sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
Hydraq creates a backdoor through which remote attackers can monitor processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Imminent Monitor has a "Process Watcher" feature to monitor processes in case the client ever crashes or gets closed.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Industroyer2 has the ability to cyclically enumerate running processes such as PServiceControl.exe, PService_PDD.exe, and other targets supplied through a hardcoded configuration.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
InvisiMole can obtain a list of running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
IronNetInjector can identify processes via C# methods such as `GetProcessesByName` and running Tasklist with the Python `os.popen` function.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Ixeshe can list running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
JHUHUGIT obtains a list of running processes on the victim.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
JPIN can list running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Javali can monitor processes for open browsers and custom banking applications.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
KEYMARBLE can obtain a list of running processes on the system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
KONNI has used the command `cmd /c tasklist` to get a snapshot of the current processes on the target machine.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
KOPILUWAK can enumerate current running processes on the targeted machine.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Kasidet has the ability to search for a given process name in processes currently running in the system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Kazuar obtains a list of running processes through WMI querying and the `ps` command.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
KillDisk has called `GetCurrentProcess`.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Kinsing has used ps to list processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
The OsInfo function in Komplex collects a running process list.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Kwampirs collects a list of running services with the command `tasklist /v`.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Linfo creates a backdoor through which remote attackers can retrieve a list of running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Lizar has a plugin designed to obtain a list of processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
LookBack can list running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
LoudMiner used the `ps` command to monitor the running processes on the system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Lucifer can identify the process that owns remote connections.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
MacMa can enumerate running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Machete has a component to check for running processes to look for web browsers.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Mafalda can enumerate running processes on a machine.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
MarkiRAT can search for different processes on a system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Maze has gathered all of the running system processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Metamorfo has performed process name checks and has monitored applications.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Meteor can check if a specific process is running, such as Kaspersky's `avp.exe`.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Mispadu can enumerate the running processes on a compromised host.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
MobileOrder has a command to upload information about all running processes to its C2 server.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
MoonWind has a command to return a list of running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Mosquito runs `tasklist` to obtain running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
NETEAGLE can send process listings over the C2 channel.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
NETWIRE can discover processes on compromised hosts.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
NKAbuse will check victim systems to ensure only one copy of the malware is running.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
NavRAT uses `tasklist /v` to check running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Nebulae can enumerate processes on a target system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
NightClub has the ability to use `GetWindowThreadProcessId` to identify the process behind a specified window.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Ninja can enumerate processes on a targeted host.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
ObliqueRAT can check for blocklisted process names on a compromised host.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
OceanSalt can collect the name and ID for every process running on the system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Orz can gather a process list from the victim.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
OutSteel can identify running processes on a compromised host.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
P8RAT can check for specific processes associated with virtual environments.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
PLAINTEE performs the `tasklist` command to list running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
PLEAD has the ability to list processes on the compromised host.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
POORAIM can enumerate processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
POWERSTATS has used `get_tasklist` to discover processes on the compromised host.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
POWRUNER may collect process information by running `tasklist` on a victim.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Pandora can monitor processes on a compromised host.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
PcShare can obtain a list of running processes on a compromised host.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Pillowmint can iterate through running processes every six seconds collecting a list of processes to capture from later.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
PipeMon can iterate over the running processes to find a suitable injection target.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
PlugX has a module to list the processes running on a machine.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
PoetRAT has the ability to list all running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
PowerDuke has a command to list the victim's processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
PowerShower has the ability to deploy a reconnaissance module to retrieve a list of the active processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
PowerSploit's `Get-ProcessTokenPrivilege` Privesc-PowerUp module can enumerate privileges for a given process.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
PowerStallion has been used to monitor process lists.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Proxysvc lists processes running on the system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Pupy can list the running processes and get the process ID and parent process’s ID.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
QakBot has the ability to check running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
RATANKBA lists the system’s processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
RCSession can identify processes based on PID.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
ROKRAT can list the current running processes on the system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
RTM can obtain information about process integrity levels.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
RainyDay can enumerate processes on a target system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Ramsay can gather a list of running processes by using Tasklist.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Remsec can obtain a process list from the victim.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Rising Sun can enumerate all running processes and process information on an infected machine.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
RotaJakiro can monitor the `/proc/[PID]` directory of known RotaJakiro processes as a part of its persistence when executing with non-root permissions. If the process is found dead, it resurrects the process. RotaJakiro processes can be matched to an associated Advisory Lock, in the `/proc/locks` folder, to ensure it doesn't spawn more than one process.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Royal can use `GetCurrentProcess` to enumerate processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Ryuk has called `CreateToolhelp32Snapshot` to enumerate all running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
SDBbot can enumerate a list of running processes on a compromised machine.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
SHOTPUT has a command to obtain a process listing.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
SILENTTRINITY can enumerate processes, including properties to determine if they have the Common Language Runtime (CLR) loaded.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
SLOTHFULMEDIA has enumerated processes by ID, name, or privileges.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
SUNBURST collected a list of process names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
SUNSPOT monitored running processes for instances of `MsBuild.exe` by hashing the name of each running process and comparing it to the corresponding value `0x53D525`. It also extracted command-line arguments and individual arguments from the running `MsBuild.exe` process to identify the directory path of the Orion software Visual Studio solution.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
SVCReady can collect a list of running processes from an infected host.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
SYSCON has the ability to use Tasklist to list running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Saint Bot has enumerated running processes on a compromised host to determine if it is running under the process name `dfrgui.exe`.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Sardonic has the ability to execute the `tasklist` command.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Seasalt has a command to perform a process listing.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
ShadowPad has collected the PID of a malicious process.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
ShimRatReporter listed all running processes on the machine.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Skidmap has monitored critical processes to ensure resiliency.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
SocGholish can list processes on targeted hosts.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Socksbot can list all running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
SodaMaster can search a list of running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
SombRAT can use the `getprocesslist` command to enumerate processes on a compromised host.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
SoreFang can enumerate processes on a victim machine through use of Tasklist.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
StreamEx has the ability to enumerate processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
StrongPity can determine if a user is logged in by checking to see if explorer.exe is running.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Sykipot may gather a list of running processes by running `tasklist /v`.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
SynAck enumerates all running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
SysUpdate can collect information about running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
TAINTEDSCRIBE can execute `ProcessList` for process discovery.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
TSCookie has the ability to list processes on the infected host.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Taidoor can use `GetCurrentProcessId` for process discovery.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
TajMahal has the ability to identify running processes and associated plugins on an infected host.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Tasklist can be used to discover processes running on a system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
ThiefQuest obtains a list of running processes using the function `kill_unwanted`.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
TrickBot uses module networkDll for process list discovery.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Trojan.Karagany can use Tasklist to collect a list of running tasks.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
UBoatRAT can list running processes on the system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
USBferry can use `tasklist` to gather information about the process running on the infected system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Uroburos can use its `Process List` command to enumerate processes on compromised hosts.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Ursnif has gathered information about running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
VERMIN can get a list of the processes and running tasks on the system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Valak has the ability to enumerate running processes on a compromised host.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Volgmer can gather a list of processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
WINERACK can enumerate processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
WarzoneRAT can obtain a list of processes on a compromised host.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Waterbear can identify the process for a specific security product.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
WinMM sets a WH_CBT Windows hook to collect information on process creation.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Winnti for Windows can check if the explorer.exe process is responsible for calling its install function.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Woody RAT can call `NtQuerySystemProcessInformation` with `SystemProcessInformation` to enumerate all running processes, including associated information such as PID, parent PID, image name, and owner.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
XAgentOSX contains the getProcessList function to run `ps aux` to get running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
ZIPLINE can identify running processes and their names.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Zebrocy uses the `tasklist` and `wmic process get Capture, ExecutablePath` commands to gather the processes running on the system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Zeus Panda checks for running processes on the victim’s machine.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Zox has the ability to list processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
ZxShell has a command, ps, to obtain a listing of processes on the system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
ZxxZ has created a snapshot of running processes using `CreateToolhelp32Snapshot`.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
down_new has the ability to list running processes on a compromised host.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
gh0st RAT has the capability to list processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
iKitten lists the current processes running.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
jRAT can query and kill system processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
macOS.OSAMiner has used `ps ax | grep <name> | grep -v grep | ...` and `ps ax | grep -E...` to conduct process discovery.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
metaMain can enumerate the processes that run on the platform.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
njRAT can search a list of running processes for Tr.exe.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
yty gets an output of running processes using the `tasklist` command.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
During Cutting Edge, threat actors used Perl scripts to enable the deployment of the THINSPOOL shell script dropper and for enumerating host data.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
For Operation Spalax, the threat actors used Nullsoft Scriptable Install System (NSIS) scripts to install malware.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
APT19 downloaded and launched code within a SCT file.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
APT32 has used COM scriptlets to download Cobalt Strike beacons.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
APT37 has used Ruby scripts to execute payloads.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
APT39 has utilized custom scripts to perform internal reconnaissance.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
Dragonfly has used the command line for execution.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
FIN6 has used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
FIN7 used SQL scripts to help perform tasks on the victim's machine.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
Fox Kitten has used a Perl reverse shell to communicate with C2.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
Malware used by Ke3chang can run commands on the command-line interface.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
OilRig has used various types of scripting for execution.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
Stealth Falcon malware uses WMI to script data collection and command execution on the victim.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
Whitefly has used a simple remote shell tool that will call back to the C2 server and wait for commands.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
Windigo has used a Perl script for information gathering.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
Bandook can support commands to execute Java-based payloads.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
Bonadan can create bind and reverse shells on the infected system.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
CHOPSTICK is capable of performing remote command execution.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
DarkComet can execute various types of scripts on the victim’s machine.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
Donut can generate shellcode outputs that execute via Ruby.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
Empire uses a command-line interface to interact with systems.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
FIVEHANDS can receive a command line argument to limit file encryption to specified directories.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
Get2 has the ability to run executables with command-line arguments.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
Imminent Monitor has a CommandPromptPacket and ScriptPacket module(s) for creating a remote shell and executing scripts.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
Kessel can create a reverse shell between the infected host and a specified system.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
Matryoshka is capable of providing Meterpreter shell access.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
P.A.S. Webshell has the ability to create reverse shells with Perl scripts.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
PoetRAT has executed a Lua script through a Lua interpreter for Windows.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
SLIGHTPULSE contains functionality to execute arbitrary commands passed to it.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
SpeakUp uses Perl scripts.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
WINERACK can create a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
Zeus Panda can launch remote scripts on the victim’s machine.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
gh0st RAT is able to open a remote shell to execute commands.
Technique: T1059 Command and Scripting Interpreter, Tactic: TA0002 Execution
During the 2016 Ukraine Electric Power Attack, Sandworm Team used PowerShell scripts to run a credential harvesting tool in memory to evade defenses.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
During the 2022 Ukraine Electric Power Attack, Sandworm Team utilized a PowerShell utility called TANKTRAP to spread and launch a wiper using Windows Group Policy.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
During C0018, the threat actors used encoded PowerShell scripts for execution.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
During C0021, the threat actors used obfuscated PowerShell to extract an encoded payload from within an .LNK file.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
During the C0032 campaign, TEMP.Veles used PowerShell to perform timestomping.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
During Frankenstein, the threat actors used PowerShell to run a series of Base64-encoded commands that acted as a stager and enumerated hosts.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
During Operation Dream Job, Lazarus Group used PowerShell commands to explore the environment of compromised victims.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
During Operation Wocao, threat actors used PowerShell on compromised systems.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
During the SolarWinds Compromise, APT29 used PowerShell to create new tasks on remote machines, identify configuration settings, exfiltrate data, and execute other commands.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
In the Triton Safety Instrumented System Attack, TEMP.Veles used a publicly available PowerShell-based tool, WMImplant.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
APT19 used PowerShell commands to execute payloads.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
APT28 downloads and executes PowerShell scripts and performs PowerShell commands.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
APT3 has used PowerShell on victim systems to download and run payloads after exploitation.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
APT32 has used PowerShell-based tools, PowerShell one-liners, and shellcode loaders for execution.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
APT33 has utilized PowerShell to download files from the C2 server and run various scripts.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
APT38 has used PowerShell to execute commands and other operational tasks.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
APT39 has used PowerShell to execute malicious code.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
APT41 leveraged PowerShell to deploy malware families in victims’ environments.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
APT5 has used PowerShell to accomplish tasks within targeted environments.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Aquatic Panda has downloaded additional scripts and executed Base64 encoded commands in PowerShell.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
BRONZE BUTLER has used PowerShell for execution.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Blue Mockingbird has used PowerShell reverse TCP shells to issue interactive commands over a network connection.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Chimera has used PowerShell scripts to execute malicious payloads and the DSInternals PowerShell module to make use of Active Directory features.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Cinnamon Tempest has used PowerShell to communicate with C2, download files, and execute reconnaissance commands.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Cobalt Group has used powershell.exe to download and execute scripts.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Confucius has used PowerShell to execute malicious files and payloads.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
CopyKittens has used PowerShell Empire.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
DarkHydrus leveraged PowerShell to download and execute additional scripts for execution.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
DarkVishnya used PowerShell to create shellcode loaders.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Deep Panda has used PowerShell scripts to download and execute programs in memory, without writing to disk.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Dragonfly has used PowerShell scripts for execution.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Earth Lusca has used PowerShell to execute commands.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Ember Bear has used PowerShell to download and execute malicious code.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
FIN10 uses PowerShell for execution as well as PowerShell Empire to establish persistence.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
FIN13 has used PowerShell commands to obtain DNS data from a compromised network.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
FIN6 has used PowerShell to gain access to merchant's networks, and a Metasploit PowerShell module to download and execute shellcode and to set up a local listener.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
FIN7 used a PowerShell script to launch shellcode that retrieved an additional payload.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
FIN8's malicious spearphishing payloads are executed as PowerShell. FIN8 has also used PowerShell for lateral movement and credential access.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Fox Kitten has used PowerShell scripts to access credential data.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
GALLIUM used PowerShell for execution to assist in lateral movement as well as for dumping credentials stored on compromised machines.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
GOLD SOUTHFIELD has staged and executed PowerShell scripts on compromised hosts.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Gallmaker used PowerShell to download additional payloads and for execution.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Gamaredon Group has used obfuscated PowerShell scripts for staging.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Gorgon Group malware can use PowerShell commands to download and execute a payload and open a decoy document on the victim’s machine.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
HAFNIUM has used the Exchange Power Shell module `Set-OabVirtualDirectoryPowerShell` to export mailbox data.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
HEXANE has used PowerShell-based tools and scripts for discovery and collection on compromised hosts.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Inception has used PowerShell to execute malicious commands and payloads.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Indrik Spider has used PowerShell Empire for execution of malware.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Kimsuky has executed a variety of PowerShell scripts.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Lazarus Group has used PowerShell to execute commands and malicious code.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
LazyScripter has used PowerShell scripts to execute malicious code.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Leviathan has used PowerShell for execution.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Magic Hound has used PowerShell for execution and privilege escalation.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Molerats used PowerShell implants on target machines.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
MoustachedBouncer has used plugins to execute PowerShell scripts.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
MuddyWater has used PowerShell for execution.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Mustang Panda has used malicious PowerShell scripts to enable execution.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Nomadic Octopus has used PowerShell for execution.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
OilRig has used PowerShell scripts for execution, including use of a macro to run a PowerShell command to decode file contents.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Patchwork used PowerSploit to download payloads, run a reverse shell, and execute malware on the victim's machine.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
The Poseidon Group's Information Gathering Tool (IGT) includes PowerShell components.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Sandworm Team has used PowerShell scripts to run a credential harvesting tool in memory to evade defenses.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Sidewinder has used PowerShell to drop and execute malware loaders.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Silence has used PowerShell to download and execute payloads.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Stealth Falcon malware uses PowerShell commands to perform various functions, including gathering system information via WMI and executing commands from its C2 server.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
TA2541 has used PowerShell to download files and to inject into various Windows processes.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
TA459 has used PowerShell for execution of a payload.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
TA505 has used PowerShell to download and execute malware and reconnaissance scripts.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
TeamTNT has executed PowerShell commands in batch scripts.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Threat Group-3390 has used PowerShell for execution.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Thrip leveraged PowerShell to run commands to download payloads, traverse the compromised networks, and carry out reconnaissance.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
ToddyCat has used Powershell scripts to perform post exploit collection.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Tonto Team has used PowerShell to download additional payloads.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Turla has used PowerShell to execute commands/scripts, in some cases via a custom executable or code from Empire's PSInject. Turla has also used PowerShell scripts to load and execute malware in memory.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Volt Typhoon has used PowerShell including for remote system discovery.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
WIRTE has used PowerShell for script execution.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Wizard Spider has used macros to execute PowerShell scripts to download malware on victim's machines. It has also used PowerShell to execute commands and move laterally through a victim network.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
menuPass uses PowerSploit to inject shellcode into PowerShell.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
AADInternals is written and executed via PowerShell.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Akira will execute PowerShell commands to delete system volume shadow copies.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
AppleSeed has the ability to execute its payload via PowerShell.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
AutoIt backdoor downloads a PowerShell script that decodes to a typical shellcode loader.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
BADHATCH can utilize `powershell.exe` to execute commands on a compromised host.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
BONDUPDATER is written in PowerShell.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Bandook has used PowerShell loaders as part of execution.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Bazar can execute a PowerShell script received from C2.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Black Basta has used PowerShell scripts for discovery and to execute files over the network.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
BloodHound can use PowerShell to pull Active Directory information from the target environment.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Bumblebee can use PowerShell for execution.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
CharmPower can use PowerShell for payload execution and C2 communication.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
The Clambling dropper can use PowerShell to download the malware.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Cobalt Strike can execute a payload on a remote host with PowerShell. This technique does not write any data to disk. Cobalt Strike can also use PowerSploit and other scripting frameworks to perform execution.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
ComRAT has used PowerShell to load itself every time a user logs in to the system. ComRAT can execute PowerShell scripts loaded into memory or from the file system.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
ConnectWise can be used to execute PowerShell commands on target machines.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
CrackMapExec can execute PowerShell commands via WMI.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
CreepyDrive can use Powershell for execution, including the cmdlets `Invoke-WebRequest` and `Invoke-Expression`.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
CreepySnail can use PowerShell for execution, including the cmdlets `Invoke-WebRequst` and `Invoke-Expression`.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Cuba has been dropped onto systems and used for lateral movement via obfuscated PowerShell scripts.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
DarkWatchman can execute PowerShell commands and has used PowerShell to execute a keylogger.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Denis has a version written in PowerShell.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Donut can generate shellcode outputs that execute via PowerShell.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
DownPaper uses PowerShell for execution.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Egregor has used an encoded PowerShell command by a service created by Cobalt Strike for lateral movement.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Emotet has used Powershell to retrieve the malicious payload and download additional resources like Mimikatz.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Empire leverages PowerShell for the majority of its client-side agent tasks. Empire also contains the ability to conduct PowerShell remoting with the `Invoke-PSRemoting` module.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
FatDuke has the ability to execute PowerShell scripts.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Ferocious can use PowerShell scripts for execution.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
FlawedAmmyy has used PowerShell to execute commands.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
GLASSTOKEN can use PowerShell for command execution.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
GRIFFON has used PowerShell to execute the Meterpreter downloader TinyMet.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
HALFBAKED can execute PowerShell scripts.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
HAMMERTOSS is known to use PowerShell.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Hancitor has used PowerShell to execute commands.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
One version of Helminth uses a PowerShell script.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
JCry has used PowerShell to execute payloads.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
JSS Loader has the ability to download and execute PowerShell scripts.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
KGH_SPY can execute PowerShell commands on the victim's machine.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
KOCTOPUS has used PowerShell commands to download additional files.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
KONNI used PowerShell to download and execute a specific 64-bit version of the malware.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
KeyBoy uses PowerShell commands to download and execute payloads.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Koadic has used PowerShell to establish persistence.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
LitePower can use a PowerShell script to execute commands.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Lizar has used PowerShell scripts.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Lokibot has used PowerShell commands embedded inside batch scripts.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Mafalda can execute PowerShell commands on a compromised machine.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Meteor can use PowerShell commands to disable the network adapters on a victim machines.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
MoleNet can use PowerShell to set persistence.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Mosquito can launch PowerShell Scripts.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
The NETWIRE binary has been executed via PowerShell script.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Netwalker has been written in PowerShell and executed directly in memory, avoiding detection.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
OSX_OCEANLOTUS.D uses PowerShell scripts.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
POSHSPY uses PowerShell to execute various commands, one to execute its payload.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
POWERSOURCE is a PowerShell backdoor.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
POWERSTATS uses PowerShell for obfuscation and execution.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
POWERTON is written in PowerShell.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
POWRUNER is written in PowerShell.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
PS1 can utilize a PowerShell loader.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
PUNCHBUGGY has used PowerShell scripts.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Pillowmint has used a PowerShell script to install a shim database.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
PowGoop has the ability to use PowerShell scripts to execute commands.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
PowerLess is written in and executed via PowerShell without using powershell.exe.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution