sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
Kimsuky has renamed malware to legitimate names such as `ESTCommon.dll` or `patch.dll`.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Lazarus Group has renamed malicious code to disguise it as Microsoft's narrator and other legitimate files.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
LuminousMoth has disguised their exfiltration malware as `ZoomVideoApp.exe`.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Machete's Machete MSI installer has masqueraded as a legitimate Adobe Acrobat Reader installer.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Magic Hound has used `dllhost.exe` to mask Fast Reverse Proxy (FRP) and `MicrosoftOutLookUpdater.exe` for Plink.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
MuddyWater has disguised malicious executables and used filenames and Registry key names associated with Windows Defender.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Mustang Panda has used names like `adobeupdate.dat` and `PotPlayerDB.dat` to disguise PlugX, and a file named `OneDrive.exe` to load a Cobalt Strike payload.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Mustard Tempest has used the filename `AutoUpdater.js` to mimic legitimate update files and has also used the Cyrillic homoglyph characters С `(0xd0a1)` and а `(0xd0b0)`, to produce the filename `Сhrome.Updаte.zip`.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Naikon has disguised malicious programs as Google Chrome, Adobe, and VMware executables.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
PROMETHIUM has disguised malicious installer files by bundling them with legitimate software installers.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Patchwork installed its payload in the startup programs folder as "Baidu Software Update." The group also adds its second stage payload to the startup programs as “Net Monitor." They have also dropped QuasarRAT binaries as files named microsoft_network.exe and crome.exe.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Poseidon Group tools attempt to spoof anti-virus processes as a means of self-defense.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Rocke has used shell scripts which download mining executables and saves them with the filename "java".
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Sandworm Team has avoided detection by naming a malicious binary explorer.exe.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
SideCopy has used a legitimate DLL file name, `Duser.dll` to disguise a malicious remote access tool.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Sidewinder has named malicious files `rekeywiz.exe` to match the name of a legitimate Windows executable.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Silence has named its backdoor "WINWORD.exe".
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Sowbug named its tools to masquerade as Windows or Adobe Reader software, such as by using the file name adobecms.exe and the directory `CSIDL_APPDATA\microsoft\security`.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
TA2541 has used file names to mimic legitimate Windows files or system functionality.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
TeamTNT has replaced .dockerd and .dockerenv with their own scripts and cryptocurrency mining software.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
ToddyCat has used the name `debug.exe` for malware components.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Transparent Tribe can mimic legitimate Windows directories by using the same icons and names.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Tropic Trooper has hidden payloads in Flash directories and fake installer files.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Volt Typhoon has used legitimate looking filenames for compressed copies of the ntds.dit database and used names including cisco_up.exe, cl64.exe, vm3dservice.exe, watchdogd.exe, Win.exe, WmiPreSV.exe, and WmiPrvSE.exe for the Earthworm and Fast Reverse Proxy tools.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
WIRTE has named a first stage dropper `Kaspersky Update Agent` in order to appear legitimate.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Whitefly has named the malicious DLL the same name as DLLs belonging to legitimate software from various security vendors.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
admin@338 actors used the following command to rename one of their tools to a benign file name: `ren "%temp%\upload" audiodg.exe`
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
menuPass has been seen changing malicious files to appear legitimate.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
ANDROMEDA has been installed to `C:\Temp\TrustedInstaller.exe` to mimic a legitimate Windows installer service.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
AppleSeed has the ability to rename its payload to ESTCommon.dll to masquerade as a DLL belonging to ESTsecurity.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
BADNEWS attempts to hide its payloads using legitimate filenames.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
BLINDINGCAN has attempted to hide its payload by using legitimate file names such as "iconcache.db".
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
BackConfig has hidden malicious payloads in `%USERPROFILE%\Adobe\Driver\dwg\` and mimicked the legitimate DHCP service binary.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Bad Rabbit has masqueraded as a Flash Player installer through the executable file `install_flash_player.exe`.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
The Bazar loader has named malicious shortcuts "adobe" and mimicked communications software.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Bisonal has renamed malicious code to `msacm32.dll` to hide within a legitimate library; earlier versions were disguised as `winhelp`.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
The Black Basta dropper has mimicked an application for creating USB bootable drivers.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Brute Ratel C4 has used a payload file named OneDrive.update to appear benign.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Bumblebee has named component DLLs "RapportGP.dll" to match those used by the security company Trusteer.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Bundlore has disguised a malicious .app file as a Flash Player update.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Calisto's installation file is an unsigned DMG image under the guise of Intego’s security solution for mac.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Carberp has masqueraded as Windows system file names, as well as "chkntfs.exe" and "syscron.exe".
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
ChChes copies itself to an .exe file with a filename that is likely intended to imitate Norton Antivirus but has several letters reversed (e.g. notron.exe).
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Chaes has used an unsigned, crafted DLL module named `hha.dll` that was designed to look like a legitimate 32-bit Windows DLL.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Chinoxy has used the name `eoffice.exe` in attempt to appear as a legitimate file.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Cuba has been disguised as legitimate 360 Total Security Antivirus and OpenVPN programs.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Cyclops Blink can rename its running process to `[kworker:0/1]` to masquerade as a Linux kernel thread. Cyclops Blink has also named RC scripts used for persistence after WatchGuard artifacts.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
DRATzarus has been named `Flash.exe`, and its dropper has been named `IExplorer`.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
DanBot files have been named `UltraVNC.exe` and `WINVNC.exe` to appear as legitimate VNC tools.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
DarkComet has dropped itself onto victim machines with file names such as WinDefender.Exe and winupdate.exe in an apparent attempt to masquerade as a legitimate file.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Daserf uses file and folder names related to legitimate programs in order to blend in, such as HP, Intel, Adobe, and perflogs.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Doki has disguised a file as a Linux kernel module.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
One of Dtrack can hide in replicas of legitimate programs like OllyDbg, 7-Zip, and FileZilla.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
EKANS has been disguised as `update.exe` to appear as a valid executable.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
If installing itself as a service fails, Elise instead writes itself as a file named svchost.exe saved in %APPDATA%\Microsoft\Network.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Felismus has masqueraded as legitimate Adobe Content Management System files.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
FinFisher renames one of its .dll files to uxtheme.dll in an apparent attempt to masquerade as a legitimate file.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
FoggyWeb can be disguised as a Visual Studio file such as `Windows.Data.TimeZones.zh-PH.pri` to evade detection. Also, FoggyWeb's loader can mimic a genuine `dll` file that carries out the same import functions as the legitimate Windows `version.dll` file.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Fysbis has masqueraded as trusted software rsyncd and dbus-inotifier.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Gelsemium has named malicious binaries `serv.exe`, `winprint.dll`, and `chrome_elf.dll` and has set its persistence in the Registry with the key value `Chrome Update` to appear legitimate.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
GoldMax has used filenames that matched the system name, and appeared as a scheduled task impersonating systems management software within the corresponding ProgramData subfolder.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
GoldenSpy's setup file installs initial executables under the folder `%WinDir%\System32\PluginManager`.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Goopy has impersonated the legitimate goopdate.dll, which was dropped on the target system with a legitimate GoogleUpdate.exe.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Grandoreiro has named malicious browser extensions and update files to appear legitimate.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Green Lambert has been disguised as a Growl help file.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
HTTPBrowser's installer contains a malicious file named navlu.dll to decrypt and run the RAT. navlu.dll is also the name of a legitimate Symantec DLL.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
HermeticWiper has used the name `postgressql.exe` to mask a malicious payload.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
HermeticWizard has been named `exec_32.dll` to mimic a legitimate MS Outlook .dll.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
IceApple .NET assemblies have used `App_Web_` in their file names to appear legitimate.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
InnaputRAT variants have attempted to appear legitimate by using the file names SafeApp.exe and NeutralApp.exe.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
InvisiMole has disguised its droppers as legitimate software or documents, matching their original names and locations, and saved its files as mpr.dll in the Windows folder.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Ixeshe has used registry values and file names associated with Adobe software, such as AcroRd32.exe.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
KGH_SPY has masqueraded as a legitimate Windows tool.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
KOCTOPUS has been disguised as legitimate software programs associated with the travel and airline industries.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
KONNI has created a shortcut called "Anti virus service.lnk" in an apparent attempt to masquerade as a legitimate file.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
LightNeuron has used filenames associated with Exchange and Outlook for binary and configuration files, such as `winmail.dat`.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
LookBack has a C2 proxy tool that masquerades as `GUP.exe`, which is software used by Notepad++.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
MCMD has been named Readme.txt to appear legitimate.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Machete renamed payloads to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python executables.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
MarkiRAT can masquerade as `update.exe` and `svehost.exe`; it has also mimicked legitimate Telegram and Chrome files.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
MechaFlounder has been downloaded as a file named lsass.exe, which matches the legitimate Windows file.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Metamorfo has disguised an MSI file as the Adobe Acrobat Reader Installer and has masqueraded payloads as OneDrive, WhatsApp, or Spotify, for example.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Mis-Type saves itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Misdat saves itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
NETWIRE has masqueraded as legitimate software including TeamViewer and macOS Finder.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
NOKKI is written to %LOCALAPPDATA%\MicroSoft Updatea\svServiceUpdate.exe prior being executed in a new process in an apparent attempt to masquerade as a legitimate folder and file.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Nebulae uses functions named `StartUserModeBrowserInjection` and `StopUserModeBrowserInjection` indicating that it's trying to imitate chrome_frame_helper.dll.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
NightClub has chosen file names to appear legitimate including EsetUpdate-0117583943.exe for its dropper.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Ninja has used legitimate looking filenames for its loader including update.dll and x64.dll.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
OLDBAIT installs itself in `%ALLUSERPROFILE%\\Application Data\Microsoft\MediaPlayer\updatewindws.exe`; the directory name is missing a space and the file name is missing the letter "o."
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
OSX/Shlayer can masquerade as a Flash Player update.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Octopus has been disguised as legitimate programs, such as Java and Telegram Messenger.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
OwaAuth uses the filename owaauth.dll, which is a legitimate file that normally resides in `%ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\Auth\`; the malicious file by the same name is saved in `%ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\bin\`.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
PUNCHBUGGY mimics filenames from %SYSTEM%\System32 to hide DLLs in %WINDIR% and/or %TEMP%.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
PcShare has been named `wuauclt.exe` to appear as the legitimate Windows Update AutoUpdate Client.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Penquin has mimicked the Cron binary to hide itself on compromised systems.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
PipeMon modules are stored on disk with seemingly benign names including use of a file extension associated with a popular word processor.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
PlugX has been disguised as legitimate Adobe and PotPlayer files.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Pony has used the Adobe Reader icon for the downloaded file to look more trustworthy.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
PowGoop has used a DLL named Goopdate.dll to impersonate a legitimate Google update file.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
PyDCrypt has dropped DCSrv under the `svchost.exe` name to disk.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Pysa has executed a malicious executable by naming it svchost.exe.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
QUADAGENT used the PowerShell filenames `Office365DCOMCheck.ps1` and `SystemDiskClean.ps1`.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
QUIETEXIT has attempted to change its name to `cron` upon startup. During incident response, QUIETEXIT samples have been identified that were renamed to blend in with other legitimate files.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
RDAT has masqueraded as VMware.exe.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
REvil can mimic the names of known executables.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Raindrop was installed under names that resembled legitimate Windows file and directory names.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
RainyDay has used names to mimic legitimate software including "vmtoolsd.exe" to spoof Vmtools.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Ramsay has masqueraded as a 7zip installer.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
The Remsec loader implements itself with the name Security Support Provider, a legitimate Windows function. Various Remsec .exe files mimic legitimate file names used by Microsoft, Symantec, Kaspersky, Hewlett-Packard, and VMWare. Remsec also disguised malicious modules using similar filenames as custom network encryption software on victims.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
RotaJakiro has used the filename `systemd-daemon` in an attempt to appear legitimate.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Ryuk has constructed legitimate appearing installation folder paths by calling `GetWindowsDirectoryW` and then inserting a null byte at the fourth character of the path. For Windows Vista or higher, the path would appear as `C:\Users\Public`.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
S-Type may save itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
SLOTHFULMEDIA has mimicked the names of known executables, such as mediaplayer.exe.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
SUGARDUMP has been named `CrashReporter.exe` to appear as a legitimate Mozilla executable.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
SUNBURST created VBScripts that were named after existing services or folders to blend into legitimate activities.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
SUNSPOT was identified on disk with a filename of `taskhostsvc.exe` and it created an encrypted log file at `C:\Windows\Temp\vmware-vmdmp.log`.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
SUPERNOVA has masqueraded as a legitimate SolarWinds DLL.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Saint Bot has been disguised as a legitimate executable, including as Windows SDK.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Samurai has created the directory `%COMMONPROGRAMFILES%\Microsoft Shared\wmi\` to contain DLLs for loading successive stages.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Shark binaries have been named `audioddg.pdb` and `Winlangdb.pdb` in order to appear legitimate.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
ShimRatReporter spoofed itself as `AlphaZawgyl_font.exe`, a specialized Unicode font.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Sibot has downloaded a DLL to the `C:\windows\system32\drivers\` folder and renamed it with a `.sys` extension.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Skidmap has created a fake `rm` binary to replace the legitimate Linux binary.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Small Sieve can use variations of Microsoft and Outlook spellings, such as "Microsift", in its file names to avoid detection.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
SocGholish has been named `AutoUpdater.js` to mimic legitimate update files.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Starloader has masqueraded as legitimate software update packages such as Adobe Acrobat Reader and Intel.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
StrifeWater has been named `calc.exe` to appear as a legitimate calculator program.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
StrongPity has been bundled with legitimate software installation files for disguise.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
The TAINTEDSCRIBE main executable has disguised itself as Microsoft’s Narrator.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
TEARDROP files had names that resembled legitimate Window file and directory names.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Tarrask has masqueraded as executable files such as `winupdate.exe`, `date.exe`, or `win.exe`.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
ThiefQuest prepends a copy of itself to the beginning of an executable file while maintaining the name of the executable.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
ThreatNeedle chooses its payload creation path from a randomly selected service name from netsvc.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
TinyTurla has been deployed as `w64time.dll` to appear legitimate.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
USBStealer mimics a legitimate Russian program called USB Disk Security.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Ursnif has used strings from legitimate system files and existing folders for its file, folder, and Registry entry names.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
A Winnti for Windows implant file was named ASPNET_FILTER.DLL, mimicking the legitimate ASP.NET ISAPI filter DLL with the same name.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
ZLib mimics the resource version information of legitimate Realtek Semiconductor, Nvidia, or Synaptics modules.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Keydnap puts a space after a false .jpg extension so that execution actually goes through the Terminal.app program.
Technique: T1036.006 Masquerading: Space after Filename, Tactic: TA0005 Defense Evasion
Mustang Panda has used an additional filename extension to hide the true file type.
Technique: T1036.007 Masquerading: Double File Extension, Tactic: TA0005 Defense Evasion
The Bazar loader has used dual-extension executable files such as PreviewReport.DOC.exe.
Technique: T1036.007 Masquerading: Double File Extension, Tactic: TA0005 Defense Evasion
DarkGate masquerades malicious LNK files as PDF objects using the double extension `.pdf.lnk`.
Technique: T1036.007 Masquerading: Double File Extension, Tactic: TA0005 Defense Evasion
Milan has used an executable named `companycatalog.exe.config` to appear benign.
Technique: T1036.007 Masquerading: Double File Extension, Tactic: TA0005 Defense Evasion
During the 2016 Ukraine Electric Power Attack, Sandworm Team masqueraded executables as `.txt` files.
Technique: T1036.008 Masquerading: Masquerade File Type, Tactic: TA0005 Defense Evasion
During Operation Dream Job, Lazarus Group disguised malicious template files as JPEG files to avoid detection.
Technique: T1036.008 Masquerading: Masquerade File Type, Tactic: TA0005 Defense Evasion
Volt Typhoon has appended copies of the ntds.dit database with a .gif file extension.
Technique: T1036.008 Masquerading: Masquerade File Type, Tactic: TA0005 Defense Evasion
ANDROMEDA has been delivered through a LNK file disguised as a folder.
Technique: T1036.008 Masquerading: Masquerade File Type, Tactic: TA0005 Defense Evasion
AvosLocker has been disguised as a .jpg file.
Technique: T1036.008 Masquerading: Masquerade File Type, Tactic: TA0005 Defense Evasion
Brute Ratel C4 has used Microsoft Word icons to hide malicious LNK files.
Technique: T1036.008 Masquerading: Masquerade File Type, Tactic: TA0005 Defense Evasion
OSX_OCEANLOTUS.D has disguised it's true file structure as an application bundle by adding special characters to the filename and using the icon for legitimate Word documents.
Technique: T1036.008 Masquerading: Masquerade File Type, Tactic: TA0005 Defense Evasion
The QakBot payload has been disguised as a PNG file and hidden within LNK files using a Microsoft File Explorer icon.
Technique: T1036.008 Masquerading: Masquerade File Type, Tactic: TA0005 Defense Evasion
APT29 has hijacked legitimate application-specific startup scripts to enable malware to execute on system startup.
Technique: T1037 Boot or Logon Initialization Scripts, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Rocke has installed an "init.d" startup script to maintain persistence.
Technique: T1037 Boot or Logon Initialization Scripts, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Depending on the Linux distribution and when executing with root permissions, RotaJakiro may install persistence using a `.conf` file in the `/etc/init/` folder.
Technique: T1037 Boot or Logon Initialization Scripts, Tactic: TA0003 Persistence TA0004 Privilege Escalation
An APT28 loader Trojan adds the Registry key `HKCU\Environment\UserInitMprLogonScript` to establish persistence.
Technique: T1037.001 Boot or Logon Initialization Scripts: Logon Script (Windows), Tactic: TA0003 Persistence TA0004 Privilege Escalation
Cobalt Group has added persistence by registering the file name for the next stage malware under `HKCU\Environment\UserInitMprLogonScript`.
Technique: T1037.001 Boot or Logon Initialization Scripts: Logon Script (Windows), Tactic: TA0003 Persistence TA0004 Privilege Escalation
Attor's dispatcher can establish persistence via adding a Registry key with a logon script `HKEY_CURRENT_USER\Environment "UserInitMprLogonScript" `.
Technique: T1037.001 Boot or Logon Initialization Scripts: Logon Script (Windows), Tactic: TA0003 Persistence TA0004 Privilege Escalation
JHUHUGIT has registered a Windows shell script under the Registry key `HKCU\Environment\UserInitMprLogonScript` to establish persistence.
Technique: T1037.001 Boot or Logon Initialization Scripts: Logon Script (Windows), Tactic: TA0003 Persistence TA0004 Privilege Escalation
KGH_SPY has the ability to set the `HKCU\Environment\UserInitMprLogonScript` Registry key to execute logon scripts.
Technique: T1037.001 Boot or Logon Initialization Scripts: Logon Script (Windows), Tactic: TA0003 Persistence TA0004 Privilege Escalation
Zebrocy performs persistence with a logon script via adding to the Registry key `HKCU\Environment\UserInitMprLogonScript`.
Technique: T1037.001 Boot or Logon Initialization Scripts: Logon Script (Windows), Tactic: TA0003 Persistence TA0004 Privilege Escalation
APT29 has installed a run command on a compromised system to enable malware execution on system startup.
Technique: T1037.004 Boot or Logon Initialization Scripts: RC Scripts, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Cyclops Blink has the ability to execute on device startup, using a modified RC script named S51armled.
Technique: T1037.004 Boot or Logon Initialization Scripts: RC Scripts, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Green Lambert can add `init.d` and `rc.d` files in the `/etc` folder to establish persistence.
Technique: T1037.004 Boot or Logon Initialization Scripts: RC Scripts, Tactic: TA0003 Persistence TA0004 Privilege Escalation
HiddenWasp installs reboot persistence by adding itself to `/etc/rc.local`.
Technique: T1037.004 Boot or Logon Initialization Scripts: RC Scripts, Tactic: TA0003 Persistence TA0004 Privilege Escalation
iKitten adds an entry to the rc.common file for persistence.
Technique: T1037.004 Boot or Logon Initialization Scripts: RC Scripts, Tactic: TA0003 Persistence TA0004 Privilege Escalation
jRAT can list and manage startup entries.
Technique: T1037.005 Boot or Logon Initialization Scripts: Startup Items, Tactic: TA0003 Persistence TA0004 Privilege Escalation
During C0015, the threat actors collected files from network shared drives prior to network encryption.
Technique: T1039 Data from Network Shared Drive, Tactic: TA0009 Collection
APT28 has collected files from network shared drives.
Technique: T1039 Data from Network Shared Drive, Tactic: TA0009 Collection
BRONZE BUTLER has exfiltrated files stolen from file shares.
Technique: T1039 Data from Network Shared Drive, Tactic: TA0009 Collection
Chimera has collected data of interest from network shares.
Technique: T1039 Data from Network Shared Drive, Tactic: TA0009 Collection
Fox Kitten has searched network shares to access sensitive documents.
Technique: T1039 Data from Network Shared Drive, Tactic: TA0009 Collection
Gamaredon Group malware has collected Microsoft Office documents from mapped network drives.
Technique: T1039 Data from Network Shared Drive, Tactic: TA0009 Collection
Sowbug extracted Word documents from a file server on a victim network.
Technique: T1039 Data from Network Shared Drive, Tactic: TA0009 Collection
menuPass has collected data from remote systems by mounting network shares with `net use` and using Robocopy to transfer data.
Technique: T1039 Data from Network Shared Drive, Tactic: TA0009 Collection
When it first starts, BADNEWS crawls the victim's mapped drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.
Technique: T1039 Data from Network Shared Drive, Tactic: TA0009 Collection
CosmicDuke steals user files from network shared drives with file extensions and keywords that match a predefined list.
Technique: T1039 Data from Network Shared Drive, Tactic: TA0009 Collection
Egregor can collect any files found in the enumerated drivers before sending it to its C2 channel.
Technique: T1039 Data from Network Shared Drive, Tactic: TA0009 Collection
Ramsay can collect data from network drives and stage it for exfiltration.
Technique: T1039 Data from Network Shared Drive, Tactic: TA0009 Collection
During the 2015 Ukraine Electric Power Attack, Sandworm Team used BlackEnergy’s network sniffer module to discover user credentials being sent over the network between the local LAN and the power grid’s industrial control systems.
Technique: T1040 Network Sniffing, Tactic: TA0006 Credential Access TA0007 Discovery
APT28 deployed the open source tool Responder to conduct NetBIOS Name Service poisoning, which captured usernames and hashed passwords that allowed access to legitimate credentials. APT28 close-access teams have used Wi-Fi pineapples to intercept Wi-Fi signals and user credentials.
Technique: T1040 Network Sniffing, Tactic: TA0006 Credential Access TA0007 Discovery
APT33 has used SniffPass to collect credentials by sniffing network traffic.
Technique: T1040 Network Sniffing, Tactic: TA0006 Credential Access TA0007 Discovery
DarkVishnya used network sniffing to obtain login data.
Technique: T1040 Network Sniffing, Tactic: TA0006 Credential Access TA0007 Discovery
Kimsuky has used the Nirsoft SniffPass network sniffer to obtain passwords sent over non-secure protocols.
Technique: T1040 Network Sniffing, Tactic: TA0006 Credential Access TA0007 Discovery
Sandworm Team has used intercepter-NG to sniff passwords in network traffic.
Technique: T1040 Network Sniffing, Tactic: TA0006 Credential Access TA0007 Discovery
Emotet has been observed to hook network APIs to monitor network traffic.
Technique: T1040 Network Sniffing, Tactic: TA0006 Credential Access TA0007 Discovery
Empire can be used to conduct packet captures on target hosts.
Technique: T1040 Network Sniffing, Tactic: TA0006 Credential Access TA0007 Discovery
FoggyWeb can configure custom listeners to passively monitor all incoming HTTP GET and POST requests sent to the AD FS server from the intranet/internet and intercept HTTP requests that match the custom URI patterns defined by the actor.
Technique: T1040 Network Sniffing, Tactic: TA0006 Credential Access TA0007 Discovery
Impacket can be used to sniff network traffic via an interface or raw socket.
Technique: T1040 Network Sniffing, Tactic: TA0006 Credential Access TA0007 Discovery
MESSAGETAP uses the libpcap library to listen to all traffic and parses network protocols starting with Ethernet and IP layers. It continues parsing protocol layers including SCTP, SCCP, and TCAP and finally extracts SMS message data and routing metadata.
Technique: T1040 Network Sniffing, Tactic: TA0006 Credential Access TA0007 Discovery
NBTscan can dump and print whole packet content.
Technique: T1040 Network Sniffing, Tactic: TA0006 Credential Access TA0007 Discovery
Penquin can sniff network traffic to look for packets matching specific conditions.
Technique: T1040 Network Sniffing, Tactic: TA0006 Credential Access TA0007 Discovery
PoshC2 contains a module for taking packet captures on compromised hosts.
Technique: T1040 Network Sniffing, Tactic: TA0006 Credential Access TA0007 Discovery
Regin appears to have functionality to sniff for credentials passed over HTTP, SMTP, and SMB.
Technique: T1040 Network Sniffing, Tactic: TA0006 Credential Access TA0007 Discovery
Responder captures hashes and credentials that are sent to the system after the name services have been poisoned.
Technique: T1040 Network Sniffing, Tactic: TA0006 Credential Access TA0007 Discovery
During C0017, APT41 used its Cloudflare services C2 channels for data exfiltration.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
During Frankenstein, the threat actors collected information via Empire, which sent the data back to the adversary's C2.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
During Operation Dream Job, Lazarus Group exfiltrated data from a compromised host to actor-controlled C2 servers.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
During Operation Honeybee, the threat actors uploaded stolen files to their C2 servers.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
During Operation Wocao, threat actors used the XServer backdoor to exfiltrate data.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
APT3 has a tool that exfiltrates data over the C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
APT32's backdoor has exfiltrated data using the already opened channel with its C&C server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
APT39 has exfiltrated stolen victim data through C2 communications.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Chimera has used Cobalt Strike C2 beacons for data exfiltration.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Confucius has exfiltrated stolen files to its C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
GALLIUM used Web shells and HTRAN for C2 and to exfiltrate data.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
A Gamaredon Group file stealer can transfer collected files to a hardcoded C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Higaisa exfiltrated data over its C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Ke3chang transferred compressed and encrypted RAR files containing exfiltration through the established backdoor command and control channel during operations.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Kimsuky has exfiltrated data over its C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Lazarus Group has exfiltrated data and files over a C2 channel through its various tools and malware.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Leviathan has exfiltrated data over its C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
LuminousMoth has used malware that exfiltrates stolen data to its C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
MuddyWater has used C2 infrastructure to receive exfiltrated data.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Sandworm Team has sent system information to its C2 server using HTTP.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
After data is collected by Stealth Falcon malware, it is exfiltrated over the existing C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Wizard Spider has exfiltrated domain credentials and network enumeration information over command and control (C2) channels.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
ZIRCONIUM has exfiltrated files via the Dropbox API C2.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
ADVSTORESHELL exfiltrates data over the same channel used for C2.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Amadey has sent victim data to its C2 servers.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
AppleJeus has exfiltrated collected host information to a C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
AppleSeed can exfiltrate files via the C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Astaroth exfiltrates collected information from its r1.log file to the external C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Attor has exfiltrated data over the C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
AuTo Stealer can exfiltrate data over actor-controlled C2 servers via HTTP or TCP.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Adversaries can direct BACKSPACE to upload files to the C2 Server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
BADHATCH can exfiltrate data over the C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
BLINDINGCAN has sent user and system information to a C2 server via HTTP POST requests.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
BLUELIGHT has exfiltrated data over its C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Bandook can upload files from a victim's machine over the C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Bankshot exfiltrates data over its C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Bisonal has added the exfiltrated data to the URL over the C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
BoxCaon uploads files and data from a compromised host over the existing C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Bumblebee can send collected data in JSON format to C2.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
CallMe exfiltrates data to its C2 server over the same protocol as C2 communications.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Cannon exfiltrates collected data over email via SMTP/S and POP3/S C2 channels.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Carberp has exfiltrated data via HTTP to already established C2 servers.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Caterpillar WebShell can upload files over the C2 channel.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
CharmPower can exfiltrate gathered data to a hardcoded C2 URL via HTTP POST.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Chrommme can exfiltrate collected data via C2.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
CreepySnail can connect to C2 for data exfiltration.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Crimson can exfiltrate stolen information over its C2.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Crutch can exfiltrate data over the primary C2 channel (Dropbox HTTP API).
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Cyclops Blink has the ability to upload exfiltrated files to a C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
DarkGate uses existing command and control channels to retrieve captured cryptocurrency wallet credentials.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
DnsSystem can exfiltrate collected data to its C2 server.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Doki has used Ngrok to establish C2 and exfiltrate data.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration
Drovorub can exfiltrate files over C2 infrastructure.
Technique: T1041 Exfiltration Over C2 Channel, Tactic: TA0010 Exfiltration