sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
Carbanak checks the Registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings` for proxy configurations information.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Carberp has searched the Image File Execution Options registry key for "Debugger" within every subkey.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Carbon enumerates values in the Registry.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Cardinal RAT contains watchdog functionality that periodically ensures `HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load` is set to point to its executable.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
CharmPower has the ability to enumerate `Uninstall` registry values.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Clambling has the ability to enumerate Registry keys, including `KEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt\strDataDir` to search for a bitcoin wallet.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Cobalt Strike can query `HKEY_CURRENT_USER\Software\Microsoft\Office\<Excel Version>\Excel\Security\AccessVBOM\`  to determine if the security setting for restricting default programmatic access is enabled.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
ComRAT can check the default browser by querying `HKCR\http\shell\open\command`.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Crimson can check the Registry for the presence of `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\last_edate` to determine how long it has been installed on a host.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
DarkWatchman can query the Registry to determine if it has already been installed on the system.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Denis queries the Registry for keys and values.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Derusbi is capable of enumerating Registry keys and values.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
DownPaper searches and reads the value of the Windows Update Registry Run key.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Dtrack can collect the RegisteredOwner, RegisteredOrganization, and InstallDate registry values.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Epic uses the `rem reg query` command to obtain values from Registry keys.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
FELIXROOT queries the Registry for specific keys for potential privilege escalation and proxy information. FELIXROOT has also used WMI to query the Windows Registry.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
FatDuke can get user agent strings for the default browser from `HKCU\Software\Classes\http\shell\open\command`.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
FinFisher queries Registry values as part of its anti-sandbox checks.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
FunnyDream can check `Software\Microsoft\Windows\CurrentVersion\Internet Settings` to extract the `ProxyServer` string.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Gelsemium can open random files and Registry keys to obscure malware behavior from sandbox analysis.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Gold Dragon enumerates registry keys with the command `regkeyenum` and obtains information for the Registry key `HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run`.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
A variant of HOPLIGHT hooks lsass.exe, and lsass.exe then checks the Registry for the data value 'rdpproto' under the key `SYSTEM\CurrentControlSet\Control\Lsa Name`.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Hydraq creates a backdoor through which remote attackers can retrieve system information, such as CPU speed, from Registry keys.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Industroyer has a data wiper component that enumerates keys in the Registry `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services`.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
InvisiMole can enumerate Registry values, keys, and data.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
JPIN can enumerate Registry keys.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
LiteDuke can query the Registry to check for the presence of `HKCU\Software\KasperskyLab`.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
LitePower can query the Registry for keys added to execute COM hijacking.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Lucifer can check for existing stratum cryptomining information in `HKLM\Software\Microsoft\Windows\CurrentVersion\spreadCpuXmr – %stratum info%`.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Mafalda can enumerate Registry keys with all subkeys and values.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Milan can query `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid` to retrieve the machine GUID.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Mori can read data from the Registry including from `HKLM\Software\NFC\IPA` and
`HKLM\Software\NFC\`.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
OSInfo queries the registry to look for information about Terminal Services.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
POWERSOURCE queries Registry keys in preparation for setting Run keys to achieve persistence.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
POWRUNER may query the Registry by running `reg query` on a victim.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
PcShare can search the registry files of a compromised host.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Pillowmint has used shellcode which reads code stored in the registry keys `\REGISTRY\SOFTWARE\Microsoft\DRM` using the native Windows API as well as read `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces` as part of its C2.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
PlugX can enumerate and query for information contained within the Windows Registry.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
PowerSploit contains a collection of Privesc-PowerUp modules that can query Registry keys for potential opportunities.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Proxysvc gathers product names from the Registry key: `HKLM\Software\Microsoft\Windows NT\CurrentVersion ProductName` and the processor description from the Registry key `HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessorNameString`.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
QUADAGENT checks if a value exists within a Registry key in the HKCU hive whose name is the same as the scheduled task it has created.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
QUIETCANARY has the ability to retrieve information from the Registry.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
RATANKBA uses the command `reg query “HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings”`.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
REvil can query the Registry to get random file extensions to append to encrypted files.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
ROKRAT can access the `HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData` Registry key to obtain the System manufacturer value to identify the machine type.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Reaver queries the Registry to determine the correct Startup path to use for persistence.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Rising Sun has identified the OS product name from a compromised host by searching the registry for `SOFTWARE\MICROSOFT\Windows NT\ CurrentVersion | ProductName`.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
SILENTTRINITY can use the `GetRegValue` function to check Registry keys within `HKCU\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated` and `HKLM\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated`. It also contains additional modules that can check software AutoRun values and use the Win32 namespace to get values from HKCU, HKLM, HKCR, and HKCC hives.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
SUNBURST collected the registry value `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid` from compromised hosts.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
SVCReady can search for the `HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System` Registry key to gather system information.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Saint Bot has used `check_registry_keys` as part of its environmental checks.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Samurai can query `SOFTWARE\Microsoft\.NETFramework\policy\v2.0` for discovery.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Shamoon queries several Registry keys to identify hard disk partitions to overwrite.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Shark can query `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid` to retrieve the machine GUID.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Sibot has queried the registry for proxy server information.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
SodaMaster has the ability to query the Registry to detect a key specific to VMware.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
StoneDrill has looked in the registry to find the default browser path.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Stuxnet searches the Registry for indicators of security programs.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
SynAck enumerates Registry keys associated with event logs.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
TEARDROP checked that `HKU\SOFTWARE\Microsoft\CTF` existed before decoding its embedded payload.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Taidoor can query the Registry on compromised hosts using `RegQueryValueExA`.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
TinyTurla can query the Registry for its configuration information.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Uroburos can query the Registry, typically `HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds`, to find the key and path to decrypt and load its kernel driver and kernel driver loader.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Ursnif has used Reg to query the Registry for installed programs.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Valak can use the Registry for code updates and to collect credentials.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Volgmer checks the system for certain Registry keys.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
WINDSHIELD can gather Registry values.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
WastedLocker checks for specific registry keys related to the `UCOMIEnumConnections` and `IActiveScriptParseProcedure32` interfaces.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Waterbear can query the Registry key `"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSDTC\MTxOCI"` to see if the value `OracleOcilib` exists.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Woody RAT can search registry keys to identify antivirus programs on an compromised host.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Zebrocy executes the `reg query` command to obtain information in the Registry.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
Zeus Panda checks for the existence of a Registry key and if it contains certain values.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
ZxShell can query the netsvc group value data located in the svchost group Registry key.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
ZxxZ can search the registry of a compromised host.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
gh0st RAT has checked for the existence of a Service key to determine if it has already been installed on the system.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
njRAT can read specific registry values.
Technique: T1012 Query Registry, Tactic: TA0007 Discovery
APT28 has used a UEFI (Unified Extensible Firmware Interface) rootkit known as LoJax.
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
APT41 deployed rootkits on Linux systems.
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
TeamTNT has used rootkits such as the open-source Diamorphine rootkit and their custom bots to hide cryptocurrency mining activities on the machine.
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
Winnti Group used a rootkit to modify typical server functionality.
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
COATHANGER hooks or replaces multiple legitimate processes and other functions on victim devices.
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
Carberp has used user mode rootkit techniques to remain hidden on the system.
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
Caterpillar WebShell has a module to use a rootkit on a system.
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
Drovorub has used a kernel module rootkit to hide processes, files, executables, and network artifacts from user space view.
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
Ebury has used user mode rootkit techniques to remain hidden on the system.
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
HIDEDRV is a rootkit that hides certain operating system artifacts.
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
HTRAN can install a rootkit to hide network connections from the host OS.
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
Hacking Team UEFI Rootkit is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems.
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
HiddenWasp uses a rootkit to hook and implement functions on the system.
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
Hikit is a Rootkit that has been used by Axiom.
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
Hildegard has modified /etc/ld.so.preload to overwrite readdir() and readdir64().
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
LoJax is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems.
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
PoisonIvy starts a rootkit from a malicious file dropped to disk.
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
Ramsay has included a rootkit to evade defenses.
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
Skidmap is a kernel-mode rootkit that has the ability to hook system calls to hide specific files and fake network and CPU-related statistics to make the CPU load of the infected machine always appear low.
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
Stuxnet uses a Windows rootkit to mask its binaries and other relevant files.
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
Umbreon hides from defenders by hooking libc function calls, hiding artifacts that would reveal its presence, such as the user account it creates to provide access and undermining strace, a tool often used to identify malware.
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
Uroburos can use its kernel module to prevent its host components from being listed by the targeted system's OS and to mediate requests between user mode and concealed components.
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
WarzoneRAT can include a rootkit to hide processes, files, and startup.
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
Winnti for Linux has used a modified copy of the open-source userland rootkit Azazel, named libxselinux.so, to hide the malware's operations and network activity.
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
Zeroaccess is a kernel-mode rootkit.
Technique: T1014 Rootkit, Tactic: TA0005 Defense Evasion
During C0015, the threat actors used code to obtain the external public-facing IPv4 address of the compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
During C0017, APT41 used `cmd.exe /c ping %userdomain%` for discovery.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
During C0018, the threat actors ran `nslookup` and Advanced IP Scanner on the target network.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
During Frankenstein, the threat actors used Empire to find the public IP address of a compromised system.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
During FunnyDream, the threat actors used ipconfig for discovery on remote systems.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
During Operation CuckooBees, the threat actors used `ipconfig`, `nbtstat`, `tracert`, `route print`, and `cat /etc/hosts` commands.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
During Operation Wocao, threat actors discovered the local network configuration with `ipconfig`.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
APT1 used the `ipconfig /all` command to gather network configuration information.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
APT19 used an HTTP malware variant and a Port 22 malware variant to collect the MAC address and IP address from the victim’s machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
A keylogging tool used by APT3 gathers network information from the victim, including the MAC address, IP address, WINS, DHCP server, and gateway.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
APT32 used the `ipconfig /all` command to gather the IP address from the system.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
APT41 collected MAC addresses from victim machines.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Chimera has used ipconfig, Ping, and `tracert` to enumerate the IP address and network environment and settings of the local host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Darkhotel has collected the IP address and network adapter information from the victim’s machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Dragonfly has used batch scripts to enumerate network information, including information about trusts, zones, and the domain.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Earth Lusca used the command `ipconfig` to obtain information about network configurations.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
FIN13 has used `nslookup` and `ipconfig` for network reconnaissance efforts. FIN13 has also utilized a compromised Symantec Altiris console and LanDesk account to retrieve network information.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
GALLIUM used `ipconfig /all` to obtain information about the victim network configuration. The group also ran a modified version of NBTscan to identify available NetBIOS name servers.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
HAFNIUM has collected IP information via IPInfo.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
HEXANE has used Ping and `tracert` for network discovery.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Higaisa used `ipconfig` to gather network configuration information.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Ke3chang has performed local network configuration discovery using `ipconfig`.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Kimsuky has used `ipconfig/all` to gather network configuration information.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Lazarus Group malware IndiaIndia obtains and sends to its C2 server information about the first network interface card’s configuration, including IP address, gateways, subnet mask, DHCP information, and whether WINS is available.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Magic Hound malware gathers the victim's local IP address, MAC address, and external IP address.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Moses Staff has collected the domain name of a compromised network.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
MuddyWater has used malware to collect the victim’s IP address and domain name.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Mustang Panda has used `ipconfig` and `arp` to determine network configuration information.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Naikon uses commands such as `netsh interface show` to discover network interface settings.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
OilRig has run `ipconfig /all` on a victim.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
SideCopy has identified the IP address of a compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Sidewinder has used malware to collect information on network interfaces, including the MAC address.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Stealth Falcon malware gathers the Address Resolution Protocol (ARP) table from the victim.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
TeamTNT has enumerated the host machine’s IP address.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Threat Group-3390 actors use NBTscan to discover vulnerable systems.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Tropic Trooper has used scripts to collect the host's network topology.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Turla surveys a system upon check-in to discover network configuration details using the `arp -a`, `nbtstat -n`, `net config`, `ipconfig /all`, and `route` commands, as well as NBTscan. Turla RPC backdoors have also retrieved registered RPC interface information from process memory.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Volt Typhoon has executed multiple commands to enumerate network topology and settings including  `ipconfig`, `netsh interface firewall show all`, and `netsh interface portproxy show all`.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Wizard Spider has used ipconfig to identify the network configuration of a victim machine. Wizard Spider has also used the PowerShell cmdlet `Get-ADComputer` to collect IP address data from Active Directory.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
ZIRCONIUM has used a tool to enumerate proxy settings in the target environment.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
admin@338 actors used the following command after exploiting a machine with LOWBALL malware to acquire information about local networks: `ipconfig /all >> %temp%\download`
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
menuPass has used several tools to scan for open NetBIOS nameservers and enumerate NetBIOS sessions.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Action RAT has the ability to collect the MAC address of an infected host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
AdFind can extract subnet information from Active Directory.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Agent Tesla can collect the IP address of the victim machine and spawn instances of netsh.exe to enumerate wireless settings.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Agent.btz collects the network adapter’s IP and MAC address as well as IP addresses of the network adapter’s default gateway, primary/secondary WINS, DHCP, and DNS servers, and saves them into a log file.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Amadey can identify the IP address of a victim machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Anchor can determine the public IP and location of a compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
AppleSeed can identify the IP of a targeted system.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Aria-body has the ability to identify the location, public IP address, and domain name on a compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Arp can be used to display ARP configuration information on the host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Astaroth collects the external IP address from the system.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Avaddon can collect the external IP address of the victim.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Avenger can identify the domain of the compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Azorult can collect host IP information from the victim’s machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
BADCALL collects the network adapter information.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
BADFLICK has captured victim IP address details.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
BLINDINGCAN has collected the victim machine's local IP address information and MAC address.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
BLUELIGHT can collect IP information from the victim’s machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
BabyShark has executed the `ipconfig /all` command.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Backdoor.Oldrea collects information about the Internet adapter configuration.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Bandook has a command to get the public IP address from a system.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Bazar can collect the IP address and NetBIOS name of an infected machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Bisonal can execute `ipconfig` on the victim’s machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
BlackEnergy has gathered information about network IP configurations using ipconfig.exe and about routing tables using route.exe.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Bonadan can find the external IP address of the infected host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
BoxCaon can collect the victim's MAC address by using the `GetAdaptersInfo` API.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Brave Prince gathers network configuration information as well as the ARP cache.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Calisto runs the `ifconfig` command to obtain the IP address from the victim’s machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Carbon can collect the IP address of the victims and other computers on the network using the commands: `ipconfig -all` `nbtstat -n`, and `nbtstat -s`.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Catchamas gathers the Mac address, IP address, and the network adapter information from the victim’s machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Caterpillar WebShell can gather the IP address from the victim's machine using the IP config command.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
CharmPower has the ability to use `ipconfig` to enumerate system network settings.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Chrommme can enumerate the IP address of a compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Clambling can enumerate the IP address of a compromised machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Cobalt Strike can determine the NetBios name and  the IP addresses of targets machines including domain controllers.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Comnie uses `ipconfig /all` and `route PRINT` to identify network adapter and interface information.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Conti can retrieve the ARP cache from the local system by using the `GetIpNetTable()` API call and check to ensure IP addresses it connects to are for local, non-Internet, systems.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
CrackMapExec can collect DNS information from the targeted system.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
CreepySnail can use `getmac` and `Get-NetIPAddress` to enumerate network settings.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Crimson contains a command to collect the victim MAC address and LAN IP.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Cuba can retrieve the ARP cache from the local system by using `GetIpNetTable`.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Cyclops Blink can use the Linux API `if_nameindex` to gather network interface names.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
DEADEYE can discover the DNS domain name of a targeted system.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Denis uses `ipconfig` to gather the IP address from the system.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Diavol can enumerate victims' local and external IPs when registering with C2.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Dtrack can collect the host's IP addresses using the `ipconfig` command.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
The reconnaissance modules used with Duqu can collect information on network configuration.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Dyre has the ability to identify network settings on a compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
EKANS can determine the domain of a compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Elise executes `ipconfig /all` after initial communication is made to the remote server.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Emissary has the capability to execute the command `ipconfig /all`.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Empire can acquire network configuration information like DNS servers, public IP, and network proxies used by a host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Epic uses the `nbtstat -n` and `nbtstat -s` commands on the victim’s machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Explosive has collected the MAC address from the victim's machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
FALLCHILL collects MAC address and local IP address information from the victim.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
FELIXROOT collects information about the network including the IP address and DHCP server.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
FatDuke can identify the MAC address on the target computer.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Felismus collects the victim LAN IP address and sends it to the C2 server.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Flagpro has been used to execute the `ipconfig /all` command on a victim system.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
FunnyDream can parse the `ProxyServer` string in the Registry to discover http proxies.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
GeminiDuke collects information on network settings and Internet proxy settings from the victim.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
GoldMax retrieved a list of the system's network interface after execution.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Grandoreiro can determine the IP and physical location of the compromised host via IPinfo.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
GravityRAT collects the victim IP address, MAC address, as well as the victim account domain name.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Green Lambert can obtain proxy information from a victim's machine using system environment variables.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
GrimAgent can enumerate the IP and domain of a target system.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
HotCroissant has the ability to identify the IP address of the compromised machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Hydraq creates a backdoor through which remote attackers can retrieve IP addresses of compromised machines.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
The IceApple ifconfig module can iterate over all network interfaces on the host and retrieve the name, description, MAC address, DNS suffix, DNS servers, gateways, IPv4 addresses, and subnet masks.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Industroyer’s 61850 payload component enumerates connected network adapters and their corresponding IP addresses.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
InvisiMole gathers information on the IP forwarding table, MAC address, configured proxy, and network SSID.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Ixeshe enumerates the IP address, network proxy settings, and domain name from a victim's system.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
A JHUHUGIT variant gathers network interface card information.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
JPIN can obtain network information, including DNS, IP, and proxies.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
KEYMARBLE gathers the MAC address of the victim’s machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
KONNI can collect the IP address from the victim’s machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
KOPILUWAK can use Arp to discover a target's network configuration setttings.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Kazuar gathers information about network adapters.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Kessel has collected the DNS address of the infected host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Kevin can collect the MAC address and other information from a victim machine using `ipconfig/all`.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
KeyBoy can determine the public or WAN IP address for the system.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Koadic can retrieve the contents of the IP routing table as well as information about the Windows domain.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Kobalos can record the IP address of the target machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Kwampirs collects network adapter and interface information by using the commands `ipconfig /all`, `arp -a` and `route print`. It also collects the system's MAC address with `getmac` and domain configuration with `net config workstation`.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
LightNeuron gathers information about network adapters using the Win32 API call `GetAdaptersInfo`.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
LiteDuke has the ability to discover the proxy configuration of Firefox and/or Opera.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Lizar can retrieve network information from a compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Lokibot has the ability to discover the domain name of the infected host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
LoudMiner used a script to gather the IP address of the infected machine before sending to the C2.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Lucifer can collect the IP address of a compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
MacMa can collect IP addresses from a compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Machete collects the MAC address of the target computer and other network configuration information.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Mafalda can use the `GetAdaptersInfo` function to retrieve information about network adapters and the `GetIpNetTable` function to retrieve the IPv4 to physical network address mapping table.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Milan can run `C:\Windows\system32\cmd.exe /c cmd /c ipconfig /all 2>&1` to discover network settings.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Mis-Type may create a file containing the results of the command `cmd.exe /c ipconfig /all`.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
MoonWind obtains the victim IP address.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
More_eggs has the capability to gather the IP address from the victim's machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Mosquito uses the `ipconfig` command.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
NBTscan can be used to collect MAC addresses.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
NETWIRE can collect the IP address of a compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
NGLite identifies the victim system MAC and IPv4 addresses and uses these to establish a victim identifier.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
NOKKI can gather information on the victim IP address.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Naid collects the domain name from a compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
NanHaiShu can gather information about the victim proxy server.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
NanoCore gathers the IP address from the victim’s machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Neoichor can gather the IP address from an infected host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Ninja can enumerate the IP address on compromised systems.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Nltest may be used to enumerate the parent domain of a local machine using `/parentdomain`.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
OSInfo discovers the current domain information.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
OSX_OCEANLOTUS.D can collect the network interface MAC address on the infected host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
OceanSalt can collect the victim’s IP address.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Octopus can collect the host IP address from the victim’s machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Okrum can collect network information, including the host IP address, DNS, and proxy information.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Olympic Destroyer uses API calls to enumerate the infected system's ARP table.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Orz can gather victim proxy information.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
PLAINTEE uses the `ipconfig /all` command to gather the victim’s IP address.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
POWERSTATS can retrieve IP, network adapter configuration information, and domain from compromised hosts.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
POWRUNER may collect network configuration data by running `ipconfig /all` on a victim.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Pay2Key can identify the IP and MAC addresses of the compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
PcShare can obtain the proxy settings of a compromised machine using `InternetQueryOptionA` and its IP address by running `nslookup myip.opendns.comresolver1.opendns.com\r\n`.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Penquin can report the IP of the compromised host to attacker controlled infrastructure.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
PingPull can retrieve the IP address of a compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
PipeMon can collect and send the local IP address, RDP information, and the network adapter physical address as a part of its C2 beacon.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Pisloader has a command to collect the victim's IP address.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
PoshC2 can enumerate network adapter information.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
PowerDuke has a command to get the victim's domain and NetBIOS name.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
PowerShower has the ability to identify the current Windows domain of the infected host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
A module in Prikormka collects information from the victim about its IP addresses and MAC addresses.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Proxysvc collects the network adapter information and domain/username information based on current remote sessions.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Pupy has built in commands to identify a host’s IP address and find out other network configuration settings by viewing connected sessions.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Pysa can perform network reconnaissance using the Advanced IP Scanner tool.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
QUADAGENT gathers the current domain the victim system belongs to.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
QUIETCANARY can identify the default proxy setting on a compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
QakBot can use `net config workstation`, `arp -a`, `nslookup`, and `ipconfig /all` to gather network configuration information.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
QuasarRAT has the ability to enumerate the Wide Area Network (WAN) IP through requests to ip-api[.]com, freegeoip[.]net, or api[.]ipify[.]org observed with user-agent string `Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0`.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
RATANKBA gathers the victim’s IP address via the `ipconfig -all` command.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Ramsay can use ipconfig and Arp to collect network configuration information, including routing information and ARP tables.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Reaver collects the victim's IP address.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
RedLeaves can obtain information about network parameters.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Remsec can obtain information about network configuration, including the routing table, ARP cache, and DNS cache.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Revenge RAT collects the IP address and MAC address from the system.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Rifdoor has the ability to identify the IP address of the compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Rising Sun can detect network adapter and IP address information.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
RogueRobin gathers the IP address and domain from the victim’s machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Royal can enumerate IP addresses using `GetIpAddrTable`.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Ryuk has called `GetIpNetTable` in attempt to identify all mounted drives and hosts that have Address Resolution Protocol (ARP) entries.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery