sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
BlackEnergy attempts to bypass default User Access Control (UAC) settings by exploiting a backward-compatibility setting found in Windows 7 and later.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Bumblebee has the ability to bypass UAC to deploy post exploitation tools with elevated privileges.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
CSPY Downloader can bypass UAC using the SilentCleanup task to execute the binary with elevated privileges.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Clambling has the ability to bypass UAC using a `passuac.dll` file.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Cobalt Strike can use a number of known techniques to bypass Windows UAC.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
DarkGate uses two distinct User Account Control (UAC) bypass techniques to escalate privileges.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Downdelph bypasses UAC to escalate privileges by using a custom “RedirectEXE” shim database.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Empire includes various modules to attempt to bypass UAC for escalation of privileges.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
FinFisher performs UAC bypass.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Gelsemium can bypass UAC to elevate process privileges on a compromised host.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Grandoreiro can bypass UAC by registering as the default handler for .MSC files.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
H1N1 bypasses user access control by using a DLL hijacking vulnerability in the Windows Update Standalone Installer (wusa.exe).
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
InvisiMole can use fileless UAC bypass and create an elevated COM object to escalate privileges.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
KOCTOPUS will perform UAC bypass either through fodhelper.exe or eventvwr.exe.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
KONNI has bypassed UAC by performing token impersonation as well as an RPC-based method, this included bypassing UAC set to “AlwaysNotify".
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Koadic has 2 methods for elevating integrity. It can bypass UAC through `eventvwr.exe` and `sdclt.exe`.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Lokibot has utilized multiple techniques to bypass UAC.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
An older variant of PLAINTEE performs UAC bypass.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
PipeMon installer can use UAC bypass techniques to install the payload.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
PoshC2 can utilize multiple methods to bypass UAC.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Pupy can bypass Windows UAC through either DLL hijacking, eventvwr, or appPaths.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
QuasarRAT can generate a UAC pop-up Window to prompt the target user to run a command as the administrator.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
RCSession can bypass UAC to escalate privileges.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
RTM can attempt to run the program as admin, then show a fake error message and a legitimate UAC bypass prompt to the user in an attempt to socially engineer the user into escalating privileges.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Ramsay can use UACMe for privilege escalation.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Remcos has a command for UAC bypassing.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
SILENTTRINITY contains a number of modules that can bypass UAC, including through Window's Device Manager, Manage Optional Features, and an image hijack on the `.msc` file extension.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Saint Bot has attempted to bypass UAC using `fodhelper.exe` to escalate privileges.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Sakula contains UAC bypass code for both 32- and 64-bit systems.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Shamoon attempts to disable UAC remote restrictions by modifying the Registry.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
ShimRat has hijacked the cryptbase.dll within migwiz.exe to escalate privileges. This prevented the User Access Control window from appearing.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
UACMe contains many methods for bypassing Windows User Account Control on multiple versions of the operating system.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
WarzoneRAT can use `sdclt.exe` to bypass UAC in Windows 10 to escalate privileges; for older Windows versions WarzoneRAT can use the IFileOperation exploit to bypass the UAC module.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
WastedLocker can perform a UAC bypass if it is not executed with administrator rights or if the infected host runs Windows Vista or later.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Winnti for Windows can use a variant of the sysprep UAC bypass.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Many ZeroT samples can perform UAC bypass by using eventvwr.exe to execute a malicious file.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Cobalt Strike can use `sudo` to run a command.
Technique: T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Dok adds `admin  ALL=(ALL) NOPASSWD: ALL` to the `/etc/sudoers` file.
Technique: T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Proton modifies the tty_tickets line in the sudoers file.
Technique: T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
OSX/Shlayer can escalate privileges to root by asking the user for credentials.
Technique: T1548.004 Abuse Elevation Control Mechanism: Elevated Execution with Prompt, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
During the SolarWinds Compromise, APT29 used forged SAML tokens that allowed the actors to impersonate users and bypass MFA, enabling APT29 to access enterprise cloud applications and services.
Technique: T1550 Use Alternate Authentication Material, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
FoggyWeb can allow abuse of a compromised AD FS server's SAML token.
Technique: T1550 Use Alternate Authentication Material, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
During the SolarWinds Compromise, APT29 used compromised service principals to make changes to the Office 365 environment.
Technique: T1550.001 Use Alternate Authentication Material: Application Access Token, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
APT28 has used several malicious applications that abused OAuth access tokens to gain access to target email accounts, including Gmail and Yahoo Mail.
Technique: T1550.001 Use Alternate Authentication Material: Application Access Token, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
CreepyDrive can use legitimate OAuth refresh tokens to authenticate with OneDrive.
Technique: T1550.001 Use Alternate Authentication Material: Application Access Token, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
Peirates can use stolen service account tokens to perform its operations. It also enables adversaries to switch between valid service accounts.
Technique: T1550.001 Use Alternate Authentication Material: Application Access Token, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
During Night Dragon, threat actors used pass-the-hash tools to obtain authenticated access to sensitive internal desktops and servers.
Technique: T1550.002 Use Alternate Authentication Material: Pass the Hash, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
The APT1 group is known to have used pass the hash.
Technique: T1550.002 Use Alternate Authentication Material: Pass the Hash, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
APT28 has used pass the hash for lateral movement.
Technique: T1550.002 Use Alternate Authentication Material: Pass the Hash, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
APT32 has used pass the hash for lateral movement.
Technique: T1550.002 Use Alternate Authentication Material: Pass the Hash, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
APT41 uses tools such as Mimikatz to enable lateral movement via captured password hashes.
Technique: T1550.002 Use Alternate Authentication Material: Pass the Hash, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
Chimera has dumped password hashes for use in pass the hash authentication attacks.
Technique: T1550.002 Use Alternate Authentication Material: Pass the Hash, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
FIN13 has used the PowerShell utility `Invoke-SMBExec` to execute the pass the hash method for lateral movement within an compromised environment.
Technique: T1550.002 Use Alternate Authentication Material: Pass the Hash, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
GALLIUM used dumped hashes to authenticate to other machines via pass the hash.
Technique: T1550.002 Use Alternate Authentication Material: Pass the Hash, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
Kimsuky has used pass the hash for authentication to remote access software used in C2.
Technique: T1550.002 Use Alternate Authentication Material: Pass the Hash, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
Wizard Spider has used the `Invoke-SMBExec` PowerShell cmdlet to execute the pass-the-hash technique and utilized stolen password hashes to move laterally.
Technique: T1550.002 Use Alternate Authentication Material: Pass the Hash, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
BADHATCH can perform pass the hash on compromised machines with x64 versions.
Technique: T1550.002 Use Alternate Authentication Material: Pass the Hash, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
Cobalt Strike can perform pass the hash.
Technique: T1550.002 Use Alternate Authentication Material: Pass the Hash, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
CrackMapExec can pass the hash to authenticate via SMB.
Technique: T1550.002 Use Alternate Authentication Material: Pass the Hash, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
Empire can perform pass the hash attacks.
Technique: T1550.002 Use Alternate Authentication Material: Pass the Hash, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
HOPLIGHT has been observed loading several APIs associated with Pass the Hash.
Technique: T1550.002 Use Alternate Authentication Material: Pass the Hash, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
Mimikatz's `SEKURLSA::Pth` module can impersonate a user, with only a password hash, to execute arbitrary commands.
Technique: T1550.002 Use Alternate Authentication Material: Pass the Hash, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
Pass-The-Hash Toolkit can perform pass the hash.
Technique: T1550.002 Use Alternate Authentication Material: Pass the Hash, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
PoshC2 has a number of modules that leverage pass the hash for lateral movement.
Technique: T1550.002 Use Alternate Authentication Material: Pass the Hash, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
APT29 used Kerberos ticket attacks for lateral movement.
Technique: T1550.003 Use Alternate Authentication Material: Pass the Ticket, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
APT32 successfully gained remote access by using pass the ticket.
Technique: T1550.003 Use Alternate Authentication Material: Pass the Ticket, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
BRONZE BUTLER has created forged Kerberos Ticket Granting Ticket (TGT) and Ticket Granting Service (TGS) tickets to maintain administrative access.
Technique: T1550.003 Use Alternate Authentication Material: Pass the Ticket, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
Mimikatz’s `LSADUMP::DCSync` and `KERBEROS::PTT` modules implement the three steps required to extract the krbtgt account hash and create/use Kerberos tickets.
Technique: T1550.003 Use Alternate Authentication Material: Pass the Ticket, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
Pupy can also perform pass-the-ticket.
Technique: T1550.003 Use Alternate Authentication Material: Pass the Ticket, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
Some SeaDuke samples have a module to use pass the ticket with Kerberos for authentication.
Technique: T1550.003 Use Alternate Authentication Material: Pass the Ticket, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
During the SolarWinds Compromise, APT29 used stolen cookies to access cloud resources and a forged `duo-sid` cookie to bypass MFA set on an email account.
Technique: T1550.004 Use Alternate Authentication Material: Web Session Cookie, Tactic: TA0005 Defense Evasion TA0008 Lateral Movement
Astaroth uses an external software known as NetPass to recover passwords.
Technique: T1552 Unsecured Credentials, Tactic: TA0006 Credential Access
DarkGate uses NirSoft tools to steal user credentials from the infected machine. NirSoft tools are executed via process hollowing in a newly-created instance of vbc.exe or regasm.exe.
Technique: T1552 Unsecured Credentials, Tactic: TA0006 Credential Access
Pacu can search for sensitive data: for example, in Code Build environment variables, EC2 user data, and Cloud Formation templates.
Technique: T1552 Unsecured Credentials, Tactic: TA0006 Credential Access
APT3 has a tool that can locate credentials in files on the file system such as those from Firefox or Chrome.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
APT33 has used a variety of publicly available tools like LaZagne to gather credentials.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
FIN13 has obtained administrative credentials by browsing through local files on a compromised machine.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
Fox Kitten has accessed files to gain valid credentials.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
Kimsuky has used tools that are capable of obtaining credentials from saved mail.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
Leafminer used several tools for retrieving login and password information, including LaZagne.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
MuddyWater has run a tool that steals passwords saved in victim email.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
Scattered Spider Spider searches for credential storage documentation on a compromised host.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
TA505 has used malware to gather credentials from FTP clients and Outlook.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
TeamTNT has searched for unsecured AWS credentials and Docker API credentials.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
AADInternals can gather unsecured credentials for Azure AD services, such as Azure AD Connect, from a local machine.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
Agent Tesla has the ability to extract credentials from configuration or support files.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
Azorult can steal credentials in files belonging to common software such as Skype, Telegram, and Steam.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
BlackEnergy has used a plug-in to gather credentials stored in files on the host by various software programs, including The Bat! email client, Outlook, and Windows Credential Store.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
Emotet has been observed leveraging a module that retrieves passwords stored on a system for the current logged-on user.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
Empire can use various modules to search for files containing passwords.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
Hildegard has searched for SSH keys, Docker credentials, and Kubernetes service tokens.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
LaZagne can obtain credentials from chats, databases, mail, and WiFi.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
PoshC2 contains modules for searching for passwords in local and remote files.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
Pupy can use Lazagne for harvesting credentials.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
Pysa has extracted credentials from the password database before encrypting the files.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
QuasarRAT can obtain passwords from FTP clients.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
Smoke Loader searches for files named logins.json to parse for credentials.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
TrickBot can obtain passwords stored in files from several applications such as Outlook, Filezilla, OpenSSH, OpenVPN and WinSCP. Additionally, it searches for the ".vnc.lnk" affix to steal VNC credentials.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
XTunnel is capable of accessing locally stored passwords on victims.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
jRAT can capture passwords from common chat applications such as MSN Messenger, AOL, Instant Messenger, and and Google Talk.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
If an initial connectivity check fails, pngdowner attempts to extract proxy details and credentials from Windows Protected Storage and from the IE Credentials Store. This allows the adversary to use the proxy credentials for subsequent requests if they enable outbound HTTP access.
Technique: T1552.001 Unsecured Credentials: Credentials In Files, Tactic: TA0006 Credential Access
APT32 used Outlook Credential Dumper to harvest credentials stored in Windows registry.
Technique: T1552.002 Unsecured Credentials: Credentials in Registry, Tactic: TA0006 Credential Access
Agent Tesla has the ability to extract credentials from the Registry.
Technique: T1552.002 Unsecured Credentials: Credentials in Registry, Tactic: TA0006 Credential Access
IceApple can harvest credentials from local and remote host registries.
Technique: T1552.002 Unsecured Credentials: Credentials in Registry, Tactic: TA0006 Credential Access
PowerSploit has several modules that search the Windows Registry for stored credentials: `Get-UnattendedInstallFile`, `Get-Webconfig`, `Get-ApplicationHost`, `Get-SiteListPassword`, `Get-CachedGPPPassword`, and `Get-RegistryAutoLogon`.
Technique: T1552.002 Unsecured Credentials: Credentials in Registry, Tactic: TA0006 Credential Access
Reg may be used to find credentials in the Windows Registry.
Technique: T1552.002 Unsecured Credentials: Credentials in Registry, Tactic: TA0006 Credential Access
TrickBot has retrieved PuTTY credentials by querying the `Software\SimonTatham\Putty\Sessions` registry key
Technique: T1552.002 Unsecured Credentials: Credentials in Registry, Tactic: TA0006 Credential Access
Valak can use the clientgrabber module to steal e-mail credentials from the Registry.
Technique: T1552.002 Unsecured Credentials: Credentials in Registry, Tactic: TA0006 Credential Access
Kinsing has searched `bash_history` for credentials.
Technique: T1552.003 Unsecured Credentials: Bash History, Tactic: TA0006 Credential Access
During Operation Wocao, threat actors used Mimikatz to dump certificates and private keys from the Windows certificate store.
Technique: T1552.004 Unsecured Credentials: Private Keys, Tactic: TA0006 Credential Access
During the SolarWinds Compromise, APT29 obtained PKI keys, certificate files, and the private encryption key from an Active Directory Federation Services (AD FS) container to decrypt corresponding SAML signing certificates.
Technique: T1552.004 Unsecured Credentials: Private Keys, Tactic: TA0006 Credential Access
Rocke has used SSH private keys on the infected machine to spread its coinminer throughout a network.
Technique: T1552.004 Unsecured Credentials: Private Keys, Tactic: TA0006 Credential Access
Scattered Spider enumerate and exfiltrate code-signing certificates from a compromised host.
Technique: T1552.004 Unsecured Credentials: Private Keys, Tactic: TA0006 Credential Access
TeamTNT has searched for unsecured SSH keys.
Technique: T1552.004 Unsecured Credentials: Private Keys, Tactic: TA0006 Credential Access
AADInternals can gather encryption keys from Azure AD services such as ADSync and Active Directory Federated Services servers.
Technique: T1552.004 Unsecured Credentials: Private Keys, Tactic: TA0006 Credential Access
Ebury has intercepted unencrypted private keys as well as private key pass-phrases.
Technique: T1552.004 Unsecured Credentials: Private Keys, Tactic: TA0006 Credential Access
Empire can use modules like `Invoke-SessionGopher` to extract private key and session information.
Technique: T1552.004 Unsecured Credentials: Private Keys, Tactic: TA0006 Credential Access
FoggyWeb can retrieve token signing certificates and token decryption certificates from a compromised AD FS server.
Technique: T1552.004 Unsecured Credentials: Private Keys, Tactic: TA0006 Credential Access
Hildegard has searched for private keys in .ssh.
Technique: T1552.004 Unsecured Credentials: Private Keys, Tactic: TA0006 Credential Access
Kinsing has searched for private keys.
Technique: T1552.004 Unsecured Credentials: Private Keys, Tactic: TA0006 Credential Access
Machete has scanned and looked for cryptographic keys and certificate file extensions.
Technique: T1552.004 Unsecured Credentials: Private Keys, Tactic: TA0006 Credential Access
Mafalda can collect a Chrome encryption key used to protect browser cookies.
Technique: T1552.004 Unsecured Credentials: Private Keys, Tactic: TA0006 Credential Access
Mimikatz's `CRYPTO::Extract` module can extract keys by interacting with Windows cryptographic application programming interface (API) functions.
Technique: T1552.004 Unsecured Credentials: Private Keys, Tactic: TA0006 Credential Access
jRAT can steal keys for VPNs and cryptocurrency wallets.
Technique: T1552.004 Unsecured Credentials: Private Keys, Tactic: TA0006 Credential Access
TeamTNT has queried the AWS instance metadata service for credentials.
Technique: T1552.005 Unsecured Credentials: Cloud Instance Metadata API, Tactic: TA0006 Credential Access
Hildegard has queried the Cloud Instance Metadata API for cloud credentials.
Technique: T1552.005 Unsecured Credentials: Cloud Instance Metadata API, Tactic: TA0006 Credential Access
Peirates can query the query AWS and GCP metadata APIs for secrets.
Technique: T1552.005 Unsecured Credentials: Cloud Instance Metadata API, Tactic: TA0006 Credential Access
APT33 has used a variety of publicly available tools like Gpppassword to gather credentials.
Technique: T1552.006 Unsecured Credentials: Group Policy Preferences, Tactic: TA0006 Credential Access
Wizard Spider has used PowerShell cmdlets `Get-GPPPassword` and `Find-GPOPassword` to find unsecured credentials in a compromised network group policy.
Technique: T1552.006 Unsecured Credentials: Group Policy Preferences, Tactic: TA0006 Credential Access
PowerSploit contains a collection of Exfiltration modules that can harvest credentials from Group Policy Preferences.
Technique: T1552.006 Unsecured Credentials: Group Policy Preferences, Tactic: TA0006 Credential Access
SILENTTRINITY has a module that can extract cached GPP passwords.
Technique: T1552.006 Unsecured Credentials: Group Policy Preferences, Tactic: TA0006 Credential Access
Peirates can query the Kubernetes API for secrets.
Technique: T1552.007 Unsecured Credentials: Container API, Tactic: TA0006 Credential Access
LAPSUS$ has targeted various collaboration tools like Slack, Teams, JIRA, Confluence, and others to hunt for exposed credentials to support privilege escalation and lateral movement.
Technique: T1552.008 Unsecured Credentials: Chat Messages, Tactic: TA0006 Credential Access
Axiom has used digital certificates to deliver malware.
Technique: T1553 Subvert Trust Controls, Tactic: TA0005 Defense Evasion
CoinTicker downloads the EggShell mach-o binary using curl, which does not set the quarantine flag.
Technique: T1553.001 Subvert Trust Controls: Gatekeeper Bypass, Tactic: TA0005 Defense Evasion
MacMa has removed the `com.apple.quarantineattribute` from the dropped file, `$TMPDIR/airportpaird`.
Technique: T1553.001 Subvert Trust Controls: Gatekeeper Bypass, Tactic: TA0005 Defense Evasion
If running with elevated privileges, OSX/Shlayer has used the `spctl` command to disable Gatekeeper protection for a downloaded file. OSX/Shlayer can also leverage system links pointing to bash scripts in the downloaded DMG file to bypass Gatekeeper, a flaw patched in macOS 11.3 and later versions. OSX/Shlayer has been Notarized by Apple, resulting in successful passing of additional Gatekeeper checks.
Technique: T1553.001 Subvert Trust Controls: Gatekeeper Bypass, Tactic: TA0005 Defense Evasion
OSX_OCEANLOTUS.D uses the command `xattr -d com.apple.quarantine` to remove the quarantine file attribute used by Gatekeeper.
Technique: T1553.001 Subvert Trust Controls: Gatekeeper Bypass, Tactic: TA0005 Defense Evasion
XCSSET has dropped a malicious applet into an app's `.../Contents/MacOS/` folder of a previously launched app to bypass Gatekeeper's security checks on first launch apps (prior to macOS 13).
Technique: T1553.001 Subvert Trust Controls: Gatekeeper Bypass, Tactic: TA0005 Defense Evasion
For C0015, the threat actors used DLL files that had invalid certificates.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
During Operation Dream Job, Lazarus Group digitally signed their own malware to evade detection.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
During Operation Honeybee, the threat actors deployed the MaoCheng dropper with a stolen Adobe Systems digital signature.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
During the SolarWinds Compromise, APT29 was able to get SUNBURST signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
APT41 leveraged code-signing certificates to sign malware when targeting both gaming and non-gaming organizations.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
CopyKittens digitally signed an executable with a stolen certificate from legitimate company AI Squared.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Darkhotel has used code-signing certificates on its malware that are either forged due to weak keys or stolen. Darkhotel has also stolen certificates and signed backdoors and downloaders with them.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Ember Bear has used stolen certificates from Electrum Technologies GmbH to sign payloads.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
FIN6 has used Comodo code-signing certificates.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
FIN7 has signed Carbanak payloads with legally purchased code signing certificates. FIN7 has also digitally signed their phishing documents, backdoors and other staging tools to bypass security controls.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
GALLIUM has used stolen certificates to sign its tools including those from Whizzimo LLC.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Kimsuky has signed files with the name EGIS CO,. Ltd..
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Lazarus Group has digitally signed malware and utilities to evade detection.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Leviathan has used stolen code signing certificates to sign malware.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
LuminousMoth has signed their malware with a valid digital signature.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Molerats has used forged Microsoft code-signing certificates on malware.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Moses Staff has used signed drivers from an open source tool called DiskCryptor to evade detection.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
PROMETHIUM has signed code with self-signed certificates.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Patchwork has signed malware with self-signed certificates from fictitious and spoofed legitimate software companies.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Scattered Spider has used self-signed and stolen certificates originally issued to NVIDIA and Global Software LLC.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Silence has used a valid certificate to sign their primary loader Silence.Downloader (aka TrueBot).
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Suckfly has used stolen certificates to sign its malware.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
TA505 has signed payloads with code signing certificates from Thawte and Sectigo.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Winnti Group used stolen certificates to sign its malware.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Wizard Spider has used Digicert code-signing certificates for some of its malware.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
menuPass has resized and added data to the certificate table to enable the signing of modified files with legitimate signatures.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Anchor has been signed with valid certificates to evade detection by security tools.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
AppleJeus has used a valid digital signature from Sectigo to appear legitimate.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
BLINDINGCAN has been signed with code-signing certificates such as CodeRipper.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
BOOSTWRITE has been signed by a valid CA.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
BackConfig has been signed with self signed digital certificates mimicking a legitimate software company.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Bandook was signed with valid Certum certificates.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Bazar has been signed with fake certificates including those appearing to be from VB CORPORATE PTY. LTD.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
The Black Basta dropper has been digitally signed with a certificate issued by Akeo Consulting for legitimate executables used for creating bootable USB drives.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
CSPY Downloader has come signed with revoked certificates.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
ChChes samples were digitally signed with a certificate originally used by Hacking Team that was later leaked and subsequently revoked.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Clop can use code signing to evade detection.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Cobalt Strike can use self signed Java applets to execute signed applet attacks.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Some Daserf samples were signed with a stolen digital certificate.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Ebury has installed a self-signed RPM package mimicking the original system package on RPM based systems.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Ecipekac has used a valid, legitimate digital signature to evade detection.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Turla has used valid digital certificates from Sysprint AG to sign its Epic dropper.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Gazer versions are signed with various valid certificates; one was likely faked and issued by Comodo for "Solid Loop Ltd," and another was issued for "Ultimate Computer Support Ltd."
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
GreyEnergy digitally signs the malware with a code-signing certificate.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Helminth samples have been signed with legitimate, compromised code signing certificates owned by software company AI Squared.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
The HermeticWiper executable has been signed with a legitimate certificate issued to Hermetica Digital Ltd.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
HermeticWizard has been signed by valid certificates assigned to Hermetica Digital.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Janicab used a valid AppleDeveloperID to sign the code to get past security restrictions.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
LockerGoga has been signed with stolen certificates in order to make it look more legitimate.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Metamorfo has digitally signed executables using AVAST Software certificates.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
More_eggs has used a signed binary shellcode loader and a signed Dynamic Link Library (DLL) to create a reverse shell.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Nerex drops a signed Microsoft DLL to disk.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
PipeMon, its installer, and tools are signed with stolen code-signing certificates.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
QakBot can use signed loaders to evade detection.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
A QuasarRAT .dll file is digitally signed by a certificate from AirVPN.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
RTM samples have been signed with a code-signing certificates.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
SUNBURST was digitally signed by SolarWinds from March - May 2020.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
SpicyOmelette has been signed with valid digital certificates.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
StrongPity has been signed with self-signed certificates.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Stuxnet used a digitally signed driver with a compromised Realtek certificate.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
SysUpdate has been signed with stolen digital certificates.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
TrickBot has come with a signed downloader component.
Technique: T1553.002 Subvert Trust Controls: Code Signing, Tactic: TA0005 Defense Evasion
Dok installs a root certificate to aid in Adversary-in-the-Middle actions using the command `add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /tmp/filename`.
Technique: T1553.004 Subvert Trust Controls: Install Root Certificate, Tactic: TA0005 Defense Evasion
Hikit installs a self-generated certificate to the local trust store as a root CA and Trusted Publisher.
Technique: T1553.004 Subvert Trust Controls: Install Root Certificate, Tactic: TA0005 Defense Evasion
RTM can add a certificate to the Windows store.
Technique: T1553.004 Subvert Trust Controls: Install Root Certificate, Tactic: TA0005 Defense Evasion
certutil can be used to install browser root certificates as a precursor to performing Adversary-in-the-Middle between connections to banking websites. Example command: `certutil -addstore -f -user ROOT ProgramData\cert512121.der`.
Technique: T1553.004 Subvert Trust Controls: Install Root Certificate, Tactic: TA0005 Defense Evasion
APT29 has embedded ISO images and VHDX files in HTML to evade Mark-of-the-Web.
Technique: T1553.005 Subvert Trust Controls: Mark-of-the-Web Bypass, Tactic: TA0005 Defense Evasion
TA505 has used .iso files to deploy malicious .lnk files.
Technique: T1553.005 Subvert Trust Controls: Mark-of-the-Web Bypass, Tactic: TA0005 Defense Evasion
Amadey has modified the `:Zone.Identifier` in the ADS area to zero.
Technique: T1553.005 Subvert Trust Controls: Mark-of-the-Web Bypass, Tactic: TA0005 Defense Evasion
QakBot has been packaged in ISO files in order to bypass Mark of the Web (MOTW) security measures.
Technique: T1553.005 Subvert Trust Controls: Mark-of-the-Web Bypass, Tactic: TA0005 Defense Evasion
APT39 has used malware to turn off the `RequireSigned` feature which ensures only signed DLLs can be run on Windows.
Technique: T1553.006 Subvert Trust Controls: Code Signing Policy Modification, Tactic: TA0005 Defense Evasion
Turla has modified variables in kernel memory to turn off Driver Signature Enforcement after exploiting vulnerabilities that obtained kernel mode privileges.
Technique: T1553.006 Subvert Trust Controls: Code Signing Policy Modification, Tactic: TA0005 Defense Evasion
BlackEnergy has enabled the `TESTSIGNING` boot configuration option to facilitate loading of a driver component.
Technique: T1553.006 Subvert Trust Controls: Code Signing Policy Modification, Tactic: TA0005 Defense Evasion
Hikit has attempted to disable driver signing verification by tampering with several Registry keys prior to the loading of a rootkit driver component.
Technique: T1553.006 Subvert Trust Controls: Code Signing Policy Modification, Tactic: TA0005 Defense Evasion
Pandora can use CVE-2017-15303 to disable Windows Driver Signature Enforcement (DSE) protection and load its driver.
Technique: T1553.006 Subvert Trust Controls: Code Signing Policy Modification, Tactic: TA0005 Defense Evasion
During the 2016 Ukraine Electric Power Attack, Sandworm Team used a trojanized version of Windows Notepad to add a layer of persistence for Industroyer.
Technique: T1554 Compromise Host Software Binary, Tactic: TA0003 Persistence
During Cutting Edge, threat actors trojanized legitimate files in Ivanti Connect Secure appliances with malicious code.
Technique: T1554 Compromise Host Software Binary, Tactic: TA0003 Persistence
APT5 has modified legitimate binaries and scripts for Pulse Secure VPNs including the legitimate DSUpgrade.pm file to install the ATRIUM webshell for persistence.
Technique: T1554 Compromise Host Software Binary, Tactic: TA0003 Persistence
BUSHWALK can embed into the legitimate `querymanifest.cgi` file on compromised Ivanti Connect Secure VPNs.
Technique: T1554 Compromise Host Software Binary, Tactic: TA0003 Persistence
Bonadan has maliciously altered the OpenSSH binary on targeted systems to create a backdoor.
Technique: T1554 Compromise Host Software Binary, Tactic: TA0003 Persistence
Ebury has been embedded into modified OpenSSH binaries to gain persistent access to SSH credential information.
Technique: T1554 Compromise Host Software Binary, Tactic: TA0003 Persistence
FRAMESTING can embed itself in the CAV Python package of an Ivanti Connect Secure VPN located in `/home/venv3/lib/python3.6/site-packages/cav-0.1-py3.6.egg/cav/api/resources/category.py.`
Technique: T1554 Compromise Host Software Binary, Tactic: TA0003 Persistence
Industroyer has used a Trojanized version of the Windows Notepad application for an additional backdoor persistence mechanism.
Technique: T1554 Compromise Host Software Binary, Tactic: TA0003 Persistence
Kessel has maliciously altered the OpenSSH binary on targeted systems to create a backdoor.
Technique: T1554 Compromise Host Software Binary, Tactic: TA0003 Persistence
Kobalos replaced the SSH client with a trojanized SSH client to steal credentials on compromised systems.
Technique: T1554 Compromise Host Software Binary, Tactic: TA0003 Persistence
LIGHTWIRE can imbed itself into the legitimate `compcheckresult.cgi` component of Ivanti Connect Secure VPNs to enable command execution.
Technique: T1554 Compromise Host Software Binary, Tactic: TA0003 Persistence
LITTLELAMB.WOOLTEA can append malicious components to the `tmp/tmpmnt/bin/samba_upgrade.tar` archive inside the factory reset partition in attempt to persist post reset.
Technique: T1554 Compromise Host Software Binary, Tactic: TA0003 Persistence
SLOWPULSE is applied in compromised environments through modifications to legitimate Pulse Secure files.
Technique: T1554 Compromise Host Software Binary, Tactic: TA0003 Persistence
ThiefQuest searches through the `/Users/` folder looking for executable files. For each executable, ThiefQuest prepends a copy of itself to the beginning of the file. When the file is executed, the ThiefQuest code is executed first. ThiefQuest creates a hidden file, copies the original target executable to the file, then executes the new hidden file to maintain the appearance of normal behavior.
Technique: T1554 Compromise Host Software Binary, Tactic: TA0003 Persistence
WARPWIRE can embed itself into a legitimate file on compromised Ivanti Connect Secure VPNs.
Technique: T1554 Compromise Host Software Binary, Tactic: TA0003 Persistence
WIREFIRE can modify the `visits.py` component of Ivanti Connect Secure VPNs for file download and arbitrary command execution.
Technique: T1554 Compromise Host Software Binary, Tactic: TA0003 Persistence
XCSSET uses a malicious browser application to replace the legitimate browser in order to continuously capture credentials, monitor web traffic, and download additional modules.
Technique: T1554 Compromise Host Software Binary, Tactic: TA0003 Persistence
During the SolarWinds Compromise, APT29 used account credentials they obtained to attempt access to Group Managed Service Account (gMSA) passwords.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
APT33 has used a variety of publicly available tools like LaZagne to gather credentials.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
APT39 has used the Smartftp Password Decryptor tool to decrypt FTP passwords.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
Evilnum can collect email credentials from victims.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access