sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
Andariel has used watering hole attacks, often with zero-day exploits, to gain initial access to victims within a specific IP range.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
Axiom has used watering hole attacks to gain access.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
BRONZE BUTLER compromised three Japanese websites using a Flash exploit to perform watering hole attacks.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
Dark Caracal leveraged a watering hole to serve up malicious code.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
Darkhotel used embedded iframes on hotel login portals to redirect selected victims to download malware.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
Dragonfly has compromised targets via strategic web compromise (SWC) utilizing a custom exploit kit.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
Earth Lusca has performed watering hole attacks.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
Elderwood has delivered zero-day exploits and malware to victims by injecting malicious code into specific public Web pages visited by targets within a particular sector.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
Lazarus Group delivered RATANKBA and other malicious code to victims via a compromised legitimate website.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
Leafminer has infected victims using watering holes.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
Leviathan has infected victims using watering holes.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
Machete has distributed Machete through a fake blog website.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
Magic Hound has conducted watering-hole attacks through media and magazine websites.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
Mustard Tempest has used drive-by downloads for initial infection, often using fake browser updates as a lure.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
PLATINUM has sometimes used drive-by attacks against vulnerable browser plugins.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
PROMETHIUM has used watering hole attacks to deliver malicious versions of legitimate installers.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
Patchwork has used watering holes to deliver files with exploits to initial victims.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
RTM has distributed its malware via the RIG and SUNDOWN exploit kits, as well as online advertising network `Yandex.Direct`.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
Threat Group-3390 has extensively used strategic web compromises to target victims.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
Transparent Tribe has used websites with malicious hyperlinks and iframes to infect targeted victims with Crimson, njRAT, and other malicious tools.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
Turla has infected victims using watering holes.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
Windigo has distributed Windows malware via drive-by downloads.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
Windshift has used compromised websites to register custom URL schemes on a remote system.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
Bad Rabbit spread through watering holes on popular sites by injecting JavaScript into the HTML body or a `.js` file.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
Bundlore has been spread through malicious advertisements on websites.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
Grandoreiro has used compromised websites and Google Ads to bait victims into downloading its installer.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
KARAE was distributed through torrent file-sharing websites to South Korean victims, using a YouTube video downloader application as a lure.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
LoudMiner is typically bundled with pirated copies of Virtual Studio Technology (VST) for Windows and macOS.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
POORAIM has been delivered through compromised sites acting as watering holes.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
REvil has infected victim machines through compromised websites and exploit kits.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
Snip3 has been delivered to targets via downloads from malicious domains.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
SocGholish has been distributed through compromised websites with malicious content often masquerading as browser updates.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
During C0017, APT41 exploited CVE-2021-44207 in the USAHerds application and CVE-2021-44228 in Log4j, as well as other .NET deserialization, SQL injection, and directory traversal vulnerabilities to gain initial access.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
During C0018, the threat actors exploited VMWare Horizon Unified Access Gateways that were vulnerable to several Log4Shell vulnerabilities, including CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
During C0027, Scattered Spider exploited CVE-2021-35464 in the ForgeRock Open Access Management (OpenAM) application server to gain initial access.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
During Cutting Edge, threat actors exploited CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure VPN appliances to enable authentication bypass and command injection. A server-side request forgery (SSRF) vulnerability, CVE-2024-21893, was identified later and used to bypass mitigations for the initial two vulnerabilities by chaining with CVE-2024-21887.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
During Night Dragon, threat actors used SQL injection exploits against extranet web servers to gain access.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
During Operation CuckooBees, the threat actors exploited multiple vulnerabilities in externally facing servers.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
During Operation Wocao, threat actors gained initial access by exploiting vulnerabilities in JBoss webservers.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
During the SolarWinds Compromise, APT29 exploited CVE-2020-0688 against the Microsoft Exchange Control Panel to regain access to a network.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
APT28 has used a variety of public exploits, including CVE 2020-0688 and CVE 2020-17144, to gain execution on vulnerable Microsoft Exchange; they have also conducted SQL injection attacks against external websites.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
APT39 has used SQL injection for initial compromise.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
APT41 exploited CVE-2020-10189 against Zoho ManageEngine Desktop Central through unsafe deserialization, and CVE-2019-19781 to compromise Citrix Application Delivery Controllers (ADC) and gateway devices. APT41 leveraged vulnerabilities such as ProxyLogon exploitation or SQL injection for initial access.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
APT5 has exploited vulnerabilities in externally facing software and devices including Pulse Secure VPNs and Citrix Application Delivery Controllers.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
Axiom has been observed using SQL injection to gain access to systems.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
BackdoorDiplomacy has exploited CVE-2020-5902, an F5 BIP-IP vulnerability, to drop a Linux backdoor. BackdoorDiplomacy has also exploited mis-configured Plesk servers.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
BlackTech has exploited a buffer overflow vulnerability in Microsoft Internet Information Services (IIS) 6.0, CVE-2017-7269, in order to establish a new HTTP or command and control (C2) server.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
Blue Mockingbird has gained initial access by exploiting CVE-2019-18935, a vulnerability within Telerik UI for ASP.NET AJAX.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
Cinnamon Tempest has exploited multiple unpatched vulnerabilities for initial access including vulnerabilities in Microsoft Exchange, Manage Engine AdSelfService Plus, Confluence, and Log4j.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
Dragonfly has conducted SQL injection attacks, exploited vulnerabilities CVE-2019-19781 and CVE-2020-0688 for Citrix and MS Exchange, and CVE-2018-13379 for Fortinet VPNs.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
Earth Lusca has compromised victims by directly exploiting vulnerabilities of public-facing servers, including those associated with Microsoft Exchange and Oracle GlassFish.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
FIN13 has exploited known vulnerabilities such as CVE-2017-1000486 (Primefaces Application Expression Language Injection), CVE-2015-7450 (WebSphere Application Server SOAP Deserialization Exploit), CVE-2010-5326 (SAP NewWeaver Invoker Servlet Exploit), and EDB-ID-24963 (SAP NetWeaver ConfigServlet Remote Code Execution) to gain initial access.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
FIN7 has compromised targeted organizations through exploitation of CVE-2021-31207 in Exchange.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
Fox Kitten has exploited known vulnerabilities in Fortinet, PulseSecure, and Palo Alto VPN appliances.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
GALLIUM exploited a publicly-facing servers including Wildfly/JBoss servers to gain access to the network.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
GOLD SOUTHFIELD has exploited Oracle WebLogic vulnerabilities for initial compromise.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
HAFNIUM has exploited CVE-2021-44228 in Log4j and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065  to compromise on-premises versions of Microsoft Exchange Server.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
Ke3chang has compromised networks by exploiting Internet-facing applications, including vulnerable Microsoft Exchange and SharePoint servers.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
Kimsuky has exploited various vulnerabilities for initial access, including Microsoft Exchange vulnerability CVE-2020-0688.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
Moses Staff has exploited known vulnerabilities in public-facing infrastructure such as Microsoft Exchange Servers.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
MuddyWater has exploited the Microsoft Exchange memory corruption vulnerability (CVE-2020-0688).
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
Rocke exploited Apache Struts, Oracle WebLogic (CVE-2017-10271), and Adobe ColdFusion (CVE-2017-3066) vulnerabilities to deliver malware.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
Sandworm Team exploits public-facing applications for initial access and to acquire infrastructure, such as exploitation of the EXIM mail transfer agent in Linux systems.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
ToddyCat has exploited the ProxyLogon vulnerability (CVE-2021-26855) to compromise Exchange Servers at multiple organizations.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
Volatile Cedar has targeted publicly facing web servers, with both automatic and manual vulnerability discovery.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
Volt Typhoon gained initial access through exploitation of CVE-2021-40539 in internet-facing ManageEngine ADSelfService Plus servers.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
menuPass has leveraged vulnerabilities in Pulse Secure VPNs to hijack sessions.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
COATHANGER is installed following exploitation of a vulnerable FortiGate device.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
Havij is used to automate SQL injection.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
Siloscape is executed after the attacker gains initial access to a Windows container using a known vulnerability.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
SoreFang can gain access by exploiting a Sangfor SSL VPN vulnerability that allows for the placement and delivery of malicious update binaries.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
ZxShell has been dropped through exploitation of CVE-2011-2462, CVE-2013-3163, and CVE-2014-0322.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
sqlmap can be used to automate exploitation of SQL injection vulnerabilities.
Technique: T1190 Exploit Public-Facing Application, Tactic: TA0001 Initial Access
XCSSET adds malicious code to a host's Xcode projects by enumerating CocoaPods `target_integrator.rb` files under the `/Library/Ruby/Gems` folder or enumerates all `.xcodeproj` folders under a given directory. XCSSET then downloads a script and Mach-O file into the Xcode project folder.
Technique: T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools, Tactic: TA0001 Initial Access
During the SolarWinds Compromise, APT29 gained initial network access to some victims via a trojanized update of SolarWinds Orion software.
Technique: T1195.002 Supply Chain Compromise: Compromise Software Supply Chain, Tactic: TA0001 Initial Access
APT41 gained access to production environments where they could inject malicious code into legitimate, signed files and widely distribute them to end users.
Technique: T1195.002 Supply Chain Compromise: Compromise Software Supply Chain, Tactic: TA0001 Initial Access
Cobalt Group has compromised legitimate web browser updates to deliver a backdoor.
Technique: T1195.002 Supply Chain Compromise: Compromise Software Supply Chain, Tactic: TA0001 Initial Access
Dragonfly has placed trojanized installers for control system software on legitimate vendor app stores.
Technique: T1195.002 Supply Chain Compromise: Compromise Software Supply Chain, Tactic: TA0001 Initial Access
FIN7 has gained initial access by compromising a victim's software supply chain.
Technique: T1195.002 Supply Chain Compromise: Compromise Software Supply Chain, Tactic: TA0001 Initial Access
GOLD SOUTHFIELD has distributed ransomware by backdooring software installers via a strategic web compromise of the site hosting Italian WinRAR.
Technique: T1195.002 Supply Chain Compromise: Compromise Software Supply Chain, Tactic: TA0001 Initial Access
Sandworm Team has distributed NotPetya by compromising the legitimate Ukrainian accounting software M.E.Doc and replacing a legitimate software update with a malicious one.
Technique: T1195.002 Supply Chain Compromise: Compromise Software Supply Chain, Tactic: TA0001 Initial Access
Threat Group-3390 has compromised the Able Desktop installer to gain access to victim's environments.
Technique: T1195.002 Supply Chain Compromise: Compromise Software Supply Chain, Tactic: TA0001 Initial Access
CCBkdr was added to a legitimate, signed version 5.33 of the CCleaner software and distributed on CCleaner's distribution site.
Technique: T1195.002 Supply Chain Compromise: Compromise Software Supply Chain, Tactic: TA0001 Initial Access
GoldenSpy has been packaged with a legitimate tax preparation software.
Technique: T1195.002 Supply Chain Compromise: Compromise Software Supply Chain, Tactic: TA0001 Initial Access
SUNSPOT malware was designed and used to insert SUNBURST into software builds of the SolarWinds Orion IT management product.
Technique: T1195.002 Supply Chain Compromise: Compromise Software Supply Chain, Tactic: TA0001 Initial Access
APT39 has used the BITS protocol to exfiltrate stolen data from a compromised host.
Technique: T1197 BITS Jobs, Tactic: TA0005 Defense Evasion TA0003 Persistence
APT41 used BITSAdmin to download and install payloads.
Technique: T1197 BITS Jobs, Tactic: TA0005 Defense Evasion TA0003 Persistence
Leviathan has used BITSAdmin to download additional tools.
Technique: T1197 BITS Jobs, Tactic: TA0005 Defense Evasion TA0003 Persistence
Patchwork has used BITS jobs to download malicious payloads.
Technique: T1197 BITS Jobs, Tactic: TA0005 Defense Evasion TA0003 Persistence
Wizard Spider has used batch scripts that utilizes WMIC to execute a BITSAdmin transfer of a ransomware payload to each compromised machine.
Technique: T1197 BITS Jobs, Tactic: TA0005 Defense Evasion TA0003 Persistence
BITSAdmin can be used to create BITS Jobs to launch a malicious process.
Technique: T1197 BITS Jobs, Tactic: TA0005 Defense Evasion TA0003 Persistence
Bazar has been downloaded via Windows BITS functionality.
Technique: T1197 BITS Jobs, Tactic: TA0005 Defense Evasion TA0003 Persistence
Cobalt Strike can download a hosted "beacon" payload using BITSAdmin.
Technique: T1197 BITS Jobs, Tactic: TA0005 Defense Evasion TA0003 Persistence
Egregor has used BITSadmin to download and execute malicious DLLs.
Technique: T1197 BITS Jobs, Tactic: TA0005 Defense Evasion TA0003 Persistence
A JPIN variant downloads the backdoor payload via the BITS service.
Technique: T1197 BITS Jobs, Tactic: TA0005 Defense Evasion TA0003 Persistence
MarkiRAT can use BITS Utility to connect with the C2 server.
Technique: T1197 BITS Jobs, Tactic: TA0005 Defense Evasion TA0003 Persistence
ProLock can use BITS jobs to download its malicious payload.
Technique: T1197 BITS Jobs, Tactic: TA0005 Defense Evasion TA0003 Persistence
UBoatRAT takes advantage of the /SetNotifyCmdLine option in BITSAdmin to ensure it stays running on a system to maintain persistence.
Technique: T1197 BITS Jobs, Tactic: TA0005 Defense Evasion TA0003 Persistence
During the SolarWinds Compromise, APT29 gained access through compromised accounts at cloud solution partners, and used compromised certificates issued by Mimecast to authenticate to Mimecast customer systems.
Technique: T1199 Trusted Relationship, Tactic: TA0001 Initial Access
Once APT28 gained access to the DCCC network, the group then proceeded to use that access to compromise the DNC network.
Technique: T1199 Trusted Relationship, Tactic: TA0001 Initial Access
APT29 has compromised IT, cloud services, and managed services providers to gain broad access to multiple customers for subsequent operations.
Technique: T1199 Trusted Relationship, Tactic: TA0001 Initial Access
GOLD SOUTHFIELD has breached Managed Service Providers (MSP's) to deliver malware to MSP customers.
Technique: T1199 Trusted Relationship, Tactic: TA0001 Initial Access
LAPSUS$ has accessed internet-facing identity providers such as Azure Active Directory and Okta to target specific organizations.
Technique: T1199 Trusted Relationship, Tactic: TA0001 Initial Access
POLONIUM has used compromised credentials from an IT company to target downstream customers including a law firm and aviation company.
Technique: T1199 Trusted Relationship, Tactic: TA0001 Initial Access
Sandworm Team has used dedicated network connections from one victim organization to gain unauthorized access to a separate organization.
Technique: T1199 Trusted Relationship, Tactic: TA0001 Initial Access
Threat Group-3390 has compromised third party service providers to gain access to victim's environments.
Technique: T1199 Trusted Relationship, Tactic: TA0001 Initial Access
menuPass has used legitimate access granted to Managed Service Providers in order to access victims of interest.
Technique: T1199 Trusted Relationship, Tactic: TA0001 Initial Access
DarkVishnya used Bash Bunny, Raspberry Pi, netbooks or inexpensive laptops to connect to the company’s local network.
Technique: T1200 Hardware Additions, Tactic: TA0001 Initial Access
During Operation CuckooBees, the threat actors used the `net accounts` command as part of their advanced reconnaissance.
Technique: T1201 Password Policy Discovery, Tactic: TA0007 Discovery
Chimera has used the NtdsAudit utility to collect information related to accounts and passwords.
Technique: T1201 Password Policy Discovery, Tactic: TA0007 Discovery
OilRig has used net.exe in a script with `net accounts /domain` to find the password policy of a domain.
Technique: T1201 Password Policy Discovery, Tactic: TA0007 Discovery
Turla has used `net accounts` and `net accounts /domain` to acquire password policy information.
Technique: T1201 Password Policy Discovery, Tactic: TA0007 Discovery
BloodHound can collect password policy information on the target environment.
Technique: T1201 Password Policy Discovery, Tactic: TA0007 Discovery
CrackMapExec can discover the password policies applied to the target system.
Technique: T1201 Password Policy Discovery, Tactic: TA0007 Discovery
Kwampirs collects password policy information with the command `net accounts`.
Technique: T1201 Password Policy Discovery, Tactic: TA0007 Discovery
The `net accounts` and `net accounts /domain` commands with Net can be used to obtain password policy information.
Technique: T1201 Password Policy Discovery, Tactic: TA0007 Discovery
PoshC2 can use `Get-PassPol` to enumerate the domain password policy.
Technique: T1201 Password Policy Discovery, Tactic: TA0007 Discovery
Lazarus Group persistence mechanisms have used `forfiles.exe` to execute .htm files.
Technique: T1202 Indirect Command Execution, Tactic: TA0005 Defense Evasion
Forfiles can be used to subvert controls and possibly conceal command execution by not directly invoking cmd.
Technique: T1202 Indirect Command Execution, Tactic: TA0005 Defense Evasion
Revenge RAT uses the Forfiles utility to execute commands on the system.
Technique: T1202 Indirect Command Execution, Tactic: TA0005 Defense Evasion
During Frankenstein, the threat actors exploited CVE-2017-11882 to execute code on the victim's machine.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
During Operation Dust Storm, the threat actors exploited Adobe Flash vulnerability CVE-2011-0611, Microsoft Windows Help vulnerability CVE-2010-1885, and several Internet Explorer vulnerabilities, including CVE-2011-1255, CVE-2012-1889, and CVE-2014-0322.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
APT12 has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities (CVE-2009-3129, CVE-2012-0158) and vulnerabilities in Adobe Reader and Flash (CVE-2009-4324, CVE-2009-0927, CVE-2011-0609, CVE-2011-0611).
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
APT28 has exploited Microsoft Office vulnerability CVE-2017-0262 for execution.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
APT29 has used multiple software exploits for common client software, like Microsoft Word, Exchange, and Adobe Reader, to gain code execution.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
APT3 has exploited the Adobe Flash Player vulnerability CVE-2015-3113 and Internet Explorer vulnerability CVE-2014-1776.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
APT32 has used RTF document that includes an exploit to execute malicious code. (CVE-2017-11882)
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
APT33 has attempted to exploit a known vulnerability in WinRAR (CVE-2018-20250), and attempted to gain remote code execution via a security bypass vulnerability (CVE-2017-11774).
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Andariel has exploited numerous ActiveX vulnerabilities, including zero-days.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Aoqin Dragon has exploited CVE-2012-0158 and CVE-2010-3333 for execution against targeted systems.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Axiom has used exploits for multiple vulnerabilities including CVE-2014-0322, CVE-2012-4792, CVE-2012-1889, and CVE-2013-3893.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
BITTER has exploited Microsoft Office vulnerabilities CVE-2012-0158, CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Confucius has exploited Microsoft Office vulnerabilities, including CVE-2015-1641, CVE-2017-11882, and CVE-2018-0802.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Darkhotel has exploited Adobe Flash vulnerability CVE-2015-8651 for execution.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Dragonfly has exploited CVE-2011-0611 in Adobe Flash Player to gain execution on a targeted system.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
EXOTIC LILY has used malicious documents containing exploits for CVE-2021-40444 affecting Microsoft MSHTML.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Elderwood has used exploitation of endpoint software, including Microsoft Internet Explorer Adobe Flash vulnerabilities, to gain execution. They have also used zero-day exploits.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Ember Bear has exploited Microsoft Office vulnerability CVE-2017-11882.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Higaisa has exploited CVE-2018-0798 for execution.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Inception has exploited CVE-2012-0158, CVE-2014-1761, CVE-2017-11882 and CVE-2018-0802 for execution.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Lazarus Group has exploited Adobe Flash vulnerability CVE-2018-4878 for execution.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Leviathan has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
MuddyWater has exploited the Office vulnerability CVE-2017-0199 for execution.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Mustang Panda has exploited CVE-2017-0199 in Microsoft Word to execute code.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Patchwork uses malicious documents to deliver remote execution exploits as part of. The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Sandworm Team has exploited vulnerabilities in Microsoft PowerPoint via OLE objects (CVE-2014-4114) and Microsoft Word via crafted TIFF images (CVE-2013-3906).
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Sidewinder has exploited vulnerabilities to gain execution including CVE-2017-11882 and CVE-2020-0674.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
TA459 has exploited Microsoft Word vulnerability CVE-2017-0199 for execution.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
The White Company has taken advantage of a known vulnerability in Microsoft Word (CVE 2012-0158) to execute code.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Threat Group-3390 has exploited CVE-2018-0798 in Equation Editor.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Transparent Tribe has crafted malicious files to exploit CVE-2012-0158 and CVE-2010-3333 for execution.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Tropic Trooper has executed commands through Microsoft security vulnerabilities, including CVE-2017-11882, CVE-2018-0802, and CVE-2012-0158.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
admin@338 has exploited client software vulnerabilities for execution, such as Microsoft Word CVE-2012-0158.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Agent Tesla has exploited Office vulnerabilities such as CVE-2017-11882 and CVE-2017-8570 for execution during delivery.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Bankshot leverages a known zero-day vulnerability in Adobe Flash to execute the implant into the victims’ machines.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Cobalt Strike can exploit Oracle Java vulnerabilities for execution, including CVE-2011-3544, CVE-2013-2465, CVE-2012-4681, and CVE-2013-2460.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
DealersChoice leverages vulnerable versions of Flash to perform execution.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
EvilBunny has exploited CVE-2011-4369, a vulnerability in the PRC component in Adobe Reader.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
HAWKBALL has exploited Microsoft Office vulnerabilities CVE-2017-11882 and CVE-2018-0802 to deliver the payload.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
InvisiMole has installed legitimate but vulnerable Total Video Player software and wdigest.dll library drivers on compromised hosts to exploit stack overflow and input validation vulnerabilities for code execution.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Ramsay has been embedded in documents exploiting CVE-2017-0199, CVE-2017-11882, and CVE-2017-8570.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
SUPERNOVA was installed via exploitation of a SolarWinds Orion API authentication bypass vulnerability (CVE-2020-10148).
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
SpeakUp attempts to exploit the following vulnerabilities in order to execute its malicious script: CVE-2012-0874, CVE-2010-1871, CVE-2017-10271, CVE-2018-2894, CVE-2016-3088, JBoss AS 3/4/5/6, and the Hadoop YARN ResourceManager.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Woody RAT has relied on CVE-2022-30190 (Follina) for execution during delivery.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
Xbash can attempt to exploit known vulnerabilities in Hadoop, Redis, or ActiveMQ when it finds those services running in order to conduct further execution.
Technique: T1203 Exploitation for Client Execution, Tactic: TA0002 Execution
LAPSUS$ has recruited target organization employees or contractors who provide credentials and approve an associated MFA prompt, or install remote management software onto a corporate workstation, allowing LAPSUS$ to take control of an authenticated system.
Technique: T1204 User Execution, Tactic: TA0002 Execution
Scattered Spider has impersonated organization IT and helpdesk staff to instruct victims to execute commercial remote access tools to gain initial access.
Technique: T1204 User Execution, Tactic: TA0002 Execution
During C0011, Transparent Tribe relied on student targets to click on a malicious link sent via email.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
During C0021, the threat actors lured users into clicking a malicious link which led to the download of a  ZIP archive containing a malicious .LNK file.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
During Night Dragon, threat actors enticed users to click on links in spearphishing emails to download malware.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
During Operation Dream Job, Lazarus Group lured users into executing a malicious link to disclose private account information or provide initial access.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
During Operation Dust Storm, the threat actors relied on a victim clicking on a malicious link sent via email.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
During Operation Spalax, the threat actors relied on a victim to click on a malicious link distributed via phishing emails.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
APT28 has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
APT29 has used various forms of spearphishing attempting to get a user to click on a malicous link.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
APT3 has lured victims into clicking malicious links delivered through spearphishing.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
APT32 has lured targets to download a Cobalt Strike beacon by including a malicious link within spearphishing emails.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
APT33 has lured users to click links to malicious HTML applications delivered via spearphishing emails.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious link.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
BlackTech has used e-mails with malicious links to lure victims into installing malware.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Cobalt Group has sent emails containing malicious links that require users to execute a file or macro to infect the victim machine.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Confucius has lured victims into clicking on a malicious link sent through spearphishing.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
EXOTIC LILY has used malicious links to lure users into executing malicious payloads.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Earth Lusca  has sent spearphishing emails that required the user to click on a malicious link and subsequently open a decoy document with a malicious loader.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open links.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Ember Bear has attempted to lure users to click on a malicious link within a spearphishing email.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Evilnum has sent spearphishing emails designed to trick the recipient into opening malicious shortcut links which downloads a .LNK file.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
FIN4 has lured victims to click malicious links delivered via spearphishing emails (often sent from compromised accounts).
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
FIN7 has used malicious links to lure victims into downloading malware.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
FIN8 has used emails with malicious links to lure victims into installing malware.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Kimsuky has lured victims into clicking malicious links.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
LazyScripter has relied upon users clicking on links to malicious files.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Leviathan has sent spearphishing email links attempting to get a user to click.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
LuminousMoth has lured victims into clicking malicious Dropbox download links delivered through spearphishing.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Machete has has relied on users opening malicious links delivered through spearphishing to execute malware.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Magic Hound has attempted to lure victims into opening malicious links embedded in emails.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Mofang's spearphishing emails required a user to click the link to connect to a compromised website.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Molerats has sent malicious links via email trick users into opening a RAR archive and running an executable.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
MuddyWater has distributed URLs in phishing e-mails that link to lure documents.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Mustang Panda has sent malicious links including links directing victims to a Google Drive folder.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Mustard Tempest has lured users into downloading malware through malicious links in fake advertisements and spearphishing emails.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
OilRig has delivered malicious links to achieve execution on the target system.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Patchwork has used spearphishing with links to try to get users to click, download and open malicious files.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Sandworm Team has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Sidewinder has lured targets to click on malicious links to gain execution in the target environment.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
TA2541 has used malicious links to cloud and web services to gain execution on victim machines.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
TA505 has used lures to get users to click links in emails and attachments. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Transparent Tribe has directed users to open URLs hosting malicious content.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Turla has used spearphishing via a link to get users to download and run their malware.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Windshift has used links embedded in e-mails to lure victims into executing malicious code.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Wizard Spider has lured victims into clicking a malicious link delivered through spearphishing.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
ZIRCONIUM has used malicious links in e-mails to lure victims into downloading malware.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
AppleJeus's spearphishing links required user interaction to navigate to the malicious website.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
BackConfig has compromised victims via links to URLs hosting malicious content.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Bazar can gain execution after a user clicks on a malicious link to decoy landing pages hosted on Google Docs.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Bumblebee has relied upon a user downloading a file from a OneDrive link for execution.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Emotet has relied upon users clicking on a malicious link delivered through spearphishing.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Grandoreiro has used malicious links to gain execution on victim machines.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
GuLoader has relied upon users clicking on links to malicious documents.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Hancitor has relied upon users clicking on a malicious link delivered through phishing.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Javali has achieved execution through victims clicking links to malicious websites.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
KOCTOPUS has relied on victims clicking on a malicious link delivered via email.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Kerrdown has gained execution through victims opening malicious links.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Melcoz has gained execution through victims opening malicious links.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
NETWIRE has been executed through convincing victims into clicking malicious links.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
ObliqueRAT has gained execution on targeted systems through luring users to click on links to malicious URLs.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
OutSteel has relied on a user to click a malicious link within a spearphishing email.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
PLEAD has been executed via malicious links in e-mails.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Pony has attempted to lure targets into clicking links in spoofed emails from legitimate banks.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
QakBot has gained execution through users opening malicious links.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
SMOKEDHAM has relied upon users clicking on a malicious link delivered through phishing.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Saint Bot has relied on users to click on a malicious link delivered via a spearphishing.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Snip3 has been executed through luring victims into clicking malicious links.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
SocGholish has lured victims into interacting with malicious links on compromised websites for execution.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
SpicyOmelette has been executed through malicious links within spearphishing emails.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
Squirrelwaffle has relied on victims to click on a malicious link send via phishing campaigns.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
TSCookie has been executed via malicious links embedded in e-mails spoofing the Ministries of Education, Culture, Sports, Science and Technology of Japan.
Technique: T1204.001 User Execution: Malicious Link, Tactic: TA0002 Execution
During the 2015 Ukraine Electric Power Attack, Sandworm Team leveraged Microsoft Office attachments which contained malicious macros that were automatically executed once the user permitted them.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
During C0011, Transparent Tribe relied on a student target to open a malicious document delivered via email.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
During C0015, the threat actors relied on users to enable macros within a malicious Microsoft Word document.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
During Frankenstein, the threat actors relied on a victim to enable macros within a malicious Microsoft Word document likely sent via email.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
During Operation Dream Job, Lazarus Group lured victims into executing malicious documents that contained "dream job" descriptions from defense, aerospace, and other sectors.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
During Operation Dust Storm, the threat actors relied on potential victims to open a malicious Microsoft Word document sent via email.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution