in specified directories.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Ixeshe can collect data from a local system.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
KGH_SPY can send a file containing victim system information to C2.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
KONNI has stored collected information and discovered processes in a tmp file.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
KOPILUWAK can gather information from compromised hosts.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Kazuar uploads files from a specified directory to the C2 server.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Kevin can upload logs and other data from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Koadic can download files off the target system to send back to the server.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
LightNeuron can collect files from a local system.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Linfo creates a backdoor through which remote attackers can obtain data from local systems.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
LoFiSe can collect files of interest from targeted systems.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
MCMD has the ability to upload files from an infected device.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
MacMa can collect then exfiltrate files from the compromised system.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Machete searches the File system for files of interest.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Mafalda can collect files and information from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
MarkiRAT can upload data from the victim's machine to the C2 server.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Milan can upload files from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Mis-Type has collected files and data from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Misdat has collected files and data from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
MobileOrder exfiltrates data collected from the victim mobile device.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Mongall has the ability to upload files from victim's machines.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Nebulae has the capability to upload collected files to C2.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Neoichor can upload files from a victim's machine.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
NightClub can use a file monitor to steal specific files from targeted systems.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
OSX_OCEANLOTUS.D has the ability to upload files from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Octopus can exfiltrate files from the system using a documents collector tool.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Out1 can copy files and Registry data from compromised hosts.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
OutSteel can collect information from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
P.A.S. Webshell has the ability to copy files on a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
POWERSTATS can upload files from compromised hosts.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
PUNCHTRACK scrapes memory for properly formatted payment card data.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Pasam creates a backdoor through which remote attackers can retrieve files.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
PcShare can collect files and information from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Pcexter can upload files from targeted systems.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Pillowmint has collected credit card data using native API functions.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
PinchDuke collects user files from the compromised host based on predefined file extensions.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
PingPull can collect data from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
PoisonIvy creates a backdoor through which remote attackers can steal system information.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
PowerLess has the ability to exfiltrate data, including Chrome and Edge browser database files, from compromised machines.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
PowerSploit contains a collection of Exfiltration modules that can access data from local files, volumes, and processes.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Proxysvc searches the local system and gathers data.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
QakBot can use a variety of commands, including esentutl.exe to steal sensitive data from Internet Explorer and Microsoft Edge, to acquire information that is subsequently exfiltrated.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
QuasarRAT can retrieve files from compromised client machines.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
QuietSieve can collect files from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
RAPIDPULSE retrieves files from the victim system via encrypted commands sent to the web shell.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
RCSession can collect data from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
ROKRAT can collect host data and specific file types.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
RainyDay can use a file exfiltration tool to collect recently changed files on a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Ramsay can collect Microsoft Word documents from the target's file system, as well as `.txt`, `.doc`, and `.xls` files from the Internet Explorer cache.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
RawPOS dumps memory from specific processes on a victim system, parses the dumped files, and scrapes them for credit card data.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Rising Sun has collected data and files from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Rover searches for files on local drives based on a predefined list of file extensions.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
SDBbot has the ability to access the file system on a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
SLIGHTPULSE can read files specified on the local system.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
SLOTHFULMEDIA has uploaded files and information from victim machines.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
STARWHALE can collect data from an infected local host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
SUNBURST collected information from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
SVCReady can collect data from an infected host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Saint Bot can collect files and information from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Samurai can leverage an exfiltration module to download arbitrary files from compromised machines.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Sardonic has the ability to collect data from a compromised machine to deliver to the attacker.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Shark can upload files to its C2.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
SharpDisco has dropped a recent-files stealer plugin to `C:\Users\Public\WinSrcNT\It11.exe`.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
ShimRat has the capability to upload collected files to a C2.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
SideTwist has the ability to upload files from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
SombRAT has collected data and files from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
SpicyOmelette has collected data and other information from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
StrifeWater can collect data from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
SysUpdate can collect information and files from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Taidoor can upload data and files from a victim's machine.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
TajMahal has the ability to steal documents from the local system including the print spooler queue.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
ThreatNeedle can collect data and files from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
TinyTurla can upload files from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Tomiris has the ability to collect recent files matching a hardcoded list of extensions prior to exfiltration.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
TrickBot collects local files and information from the victim’s local machine.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
USBferry can collect information from an air-gapped host machine.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Uroburos can use its `Get` command to exfiltrate specified files from the compromised system.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Ursnif has collected files from victim machines, including certificates and cookies.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
WarzoneRAT can collect data from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
WellMail can exfiltrate files from the victim machine.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
WellMess can send files from the victim machine to C2.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Wevtutil can be used to export events from a specific log.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Woody RAT can collect information from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
XCSSET collects contacts and application data from files in Desktop, Documents, Downloads, Dropbox, and WeChat folders.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Zox has the ability to upload files from a targeted system.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
ZxShell can transfer files from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
ZxxZ can collect data from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
ccf32 can collect files from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
esentutl can be used to collect data from local file systems.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
metaMain can collect files and system information from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
njRAT can collect data from a local system.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
xCaon has uploaded files from victims' machines.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
yty collects files with the following extensions: .ppt, .pptx, .pdf, .doc, .docx, .xls, .xlsx, .docm, .rtf, .inp, .xlsm, .csv, .odt, .pps, .vcf and sends them back to the C2 server.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Scattered Spider has created volume shadow copies of virtual domain controller disks to extract the `NTDS.dit` file.
Technique: T1006 Direct Volume Access, Tactic: TA0005 Defense Evasion
esentutl can use the Volume Shadow Copy service to copy locked files such as `ntds.dit`.
Technique: T1006 Direct Volume Access, Tactic: TA0005 Defense Evasion
During Operation CuckooBees, the threat actors used the `net start` command as part of their initial reconnaissance.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
During Operation Wocao, threat actors used the `tasklist` command to search for one of its backdoors.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
APT1 used the commands `net start` and `tasklist` to get a listing of the services on the system.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Aquatic Panda has attempted to discover services for third party EDR products.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
BRONZE BUTLER has used TROJ_GETVERSION to discover system services.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Chimera has used `net start` and `net use` for system service discovery.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Earth Lusca has used Tasklist to obtain information from a compromised host.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Indrik Spider has used the win32_service WMI class to retrieve a list of services from the system.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Ke3chang performs service discovery using `net start` commands.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Kimsuky has used an instrumentor script to gather the names of all services running on a victim's system.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
OilRig has used `sc query` on a victim to gather information about services.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
After compromising a victim, Poseidon Group discovers all running services.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
TeamTNT has searched for services such as Alibaba Cloud Security's aliyun service and BMC Helix Cloud Security's bmc-agent service in order to disable them.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Turla surveys a system upon check-in to discover running services and associated processes using the `tasklist /svc` command.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to obtain information about services: `net start >> %temp%\download`
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
BBSRAT can query service configuration information.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Babuk can enumerate all services running on a compromised host.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
BitPaymer can enumerate existing Windows services on the host that are configured to run as LocalSystem.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Black Basta can check whether the service name FAX is present.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Caterpillar WebShell can obtain a list of the services from a system.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Cobalt Strike can enumerate services on compromised hosts.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Comnie runs the command: `net start >> %TEMP%\info.dat` on a victim.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Cuba can query service status using `QueryServiceStatusEx` function.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
DarkTortilla can retrieve information about a compromised system's running services.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Dyre has the ability to identify running services on a compromised host.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Elise executes `net start` after initial communication is made to the remote server.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Emissary has the capability to execute the command `net start` to interact with services.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Epic uses the `tasklist /svc` command to list the services on the system.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
GeminiDuke collects information on programs and services on the victim that are configured to automatically run at startup.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
GravityRAT has a feature to list the available services on the system.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
GreyEnergy enumerates all Windows services.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Heyoka Backdoor can check if it is running as a service on a compromised host.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
HotCroissant has the ability to retrieve a list of services on the infected host.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Hydraq creates a backdoor through which remote attackers can monitor services.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
HyperBro can list all services and their configurations.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
InvisiMole can obtain running services on the victim.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Ixeshe can list running services.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
JPIN can list running services.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Kwampirs collects a list of running services with the command `tasklist /svc`.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
LookBack can enumerate services on the victim machine.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
The `net start` command can be used in Net to find information about Windows services.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
PoshC2 can enumerate service and service permission information.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
RATANKBA uses `tasklist /svc` to display running tasks.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
REvil can enumerate active services.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
RainyDay can create and register a service for execution.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
S-Type runs the command `net start` on a victim.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
SILENTTRINITY can search for modifiable services that could be used for privilege escalation.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
SLOTHFULMEDIA has the capability to enumerate services.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
SUNBURST collected a list of service names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Sardonic has the ability to execute the `net start` command.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
SombRAT can enumerate services on a victim machine.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Sykipot may use `net start` to display running services.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
SynAck enumerates all running services.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
SysUpdate can collect a list of services on a victim machine.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Tasklist can be used to discover services running on a system.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
TrickBot collects a list of install programs and services on the system’s machine.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Ursnif has gathered information about running services.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
Volgmer queries the system to identify existing services.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
WINERACK can enumerate services.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
ZLib has the ability to discover and manipulate Windows services.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
ZxShell can check the services on the system.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
jRAT can list local services.
Technique: T1007 System Service Discovery, Tactic: TA0007 Discovery
During Night Dragon, threat actors used company extranet servers as secondary C2 servers.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
APT41 used the Steam community page as a fallback mechanism for C2.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
FIN7's Harpy backdoor malware can use DNS as a backup channel for C2 if HTTP fails.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
Lazarus Group malware SierraAlfa sends data to one of the hard-coded C2 servers chosen at random, and if the transmission fails, chooses a new C2 server to attempt the transmission again.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
OilRig malware ISMAgent falls back to its DNS tunneling mechanism if it is unable to reach the C2 server over HTTP.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
Anchor can use secondary C2 servers for communication after establishing connectivity and relaying victim information to primary C2 servers.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
AppleSeed can use a second channel for C2 when the primary channel is in upload mode.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
BISCUIT malware contains a secondary fallback command and control server that is contacted after the primary command and control server.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
Bazar has the ability to use an alternative C2 server if the primary server fails.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
BlackEnergy has the capability to communicate over a backup channel via plus.google.com.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
Bumblebee can use backup C2 servers if the primary server fails.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
CHOPSTICK can switch to a new C2 channel if the current one is broken.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
Cardinal RAT can communicate over multiple C2 host and port combinations.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
CharmPower can change its C2 channel once every 360 loops by retrieving a new domain from the actors’ S3 bucket.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
Crutch has used a hardcoded GitHub repository as a fallback channel.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
Derusbi uses a backup communication method with an HTTP beacon.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
DustySky has two hard-coded domains for C2 servers; if the first does not respond, it will try the second.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
Ebury has implemented a fallback mechanism to begin using a DGA when the attacker hasn't connected to the infected system for three days.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
Exaramel for Linux can attempt to find a new C2 server if it receives an error.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
FatDuke has used several C2 servers per targeted organization.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
Gelsemium can use multiple domains and protocols in C2.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
HOPLIGHT has multiple C2 channels in place in case one fails.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
InvisiMole has been configured with several servers available for alternate C2 communications.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
JHUHUGIT tests if it can reach its C2 server by first attempting a direct connection, and if it fails, obtaining proxy settings and sending the connection through a proxy, and finally injecting code into a running browser if the proxy method fails.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
Kazuar can accept multiple URLs for C2 servers.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
Kevin can assign hard-coded fallback domains for C2.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
Kwampirs uses a large list of C2 servers that it cycles through until a successful connection is established.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
Linfo creates a backdoor through which remote attackers can change C2 servers.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
Machete has sent data over HTTP if FTP failed, and has also used a fallback server.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
MiniDuke uses Google Search to identify C2 servers if its primary C2 method via Twitter is not working.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
Mis-Type first attempts to use a Base64-encoded network protocol over a raw TCP socket for C2, and if that method fails, falls back to a secondary HTTP-based protocol to communicate to an alternate C2 server.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
Mythic can use a list of C2 URLs as fallback mechanisms in case one IP or domain gets blocked.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
NETEAGLE will attempt to detect if the infected host is configured to a proxy. If so, NETEAGLE will send beacons via an HTTP POST request; otherwise it will send beacons via UDP/6000.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
PipeMon can switch to an alternate C2 domain when a particular date has been reached.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
QUADAGENT uses multiple protocols (HTTPS, HTTP, DNS) for its C2 server as fallback channels if communication with one is unsuccessful.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
QUIETEXIT can attempt to connect to a second hard-coded C2 if the first hard-coded C2 address fails.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
RDAT has used HTTP if DNS C2 communications were not functioning.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
RainyDay has the ability to switch between TCP and HTTP for C2 if one method is not working.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
S-Type primarily uses port 80 for C2, but falls back to ports 443 or 8080 if initial communication fails.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
Shark can update its configuration to use a different C2 server.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
ShimRat has used a secondary C2 location if the first was unavailable.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
SideTwist has primarily used port 443 for C2 but can use port 80 as a fallback.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
SslMM has a hard-coded primary and backup C2 string.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
Stuxnet has the ability to generate new C2 domains.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
TAINTEDSCRIBE can randomly pick one of five hard-coded IP addresses for C2 communication; if one of the IP fails, it will wait 60 seconds and then try another IP address.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
TinyTurla can go through a list of C2 server IPs and will try to register with each until one responds.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
TrickBot can use secondary C2 servers for communication after establishing connectivity and relaying victim information to primary C2 servers.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
Uroburos can use up to 10 channels to communicate between implants.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
Valak can communicate over multiple C2 hosts.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
WinMM is usually configured with primary and backup domains for C2 communications.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
The C2 server used by XTunnel provides a port number to the victim to use as a fallback in case the connection closes on the currently used port.
Technique: T1008 Fallback Channels, Tactic: TA0011 Command and Control
HEXANE has used a PowerShell-based keylogging tool to capture the window title.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
Lazarus Group malware IndiaIndia obtains and sends to its C2 server the title of the window for each running process. The KilaAlfa keylogger also reports the title of the window in the foreground.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
Aria-body has the ability to identify the titles of running windows on a compromised host.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
Attor can obtain application window titles and then determines which windows to perform Screen Capture on.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
Cadelspy has the ability to identify open windows on the compromised host.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
Catchamas obtains application windows titles and then determines which windows to perform Screen Capture on.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
DarkGate will search for cryptocurrency wallets by examining application window names for specific strings. DarkGate extracts information collected via NirSoft tools from the hosting process's memory by first identifying the window through the `FindWindow` API function.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
DarkWatchman reports window names along with keylogger information to provide application context.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
The discovery modules used with Duqu can collect information on open windows.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
Flagpro can check the name of the window displayed on the system.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
FunnyDream has the ability to discover application windows via execution of `EnumWindows`.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
Grandoreiro can identify installed security tools based on window names.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
HotCroissant has the ability to list the names of all open windows on the infected host.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
InvisiMole can enumerate windows and child windows on a compromised host.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
Kazuar gathers information about opened windows.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
Machete saves the window names.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
Metamorfo can enumerate all windows on the victim’s machine.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
NETWIRE can discover and close windows on controlled systems.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
NetTraveler reports window names along with keylogger information to provide application context.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
NightClub can use `GetForegroundWindow` to enumerate the active window.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
PLEAD has the ability to list open windows on the compromised host.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
PoisonIvy captures window titles.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
PowerDuke has a command to get text of the current foreground window.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
QakBot has the ability to enumerate windows on a compromised host.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
ROKRAT can use  the `GetForegroundWindow` and `GetWindowText` APIs to discover where the user is typing.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
Remexi has a command to capture active windows on the machine and retrieve window titles.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
SILENTTRINITY can enumerate the active Window during keylogging through execution of `GetActiveWindowTitle`.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
SOUNDBITE is capable of enumerating application windows.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
Trojan.Karagany can monitor the titles of open windows to identify specific keywords.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
WINERACK can enumerate active windows.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
njRAT gathers information about opened windows during the initial infection.
Technique: T1010 Application Window Discovery, Tactic: TA0007 Discovery
Flame has a module named BeetleJuice that contains Bluetooth functionality that may be used in different ways, including transmitting encoded information from the infected system over the Bluetooth protocol, acting as a Bluetooth beacon, and identifying other Bluetooth devices in the vicinity.
Technique: T1011.001 Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth, Tactic: TA0010 Exfiltration
During Operation Wocao, the threat actors executed `/c cd /d c:\windows\temp\ & reg query HKEY_CURRENT_USER\Software\<username>\PuTTY\Sessions\` to detect recent PuTTY sessions, likely to further lateral movement.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
APT32's backdoor can query the Windows Registry to gather system information.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
APT39 has used various strains of malware to query the Registry.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
APT41 queried registry values to determine items such as configured RDP ports and network configurations.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Chimera has queried Registry keys using `reg query \\<host>\HKU\<SID>\SOFTWARE\Microsoft\Terminal Server Client\Servers` and `reg query \\<host>\HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Internet Settings`.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Dragonfly has queried the Registry to identify victim information.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Fox Kitten has accessed Registry hives ntuser.dat and UserClass.dat.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Kimsuky has obtained specific Registry keys and values on a compromised host.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Lazarus Group malware IndiaIndia checks Registry keys within HKCU and HKLM to determine if certain applications are present, including SecureCRT, Terminal Services, RealVNC, TightVNC, UltraVNC, Radmin, mRemote, TeamViewer, FileZilla, pcAnyware, and Remote Desktop. Another Lazarus Group malware sample checks for the presence of the following Registry key:`HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt`.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
OilRig has used `reg query “HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default”` on a victim to query the Registry.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Stealth Falcon malware attempts to determine the installed version of .NET by querying the Registry.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
A Threat Group-3390 tool can read and decrypt stored Registry values.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Turla surveys a system upon check-in to discover information in the Windows Registry with the `reg query` command. Turla has also retrieved PowerShell payloads hidden in Registry keys as well as checking keys associated with null session named pipes .
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Volt Typhoon has queried the Registry on compromised systems, `reg query hklm\software\`, for information on installed software.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
ZIRCONIUM has used a tool to query the Registry for proxy settings.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
ADVSTORESHELL can enumerate registry keys.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Attor has opened the registry and performed query searches.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Azorult can check for installed software on the system under the Registry key `Software\Microsoft\Windows\CurrentVersion\Uninstall`.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
BACKSPACE is capable of enumerating and making modifications to an infected system's Registry.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
BabyShark has executed the `reg query` command for `HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default`.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Bankshot searches for certain Registry keys to be configured before executing the payload.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Bazar can query `Windows\CurrentVersion\Uninstall` for installed applications.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
BendyBear can query the host's Registry key at `HKEY_CURRENT_USER\Console\QuickEdit` to retrieve data.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Bisonal has used the RegQueryValueExA function to retrieve proxy information in the Registry.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
BitPaymer can use the RegEnumKeyW to iterate through Registry keys.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Brave Prince gathers information about the Registry.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Bumblebee can check the Registry for specific keys.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
CHOPSTICK provides access to the Windows Registry, which can be used to gather information.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery