sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
DarkWatchman can modify Registry values to store configuration strings, keylogger, and output of components.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
EVILNUM can make modifications to the Regsitry for persistence.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Exaramel for Windows adds the configuration to the Registry in XML format.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Explosive has a function to write itself to Registry values.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
FELIXROOT deletes the Registry key `HKCU\Software\Classes\Applications\rundll32.exe\shell\open`.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Ferocious has the ability to add a Class ID in the current user Registry hive to enable persistence mechanisms.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Gelsemium can modify the Registry to store its components.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Grandoreiro can modify the Registry to store its configuration at `HKCU\Software\` under frequently changing names including `%USERNAME%` and `ToolTech-RM`.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
GreyEnergy modifies conditions in the Registry and adds keys.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
HOPLIGHT has modified Managed Object Format (MOF) files within the Registry to run specific commands and create persistence on the system.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
HermeticWiper has the ability to modify Registry keys to disable crash dumps, colors for compressed files, and pop-up information about folders and desktop items.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Hydraq creates a Registry subkey to register its created service, and can also uninstall itself later by deleting this value. Hydraq's backdoor also enables remote attackers to modify and delete subkeys.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
HyperStack can add the name of its communication pipe to `HKLM\SYSTEM\\CurrentControlSet\\Services\\lanmanserver\\parameters\NullSessionPipes`.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
InvisiMole has a command to create, set, copy, or delete a specified Registry key or value.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
KEYMARBLE has a command to create Registry entries for storing data under `HKEY_CURRENT_USER\SOFTWARE\Microsoft\WABE\DataPath`.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
KOCTOPUS has added and deleted keys from the Registry.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
KONNI has modified registry keys of ComSysApp, Svchost, and xmlProv on the machine to gain persistence.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
LoJax has modified the Registry key `‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’` from `‘autocheck autochk *’` to `‘autocheck autoche *’`.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Lokibot has modified the Registry as part of its UAC bypass process.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Mafalda can manipulate the system registry on a compromised host.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
MegaCortex has added entries to the Registry for ransom contact information.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Metamorfo has written process names to the Registry, disabled IE browser features, deleted Registry keys, and changed the ExtendedUIHoverTime key.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Mori can write data to `HKLM\Software\NFC\IPA` and `HKLM\Software\NFC\` and delete Registry values.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Mosquito can modify Registry keys under `HKCU\Software\Microsoft\[dllname]` to store configuration values. Mosquito also modifies Registry keys under `HKCR\CLSID\...\InprocServer32` with a path to the launcher.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
NETWIRE can modify the Registry to store its configuration information.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Naid creates Registry entries that store information about a created service and point to a malicious DLL dropped to disk.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
NanoCore has the capability to edit the Registry.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Neoichor has the ability to configure browser settings by modifying Registry entries under `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer`.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Nerex creates a Registry subkey that registers a new service.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Netwalker can add the following registry entry: `HKEY_CURRENT_USER\SOFTWARE\{8 random characters}`.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
NightClub can modify the Registry to set the ServiceDLL for a service created by the malware for persistence.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Orz can perform Registry operations.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
PHOREAL is capable of manipulating the Registry.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
PLAINTEE uses `reg add` to add a Registry Run key for persistence.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Pandora can write an encrypted token to the Registry to enable processing of remote commands.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
PcShare can delete its persistence mechanisms from the registry.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Pillowmint has modified the Registry key `HKLM\SOFTWARE\Microsoft\DRM` to store a malicious payload.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
PipeMon has modified the Registry to store its encrypted payload.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
PlugX has a module to create, delete, or modify Registry keys.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
PoetRAT has made registry modifications to alter its behavior upon execution.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
PoisonIvy creates a Registry subkey that registers a new system device.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
PolyglotDuke can write encrypted JSON configuration files to the Registry.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
PowerShower has added a registry key so future powershell.exe instances are spawned off-screen by default, and has removed all registry entries that are left behind during the dropper process.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Prestige has the ability to register new registry keys for a new extension handler via `HKCR\.enc` and `HKCR\enc\shell\open\command`.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Pysa has modified the registry key “SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System” and added the ransom note.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
QUADAGENT modifies an HKCU Registry key to store a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
QakBot can modify the Registry to store its configuration information in a randomly named subkey under `HKCU\Software\Microsoft`.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
QuasarRAT has a command to edit the Registry on the victim’s machine.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
RCSession can write its configuration file to the Registry.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
REvil can modify the Registry to save encryption parameters and system information.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
ROKRAT can modify the `HKEY_CURRENT_USER\Software\Microsoft\Office\` registry key so it can bypass the VB object model (VBOM) on a compromised host.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
RTM can delete all Registry entries created during its execution.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Reg may be used to interact with and modify the Windows Registry of a local or remote system at the command-line interface.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
RegDuke can create seemingly legitimate Registry key to store its encryption key.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Regin appears to have functionality to modify remote Registry information.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Remcos has full control of the Registry, including the ability to modify it.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Rover has functionality to remove Registry Run key persistence as a cleanup procedure.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
SILENTTRINITY can modify registry keys, including to enable or disable Remote Desktop Protocol (RDP).
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
SLOTHFULMEDIA can add, modify, and/or delete registry keys. It has changed the proxy configuration of a victim system by modifying the `HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap` registry.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
SMOKEDHAM has modified registry keys for persistence, to enable credential caching for credential access, and to facilitate lateral movement via RDP.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
SOUNDBITE is capable of modifying the Registry.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
SUNBURST had commands that allow an attacker to write or delete registry keys, and was observed stopping services by setting their `HKLM\SYSTEM\CurrentControlSet\services\\[service_name]\\Start` registry entries to value 4. It also deleted previously-created Image File Execution Options (IFEO) Debugger registry values and registry keys related to HTTP proxy to clean up traces of its activity.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
The Samurai loader component can create multiple Registry keys to force the svchost.exe process to load the final backdoor.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
ShadowPad can modify the Registry to store and maintain a configuration block and virtual file system.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Once Shamoon has access to a network share, it enables the RemoteRegistry service on the target system. It will then connect to the system with RegConnectRegistryW and modify the Registry to disable UAC remote restrictions by setting `SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy` to 1.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
ShimRat has registered two registry keys for shim databases.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Sibot has modified the Registry to install a second-stage script in the `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot`.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
StreamEx has the ability to modify the Registry.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Stuxnet can create registry keys to load driver files.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
SynAck can manipulate Registry keys.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
SysUpdate can write its configuration file to `Software\Classes\scConfig` in either `HKEY_LOCAL_MACHINE` or `HKEY_CURRENT_USER`.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
TEARDROP modified the Registry to create a Windows service for itself on a compromised host.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
TYPEFRAME can install encrypted configuration data under the Registry key `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\laxhost.dll` and `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs`.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Taidoor has the ability to modify the Registry on compromised hosts using `RegDeleteValueA` and `RegCreateKeyExA`.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
TajMahal can set the `KeepPrintedJobs` attribute for configured printers in `SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers` to enable document stealing.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Tarrask is able to delete the Security Descriptor (`SD`) registry subkey in order to “hide” scheduled tasks.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
ThreatNeedle can modify the Registry to save its configuration data as the following RC4-encrypted Registry key: `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\GameCon`.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
TinyTurla can set its configuration parameters in the Registry.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
TrickBot can modify registry entries.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Uroburos can store configuration information in the Registry including the initialization vector and AES key needed to find and decrypt other Uroburos components.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Ursnif has used Registry modifications as part of its installation routine.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Valak has the ability to modify the Registry key `HKCU\Software\ApplicationContainer\Appsw64` to store information regarding the C2 server and downloads.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Volgmer modifies the Registry to store an encoded configuration file in `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security`.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
WarzoneRAT can create `HKCU\Software\Classes\Folder\shell\open\command` as a new registry key during privilege escalation.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
WastedLocker can modify registry values within the `Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap` registry key.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Waterbear has deleted certain values from the Registry to load a malicious DLL.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Zeus Panda modifies several Registry keys under `HKCU\Software\Microsoft\Internet Explorer\ PhishingFilter\` to disable phishing filters.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
ZxShell can create Registry entries to enable services to run.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
gh0st RAT has altered the InstallTime subkey.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
metaMain can write the process ID of a target process into the `HKEY_LOCAL_MACHINE\SOFTWARE\DDE\tpid` Registry value as part of its reflective loading activity.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
njRAT can create, delete, or modify a specified Registry key or value.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
zwShell can modify the Registry.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
APT28 has used tools to take screenshots from victims.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
APT39 has used a screen capture utility to take screenshots on a compromised host.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
BRONZE BUTLER has used a tool to capture screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Dark Caracal took screenshots using their Windows malware.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Dragonfly has performed screen captures of victims, including by using a tool, scr.exe (which matched the hash of ScreenUtil).
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
FIN7 captured screenshots and desktop video recordings.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
GOLD SOUTHFIELD has used the remote monitoring and management tool ConnectWise to obtain screen captures from victim's machines.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Gamaredon Group's malware can take screenshots of the compromised computer every minute.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Malware used by Group5 is capable of watching the victim's screen.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Magic Hound malware can take a screenshot and upload the file to its C2 server.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
MoustachedBouncer has used plugins to take screenshots on targeted systems.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
MuddyWater has used malware that can capture screenshots of the victim’s machine.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
OilRig has a tool called CANDYKING to capture a screenshot of user's desktop.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Silence can capture victim screen activity.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Agent Tesla can capture screenshots of the victim’s desktop.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
AppleSeed can take screenshots on a compromised host by calling a series of APIs.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Aria-body has the ability to capture screenshots on compromised hosts.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
AsyncRAT has the ability to view the screen on compromised hosts.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Attor's has a plugin that captures screenshots of the target applications.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Azorult can capture screenshots of the victim’s machines.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
BADHATCH can take screenshots and send them to an actor-controlled C2 server.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
BADNEWS has a command to take a screenshot and send it to the C2 server.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
BISCUIT has a command to periodically take screenshots of the system.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
BLUELIGHT has captured a screenshot of the display every 30 seconds for the first 5 minutes after initiating a C2 loop, and then once every five minutes thereafter.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
BadPatch captures screenshots in .jpg format and then exfiltrates them.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Bandook is capable of taking an image of and uploading the current desktop.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
BlackEnergy is capable of taking screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Brute Ratel C4 can take screenshots on compromised hosts.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
CHOPSTICK has the capability to capture screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Cadelspy has the ability to capture screenshots and webcam photos.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Cannon can take a screenshot of the desktop.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Carbanak performs desktop video recording and captures screenshots of the desktop and sends it to the C2 server.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Carberp can capture display screenshots with the screens_dll.dll plugin.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Cardinal RAT can capture screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Catchamas captures screenshots based on specific keywords in the window’s title.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Chaes can capture screenshots of the infected machine.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
CharmPower has the ability to capture screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Chrommme has the ability to capture screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Clambling has the ability to capture screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Cobalt Strike's Beacon payload is capable of capturing screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Cobian RAT has a feature to perform screen capture.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
ConnectWise can take screenshots on remote hosts.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
CosmicDuke takes periodic screenshots and exfiltrates them.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Crimson contains a command to perform screen captures.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
CrossRAT is capable of taking screen captures.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
DOGCALL is capable of capturing screenshots of the victim's machine.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Daserf can take screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Derusbi is capable of performing screen captures.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
DustySky captures PNG screenshots of the main screen.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
ECCENTRICBANDWAGON can capture screenshots and store them locally.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Empire is capable of capturing screenshots on Windows and macOS systems.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
EvilGrab has the capability to capture screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
FinFisher takes a screenshot of the screen and displays it on top of all other windows for few seconds in an apparent attempt to hide some messages showed by the system during the setup process.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Flame can take regular screenshots when certain applications are open that are sent to the command and control server.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
FlawedAmmyy can capture screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
FruitFly takes screenshots of the user's desktop.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
The FunnyDream ScreenCap component can take screenshots on a compromised host.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
GRIFFON has used a screenshot module that can be used to take a screenshot of the remote system.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
HALFBAKED can obtain screenshots from the victim.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
HotCroissant has the ability to do real time screen viewing on an infected host.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Hydraq includes a component based on the code of VNC that can stream a live feed of the desktop of an infected host.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
HyperBro has the ability to take screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
InvisiMole can capture screenshots of not only the entire screen, but of each separate window open, in case they are overlapping.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
A JHUHUGIT variant takes screenshots by simulating the user pressing the "Take Screenshot" key (VK_SCREENSHOT), accessing the screenshot saved in the clipboard, and converting it to a JPG image.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Janicab captured screenshots and sent them out to a C2 server.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
KEYMARBLE can capture screenshots of the victim’s machine.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
KONNI can take screenshots of the victim’s machine.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Kasidet has the ability to initiate keylogging and screen captures.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Kazuar captures screenshots of the victim’s screen.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
KeyBoy has a command to perform screen grabbing.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Kivars has the ability to capture screenshots on the infected host.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
LitePower can take system screenshots and save them to `%AppData%`.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Lizar can take JPEG screenshots of an infected system.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
LookBack can take desktop screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
MacMa has used Apple’s Core Graphic APIs, such as `CGWindowListCreateImageFromArray`, to capture the user's screen and open windows.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
MacSpy can capture screenshots of the desktop over multiple monitors.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Machete captures screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Mafalda can take a screenshot of the target machine and save it to a file.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
MarkiRAT can capture screenshots that are initially saved as ‘scr.jpg’.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Matryoshka is capable of performing screen captures.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Metamorfo can collect screenshots of the victim’s machine.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Micropsia takes screenshots every 90 seconds by calling the Gdi32.BitBlt API.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Mispadu has the ability to capture screenshots on compromised hosts.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
NETWIRE can capture the victim's screen.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
NKAbuse can take screenshots of the victim machine.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
NightClub can load a module to call `CreateCompatibleDC` and `GdipSaveImageToStream` for screen capture.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
ObliqueRAT can capture a screenshot of the current screen.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Octopus can capture screenshots of the victims’ machine.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
POORAIM can perform screen capturing.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
POWERSTATS can retrieve screenshots from compromised hosts.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
POWRUNER can capture a screenshot from a victim.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
PcShare can take screen shots of a compromised machine.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Peppy can take screenshots on targeted systems.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
PlugX allows the operator to capture screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
PoetRAT has the ability to take screen captures.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
PowerSploit's `Get-TimedScreenshot` Exfiltration module can take screenshots at regular intervals.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Prikormka contains a module that captures screenshots of the victim's desktop.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Proton captures the content of the desktop with the screencapture binary.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Pteranodon can capture screenshots at a configurable interval.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Pupy can drop a mouse-logger that will take small screenshots around at each click and then send back to the server.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
QuietSieve has taken screenshots every five minutes and saved them to the user's local Application Data folder under `Temp\SymbolSourceSymbols\icons` or `Temp\ModeAuto\icons`.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
RCSession can capture screenshots from a compromised host.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
RDAT can take a screenshot on the infected system.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
ROKRAT can capture screenshots of the infected system using the `gdi32` library.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
RTM can capture screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
RainyDay has the ability to capture screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Ramsay can take screenshots every 30 seconds as well as when an external removable storage device is connected.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
RedLeaves can capture screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Remcos takes automated screenshots of the infected machine.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Remexi takes screenshots of windows of interest.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
RemoteUtilities can take screenshots on a compromised host.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Revenge RAT has a plugin for screen capture.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
RogueRobin has a command named `$screenshot` that may be responsible for taking screenshots of the victim machine.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Rover takes screenshots of the compromised system's desktop and saves them to `C:\system\screenshot.bmp` for exfiltration every 60 minutes.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
SHUTTERSPEED can capture screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
SILENTTRINITY can take a screenshot of the current desktop.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
SLOTHFULMEDIA has taken a screenshot of a victim's desktop, named it "Filter3.jpg", and stored it in the local directory.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
SMOKEDHAM can capture screenshots of the victim’s desktop.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
SVCReady can take a screenshot from an infected host.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
SharpStage has the ability to capture the victim's screen.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Sliver can take screenshots of the victim’s active display.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Socksbot can take screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
StoneDrill can take screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
StrifeWater has the ability to take screen captures.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
SysUpdate has the ability to capture screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
T9000 can take screenshots of the desktop and target application windows, saving them to user directories as one byte XOR encrypted .dat files.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
TURNEDUP is capable of taking screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
TajMahal has the ability to take screenshots on an infected host including capturing content from windows of instant messaging applications.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
TinyZBot contains screen capture functionality.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Trojan.Karagany can take a desktop screenshot and save the file into `\ProgramData\Mail\MailAg\shot.png`.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Turian has the ability to take screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
UPPERCUT can capture desktop screenshots in the PNG format and send them to the C2 server.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Ursnif has used hooked APIs to take screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
VERMIN can perform screen captures of the victim’s machine.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Valak has the ability to take screenshots on a compromised host.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Woody RAT has the ability to take a screenshot of the infected host desktop using Windows GDI+.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
XAgentOSX contains the takeScreenShot (along with startTakeScreenShot and stopTakeScreenShot) functions to take screenshots using the CGGetActiveDisplayList, CGDisplayCreateImage, and NSImage:initWithCGImage methods.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
XCSSET saves a screen capture of the victim's system with a numbered filename and `.jpg` extension. Screen captures are taken at specified intervals based on the system.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
ZLib has the ability to obtain screenshots of the compromised system.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
A variant of Zebrocy captures screenshots of the victim’s machine in JPEG and BMP format.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Zeus Panda can take screenshots of the victim’s machine.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
ZxShell can capture screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
gh0st RAT can capture the victim’s screen remotely.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
jRAT has the capability to take screenshots of the victim’s machine.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
metaMain can take and save screenshots.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
njRAT can capture screenshots of the victim’s machines.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
yty collects screenshots of the victim machine.
Technique: T1113 Screen Capture, Tactic: TA0009 Collection
Magic Hound has compromised email credentials in order to steal sensitive data.
Technique: T1114 Email Collection, Tactic: TA0009 Collection
Silent Librarian has exfiltrated entire mailboxes from compromised accounts.
Technique: T1114 Email Collection, Tactic: TA0009 Collection
Emotet has been observed leveraging a module that can scrape email addresses from Outlook.
Technique: T1114 Email Collection, Tactic: TA0009 Collection
During Night Dragon, threat actors used RAT malware to exfiltrate email archives.
Technique: T1114.001 Email Collection: Local Email Collection, Tactic: TA0009 Collection
APT1 uses two utilities, GETMAIL and MAPIGET, to steal email. GETMAIL extracts emails from archived Outlook .pst files.
Technique: T1114.001 Email Collection: Local Email Collection, Tactic: TA0009 Collection
Chimera has harvested data from victim's e-mail including through execution of `wmic /node:<ip> process call create "cmd /c copy c:\Users\<username>\<path>\backup.pst c:\windows\temp\backup.pst" copy "i:\<path>\<username>\My Documents\<filename>.pst"
copy`.
Technique: T1114.001 Email Collection: Local Email Collection, Tactic: TA0009 Collection
Magic Hound has collected .PST archives.
Technique: T1114.001 Email Collection: Local Email Collection, Tactic: TA0009 Collection
Carbanak searches recursively for Outlook personal storage tables (PST) files within user directories and sends them back to the C2 server.
Technique: T1114.001 Email Collection: Local Email Collection, Tactic: TA0009 Collection
CosmicDuke searches for Microsoft Outlook data files with extensions .pst and .ost for collection and exfiltration.
Technique: T1114.001 Email Collection: Local Email Collection, Tactic: TA0009 Collection
Crimson contains a command to collect and exfiltrate emails from Outlook.
Technique: T1114.001 Email Collection: Local Email Collection, Tactic: TA0009 Collection
Emotet has been observed leveraging a module that scrapes email data from Outlook.
Technique: T1114.001 Email Collection: Local Email Collection, Tactic: TA0009 Collection
Empire has the ability to collect emails on a target system.
Technique: T1114.001 Email Collection: Local Email Collection, Tactic: TA0009 Collection
KGH_SPY can harvest data from mail clients.
Technique: T1114.001 Email Collection: Local Email Collection, Tactic: TA0009 Collection
Out1 can parse e-mails on a target machine.
Technique: T1114.001 Email Collection: Local Email Collection, Tactic: TA0009 Collection
Pupy can interact with a victim’s Outlook session and look through folders and emails.
Technique: T1114.001 Email Collection: Local Email Collection, Tactic: TA0009 Collection
QakBot can target and steal locally stored emails to support thread hijacking phishing campaigns.
Technique: T1114.001 Email Collection: Local Email Collection, Tactic: TA0009 Collection
Smoke Loader searches through Outlook files and directories (e.g., inbox, sent, templates, drafts, archives, etc.).
Technique: T1114.001 Email Collection: Local Email Collection, Tactic: TA0009 Collection
During the SolarWinds Compromise, APT29 collected emails from specific individuals, such as executives and IT staff, using `New-MailboxExportRequest` followed by `Get-MailboxExportRequest`.
Technique: T1114.002 Email Collection: Remote Email Collection, Tactic: TA0009 Collection
APT1 uses two utilities, GETMAIL and MAPIGET, to steal email. MAPIGET steals email still on Exchange servers that has not yet been archived.
Technique: T1114.002 Email Collection: Remote Email Collection, Tactic: TA0009 Collection
APT28 has collected emails from victim Microsoft Exchange servers.
Technique: T1114.002 Email Collection: Remote Email Collection, Tactic: TA0009 Collection
APT29 has collected emails from targeted mailboxes within a compromised Azure AD tenant and compromised Exchange servers, including via Exchange Web Services (EWS) API requests.
Technique: T1114.002 Email Collection: Remote Email Collection, Tactic: TA0009 Collection
Chimera has harvested data from remote mailboxes including through execution of `\\<hostname>\c$\Users\<username>\AppData\Local\Microsoft\Outlook*.ost`.
Technique: T1114.002 Email Collection: Remote Email Collection, Tactic: TA0009 Collection
Dragonfly has accessed email accounts using Outlook Web Access.
Technique: T1114.002 Email Collection: Remote Email Collection, Tactic: TA0009 Collection
FIN4 has accessed and hijacked online email communications using stolen credentials.
Technique: T1114.002 Email Collection: Remote Email Collection, Tactic: TA0009 Collection
HAFNIUM has used web shells to export mailbox data.
Technique: T1114.002 Email Collection: Remote Email Collection, Tactic: TA0009 Collection
Ke3chang has used compromised credentials and a .NET tool to dump data from Microsoft Exchange mailboxes.
Technique: T1114.002 Email Collection: Remote Email Collection, Tactic: TA0009 Collection
Kimsuky has used tools such as the MailFetch mail crawler to collect victim emails (excluding spam) from online services via IMAP.
Technique: T1114.002 Email Collection: Remote Email Collection, Tactic: TA0009 Collection
Leafminer used a tool called MailSniper to search through the Exchange server mailboxes for keywords.
Technique: T1114.002 Email Collection: Remote Email Collection, Tactic: TA0009 Collection
Magic Hound has exported emails from compromised Exchange servers including through use of the cmdlet `New-MailboxExportRequest.`
Technique: T1114.002 Email Collection: Remote Email Collection, Tactic: TA0009 Collection
LightNeuron collects Exchange emails matching rules specified in its configuration.
Technique: T1114.002 Email Collection: Remote Email Collection, Tactic: TA0009 Collection
MailSniper can be used for searching through email in Exchange and Office 365 environments.
Technique: T1114.002 Email Collection: Remote Email Collection, Tactic: TA0009 Collection
Some SeaDuke samples have a module to extract email from Microsoft Exchange servers using compromised credentials.
Technique: T1114.002 Email Collection: Remote Email Collection, Tactic: TA0009 Collection
Valak can collect sensitive mailing information from Exchange servers, including credentials and the domain certificate of an enterprise.
Technique: T1114.002 Email Collection: Remote Email Collection, Tactic: TA0009 Collection
Kimsuky has set auto-forward rules on victim's e-mail accounts.
Technique: T1114.003 Email Collection: Email Forwarding Rule, Tactic: TA0009 Collection
LAPSUS$ has set an Office 365 tenant level mail transport rule to send all mail in and out of the targeted organization to the newly created account.
Technique: T1114.003 Email Collection: Email Forwarding Rule, Tactic: TA0009 Collection
Silent Librarian has set up auto forwarding rules on compromised e-mail accounts.
Technique: T1114.003 Email Collection: Email Forwarding Rule, Tactic: TA0009 Collection
During Operation Wocao, threat actors collected clipboard data in plaintext.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
APT38 used a Trojan called KEYLIME to collect data from the clipboard.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
APT39 has used tools capable of stealing contents of the clipboard.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
Agent Tesla can steal data from the victim’s clipboard.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
Astaroth collects information from the clipboard by using the OpenClipboard() and GetClipboardData() libraries.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
Attor has a plugin that collects data stored in the Windows clipboard by using the OpenClipboard and GetClipboardData APIs.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
Cadelspy has the ability to steal data from the clipboard.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
Catchamas steals data stored in the clipboard.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
Clambling has the ability to capture and store clipboard data.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
CosmicDuke copies and exfiltrates the clipboard contents every 30 seconds.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
DarkComet can steal data from the clipboard.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
DarkGate starts a thread on execution that captures clipboard data and logs it to a predefined log file.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
DarkTortilla can download a clipboard information stealer module.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
Empire can harvest clipboard data on both Windows and macOS systems.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
Explosive has a function to use the OpenClipboard wrapper.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
FlawedAmmyy can collect clipboard data.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
Grandoreiro can capture clipboard data from a compromised host.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
The executable version of Helminth has a module to log clipboard contents.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
A JHUHUGIT variant accesses a screenshot saved in the clipboard and converts it to a JPG image.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
KONNI had a feature to steal data from the clipboard.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
Koadic can retrieve the current content of the user clipboard.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
MacSpy can steal clipboard contents.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
Machete hijacks the clipboard data by creating an overlapped window that listens to keyboard events.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
MarkiRAT can capture clipboard content.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
Melcoz can monitor content saved to the clipboard.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
Metamorfo has a function to hijack data from the clipboard by monitoring the contents of the clipboard and replacing the cryptocurrency wallet with the attacker's.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
Mispadu has the ability to capture and replace Bitcoin wallet data in the clipboard on a compromised host.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
ROKRAT can extract clipboard data from a compromised host.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
RTM collects data from the clipboard.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
Remcos steals and modifies data from the clipboard.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
Remexi collects text from the clipboard.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
RunningRAT contains code to open and copy data from the clipboard.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
TajMahal has the ability to steal data from the clipboard of an infected host.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
TinyZBot contains functionality to collect information from the clipboard.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
VERMIN collects data stored in the clipboard.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
Zeus Panda can hook GetClipboardData function to watch for clipboard pastes to collect.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
jRAT can capture clipboard data.
Technique: T1115 Clipboard Data, Tactic: TA0009 Collection
During Frankenstein, the threat actors used Empire to automatically gather the username, domain name, machine name, and other system information.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
During Operation Wocao, threat actors used a script to collect information about the infected system.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
APT1 used a batch script to perform a series of discovery techniques and saves it to a text file.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
Chimera has used custom DLLs for continuous retrieval of data from memory.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
Confucius has used a file stealer to steal documents and images with the following extensions: txt, pdf, png, jpg, doc, xls, xlm, odp, ods, odt, rtf, ppt, xlsx, xlsm, docx, pptx, and jpeg.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
FIN6 has used a script to iterate through a list of compromised PoS systems, copy and remove data to a log file, and to bind to events from the submit payment button.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
Gamaredon Group has deployed scripts on compromised systems that automatically scan for interesting documents.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
Ke3chang has performed frequent and scheduled data collection from victim networks.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
Mustang Panda used custom batch scripts to collect files automatically from a targeted system.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
OilRig has used automated collection.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection