sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
Trojan.Karagany can detect commonly used and generic virtualization platforms based primarily on drivers and file paths.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
UBoatRAT checks for virtualization software such as VMWare, VirtualBox, or QEmu on the compromised machine.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
WastedLocker checked if UCOMIEnumConnections and IActiveScriptParseProcedure32 Registry keys were detected as part of its anti-analysis technique.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
WhisperGate can stop its execution when it recognizes the presence of certain monitoring tools.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
macOS.OSAMiner can parse the output of the native `system_profiler` tool to determine if the machine is running with 4 cores.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
yty has some basic anti-sandbox detection that tries to detect Virtual PC, Sandboxie, and VMware.
Technique: T1497.001 Virtualization/Sandbox Evasion: System Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
Darkhotel has used malware that repeatedly checks the mouse cursor position to determine if a real user is on the system.
Technique: T1497.002 Virtualization/Sandbox Evasion: User Activity Based Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
FIN7 used images embedded into document lures that only activate the payload when a user double clicks to avoid sandboxes.
Technique: T1497.002 Virtualization/Sandbox Evasion: User Activity Based Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
Okrum loader only executes the payload after the left mouse button has been pressed at least three times, in order to avoid being executed within virtualized or emulated environments.
Technique: T1497.002 Virtualization/Sandbox Evasion: User Activity Based Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
Spark has used a splash screen to check whether an user actively clicks on the screen before running malicious code.
Technique: T1497.002 Virtualization/Sandbox Evasion: User Activity Based Checks, Tactic: TA0005 Defense Evasion TA0007 Discovery
During Operation Dream Job, Lazarus Group used tools that collected `GetTickCount` and `GetSystemTimeAsFileTime` data to detect sandbox or VMware services.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
AppleJeus has waited a specified time before downloading a second stage payload.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
BADFLICK has delayed communication to the actor-controlled IP address by 5 minutes.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Bazar can use a timer to delay execution of core functionality.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
BendyBear can check for analysis environments and signs of debugging using the Windows API `kernel32!GetTickCountKernel32` call.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Bisonal has checked if the malware is running in a virtual environment with the anti-debug function GetTickCount() to compare the timing.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Brute Ratel C4 can call `NtDelayExecution` to pause execution.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Bumblebee has the ability to set a hardcoded and randomized sleep interval.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Clambling can wait 30 minutes before initiating contact with C2.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Clop has used the `sleep` command to avoid sandbox detection.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Crimson can determine when it has been installed on a host for at least 15 days before downloading the final payload.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
DRATzarus can use the `GetTickCount` and `GetSystemTimeAsFileTime` API calls to measure function timing. DRATzarus can also remotely shut down into sleep mode under specific conditions to evade 
detection.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
DarkTortilla can implement the `kernel32.dll` Sleep function to delay execution for up to 300 seconds before implementing persistence or processing an addon package.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Egregor can perform a  long sleep (greater than or equal to 3 minutes) to evade detection.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
EvilBunny has used time measurements from 3 different APIs before and after performing sleep operations to check and abort if the malware is running in a sandbox.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
FatDuke can turn itself on or off at random intervals.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
GoldMax has set an execution trigger date and time, stored as an ASCII Unix/Epoch time value.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
GoldenSpy's installer has delayed installation of GoldenSpy for two hours after it reaches a victim system.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
GrimAgent can sleep for 195 - 205 seconds after payload execution and before deleting its task.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
GuLoader has the ability to perform anti-debugging based on time checks, API calls, and CPUID.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
HermeticWiper has the ability to receive a command parameter to sleep prior to carrying out destructive actions on a targeted host.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
LiteDuke can wait 30 seconds before executing additional code if security software is detected.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Lokibot has performed a time-based anti-debug check before downloading its third stage.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Okrum's loader can detect presence of an emulator by using two calls to GetTickCount API, and checking whether the time has been accelerated.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
P8RAT has the ability to "sleep" for a specified time to evade detection.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Pony has delayed execution using a built-in function to avoid detection and analysis.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
The QakBot dropper can delay dropping the payload to evade detection.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
After initial installation, Raindrop runs a computation to delay execution.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
SUNBURST remained dormant after initial access for a period of up to two weeks.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
SVCReady can enter a sleep stage for 30 minutes to evade detection.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Saint Bot has used the command `timeout 20` to pause the execution of its initial loader.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Snip3 can execute `WScript.Sleep` to delay execution of its second stage.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
SodaMaster has the ability to put itself to "sleep" for a specified time.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
StrifeWater can modify its sleep time responses from the default of 20-22 seconds.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
ThiefQuest invokes `time` call to check the system's time, executes a `sleep` command, invokes a second `time` call, and then compares the time difference between the two `time` calls and the amount of time the system slept to identify the sandbox.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Tomiris has the ability to sleep for at least nine minutes to evade sandbox-based analysis systems.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
TrickBot has used `printf` and file I/O loops to delay process execution as part of API hammering.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Ursnif has used a 30 minute delay after execution to evade sandbox monitoring tools.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
WhisperGate can pause for 20 seconds to bypass antivirus solutions.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Using the machine's local time, XCSSET waits 43200 seconds (12 hours) from the initial creation timestamp of a specific file, `.report`. After the elapsed time, XCSSET executes additional modules.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
metaMain has delayed execution for five to six minutes during its persistence establishment process.
Technique: T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
In 2016, APT28 conducted a distributed denial of service (DDoS) attack against the World Anti-Doping Agency.
Technique: T1498 Network Denial of Service, Tactic: TA0040 Impact
Lucifer can execute TCP, UDP,  and HTTP denial of service (DoS) attacks.
Technique: T1498 Network Denial of Service, Tactic: TA0040 Impact
NKAbuse enables multiple types of network denial of service capabilities across several protocols post-installation.
Technique: T1498 Network Denial of Service, Tactic: TA0040 Impact
Sandworm Team temporarily disrupted service to Georgian government, non-government, and private sector websites after compromising a Georgian web hosting provider in 2019.
Technique: T1499 Endpoint Denial of Service, Tactic: TA0040 Impact
OnionDuke has the capability to use a Denial of Service module.
Technique: T1499 Endpoint Denial of Service, Tactic: TA0040 Impact
ZxShell has a feature to perform SYN flood attack on a host.
Technique: T1499 Endpoint Denial of Service, Tactic: TA0040 Impact
Industroyer uses a custom DoS tool that leverages CVE-2015-5374 and targets hardcoded IP addresses of Siemens SIPROTEC devices.
Technique: T1499.004 Endpoint Denial of Service: Application or System Exploitation, Tactic: TA0040 Impact
During the 2016 Ukraine Electric Power Attack, Sandworm Team used various MS-SQL stored procedures.
Technique: T1505.001 Server Software Component: SQL Stored Procedures, Tactic: TA0003 Persistence
Stuxnet used xp_cmdshell to store and execute SQL code.
Technique: T1505.001 Server Software Component: SQL Stored Procedures, Tactic: TA0003 Persistence
LightNeuron has used a malicious Microsoft Exchange transport agent for persistence.
Technique: T1505.002 Server Software Component: Transport Agent, Tactic: TA0003 Persistence
During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed the Neo-REGEORG webshell on an internet-facing server.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
During C0017, APT41 deployed JScript web shells through the creation of malicious ViewState objects.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
During the C0032 campaign, TEMP.Veles planted Web shells on Outlook Exchange servers.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
During Cutting Edge, threat actors used multiple web shells to maintain presence on compromised Connect Secure appliances such as WIREFIRE, GLASSTOKEN, BUSHWALK, LIGHTWIRE, and FRAMESTING.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
During Operation CuckooBees, the threat actors generated a web shell within a vulnerable Enterprise Resource Planning Web Application Server as a persistence mechanism.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
During Operation Wocao, threat actors used their own web shells, as well as those previously placed on target systems by other threat actors, for reconnaissance and lateral movement.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
APT28 has used a modified and obfuscated version of the reGeorg web shell to maintain persistence on a target's Outlook Web Access (OWA) server.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
APT29 has installed web shells on exploited Microsoft Exchange servers.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
APT32 has used Web shells to maintain access to victim websites.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
APT38 has used web shells for persistence or to ensure redundant access.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
APT39 has installed ANTAK and ASPXSPY web shells.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
APT5 has installed multiple web shells on compromised servers including on Pulse Secure VPN appliances.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
BackdoorDiplomacy has used web shells to establish an initial foothold and for lateral movement within a victim's system.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
Deep Panda uses Web shells on publicly accessible Web servers to access victim networks.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
Dragonfly has commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
FIN13 has utilized obfuscated and open-source web shells such as JspSpy, reGeorg, MiniWebCmdShell, and Vonloesch Jsp File Browser 1.2 to enable remote code execution and to execute commands on compromised web server.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
Fox Kitten has installed web shells on compromised hosts to maintain access.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
GALLIUM used Web shells to persist in victim environments and assist in execution and exfiltration.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
HAFNIUM has deployed multiple web shells on compromised servers including SIMPLESEESHARP, SPORTSBALL, China Chopper, and ASPXSpy.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
Kimsuky has used modified versions of open source PHP web shells to maintain access, often adding "Dinosaur" references within the code.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
Leviathan relies on web shells for an initial foothold as well as persistence into the victim's systems.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
Magic Hound has used multiple web shells to gain execution.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
Moses Staff has dropped a web shell onto a compromised system.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
OilRig has used web shells, often to maintain access to a victim network.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
Sandworm Team has used webshells including P.A.S. Webshell to maintain access to victim networks.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
Threat Group-3390 has used a variety of Web shells.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
Tonto Team has used a first stage web shell after compromising a vulnerable Exchange server.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
Tropic Trooper has started a web service in the target host and wait for the adversary to connect, acting as a web shell.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
Volatile Cedar can inject web shell code into a server.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
Volt Typhoon has used webshells, including ones named AuditReport.jspx and iisstart.aspx, in compromised environments.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
ASPXSpy is a Web shell. The ASPXTool version used by Threat Group-3390 has been deployed to accessible servers running Internet Information Services (IIS).
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
BUSHWALK is a web shell that has the ability to execute arbitrary commands or write files.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
China Chopper's server component is a Web Shell payload.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
FRAMESTING is a web shell capable of enabling arbitrary command execution on compromised Ivanti Connect Secure VPNs.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
GLASSTOKEN is a web shell capable of tunneling C2 connections and code execution on compromised Ivanti Secure Connect VPNs.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
LIGHTWIRE is a web shell capable of command execution and establishing persistence on compromised Ivanti Secure Connect VPNs.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
OwaAuth is a Web shell that appears to be exclusively used by Threat Group-3390. It is installed as an ISAPI filter on Exchange servers and shares characteristics with the China Chopper Web shell.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
P.A.S. Webshell can gain remote access and execution on target web servers.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
PULSECHECK is a web shell that can enable command execution on compromised servers.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
RAPIDPULSE is a web shell that is capable of arbitrary file read on targeted web servers to exfiltrate items of interest on the victim device.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
SEASHARPEE is a Web shell.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
SLIGHTPULSE is a web shell that can read, write, and execute files on compromised servers.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
STEADYPULSE is a web shell that can enable the execution of arbitrary commands on compromised web servers.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
SUPERNOVA is a Web shell.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
WIREFIRE is a web shell that can download files to and execute arbitrary commands from compromised Ivanti Connect Secure VPNs.
Technique: T1505.003 Server Software Component: Web Shell, Tactic: TA0003 Persistence
During Operation Dream Job, Lazarus Group targeted Windows servers running Internet Information Systems (IIS) to install C2 components.
Technique: T1505.004 Server Software Component: IIS Components, Tactic: TA0003 Persistence
IceApple is an IIS post-exploitation framework, consisting of 18 modules that provide several functionalities.
Technique: T1505.004 Server Software Component: IIS Components, Tactic: TA0003 Persistence
OwaAuth has been loaded onto Exchange servers and disguised as an ISAPI filter (owaauth.dll). The IIS w3wp.exe process then loads the malicious DLL.
Technique: T1505.004 Server Software Component: IIS Components, Tactic: TA0003 Persistence
RGDoor establishes persistence on webservers as an IIS module.
Technique: T1505.004 Server Software Component: IIS Components, Tactic: TA0003 Persistence
During Operation Dust Storm, the threat actors deployed a file called `DeployJava.js` to fingerprint installed software on a victim system prior to exploit delivery.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
During Operation Wocao, threat actors collected a list of installed software on the infected system.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
BRONZE BUTLER has used tools to enumerate software installed on an infected host.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
HEXANE has enumerated programs installed on an infected machine.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
Inception has enumerated installed software on compromised systems.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
MuddyWater has used a PowerShell backdoor to check for Skype connectivity on the target machine.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
Mustang Panda has searched the victim system for the `InstallUtil.exe` program and its version.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
SideCopy has collected browser information from a compromised host.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
Sidewinder has used tools to enumerate software installed on an infected host.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
Tropic Trooper's backdoor could list the infected system's installed software.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
Volt Typhoon has queried the Registry on compromised systems for information on installed software.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
Windigo has used a script to detect installed software on targeted systems.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
Windshift has used malware to identify installed software.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
Wizard Spider has utilized the PowerShell script `Get-DataInfo.ps1` to collect installed backup software information from a compromised machine.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
Bazar can query the Registry for installed applications.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
Bundlore has the ability to enumerate what browser is being used as well as version information for Safari.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
CharmPower can list the installed applications on a compromised host.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
The Cobalt Strike System Profiler can discover applications through the browser and identify the version of Java the target has.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
ComRAT can check the victim's default browser to determine which process to inject its communications module into.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
Dridex has collected a list of installed software on the system.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
DustySky lists all installed software for the infected machine.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
Dyre has the ability to identify installed programs on a compromised host.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
HotCroissant can retrieve a list of applications from the `SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths` registry key.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
InvisiMole can collect information about installed software used by specific users, software executed on user login, and software executed by each system.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
KGH_SPY can collect information on installed applications.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
MarkiRAT can check for the Telegram installation directory by enumerating the files on disk.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
Metamorfo has searched the compromised system for banking applications.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
Orz can gather the victim's Internet Explorer version.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
P.A.S. Webshell can list PHP server configuration details.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
QakBot can enumerate a list of installed programs.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
RTM can scan victim drives to look for specific banking software on the machine to determine next actions.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
SUGARDUMP can identify Chrome, Opera, Edge Chromium, and Firefox browsers, including version number, on a compromised host.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
SVCReady can collect a list of installed software from an infected host.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
Samurai can check for the presence and version of the .NET framework.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
ShimRatReporter gathered a list of installed software on the infected host.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
Siloscape searches for the kubectl binary.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
SocGholish can identify the victim's browser in order to serve the correct fake update page.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
SpicyOmelette can enumerate running software on a targeted system.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
TajMahal has the ability to identify the Internet Explorer (IE) version on an infected host.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
Woody RAT can collect .NET, PowerShell, and Python information from an infected host.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
XCSSET uses `ps aux` with the `grep` command to enumerate common browsers and system processes potentially impacting XCSSET's exfiltration capabilities.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
down_new has the ability to gather information on installed applications.
Technique: T1518 Software Discovery, Tactic: TA0007 Discovery
During Frankenstein, the threat actors used WMI queries to determine if analysis tools were running on a compromised system.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
During Operation Wocao, threat actors used scripts to detect security software.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
APT38 has identified security software, configurations, defensive tools, and sensors installed on a compromised system.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Aquatic Panda has attempted to discover third party endpoint detection and response (EDR) tools on compromised systems.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Cobalt Group used a JavaScript backdoor that is capable of collecting a list of the security solutions installed on the victim's machine.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Darkhotel has searched for anti-malware strings and anti-virus processes running on the system.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
FIN8 has used Registry keys to detect and avoid executing in potential sandboxes.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Kimsuky has checked for the presence of antivirus software with `powershell Get-CimInstance -Namespace root/securityCenter2 – classname antivirusproduct`.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Malteiro collects the installed antivirus on the victim machine.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
MuddyWater has used malware to check running processes against a hard-coded list of security tools often used by malware researchers.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Naikon uses commands such as `netsh advfirewall firewall` to discover local firewall settings.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Patchwork scanned the “Program Files” directories for a directory with the string “Total Security” (the installation path of the “360 Total Security” antivirus tool).
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Rocke used scripts which detected and uninstalled antivirus software.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
SideCopy uses a loader DLL file to collect AV product names from an infected host.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Sidewinder has used the Windows service `winmgmts:\\.\root\SecurityCenter2` to check installed antivirus products.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
TA2541 has used tools to search victim systems for security products such as antivirus and firewall software.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
TeamTNT has searched for security products on infected machines.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
The White Company has checked for specific antivirus products on the target’s computer, including Kaspersky, Quick Heal, AVG, BitDefender, Avira, Sophos, Avast!, and ESET.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
ToddyCat can determine is Kaspersky software is running on an endpoint by running `cmd /c wmic process where name="avp.exe"`.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Tropic Trooper can search for anti-virus software running on the system.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Turla has obtained information on security software, including security logging information that may indicate whether their malware has been detected.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Windshift has used malware to identify installed AV and commonly used forensic and malware analysis tools.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Wizard Spider has used WMI to identify anti-virus products installed on a victim's machine.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
ABK has the ability to identify the installed anti-virus product on the compromised host.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Action RAT can identify AV products on an infected host using the following command: `cmd.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List`.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Amadey has checked for a variety of antivirus products.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Astaroth checks for the presence of Avast antivirus in the `C:\Program\Files\` folder.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
AuTo Stealer has the ability to collect information about installed AV products from an infected host.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Avenger has the ability to identify installed anti-virus products on a compromised host.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
BLUELIGHT can collect a list of anti-virus products installed on a machine.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
BadPatch uses WMI to enumerate installed security products in the victim’s environment.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Bazar can identify the installed antivirus engine.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Brute Ratel C4 can detect EDR userland hooks.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Bumblebee can identify specific analytical tools based on running processes.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
CHOPSTICK checks for antivirus and forensics software.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Carberp has queried the infected system's registry searching for specific registry keys associated with antivirus products.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Clop can search for processes with antivirus and antimalware product names.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Comnie attempts to detect several anti-virus products.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
CookieMiner has checked for the presence of "Little Snitch", macOS network monitoring and application firewall software, stopping and exiting if it is found.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
The main CozyCar dropper checks whether the victim has an anti-virus product installed. If the installed product is on a predetermined list, the dropper will exit.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Crimson contains a command to collect information about anti-virus software on the victim.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
DarkGate looks for various security products by process name using hard-coded values in the malware. DarkGate will not execute its keylogging thread if a process name associated with Trend Micro anti-virus is identified, or if runtime checks identify the presence of Kaspersky anti-virus. DarkGate will initiate a new thread if certain security products are identified on the victim, and recreate any malicious files associated with it if it determines they were removed by security software in a new system location.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
DarkTortilla can check for the Kaspersky Anti-Virus suite.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
DarkWatchman can search for anti-virus products on the system.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
DustySky checks for the existence of anti-virus.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
EVILNUM can search for anti-virus products on the system.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Empire can enumerate antivirus software on the target.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Epic searches for anti-malware services running on the victim’s machine and terminates itself if it finds them.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
EvilBunny has been observed querying installed antivirus software.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
FELIXROOT checks for installed security software like antivirus and firewall.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Felismus checks for processes associated with anti-virus vendors.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Ferocious has checked for AV software as part of its persistence process.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
FinFisher probes the system to check for antimalware processes.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Flame identifies security software such as antivirus through the Security module.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
FlawedAmmyy will attempt to detect anti-virus products during the initial infection.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
FunnyDream can identify the processes for Bkav antivirus.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Gelsemium can check for the presence of specific security products.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Gold Dragon checks for anti-malware products and processes.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Grandoreiro can list installed security products including the Trusteer and Diebold Warsaw GAS Tecnologia online banking protections.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
InvisiMole can check for the presence of network sniffers, AV, and BitDefender firewall.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
JPIN checks for the presence of certain security-related processes and deletes its installer/uninstaller component if it identifies any of them.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Kasidet has the ability to identify any anti-virus installed on the infected system.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
LiteDuke has the ability to check for the presence of Kaspersky security software.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
LitePower can identify installed AV software.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Lizar can search for processes associated with an anti-virus product from list.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Mafalda can search for a variety of security software programs, EDR systems, and malware analysis tools.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
MarkiRAT can check for running processes on the victim’s machine to look for Kaspersky and Bitdefender antivirus products.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Metamorfo collects a list of installed antivirus software from the victim’s system.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Meteor has the ability to search for Kaspersky Antivirus on a victim's machine.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Mispadu can list installed security products in the victim’s environment.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
MoleNet can use WMI commands to check the system for firewall and antivirus software.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
More_eggs can obtain information on installed anti-malware programs.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Mosquito's installer searches the Registry and system to see if specific antivirus tools are installed on the system.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Netwalker can detect and terminate active security software-related processes on infected systems.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
NotPetya determines if specific antivirus programs are running on an infected host machine.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
POWERSTATS has detected security tools.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
POWRUNER may collect information on the victim's anti-virus software.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
PUNCHBUGGY can gather AVs registered in the system.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Pacu can enumerate AWS security services, including WAF rules and GuardDuty detectors.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
PipeMon can check for the presence of ESET and Kaspersky security software.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
A module in Prikormka collects information from the victim about installed anti-virus software.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
QakBot can identify the installed antivirus product on a targeted system.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
RTM can obtain information about security software on the victim.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Remsec has a plugin detect security products via active drivers.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
RogueRobin enumerates running processes to search for Wireshark and Windows Sysinternals suite.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
SILENTTRINITY can determine if an anti-virus product is installed through the resolution of the service's virtual SID.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
SUNBURST checked for a variety of antivirus/endpoint detection agents prior to execution.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Skidmap has the ability to check if `/usr/sbin/setenforce` exists. This file controls what mode SELinux is in.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
SpicyOmelette can check for the presence of 29 different antivirus tools.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
StoneDrill can check for antivirus and antimalware programs.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
StreamEx has the ability to scan for security tools such as firewalls and antivirus tools.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
StrongPity can identify if ESET or BitDefender antivirus are installed before dropping its payload.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Stuxnet enumerates the currently running processes related to a variety of security products.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
T9000 performs checks for various antivirus and security products during installation.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
TajMahal has the ability to identify which anti-virus products, firewalls, and anti-spyware products are in use.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Tasklist can be used to enumerate security software currently running on a system by process name of known products.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
ThiefQuest uses the `kill_unwanted` function to get a list of running processes, compares each process with an encrypted list of “unwanted” security related programs, and kills the processes for security related programs.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
VERMIN uses WMI to check for anti-virus software installed on the system.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Valak can determine if a compromised host has security products installed.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Waterbear can find the presence of a specific security software.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
WhisperGate can recognize the presence of monitoring tools on a target system.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery
Wingbird checks for the presence of Bitdefender security software.
Technique: T1518.001 Software Discovery: Security Software Discovery, Tactic: TA0007 Discovery