sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
DustySky has exfiltrated data to the C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Dyre has the ability to send information staged on a compromised host externally to C2.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
EVILNUM can upload files over the C2 channel from the infected host.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Ebury can exfiltrate SSH credentials through custom DNS queries.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Emotet has exfiltrated data over its C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Empire can send data gathered from a target through the command and control channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Flagpro has exfiltrated data to the C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
FlawedAmmyy has sent data collected from a compromised host to its C2 servers.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
FoggyWeb can remotely exfiltrate sensitive information from a compromised AD FS server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
FunnyDream can execute commands, including gathering user information, and send the results to C2.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
GoldMax can exfiltrate files over the existing C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
GoldenSpy has exfiltrated host environment information to an external C2 domain via port 9006.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Goopy has the ability to exfiltrate data over the Microsoft Outlook C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Grandoreiro can send data it retrieves to the C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
GrimAgent has sent data related to a compromise host over its C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
HAWKBALL has sent system information and files over the C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
HOPLIGHT has used its C2 channel to exfiltrate data.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
HotCroissant has the ability to download files from the infected host to the command and control (C2) server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
IceApple's Multi File Exfiltrator module can exfiltrate multiple files from a compromised host as an HTTP response over C2.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Imminent Monitor has uploaded a file containing debugger logs, network information and system information to the C2.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Industroyer sends information about hardware profiles and previously-received commands back to the C2 server in a POST-request.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
KGH_SPY can exfiltrate collected information from the host to the C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
KONNI has sent data and files to its C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
KOPILUWAK has exfiltrated collected data to its C2 via POST requests.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Kessel has exfiltrated information gathered from the infected system to the C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Kevin can send data from the victim host through a DNS C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
LightNeuron exfiltrates data over its email C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
LitePower can send collected data, including screenshots, over its C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Lokibot has the ability to initiate contact with command and control (C2) to exfiltrate stolen data.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
MacMa exfiltrates data from a supplied path over its C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Machete's collected data is exfiltrated over the same channel used for C2.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Mafalda can send network system data and files to its C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
MarkiRAT can exfiltrate locally stored data via its C2.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
MechaFlounder has the ability to send the compromised user's account name and hostname within a URL to C2.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Metamorfo can send the data it collects to the C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Mis-Type has transmitted collected files and data to its C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Misdat has uploaded files and data to its C2 servers.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Mispadu can sends the collected financial data to the C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
MobileOrder exfiltrates data to its C2 server over the same protocol as C2 communications.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Mongall can upload files and information from a compromised host to its C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
NETEAGLE is capable of reading files over the C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
NightClub can use SMTP and DNS for file exfiltration and C2.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Octopus has uploaded stolen files and data from a victim's machine over its C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Data exfiltration is done by Okrum using the already opened channel with the C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
OopsIE can upload files from the victim's machine to its C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
OutSteel can upload files from a compromised host over its C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
PcShare can upload files and information from a compromised host to its C2 servers.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Penquin can execute the command code `do_upload` to send files to C2.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
PingPull has the ability to exfiltrate stolen victim data through its C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
PoetRAT has exfiltrated data over the C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
PowerShower has used a PowerShell document stealer module to pack and exfiltrate .txt, .pdf, .xls or .doc files smaller than 5MB that were modified during the past two days.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Proxysvc performs data exfiltration over the control server channel using a custom protocol.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Psylo exfiltrates data to its C2 server over the same protocol as C2 communications.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Pteranodon exfiltrates screenshot files to its C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Pupy can send screenshots files, keylogger data, files, and recorded audio back to the C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
QakBot can send stolen information to C2 nodes including passwords, accounts, and emails.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
RDAT can exfiltrate data gathered from the infected system via the established Exchange Web Services API C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
REvil can exfiltrate host and malware information to C2 servers.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
ROKRAT can send collected files back over same C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Remexi performs exfiltration over BITSAdmin, which is also used for the C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Rising Sun can send data gathered from the infected machine via HTTP POST request to the C2.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
RotaJakiro sends device and other collected data back to the C2 using the established C2 channels over TCP.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
S-Type has uploaded data and files from a compromised host to its C2 servers.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
SDBbot has sent collected data from a compromised host to its C2 servers.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
SILENTTRINITY can transfer files from an infected host to the C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
SLOTHFULMEDIA has sent system information to a C2 server via HTTP and HTTPS POST requests.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
SMOKEDHAM has exfiltrated data to its C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
STARWHALE can exfiltrate collected data to its C2 servers.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
SUGARDUMP has sent stolen credentials and other data to its C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
SVCReady can send collected data in JSON format to its C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Shark has the ability to upload files from the compromised host over a DNS or HTTP C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
SharpDisco can load a plugin to exfiltrate stolen files to SMB shares also used in C2.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
ShimRatReporter sent generated reports to the C2 via HTTP POST requests.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
SideTwist has exfiltrated data over its C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Sliver can exfiltrate files from the victim using the `download` command.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
SombRAT has uploaded collected data and files from a compromised host to its C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Spark has exfiltrated data over the C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Squirrelwaffle has exfiltrated victim data using HTTP POST requests to its C2 servers.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
StrifeWater can send data and files from a compromised host to its C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
StrongPity can exfiltrate collected documents through C2 channels.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Stuxnet sends compromised victim information via HTTP.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
SysUpdate has exfiltrated data over its C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
TajMahal has the ability to send collected files over its C2.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
ThiefQuest exfiltrates targeted file extensions in the `/Users/` folder to the command and control server via unencrypted HTTP. Network packets contain a string with two pieces of information: a file path and the contents of the file in a base64 encoded string.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Tomiris can upload files matching a hardcoded set of extensions, such as .doc, .docx, .pdf, and .rar, to its C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Torisma can send victim data to an actor-controlled C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
TrickBot can send information about the compromised host and upload data to a hardcoded C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Ursnif has used HTTP POSTs to exfil gathered information.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Valak has the ability to exfiltrate data over the C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
WarzoneRAT can send collected victim data to its C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Woody RAT can exfiltrate files from an infected machine to its C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
XCSSET exfiltrates data stolen from a system over its C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
ZLib has sent data and files from a compromised host to its C2 servers.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Zebrocy has exfiltrated data to the designated C2 server using HTTP POST requests.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
metaMain can upload collected files and data to its C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
njRAT has used HTTP to receive stolen information from the infected machine.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
During C0018, the threat actors used the SoftPerfect Network Scanner for network scanning.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
During C0027, used RustScan to scan for open ports on targeted ESXi appliances.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
During CostaRicto, the threat actors employed nmap and pscan to scan target environments.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
During Operation Wocao, threat actors scanned for open ports and used nbtscan to find NETBIOS nameservers.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
APT32 performed network scanning on the network to search for open ports, services, OS finger-printing, and other vulnerabilities.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
APT39 has used CrackMapExec and a custom port scanner known as BLUETORCH for network scanning.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
APT41 used a malware variant called WIDETONE to conduct port scans on specified subnets.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
BackdoorDiplomacy has used SMBTouch, a vulnerability scanner, to determine whether a target is vulnerable to EternalBlue malware.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
BlackTech has used the SNScan tool to find other potential targets on victim networks.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Chimera has used the `get -b <start ip> -e <end ip> -p` command for network scanning as well as a custom Python tool  packed into a Windows executable named Get.exe to scan IP ranges for HTTP.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Cobalt Group leveraged an open-source tool called SoftPerfect Network Scanner to perform network scanning.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
DarkVishnya performed port scanning to obtain the list of active services.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
FIN13 has utilized `nmap` for reconnaissance efforts. FIN13 has also scanned for internal MS-SQL servers in a compromised network.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Fox Kitten has used tools including NMAP to conduct broad scanning to identify open ports.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Lazarus Group has used nmap from a router VM to scan ports on systems within the restricted segment of an enterprise network.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Leafminer scanned network services to search for vulnerabilities in the victim system.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Magic Hound has used KPortScan 3.0 to perform SMB, RDP, and LDAP scanning.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Naikon has used the LadonGo scanner to scan target networks.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
OilRig has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Rocke conducted scanning for exposed TCP port 7001 as well as SSH and Redis servers.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Suckfly the victim's internal network for hosts with ports 8080, 5900, and 40 open.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
TeamTNT has used masscan to search for open Docker API ports and Kubernetes clusters. TeamTNT has also used malware that utilizes zmap and zgrab to search for vulnerable services in cloud environments.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Tropic Trooper used `pr` and an openly available tool to scan for open ports on target systems.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
menuPass has used tcping.exe, similar to Ping, to probe port status on systems of interest.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
BADHATCH can check for open ports on a computer by establishing a TCP connection.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Backdoor.Oldrea can use a network scanning module to identify ICS-related ports.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
BlackEnergy has conducted port scans on a host.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Brute Ratel C4 can conduct port scanning against targeted systems.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Caterpillar WebShell has a module to use a port scanner on a system.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
China Chopper's server component can spider authentication portals.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Cobalt Strike can perform port scans from an infected host.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Conficker scans for other machines to infect.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Empire can perform port scans from an infected host.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
HDoor scans to identify open ports on the victim.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
HermeticWizard has the ability to scan ports on a compromised network.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Hildegard has used masscan to look for kubelets in the internal Kubernetes network.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Industroyer uses a custom port scanner to map out a network.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
InvisiMole can scan the network for open ports and vulnerable instances of RDP and SMB protocols.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Koadic can scan for open TCP ports on the target network.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Lucifer can scan for open ports including TCP ports 135 and 1433.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
MURKYTOP has the capability to scan for open ports on hosts in a connected network.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
NBTscan can be used to scan IP networks.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
P.A.S. Webshell can scan networks for open ports and listening services.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Peirates can initiate a port scan against a given IP address.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
PoshC2 can perform port scans from an infected host.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Pupy has a built-in module for port scanning.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Pysa can perform network reconnaissance using the Advanced Port Scanner tool.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Ramsay can scan for systems that are vulnerable to the EternalBlue exploit.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Remsec has a plugin that can perform ARP scanning as well as port scanning.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Royal can scan the network interfaces of targeted systems.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
SILENTTRINITY can scan for open ports on a compromised machine.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
SpeakUp checks for availability of specific ports on servers.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
XTunnel is capable of probing the network for open ports.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
Xbash can perform port scanning of TCP and UDP ports.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
ZxShell can launch port scans.
Technique: T1046 Network Service Discovery, Tactic: TA0007 Discovery
During the 2016 Ukraine Electric Power Attack, WMI in scripts were used for remote execution and system surveys.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
During C0015, the threat actors used `wmic` and `rundll32` to load Cobalt Strike onto a target host.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
During C0018, the threat actors used WMIC to modify administrative settings on both a local and a remote host, likely as part of the first stages for their lateral movement; they also used WMI Provider Host (`wmiprvse.exe`) to execute a variety of encoded PowerShell scripts using the `DownloadString` method.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
During C0027, Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
During Frankenstein, the threat actors used WMI queries to check if various security applications were running as well as to determine the operating system version.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
During FunnyDream, the threat actors used `wmiexec.vbs` to run remote commands.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
During Operation Dream Job, Lazarus Group used WMIC to executed a remote XSL script.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
During Operation Wocao, threat actors has used WMI to execute commands.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
During the SolarWinds Compromise, APT29 used WMI for the remote execution of files for lateral movement.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
APT29 used WMI to steal credentials and execute backdoors at a future time.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
APT32 used WMI to deploy their tools on remote machines and to gather information about the Outlook process.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Blue Mockingbird has used wmic.exe to set environment variables.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Chimera has used WMIC to execute remote commands.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Cinnamon Tempest has used Impacket for lateral movement via WMI.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
The Deep Panda group is known to utilize WMI for lateral movement.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Earth Lusca used a VBA script to execute WMI.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
FIN13 has utilized `WMI` to execute commands and move laterally on compromised Windows machines.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
FIN6 has used WMI to automate the remote execution of PowerShell scripts.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
FIN7 has used WMI to install malware on targeted systems.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
FIN8's malicious spearphishing payloads use WMI to launch malware and spawn `cmd.exe` execution. FIN8 has also used WMIC and the Impacket suite for lateral movement, as well as during and post compromise cleanup activities.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
GALLIUM used WMI for execution to assist in lateral movement as well as for installing tools across multiple assets.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Gamaredon Group has used WMI to execute scripts used for discovery.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Indrik Spider has used WMIC to execute commands on remote computers.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Lazarus Group has used WMIC for discovery as well as to execute payloads for persistence and lateral movement.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Leviathan has used WMI for execution.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Magic Hound has used a tool to run `cmd /c wmic computersystem get domain` for discovery.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
MuddyWater has used malware that leveraged WMI for execution and querying host information.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Mustang Panda has executed PowerShell scripts via WMI.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Naikon has used WMIC.exe for lateral movement.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
OilRig has used WMI for execution.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Sandworm Team has used Impacket’s WMIexec module for remote code execution and VBScript to run WMI queries.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Stealth Falcon malware gathers system information via Windows Management Instrumentation (WMI).
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
TA2541 has used WMI to query targeted systems for security products.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
A Threat Group-3390 tool can use WMI to execute a binary.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
ToddyCat has used WMI to execute scripts for post exploit document collection.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Volt Typhoon has leveraged WMIC including for execution and remote system discovery.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Windshift has used WMI to collect information about target machines.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Wizard Spider has used WMI and LDAP queries for network discovery and to move laterally. Wizard Spider has also used batch scripts to leverage WMIC to deploy ransomware.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
menuPass has used a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Action RAT can use WMI to gather AV products installed on an infected host.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Agent Tesla has used wmi queries to gather information from the system.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Akira will leverage COM objects accessed through WMI during execution to evade detection.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Astaroth uses WMIC to execute payloads.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Avaddon uses wmic.exe to delete shadow copies.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
BADHATCH can utilize WMI to collect system information, create new processes, and run malicious PowerShell scripts on a compromised machine.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Bazar can execute a WMI query to gather information about the installed antivirus engine.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Black Basta has used WMI to execute files over the network.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
BlackCat can use `wmic.exe` to delete shadow copies on compromised networks.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
A BlackEnergy 2 plug-in uses WMI to gather victim host details.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Brute Ratel C4 can use WMI to move laterally.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Bumblebee can use WMI to gather system information and to spawn processes for code injection.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
CharmPower can use `wmic` to gather information from a system.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Cobalt Strike can use WMI to deliver a payload to a remote host.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
CrackMapExec can execute remote commands using Windows Management Instrumentation.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
DEATHRANSOM has the ability to use WMI to delete volume shadow copies.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
DarkTortilla can use WMI queries to obtain system information.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
DarkWatchman can use WMI to execute commands.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
The DustySky dropper uses Windows Management Instrumentation to extract information about the operating system and whether an anti-virus is active.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
EKANS can use Windows Mangement Instrumentation (WMI) calls to execute operations.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
EVILNUM has used the Windows Management Instrumentation (WMI) tool to enumerate infected machines.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Emotet has used WMI to execute powershell.exe.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Empire can use WMI to deliver a payload to a remote host.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
EvilBunny has used WMI to gather information about the system.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
FELIXROOT uses WMI to query the Windows Registry.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
FIVEHANDS can use WMI to delete files on a  target machine.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
FlawedAmmyy leverages WMI to enumerate anti-virus on the victim.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
FunnyDream can use WMI to open a Windows command shell on a remote machine.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
GravityRAT collects various information via WMI requests, including CPU information in the Win32_Processor entry (Processor ID, Name, Manufacturer and the clock speed).
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
HALFBAKED can use WMI queries to gather system information.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
HELLOKITTY can use WMI to delete volume shadow copies.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
HOPLIGHT has used WMI to recompile the Managed Object Format (MOF) files in the WMI repository.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
HermeticWizard can use WMI to create a new process on a remote machine via `C:\windows\system32\cmd.exe /c start C:\windows\system32\\regsvr32.exe /s /iC:\windows\<filename>.dll`.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
IcedID has used WMI to execute binaries.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Impacket's wmiexec module can be used to execute commands through WMI.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
KOMPROGO is capable of running WMI queries.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Kazuar obtains a list of running processes through WMI querying.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Koadic can use WMI to execute commands.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Lucifer can use WMI to log into remote machines for propagation.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Maze has used WMI to attempt to delete the shadow volumes on a machine, and to connect a virtual machine to the network domain of the victim organization's network.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Meteor can use `wmic.exe` as part of its effort to delete shadow copies.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
MoleNet can perform WMI commands on the system.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Mosquito's installer uses WMI to search for antivirus display names.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Netwalker can use WMI to delete Shadow Volumes.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
NotPetya can use `wmic` to help propagate itself across a network.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Octopus has used wmic.exe for local discovery information.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Olympic Destroyer uses WMI to help propagate itself across a network.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
OopsIE uses WMI to perform discovery techniques.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
POWERSTATS can use WMI queries to retrieve data from compromised hosts.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
POWRUNER may use WMI when collecting information about a victim.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
PoshC2 has a number of modules that use WMI to execute tasks.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
PowerSploit's `Invoke-WmiCommand` CodeExecution module uses WMI to execute and retrieve the output from a PowerShell payload.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
ProLock can use WMIC to execute scripts on targeted hosts.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
PyDCrypt has attempted to execute with WMIC.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
QakBot can execute WMI queries to gather information.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
RATANKBA uses WMI to perform process monitoring.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
REvil can use WMI to monitor for and kill specific processes listed in its configuration file.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Remexi executes received commands with wmic.exe (for WMI commands).
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
RogueRobin uses various WMI queries to check if the sample is running in a sandbox.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
SILENTTRINITY can use WMI for lateral movement.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
SUNBURST used the WMI query `Select * From Win32_SystemDriver` to retrieve a driver listing.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
SVCReady can use `WMI` queries to detect the presence of a virtual machine environment.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Sardonic can use WMI to execute PowerShell commands on a compromised machine.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
SharpStage can use WMI for execution.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Sibot has used WMI to discover network connections and configurations. Sibot has also used the Win32_Process class to execute a malicious DLL.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Snip3 can query the WMI class `Win32_ComputerSystem` to gather information.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
SocGholish has used WMI calls for script execution and system profiling.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
StoneDrill has used the WMI command-line (WMIC) utility to run tasks.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Stuxnet used WMI with an `explorer.exe` token to execute on a remote share.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
SysUpdate can use WMI for execution on a compromised host.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Ursnif droppers have used WMI classes to execute PowerShell commands.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
Valak can use `wmic process call create` in a scheduled task to launch plugins and for execution.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
WannaCry utilizes `wmic` to delete shadow copies.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
One variant of Zebrocy uses WMI queries to gather information.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
jRAT uses WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.
Technique: T1047 Windows Management Instrumentation, Tactic: TA0002 Execution
TeamTNT has sent locally staged files with collected credentials to C2 servers using cURL.
Technique: T1048 Exfiltration Over Alternative Protocol, Tactic: TA0010 Exfiltration
AADInternals can directly download cloud user data such as OneDrive files.
Technique: T1048 Exfiltration Over Alternative Protocol, Tactic: TA0010 Exfiltration
Bundlore uses the `curl -s -L -o` command to exfiltrate archived data to a URL.
Technique: T1048 Exfiltration Over Alternative Protocol, Tactic: TA0010 Exfiltration
Chaes has exfiltrated its collected data from the infected machine to the C2, sometimes using the MIME protocol.
Technique: T1048 Exfiltration Over Alternative Protocol, Tactic: TA0010 Exfiltration
FrameworkPOS can use DNS tunneling for exfiltration of credit card data.
Technique: T1048 Exfiltration Over Alternative Protocol, Tactic: TA0010 Exfiltration
Hydraq connects to a predefined domain on port 443 to exfil gathered information.
Technique: T1048 Exfiltration Over Alternative Protocol, Tactic: TA0010 Exfiltration
Kobalos can exfiltrate credentials over the network via UDP.
Technique: T1048 Exfiltration Over Alternative Protocol, Tactic: TA0010 Exfiltration
PoetRAT has used a .NET tool named dog.exe to exiltrate information over an e-mail account.
Technique: T1048 Exfiltration Over Alternative Protocol, Tactic: TA0010 Exfiltration
During the SolarWinds Compromise, APT29 exfiltrated collected data over a simple HTTPS request to a password-protected archive staged on a victim's OWA servers.
Technique: T1048.002 Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
APT28 has exfiltrated archives of collected data previously staged on a target's OWA server via HTTPS.
Technique: T1048.002 Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
Rclone can exfiltrate data over SFTP or HTTPS via WebDAV.
Technique: T1048.002 Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
During C0017, APT41 exfiltrated victim data via DNS lookups by encoding and prepending it as subdomains to the attacker-controlled domain.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
APT32's backdoor can exfiltrate data by encoding it in the subdomain field of DNS packets.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
APT33 has used FTP to exfiltrate files (separately from the C2 channel).
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
FIN6 has sent stolen payment card data to remote servers via HTTP POSTs.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
FIN8 has used FTP to exfiltrate collected data.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
Lazarus Group malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
OilRig has exfiltrated data over FTP separately from its primary C2 channel over DNS.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
Thrip has used WinSCP to exfiltrate data from a targeted organization over FTP.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
Wizard Spider has exfiltrated victim information using FTP.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
Agent Tesla has routines for exfiltration over SMTP, FTP, and HTTP.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
BITSAdmin can be used to create BITS Jobs to upload files from a compromised host.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
Some Brave Prince variants have used South  Korea's Daum email service to exfiltrate information, and later variants have posted the data to a web server via an HTTP post command.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
CORALDECK has exfiltrated data in HTTP POST headers.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
Carbon uses HTTP to send data to the C2 server.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
CharmPower can send victim data via FTP with credentials hardcoded in the script.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
Cherry Picker exfiltrates files over FTP.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
CookieMiner has used the `curl --upload-file` command to exfiltrate data over HTTP.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
CosmicDuke exfiltrates collected files over FTP or WebDAV. Exfiltration servers can be separately configured from C2 servers.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
Dok exfiltrates logs of its execution stored in the `/tmp` folder over FTP using the `curl` command.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
KONNI has used FTP to exfiltrate reconnaissance data out.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
Kessel can exfiltrate credentials and other information via HTTP POST request, TCP, and DNS.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
PoetRAT has used ftp for exfiltration.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration