sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
httpclient encrypts C2 content with XOR using a single byte, 0x12.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
metaMain can encrypt the data that it sends and receives from the C2 server using an RC4 encryption algorithm.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
xCaon has encrypted data sent to the C2 server using a XOR key.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
During C0021, the threat actors used SSL via TCP port 443 for C2 communications.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
During Operation Wocao, threat actors' proxy implementation "Agent" upgraded the socket in use to a TLS socket.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Cobalt Group has used the Plink utility to create SSH tunnels.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
FIN8 has used the Plink utility to tunnel RDP back to C2 infrastructure.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
OilRig used the Plink utility and other tools to create tunnels to C2 servers.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
TA2541 has used TLS encrypted C2 communications including for campaigns using AsyncRAT.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Tropic Trooper has used SSL to connect to C2 servers.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
A variant of ADVSTORESHELL encrypts some C2 with RSA.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Attor's Blowfish key is encrypted with a public RSA key.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
BADHATCH can beacon to a hardcoded C2 IP address using TLS encryption every 5 minutes.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
BISCUIT uses SSL for encrypting C2 communications.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Bazar can use TLS in C2 communications.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
CHOPSTICK encrypts C2 communications with TLS.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
COATHANGER connects to command and control infrastructure using SSL.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Carbon has used RSA encryption for C2 communications.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Cobalt Strike can use RSA asymmetric encryption with PKCS1 padding to encrypt data sent to the C2 server.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
ComRAT can use SSL/TLS encryption for its HTTP-based C2 channel. ComRAT has used public key cryptography with RSA and AES encrypted email attachments for its Gmail C2 channel.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Cyclops Blink can encrypt C2 messages with AES-256-CBC sent underneath TLS. OpenSSL library functions are also used to encrypt each message using a randomly generated key and IV, which are then encrypted using a hard-coded RSA public key.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
DarkWatchman can use TLS to encrypt its C2 channel.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Doki has used the embedTLS library for network communications.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Dridex has encrypted traffic with RSA.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Emotet is known to use RSA keys for encrypting C2 traffic.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Empire can use TLS to encrypt its C2 channel.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Gazer uses custom encryption for C2 that uses RSA.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
GoldMax has RSA-encrypted its communication with the C2 server.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Grandoreiro can use SSL in C2 communication.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
GreyEnergy encrypts communications using RSA-2048.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
GrimAgent can use a hardcoded server public RSA key to encrypt the first request to C2.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Hi-Zor encrypts C2 traffic with TLS.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
IcedID has used SSL and TLS in communications with C2.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
KEYPLUG can use TLS-encrypted WebSocket Protocol (WSS) for C2.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Koadic can use SSL and TLS for communications.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Kobalos's authentication and key exchange is performed using RSA-512.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
LITTLELAMB.WOOLTEA can communicate over SSL using the private key from the Ivanti Connect Secure web server.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Machete has used TLS-encrypted FTP to exfiltrate data.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Metamorfo's C2 communication has been encrypted using OpenSSL.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Mispadu contains a copy of the OpenSSL library to encrypt C2 traffic.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Mythic supports SSL encrypted C2.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
PITSTOP has the ability to communicate over TLS.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
POSHSPY encrypts C2 traffic with AES and RSA.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
POWERSTATS has encrypted C2 traffic with RSA.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Pay2Key has used RSA encrypted communications with C2.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Penquin can encrypt communications using the BlowFish algorithm and a symmetric key exchanged with Diffie Hellman.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
PoetRAT used TLS to encrypt command and control (C2) communications.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Pupy's default encryption for its C2 communication channel is SSL, but it also has transport options for RSA and AES.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
REvil has encrypted C2 communications with the ECIES algorithm.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Rising Sun variants can use SSL for encrypting C2 communications.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Sardonic has the ability to send a random 64-byte RC4 key to communicate with actor-controlled C2 servers by using an RSA public key.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
ServHelper may set up a reverse SSH tunnel to give the attacker access to services running on the victim, such as RDP.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Sliver can use mutual TLS and RSA  cryptography to exchange a session key.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Small Sieve can use SSL/TLS for its HTTPS Telegram Bot API-based C2 channel.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
SodaMaster can use a hardcoded RSA key to encrypt some of its C2 traffic.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
SombRAT can SSL encrypt C2 traffic.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
StrongPity has encrypted C2 traffic using SSL/TLS.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Sykipot uses SSL for encrypting C2 communications.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
TinyTurla has the ability to encrypt C2 traffic with SSL/TLS.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Tor encapsulates traffic in multiple layers of encryption, using TLS by default.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Trojan.Karagany can secure C2 communications with SSL and TLS.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Uroburos has used a combination of a Diffie-Hellman key exchange mixed with a pre-shared key (PSK) to encrypt its top layer of C2 communications.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Some Volgmer variants use SSL to encrypt C2 communications.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
WannaCry uses Tor for command and control traffic and routes a custom cryptographic protocol over the Tor circuit.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
WellMail can use hard coded client and certificate authority certificates to communicate with C2 over mutual TLS.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
WellMess can communicate to C2 with mutual TLS where client and server mutually check certificates.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Woody RAT can use RSA-4096 to encrypt data sent to its C2 server.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
XTunnel uses SSL/TLS and RC4 to encrypt traffic.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
Zebrocy uses SSL and AES ECB for encrypting C2 communications.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
adbupd contains a copy of the OpenSSL library to encrypt C2 traffic.
Technique: T1573.002 Encrypted Channel: Asymmetric Cryptography, Tactic: TA0011 Command and Control
During C0017, APT41 established persistence by loading malicious libraries via modifications to the Import Address Table (IAT) within legitimate Microsoft binaries.
Technique: T1574 Hijack Execution Flow, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
COATHANGER will remove and write malicious shared objects associated with legitimate system functions such as `read(2)`.
Technique: T1574 Hijack Execution Flow, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
DarkGate edits the Registry key `HKCU\Software\Classes\mscfile\shell\open\command` to execute a malicious AutoIt script. When eventvwr.exe is executed, this will call the Microsoft Management Console (mmc.exe), which in turn references the modified Registry key.
Technique: T1574 Hijack Execution Flow, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Denis replaces the nonexistent Windows DLL "msfte.dll" with its own malicious version, which is loaded by the SearchIndexer.exe and SearchProtocolHost.exe.
Technique: T1574 Hijack Execution Flow, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
One of Dtrack can replace the normal flow of a program execution with malicious code.
Technique: T1574 Hijack Execution Flow, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
ShimRat can hijack the cryptbase.dll within migwiz.exe to escalate privileges and bypass UAC controls.
Technique: T1574 Hijack Execution Flow, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
APT41 has used search order hijacking to execute malicious payloads, such as Winnti RAT.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Aquatic Panda has used DLL search-order hijacking to load `exe`, `dll`, and `dat` files into memory.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
BackdoorDiplomacy has executed DLL search order hijacking.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Cinnamon Tempest has used search order hijacking to launch Cobalt Strike Beacons.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Evilnum has used the malware variant, TerraTV, to load a malicious DLL placed in the TeamViewer directory, instead of the original Windows DLL located in a system folder.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
RTM has used search order hijacking to force TeamViewer to load a malicious DLL.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Threat Group-3390 has performed DLL search order hijacking to execute their payload.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Tonto Team abuses a legitimate and signed Microsoft executable to launch a malicious DLL.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Whitefly has used search order hijacking to run the loader Vcrodat.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
menuPass has used DLL search order hijacking.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Astaroth can launch itself via DLL Search Order Hijacking.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
BOOSTWRITE has exploited the loading of the legitimate Dwrite.dll file by actually loading the gdi library, which then loads the gdiplus library and ultimately loads the local Dwrite dll.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Brute Ratel C4 has used search order hijacking to load a malicious payload DLL as a dependency to a benign application packaged in the same ISO.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Chaes has used search order hijacking to load a malicious DLL.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Crutch can persist via DLL search order hijacking on Google Chrome, Mozilla Firefox, or Microsoft OneDrive.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Downdelph uses search order hijacking of the Windows executable sysprep.exe to escalate privileges.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Empire contains modules that can discover and exploit various DLL hijacking opportunities.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
A FinFisher variant uses DLL search order hijacking.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
FoggyWeb's loader has used DLL Search Order Hijacking to load malicious code instead of the legitimate `version.dll` during the `Microsoft.IdentityServer.ServiceHost.exe` execution process.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
HTTPBrowser abuses the Windows DLL load order by using a legitimate Symantec anti-virus binary, VPDN_LU.exe, to load a malicious DLL that mimics a legitimate Symantec DLL, navlu.dll.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
HUI Loader can be deployed to targeted systems via legitimate programs that are vulnerable to DLL search order hijacking.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Hikit has used DLL Search Order Hijacking to load `oci.dll` as a persistence mechanism.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
InvisiMole can be launched by using DLL search order hijacking in which the wrapper DLL is placed in the same folder as explorer.exe and loaded during startup into the Windows Explorer process instead of the legitimate library.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Melcoz can use DLL hijacking to bypass security controls.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
MirageFox is likely loaded via DLL hijacking into a legitimate McAfee binary.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
PlugX has the ability to use DLL search order hijacking for installation on targeted systems.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit DLL hijacking opportunities in services and processes.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Prikormka uses DLL search order hijacking for persistence by saving itself as ntshrui.dll to the Windows directory so it will load before the legitimate ntshrui.dll saved in the System32 subdirectory.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Ramsay can hijack outdated Windows application dependencies with malicious versions of its own DLL payload.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
RedLeaves is launched through use of DLL search order hijacking to load a malicious dll.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Variants of WEBC2 achieve persistence by using DLL search order hijacking, usually by copying the DLL file to `%SYSTEMROOT%` (`C:\WINDOWS\ntshrui.dll`).
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
WastedLocker has performed DLL hijacking before execution.
Technique: T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
During Operation CuckooBees, the threat actors used the legitimate Windows services `IKEEXT` and `PrintNotify` to side-load malicious DLLs.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
APT19 launched an HTTP malware variant and a Port 22 malware variant using a legitimate executable that loaded the malicious DLL.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
APT3 has been known to side load DLLs with a valid version of Chrome with one of their tools.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
APT32 ran legitimately-signed executables from Symantec and McAfee which load a malicious DLL. The group also side-loads its backdoor by dropping a library and a legitimate, signed executable (AcroTranscoder).
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
APT41 used legitimate executables to perform DLL side-loading of their malware.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
BRONZE BUTLER has used legitimate applications to side-load malicious DLLs.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
BlackTech has used DLL side loading by giving DLLs hardcoded names and placing them in searched directories.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Chimera has used side loading to place malicious DLLs in memory.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Cinnamon Tempest has abused legitimate executables to side-load weaponized DLLs.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Earth Lusca has placed a malicious payload in `%WINDIR%\SYSTEM32\oci.dll` so it would be sideloaded by the MSDTC service.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
FIN13 has used IISCrack.dll as a side-loading technique to load a malicious version of httpodbc.dll on old IIS Servers (CVE-2001-0507).
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
GALLIUM used DLL side-loading to covertly load PoisonIvy into memory on the victim machine.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Higaisa’s JavaScript file used a legitimate Microsoft Office 2007 package to side-load the `OINFO12.OCX` dynamic link library.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Lazarus Group has replaced `win_fw.dll`, an internal component that is executed during IDA Pro installation, with a malicious DLL to download and execute a payload.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
LuminousMoth has used legitimate executables such as `winword.exe` and `igfxem.exe` to side-load their malware.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
MuddyWater maintains persistence on victim networks through side-loading dlls to trick legitimate programs into running malware.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Mustang Panda has used a legitimately signed executable to execute a malicious payload within a DLL file.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Naikon has used DLL side-loading to load malicious DLL's into legitimate executables.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
A Patchwork .dll that contains BADNEWS is loaded and executed using DLL side-loading.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
SideCopy has used a malicious loader DLL file to execute the `credwiz.exe` process and side-load the malicious payload `Duser.dll`.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Sidewinder has used DLL side-loading to drop and execute malicious payloads including the hijacking of the legitimate Windows application file rekeywiz.exe.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Threat Group-3390 has used DLL side-loading, including by using legitimate Kaspersky antivirus variants as well as `rc.exe`, a legitimate Microsoft Resource Compiler.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Tropic Trooper has been known to side-load DLLs using a valid version of a Windows Address Book and Windows Defender executable with one of their tools.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
menuPass has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as UPPERCUT.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
BADNEWS typically loads its DLL file into a legitimate signed Java or VMware executable.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
DLL side-loading has been used to execute BBSRAT through a legitimate Citrix executable, ssonsvr.exe. The Citrix executable was dropped along with BBSRAT by the dropper.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Brute Ratel C4 has loaded a malicious DLL by spoofing the name of the legitimate Version.DLL  and placing it in the same folder as the digitally-signed Microsoft binary OneDriveUpdater.exe.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Chinoxy can use a digitally signed binary ("Logitech Bluetooth Wizard Host Process") to load its dll into memory.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Clambling can store a file named `mpsvc.dll`, which opens a malicious `mpsvc.mui` file, in the same folder as the legitimate Microsoft executable `MsMpEng.exe` to gain execution.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
DarkGate includes one infection vector that leverages a malicious "KeyScramblerE.DLL" library that will load during the execution of the legitimate KeyScrambler application.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Denis exploits a security vulnerability to load a fake DLL and execute its code.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Dridex can abuse legitimate Windows executables to side-load malicious DLL files.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Ecipekac can abuse the legitimate application policytool.exe to load a malicious DLL.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Egregor has used DLL side-loading to execute its payload.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
FinFisher uses DLL side-loading to load malicious programs.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Goopy has the ability to side-load malicious DLLs with legitimate applications from Kaspersky, Microsoft, and Google.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
HTTPBrowser has used DLL side-loading.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
HyperBro has used a legitimate application to sideload a DLL to decrypt, decompress, and run a payload.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Javali can use DLL side-loading to load malicious DLLs into legitimate executables.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Kerrdown can use DLL side-loading to load malicious DLLs.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
LoFiSe has been executed as a file named DsNcDiag.dll through side-loading.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
LookBack side loads its communications module as a DLL into the `libcurl.dll` loader.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Metamorfo has side-loaded its malicious DLL file.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Nebulae can use DLL side-loading to gain execution.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Ninja loaders can be side-loaded with legitimate and signed executables including the  VLC.exe media player.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Pandora can use DLL side-loading to execute malicious payloads.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Pcexter has been distributed and executed as a DLL file named Vspmsg.dll via DLL side-loading.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
PlugX has used DLL side-loading to evade anti-virus.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
PowGoop can side-load `Goopdate.dll` into `GoogleUpdate.exe`.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
QakBot has the ability to use DLL side-loading for execution.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
RCSession can be installed via DLL side-loading.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
RainyDay can use side-loading to run malicious executables.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Sakula uses DLL side-loading, typically using a digitally signed sample of Kaspersky Anti-Virus (AV) 6.0 for Windows Workstations or McAfee's Outlook Scan About Box to load malicious DLL files.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
SysUpdate can load DLLs through vulnerable legitimate executables.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
During the T9000 installation process, it drops a copy of the legitimate Microsoft binary igfxtray.exe. The executable contains a side-loading weakness which is used to load a portion of the malware.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Waterbear has used DLL side loading to import and load a malicious DLL loader.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Wingbird side loads a malicious file, sspisrv.dll, in part of a spoofed lssas.exe service.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
ZeroT has used DLL side-loading to load malicious payloads.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
A gh0st RAT variant has used DLL side-loading.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
metaMain can support an HKCMD sideloading start method.
Technique: T1574.002 Hijack Execution Flow: DLL Side-Loading, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Empire has a dylib hijacker module that generates a malicious dylib given the path to a legitimate dylib of a vulnerable application.
Technique: T1574.004 Hijack Execution Flow: Dylib Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
APT41 has configured payloads to load via LD_PRELOAD.
Technique: T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.
Technique: T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
COATHANGER copies the malicious file `/data2/.bd.key/preload.so` to `/lib/preload.so`, then launches a child process that executes the malicious file `/data2/.bd.key/authd` as `/bin/authd` with the arguments `/lib/preload.so reboot newreboot 1`. This injects the malicious preload.so file into the process with PID 1, and replaces its reboot function with the malicious newreboot function for persistence.
Technique: T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Ebury has injected its dynamic library into descendent processes of sshd via LD_PRELOAD.
Technique: T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
HiddenWasp adds itself as a shared object to the LD_PRELOAD environment variable.
Technique: T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Hildegard has modified /etc/ld.so.preload to intercept shared library import functions.
Technique: T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
XCSSET adds malicious file paths to the `DYLD_FRAMEWORK_PATH` and `DYLD_LIBRARY_PATH` environment variables to execute malicious code.
Technique: T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
DarkGate overrides the `%windir%` environment variable by setting a Registry key, `HKEY_CURRENT_User\Environment\windir`, to an alternate command to execute a malicious AutoIt script. This allows DarkGate to run every time the scheduled task `DiskCleanup` is executed as this uses the path value `%windir%\system32\cleanmgr.exe` for execution.
Technique: T1574.007 Hijack Execution Flow: Path Interception by PATH Environment Variable, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Empire contains modules that can discover and exploit path interception opportunities in the PATH environment variable.
Technique: T1574.007 Hijack Execution Flow: Path Interception by PATH Environment Variable, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit path interception opportunities in the PATH environment variable.
Technique: T1574.007 Hijack Execution Flow: Path Interception by PATH Environment Variable, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Empire contains modules that can discover and exploit search order hijacking vulnerabilities.
Technique: T1574.008 Hijack Execution Flow: Path Interception by Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit search order hijacking vulnerabilities.
Technique: T1574.008 Hijack Execution Flow: Path Interception by Search Order Hijacking, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Empire contains modules that can discover and exploit unquoted path vulnerabilities.
Technique: T1574.009 Hijack Execution Flow: Path Interception by Unquoted Path, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit unquoted path vulnerabilities.
Technique: T1574.009 Hijack Execution Flow: Path Interception by Unquoted Path, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
One variant of BlackEnergy locates existing driver services that have been disabled and drops its driver component into one of those service's paths, replacing the legitimate executable. The malware then sets the hijacked service to start automatically to establish persistence.
Technique: T1574.010 Hijack Execution Flow: Services File Permissions Weakness, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
During Operation Honeybee, the threat actors used a batch file that modified the COMSysApp service to load a malicious ipnet.dll payload and to load a DLL into the `svchost.exe` process.
Technique: T1574.011 Hijack Execution Flow: Services Registry Permissions Weakness, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Blue Mockingbird has used wmic.exe and Windows Registry modifications to set the COR_PROFILER environment variable to execute a malicious DLL whenever a process loads the .NET CLR.
Technique: T1574.012 Hijack Execution Flow: COR_PROFILER, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
DarkTortilla can detect profilers by verifying the `COR_ENABLE_PROFILING` environment variable is present and active.
Technique: T1574.012 Hijack Execution Flow: COR_PROFILER, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Lazarus Group has abused the `KernelCallbackTable` to hijack process control flow and execute shellcode.
Technique: T1574.013 Hijack Execution Flow: KernelCallbackTable, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
FinFisher has used the `KernelCallbackTable` to hijack the execution flow of a process by replacing the `__fnDWORD` function with the address of a created Asynchronous Procedure Call stub routine.
Technique: T1574.013 Hijack Execution Flow: KernelCallbackTable, Tactic: TA0005 Defense Evasion TA0003 Persistence TA0004 Privilege Escalation
Pacu can create snapshots of EBS volumes and RDS instances.
Technique: T1578.001 Modify Cloud Compute Infrastructure: Create Snapshot, Tactic: TA0005 Defense Evasion
During C0027, Scattered Spider used access to the victim's Azure tenant to create Azure VMs.
Technique: T1578.002 Modify Cloud Compute Infrastructure: Create Cloud Instance, Tactic: TA0005 Defense Evasion
LAPSUS$ has created new virtual machines within the target's cloud environment after leveraging credential access to cloud assets.
Technique: T1578.002 Modify Cloud Compute Infrastructure: Create Cloud Instance, Tactic: TA0005 Defense Evasion
During C0027, Scattered Spider used access to the victim's Azure tenant to create Azure VMs.

Scattered Spider has also created Amazon EC2 instances within the victim's environment.
Technique: T1578.002 Modify Cloud Compute Infrastructure: Create Cloud Instance, Tactic: TA0005 Defense Evasion
LAPSUS$ has deleted the target's systems and resources in the cloud to trigger the organization's incident and crisis response process.
Technique: T1578.003 Modify Cloud Compute Infrastructure: Delete Cloud Instance, Tactic: TA0005 Defense Evasion
Scattered Spider enumerates cloud environments to identify server and backup management infrastructure, resource access, databases and storage containers.
Technique: T1580 Cloud Infrastructure Discovery, Tactic: TA0007 Discovery
Pacu can enumerate AWS infrastructure, such as EC2 instances.
Technique: T1580 Cloud Infrastructure Discovery, Tactic: TA0007 Discovery
Sandworm Team used various third-party email campaign management services to deliver phishing emails.
Technique: T1583 Acquire Infrastructure, Tactic: TA0042 Resource Development
For C0010, UNC3890 actors established domains that appeared to be legitimate services and entities, such as LinkedIn, Facebook, Office 365, and Pfizer.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
For C0011, Transparent Tribe registered domains likely designed to appear relevant to student targets in India.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
For C0021, the threat actors registered domains for use in C2.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
For C0026, the threat actors re-registered expired C2 domains previously used for ANDROMEDA malware.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
For CostaRicto, the threat actors established domains, some of which appeared to spoof legitimate domains.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
For FunnyDream, the threat actors registered a variety of domains.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
During Operation Dream Job, Lazarus Group registered a domain name identical to that of a compromised company as part of their BEC effort.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
For Operation Dust Storm, the threat actors established domains as part of their operational infrastructure.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
For Operation Ghost, APT29 registered domains for use in C2 including some crafted to appear as existing legitimate domains.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
During Operation Honeybee, threat actors registered domains for C2.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
For Operation Spalax, the threat actors registered hundreds of domains using Duck DNS and DNS Exit.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
For the SolarWinds Compromise, APT29 acquired C2 domains, sometimes through resellers.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
APT1 has registered hundreds of domains for use in operations.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
APT28 registered domains imitating NATO, OSCE security websites, Caucasus information resources, and other organizations.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
APT32 has set up and operated websites to gather information and deliver malware.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
BITTER has registered a variety of domains to host malicious payloads and for C2.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
Dragonfly has registered domains for targeting intended victims.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
EXOTIC LILY has registered domains to spoof targeted organizations by changing the top-level domain (TLD) to “.us”, “.co” or “.biz”.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
Earth Lusca has registered domains, intended to look like legitimate target domains, that have been used in watering hole attacks.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
FIN7 has registered look-alike domains for use in phishing campaigns.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
Ferocious Kitten has acquired domains imitating legitimate sites.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
Gamaredon Group has registered multiple domains to facilitate payload staging and C2.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development