sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
build_downer has the ability to download files from C2 to the infected host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
certutil can be used to download files from a given URL.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
cmd can be used to copy files to/from a remotely connected external system.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
down_new has the ability to download files to the compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
esentutl can be used to copy files from a given URL.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
ftp may be abused by adversaries to transfer tools or files from an external system into a compromised environment.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
gh0st RAT can download files to the victim’s machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
jRAT can download and execute files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
macOS.OSAMiner has used `curl` to download a Stripped Payloads from a public facing adversary-controlled webpage.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
metaMain can download files onto compromised systems.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
njRAT can download files to the victim’s machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
xCaon has a command to download files to the victim's machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
During Operation Dream Job, Lazarus Group used Windows API `ObtainUserAgentString` to obtain the victim's User-Agent and used the value to connect to their C2 server.
Technique: T1106 Native API, Tactic: TA0002 Execution
During Operation Honeybee, the threat actors deployed malware that used API calls, including `CreateProcessAsUser`.
Technique: T1106 Native API, Tactic: TA0002 Execution
During Operation Sharpshooter, the first stage downloader resolved various Windows libraries and APIs, including `LoadLibraryA()`, `GetProcAddress()`, and `CreateProcessA()`.
Technique: T1106 Native API, Tactic: TA0002 Execution
During Operation Wocao, threat actors used the `CreateProcessA` and `ShellExecute` API functions to launch commands after being injected into a selected process.
Technique: T1106 Native API, Tactic: TA0002 Execution
APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.
Technique: T1106 Native API, Tactic: TA0002 Execution
APT38 has used the Windows API to execute code within a victim's system.
Technique: T1106 Native API, Tactic: TA0002 Execution
BlackTech has used built-in API functions.
Technique: T1106 Native API, Tactic: TA0002 Execution
Chimera has used direct Windows system calls by leveraging Dumpert.
Technique: T1106 Native API, Tactic: TA0002 Execution
Gamaredon Group malware has used `CreateProcess` to launch additional malicious components.
Technique: T1106 Native API, Tactic: TA0002 Execution
Gorgon Group malware can leverage the Windows API call, CreateProcessA(), for execution.
Technique: T1106 Native API, Tactic: TA0002 Execution
Higaisa has called various native OS APIs.
Technique: T1106 Native API, Tactic: TA0002 Execution
Lazarus Group has used the Windows API `ObtainUserAgentString` to obtain the User-Agent from a compromised host to connect to a C2 server. Lazarus Group has also used various, often lesser known, functions to perform various types of Discovery and Process Injection.
Technique: T1106 Native API, Tactic: TA0002 Execution
SideCopy has executed malware by calling the API function `CreateProcessW`.
Technique: T1106 Native API, Tactic: TA0002 Execution
Silence has leveraged the Windows API, including using CreateProcess() or ShellExecute(), to perform a variety of tasks.
Technique: T1106 Native API, Tactic: TA0002 Execution
TA505 has deployed payloads that use Windows API calls on a compromised host.
Technique: T1106 Native API, Tactic: TA0002 Execution
ToddyCat has used `WinExec` to execute commands received from C2 on compromised hosts.
Technique: T1106 Native API, Tactic: TA0002 Execution
Tropic Trooper has used multiple Windows APIs including HttpInitialize, HttpCreateHttpHandle, and HttpAddUrl.
Technique: T1106 Native API, Tactic: TA0002 Execution
Turla and its RPC backdoors have used APIs calls for various tasks related to subverting AMSI and accessing then executing commands through RPC and/or named pipes.
Technique: T1106 Native API, Tactic: TA0002 Execution
menuPass has used native APIs including `GetModuleFileName`, `lstrcat`, `CreateFile`, and `ReadFile`.
Technique: T1106 Native API, Tactic: TA0002 Execution
ADVSTORESHELL is capable of starting a process using CreateProcess.
Technique: T1106 Native API, Tactic: TA0002 Execution
Akira executes native Windows functions such as `GetFileAttributesW` and `GetSystemInfo`.
Technique: T1106 Native API, Tactic: TA0002 Execution
Amadey has used a variety of Windows API calls, including `GetComputerNameA`, `GetUserNameA`, and `CreateProcessA`.
Technique: T1106 Native API, Tactic: TA0002 Execution
AppleSeed has the ability to use multiple dynamically resolved API calls.
Technique: T1106 Native API, Tactic: TA0002 Execution
Aria-body has the ability to launch files using `ShellExecute`.
Technique: T1106 Native API, Tactic: TA0002 Execution
AsyncRAT has the ability to use OS APIs including `CheckRemoteDebuggerPresent`.
Technique: T1106 Native API, Tactic: TA0002 Execution
Attor's dispatcher has used CreateProcessW API for execution.
Technique: T1106 Native API, Tactic: TA0002 Execution
Avaddon has used the Windows Crypto API to generate an AES key.
Technique: T1106 Native API, Tactic: TA0002 Execution
AvosLocker has used a variety of Windows API calls, including `NtCurrentPeb` and `GetLogicalDrives`.
Technique: T1106 Native API, Tactic: TA0002 Execution
BADHATCH can utilize Native API functions such as, `ToolHelp32` and `Rt1AdjustPrivilege` to enable `SeDebugPrivilege` on a compromised machine.
Technique: T1106 Native API, Tactic: TA0002 Execution
BADNEWS has a command to download an .exe and execute it via CreateProcess API. It can also run with ShellExecute.
Technique: T1106 Native API, Tactic: TA0002 Execution
BBK has the ability to use the `CreatePipe` API to add a sub-process for execution via cmd.
Technique: T1106 Native API, Tactic: TA0002 Execution
Babuk can use multiple Windows API calls for actions on compromised hosts including discovery and execution.
Technique: T1106 Native API, Tactic: TA0002 Execution
BackConfig can leverage API functions such as `ShellExecuteA` and `HttpOpenRequestA` in the process of downloading and executing files.
Technique: T1106 Native API, Tactic: TA0002 Execution
Bad Rabbit has used various Windows API calls.
Technique: T1106 Native API, Tactic: TA0002 Execution
Bandook has used the ShellExecuteW() function call.
Technique: T1106 Native API, Tactic: TA0002 Execution
Bankshot creates processes using the Windows API calls: CreateProcessA() and CreateProcessAsUserA().
Technique: T1106 Native API, Tactic: TA0002 Execution
Bazar can use various APIs to allocate memory and facilitate code execution/injection.
Technique: T1106 Native API, Tactic: TA0002 Execution
BendyBear can load and execute modules and Windows Application Programming (API) calls using standard shellcode API hashing.
Technique: T1106 Native API, Tactic: TA0002 Execution
Bisonal has used the Windows API to communicate with the Service Control Manager to execute a thread.
Technique: T1106 Native API, Tactic: TA0002 Execution
BitPaymer has used dynamic API resolution to avoid identifiable strings within the binary, including `RegEnumKeyW`.
Technique: T1106 Native API, Tactic: TA0002 Execution
Black Basta has the ability to use native APIs for numerous functions including discovery and defense evasion.
Technique: T1106 Native API, Tactic: TA0002 Execution
BloodHound can use .NET API calls in the SharpHound ingestor component to pull Active Directory data.
Technique: T1106 Native API, Tactic: TA0002 Execution
BoxCaon has used Windows API calls to obtain information about the compromised host.
Technique: T1106 Native API, Tactic: TA0002 Execution
Brute Ratel C4 can call multiple Windows APIs for execution, to share memory, and defense evasion.
Technique: T1106 Native API, Tactic: TA0002 Execution
Bumblebee can use multiple Native APIs.
Technique: T1106 Native API, Tactic: TA0002 Execution
CaddyWiper has the ability to dynamically resolve and use APIs, including `SeTakeOwnershipPrivilege`.
Technique: T1106 Native API, Tactic: TA0002 Execution
Carberp has used the NtQueryDirectoryFile and ZwQueryDirectoryFile functions to hide files and directories.
Technique: T1106 Native API, Tactic: TA0002 Execution
Chaes used the `CreateFileW()` API function with read permissions to access downloaded payloads.
Technique: T1106 Native API, Tactic: TA0002 Execution
Chrommme can use Windows API including `WinExec` for execution.
Technique: T1106 Native API, Tactic: TA0002 Execution
Clop has used built-in API functions such as WNetOpenEnumW(), WNetEnumResourceW(), WNetCloseEnum(), GetProcAddress(), and VirtualAlloc().
Technique: T1106 Native API, Tactic: TA0002 Execution
Cobalt Strike's Beacon payload is capable of running shell commands without `cmd.exe` and PowerShell commands without `powershell.exe`
Technique: T1106 Native API, Tactic: TA0002 Execution
ComRAT can load a PE file from memory or the file system and execute it with `CreateProcessW`.
Technique: T1106 Native API, Tactic: TA0002 Execution
Conti has used API calls during execution.
Technique: T1106 Native API, Tactic: TA0002 Execution
CostaBricks has used a number of API calls, including `VirtualAlloc`, `VirtualFree`, `LoadLibraryA`, `GetProcAddress`, and `ExitProcess`.
Technique: T1106 Native API, Tactic: TA0002 Execution
Cuba has used several built-in API functions for discovery like GetIpNetTable and NetShareEnum.
Technique: T1106 Native API, Tactic: TA0002 Execution
Cyclops Blink can use various Linux API functions including those for execution and discovery.
Technique: T1106 Native API, Tactic: TA0002 Execution
DCSrv has used various Windows API functions, including `DeviceIoControl`, as part of its encryption process.
Technique: T1106 Native API, Tactic: TA0002 Execution
DEADEYE can execute the `GetComputerNameA` and `GetComputerNameExA` WinAPI functions.
Technique: T1106 Native API, Tactic: TA0002 Execution
DRATzarus can use various API calls to see if it is running in a sandbox.
Technique: T1106 Native API, Tactic: TA0002 Execution
DarkGate uses the native Windows API `CallWindowProc()` to decode and launch encoded shellcode payloads during execution. DarkGate can call kernel mode functions directly to hide the use of process hollowing methods during execution.
Technique: T1106 Native API, Tactic: TA0002 Execution
DarkTortilla can use a variety of API calls for persistence and defense evasion.
Technique: T1106 Native API, Tactic: TA0002 Execution
Denis used the `IsDebuggerPresent`, `OutputDebugString`, and `SetLastError` APIs to avoid debugging. Denis used `GetProcAddress` and `LoadLibrary` to dynamically resolve APIs. Denis also used the `Wow64SetThreadContext` API as part of a process hollowing process.
Technique: T1106 Native API, Tactic: TA0002 Execution
Diavol has used several API calls like `GetLogicalDriveStrings`, `SleepEx`, `SystemParametersInfoAPI`, `CryptEncrypt`, and others to execute parts of its attack.
Technique: T1106 Native API, Tactic: TA0002 Execution
Donut code modules use various API functions to load and inject code.
Technique: T1106 Native API, Tactic: TA0002 Execution
Dridex has used the `OutputDebugStringW` function to avoid malware analysis as part of its anti-debugging technique.
Technique: T1106 Native API, Tactic: TA0002 Execution
Egregor has used the Windows API to make detection more difficult.
Technique: T1106 Native API, Tactic: TA0002 Execution
Emotet has used `CreateProcess` to create a new process to run its executable and `WNetEnumResourceW` to enumerate non-hidden shares.
Technique: T1106 Native API, Tactic: TA0002 Execution
Empire contains a variety of enumeration modules that have an option to use API calls to carry out tasks.
Technique: T1106 Native API, Tactic: TA0002 Execution
EvilBunny has used various API calls as part of its checks to see if the malware is running in a sandbox.
Technique: T1106 Native API, Tactic: TA0002 Execution
Explosive has a function to call the OpenClipboard wrapper.
Technique: T1106 Native API, Tactic: TA0002 Execution
FatDuke can call `ShellExecuteW` to open the default browser on the URL localhost.
Technique: T1106 Native API, Tactic: TA0002 Execution
Flagpro can use Native API to enable obfuscation including `GetLastError` and `GetTickCount`.
Technique: T1106 Native API, Tactic: TA0002 Execution
FoggyWeb's loader can use API functions to load the FoggyWeb backdoor into the same Application Domain within which the legitimate AD FS managed code is executed.
Technique: T1106 Native API, Tactic: TA0002 Execution
FunnyDream can use Native API for defense evasion, discovery, and collection.
Technique: T1106 Native API, Tactic: TA0002 Execution
Gelsemium has the ability to use various Windows API functions to perform tasks.
Technique: T1106 Native API, Tactic: TA0002 Execution
GoldenSpy can execute remote commands in the Windows command shell using the `WinExec()` API.
Technique: T1106 Native API, Tactic: TA0002 Execution
Goopy has the ability to  enumerate the infected system's user name via `GetUserNameW`.
Technique: T1106 Native API, Tactic: TA0002 Execution
Grandoreiro can execute through the `WinExec` API.
Technique: T1106 Native API, Tactic: TA0002 Execution
GrimAgent can use Native API including `GetProcAddress` and `ShellExecuteW`.
Technique: T1106 Native API, Tactic: TA0002 Execution
GuLoader can use a number of different APIs for discovery and execution.
Technique: T1106 Native API, Tactic: TA0002 Execution
HAWKBALL has leveraged several Windows API calls to create processes, gather disk information, and detect debugger activity.
Technique: T1106 Native API, Tactic: TA0002 Execution
Hancitor has used `CallWindowProc` and `EnumResourceTypesA` to interpret and execute shellcode.
Technique: T1106 Native API, Tactic: TA0002 Execution
HermeticWiper can call multiple Windows API functions used for privilege escalation, service execution, and to overwrite random bites of data.
Technique: T1106 Native API, Tactic: TA0002 Execution
HermeticWizard can connect to remote shares using `WNetAddConnection2W`.
Technique: T1106 Native API, Tactic: TA0002 Execution
HotCroissant can perform dynamic DLL importing and API lookups using `LoadLibrary` and `GetProcAddress` on obfuscated strings.
Technique: T1106 Native API, Tactic: TA0002 Execution
HyperBro has the ability to run an application (`CreateProcessW`) or script/file (`ShellExecuteW`) via API.
Technique: T1106 Native API, Tactic: TA0002 Execution
HyperStack can use Windows API's `ConnectNamedPipe` and `WNetAddConnection2` to detect incoming connections and connect to remote shares.
Technique: T1106 Native API, Tactic: TA0002 Execution
IcedID has called `ZwWriteVirtualMemory`, `ZwProtectVirtualMemory`, `ZwQueueApcThread`, and `NtResumeThread` to inject itself into a remote process.
Technique: T1106 Native API, Tactic: TA0002 Execution
Imminent Monitor has leveraged CreateProcessW() call to execute the debugger.
Technique: T1106 Native API, Tactic: TA0002 Execution
InnaputRAT uses the API call ShellExecuteW for execution.
Technique: T1106 Native API, Tactic: TA0002 Execution
InvisiMole can use winapiexec tool for indirect execution of  `ShellExecuteW` and `CreateProcessA`.
Technique: T1106 Native API, Tactic: TA0002 Execution
KOCTOPUS can use the `LoadResource` and `CreateProcessW` APIs for execution.
Technique: T1106 Native API, Tactic: TA0002 Execution
KONNI has hardcoded API calls within its functions to use on the victim's machine.
Technique: T1106 Native API, Tactic: TA0002 Execution
Kevin can use the `ShowWindow` API to avoid detection.
Technique: T1106 Native API, Tactic: TA0002 Execution
KillDisk has called the Windows API to retrieve the hard disk handle and shut down the machine.
Technique: T1106 Native API, Tactic: TA0002 Execution
LightNeuron is capable of starting a process using CreateProcess.
Technique: T1106 Native API, Tactic: TA0002 Execution
LitePower can use various API calls.
Technique: T1106 Native API, Tactic: TA0002 Execution
Lizar has used various Windows API functions on a victim's machine.
Technique: T1106 Native API, Tactic: TA0002 Execution
Lokibot has used LoadLibrary(), GetProcAddress() and CreateRemoteThread() API functions to execute its shellcode.
Technique: T1106 Native API, Tactic: TA0002 Execution
MacMa has used macOS API functions to perform tasks.
Technique: T1106 Native API, Tactic: TA0002 Execution
Mafalda can use a variety of API calls.
Technique: T1106 Native API, Tactic: TA0002 Execution
MarkiRAT can run the ShellExecuteW API via the Windows Command Shell.
Technique: T1106 Native API, Tactic: TA0002 Execution
Maze has used several Windows API functions throughout the encryption process including IsDebuggerPresent, TerminateProcess, Process32FirstW, among others.
Technique: T1106 Native API, Tactic: TA0002 Execution
After escalating privileges, MegaCortex calls `TerminateProcess()`, `CreateRemoteThread`, and other Win32 APIs.
Technique: T1106 Native API, Tactic: TA0002 Execution
Metamorfo has used native WINAPI calls.
Technique: T1106 Native API, Tactic: TA0002 Execution
Meteor can use `WinAPI` to remove a victim machine from an Active Directory domain.
Technique: T1106 Native API, Tactic: TA0002 Execution
Milan can use the API `DnsQuery_A` for DNS resolution.
Technique: T1106 Native API, Tactic: TA0002 Execution
Mis-Type has used Windows API calls, including `NetUserAdd` and `NetUserDel`.
Technique: T1106 Native API, Tactic: TA0002 Execution
Misdat has used Windows APIs, including `ExitWindowsEx` and `GetKeyboardType`.
Technique: T1106 Native API, Tactic: TA0002 Execution
Mispadu has used a variety of Windows API calls, including ShellExecute and WriteProcessMemory.
Technique: T1106 Native API, Tactic: TA0002 Execution
Mosquito leverages the CreateProcess() and LoadLibrary() calls to execute files with the .dll and .exe extensions.
Technique: T1106 Native API, Tactic: TA0002 Execution
NETWIRE can use Native API including `CreateProcess` `GetProcessById`, and `WriteProcessMemory`.
Technique: T1106 Native API, Tactic: TA0002 Execution
Nebulae has the ability to use `CreateProcess` to execute a process.
Technique: T1106 Native API, Tactic: TA0002 Execution
Netwalker can use Windows API functions to inject the ransomware DLL.
Technique: T1106 Native API, Tactic: TA0002 Execution
NightClub can use multiple native APIs including `GetKeyState`, `GetForegroundWindow`, `GetWindowThreadProcessId`, and `GetKeyboardLayout`.
Technique: T1106 Native API, Tactic: TA0002 Execution
The Ninja loader can call Windows APIs for discovery, process injection, and payload decryption.
Technique: T1106 Native API, Tactic: TA0002 Execution
PLEAD can use `ShellExecute` to execute applications.
Technique: T1106 Native API, Tactic: TA0002 Execution
PcShare has used a variety of Windows API functions.
Technique: T1106 Native API, Tactic: TA0002 Execution
Pillowmint has used multiple native Windows APIs to execute and conduct process injections.
Technique: T1106 Native API, Tactic: TA0002 Execution
PipeMon's first stage has been executed by a call to `CreateProcess` with the decryption password in an argument. PipeMon has used a call to `LoadLibrary` to load its installer.
Technique: T1106 Native API, Tactic: TA0002 Execution
PlugX can use the Windows API functions `GetProcAddress`, `LoadLibrary`, and `CreateProcess` to execute another process.
Technique: T1106 Native API, Tactic: TA0002 Execution
PolyglotDuke can use `LoadLibraryW` and `CreateProcess` to load and execute code.
Technique: T1106 Native API, Tactic: TA0002 Execution
Pony has used several Windows functions for various purposes.
Technique: T1106 Native API, Tactic: TA0002 Execution
Prestige has used the `Wow64DisableWow64FsRedirection()` and `Wow64RevertWow64FsRedirection()` functions to disable and restore file system redirection.
Technique: T1106 Native API, Tactic: TA0002 Execution
Pteranodon has used various API calls.
Technique: T1106 Native API, Tactic: TA0002 Execution
QUIETCANARY can call `System.Net.HttpWebRequest` to identify the default proxy configured on the victim computer.
Technique: T1106 Native API, Tactic: TA0002 Execution
QakBot can use `GetProcAddress` to help delete malicious strings from memory.
Technique: T1106 Native API, Tactic: TA0002 Execution
RCSession can use WinSock API for communication including `WSASend` and `WSARecv`.
Technique: T1106 Native API, Tactic: TA0002 Execution
RDFSNIFFER has used several Win32 API functions to interact with the victim machine.
Technique: T1106 Native API, Tactic: TA0002 Execution
REvil can use Native API for execution and to retrieve active services.
Technique: T1106 Native API, Tactic: TA0002 Execution
ROKRAT can use a variety of API calls to execute shellcode.
Technique: T1106 Native API, Tactic: TA0002 Execution
RTM can use the `FindNextUrlCacheEntryA` and `FindFirstUrlCacheEntryA` functions to search for specific strings within browser history.
Technique: T1106 Native API, Tactic: TA0002 Execution
The file collection tool used by RainyDay can utilize native API including `ReadDirectoryChangeW` for folder monitoring.
Technique: T1106 Native API, Tactic: TA0002 Execution
Ramsay can use Windows API functions such as `WriteFile`, `CloseHandle`, and `GetCurrentHwProfile` during its collection and file storage operations. Ramsay can execute its embedded components via `CreateProcessA` and `ShellExecute`.
Technique: T1106 Native API, Tactic: TA0002 Execution
Rising Sun used dynamic API resolutions to various Windows APIs by leveraging `LoadLibrary()` and `GetProcAddress()`.
Technique: T1106 Native API, Tactic: TA0002 Execution
When executing with non-root permissions, RotaJakiro uses the the `shmget` API to create shared memory between other known RotaJakiro processes. RotaJakiro also uses the `execvp` API to help its dead process "resurrect".
Technique: T1106 Native API, Tactic: TA0002 Execution
Royal can use multiple APIs for discovery, communication, and execution.
Technique: T1106 Native API, Tactic: TA0002 Execution
Ryuk has used multiple native APIs including `ShellExecuteW` to run executables,`GetWindowsDirectoryW` to create folders, and `VirtualAlloc`, `WriteProcessMemory`, and `CreateRemoteThread` for process injection.
Technique: T1106 Native API, Tactic: TA0002 Execution
S-Type has used Windows APIs, including `GetKeyboardType`, `NetUserAdd`, and `NetUserDel`.
Technique: T1106 Native API, Tactic: TA0002 Execution
SILENTTRINITY has the ability to leverage API including `GetProcAddress` and `LoadLibrary`.
Technique: T1106 Native API, Tactic: TA0002 Execution
SUNSPOT used Windows API functions such as `MoveFileEx` and `NtQueryInformationProcess` as part of the SUNBURST injection process.
Technique: T1106 Native API, Tactic: TA0002 Execution
SVCReady can use Windows API calls to gather information from an infected host.
Technique: T1106 Native API, Tactic: TA0002 Execution
Saint Bot has used different API calls, including `GetProcAddress`, `VirtualAllocEx`, `WriteProcessMemory`, `CreateProcessA`, and `SetThreadContext`.
Technique: T1106 Native API, Tactic: TA0002 Execution
Samurai has the ability to call Windows APIs.
Technique: T1106 Native API, Tactic: TA0002 Execution
Sardonic has the ability to call Win32 API functions to determine if `powershell.exe` is running.
Technique: T1106 Native API, Tactic: TA0002 Execution
SharpDisco can leverage Native APIs through plugins including `GetLogicalDrives`.
Technique: T1106 Native API, Tactic: TA0002 Execution
ShimRat has used Windows API functions to install the service and shim.
Technique: T1106 Native API, Tactic: TA0002 Execution
ShimRatReporter used several Windows API functions to gather information from the infected system.
Technique: T1106 Native API, Tactic: TA0002 Execution
SideTwist can use `GetUserNameW`, `GetComputerNameW`, and `GetComputerNameExW` to gather information.
Technique: T1106 Native API, Tactic: TA0002 Execution
Siloscape makes various native API calls.
Technique: T1106 Native API, Tactic: TA0002 Execution
SodaMaster can use `RegOpenKeyW` to access the Registry.
Technique: T1106 Native API, Tactic: TA0002 Execution
SombRAT has the ability to respawn itself using `ShellExecuteW` and `CreateProcessW`.
Technique: T1106 Native API, Tactic: TA0002 Execution
StrifeWater can use a variety of APIs for execution.
Technique: T1106 Native API, Tactic: TA0002 Execution
Stuxnet uses the SetSecurityDescriptorDacl API to reduce object integrity levels.
Technique: T1106 Native API, Tactic: TA0002 Execution
SynAck parses the export tables of system DLLs to locate and call various Windows API functions.
Technique: T1106 Native API, Tactic: TA0002 Execution
SysUpdate can call the `GetNetworkParams` API as part of its C2 establishment process.
Technique: T1106 Native API, Tactic: TA0002 Execution
Taidoor has the ability to use native APIs for execution including `GetProcessHeap`, `GetProcAddress`, and `LoadLibrary`.
Technique: T1106 Native API, Tactic: TA0002 Execution
ThiefQuest uses various API to perform behaviors such as executing payloads and performing local enumeration.
Technique: T1106 Native API, Tactic: TA0002 Execution
TinyTurla has used `WinHTTP`, `CreateProcess`, and other APIs for C2 communications and other functions.
Technique: T1106 Native API, Tactic: TA0002 Execution
Torisma has used various Windows API calls.
Technique: T1106 Native API, Tactic: TA0002 Execution
TrickBot uses the Windows API call, CreateProcessW(), to manage execution flow. TrickBot has also used `Nt*` API functions to perform Process Injection.
Technique: T1106 Native API, Tactic: TA0002 Execution
Uroburos can use native Windows APIs including `GetHostByName`.
Technique: T1106 Native API, Tactic: TA0002 Execution
Ursnif has used `CreateProcessW` to create child processes.
Technique: T1106 Native API, Tactic: TA0002 Execution
Volgmer executes payloads using the Windows API call CreateProcessW().
Technique: T1106 Native API, Tactic: TA0002 Execution
WarzoneRAT can use a variety of API calls on a compromised host.
Technique: T1106 Native API, Tactic: TA0002 Execution
WastedLocker's custom crypter, CryptOne, leveraged the VirtualAlloc() API function to help execute the payload.
Technique: T1106 Native API, Tactic: TA0002 Execution
Waterbear can leverage API functions for execution.
Technique: T1106 Native API, Tactic: TA0002 Execution
WhisperGate has used the `ExitWindowsEx` to flush file buffers to disk and stop running processes and other API calls.
Technique: T1106 Native API, Tactic: TA0002 Execution
WindTail can invoke Apple APIs `contentsOfDirectoryAtPath`, `pathExtension`, and (string) `compare`.
Technique: T1106 Native API, Tactic: TA0002 Execution
Winnti for Windows can use Native API to create a new process and to start services.
Technique: T1106 Native API, Tactic: TA0002 Execution
Woody RAT can use multiple native APIs, including `WriteProcessMemory`, `CreateProcess`, and `CreateRemoteThread` for process injection.
Technique: T1106 Native API, Tactic: TA0002 Execution
XAgentOSX contains the execFile function to execute a specified file on the system using the NSTask:launch method.
Technique: T1106 Native API, Tactic: TA0002 Execution
ZxShell can leverage native API including `RegisterServiceCtrlHandler ` to register a service.RegisterServiceCtrlHandler
Technique: T1106 Native API, Tactic: TA0002 Execution
ZxxZ has used API functions such as `Process32First`, `Process32Next`, and `ShellExecuteA`.
Technique: T1106 Native API, Tactic: TA0002 Execution
build_downer has the ability to use the `WinExec` API to execute malware on a compromised host.
Technique: T1106 Native API, Tactic: TA0002 Execution
gh0st RAT has used the `InterlockedExchange`, `SeShutdownPrivilege`, and `ExitWindowsEx` Windows API functions.
Technique: T1106 Native API, Tactic: TA0002 Execution
metaMain can execute an operator-provided Windows command by leveraging functions such as `WinExec`, `WriteFile`, and `ReadFile`.
Technique: T1106 Native API, Tactic: TA0002 Execution
njRAT has used the ShellExecute() function within a script.
Technique: T1106 Native API, Tactic: TA0002 Execution
xCaon has leveraged native OS function calls to retrieve  victim's network adapter's  information using GetAdapterInfo() API.
Technique: T1106 Native API, Tactic: TA0002 Execution
During the 2016 Ukraine Electric Power Attack, Sandworm Team used a script to attempt RPC authentication against a number of hosts.
Technique: T1110 Brute Force, Tactic: TA0006 Credential Access
During Operation Dream Job, Lazarus Group performed brute force attacks against administrator accounts.
Technique: T1110 Brute Force, Tactic: TA0006 Credential Access
APT28 can perform brute force attacks to obtain credentials.
Technique: T1110 Brute Force, Tactic: TA0006 Credential Access
APT38 has used brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable.
Technique: T1110 Brute Force, Tactic: TA0006 Credential Access
APT39 has used Ncrack to reveal credentials.
Technique: T1110 Brute Force, Tactic: TA0006 Credential Access
DarkVishnya used brute-force attack to obtain login data.
Technique: T1110 Brute Force, Tactic: TA0006 Credential Access
Dragonfly has attempted to brute force credentials to gain access.
Technique: T1110 Brute Force, Tactic: TA0006 Credential Access
FIN5 has has used the tool GET2 Penetrator to look for remote login and hard-coded credentials.
Technique: T1110 Brute Force, Tactic: TA0006 Credential Access
Fox Kitten has brute forced RDP credentials.
Technique: T1110 Brute Force, Tactic: TA0006 Credential Access
HEXANE has used brute force attacks to compromise valid credentials.
Technique: T1110 Brute Force, Tactic: TA0006 Credential Access
OilRig has used brute force techniques to obtain credentials.
Technique: T1110 Brute Force, Tactic: TA0006 Credential Access
Turla may attempt to connect to systems within a victim's network using `net use` commands and a predefined list or collection of passwords.
Technique: T1110 Brute Force, Tactic: TA0006 Credential Access
Caterpillar WebShell has a module to perform brute force attacks on a system.
Technique: T1110 Brute Force, Tactic: TA0006 Credential Access
Chaos conducts brute force attacks against SSH services to gain initial access.
Technique: T1110 Brute Force, Tactic: TA0006 Credential Access
CrackMapExec can brute force supplied user credentials across a network range.
Technique: T1110 Brute Force, Tactic: TA0006 Credential Access
Kinsing has attempted to brute force hosts over SSH.
Technique: T1110 Brute Force, Tactic: TA0006 Credential Access
PoshC2 has modules for brute forcing local administrator and AD user accounts.
Technique: T1110 Brute Force, Tactic: TA0006 Credential Access
Pysa has used brute force attempts against a central management console, as well as some Active Directory accounts.
Technique: T1110 Brute Force, Tactic: TA0006 Credential Access
QakBot can conduct brute force attacks to capture credentials.
Technique: T1110 Brute Force, Tactic: TA0006 Credential Access
APT28 has used a brute-force/password-spray tooling that operated in two modes: in brute-force mode it typically sent over 300 authentication attempts per hour per targeted account over the course of several hours or days. APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password guessing attacks.
Technique: T1110.001 Brute Force: Password Guessing, Tactic: TA0006 Credential Access
APT29 has successfully conducted password guessing attacks against a list of mailboxes.
Technique: T1110.001 Brute Force: Password Guessing, Tactic: TA0006 Credential Access
China Chopper's server component can perform brute force password guessing against authentication portals.
Technique: T1110.001 Brute Force: Password Guessing, Tactic: TA0006 Credential Access
CrackMapExec can brute force passwords for a specified user on a single target system or across an entire network.
Technique: T1110.001 Brute Force: Password Guessing, Tactic: TA0006 Credential Access
Emotet has been observed using a hard coded list of passwords to brute force user accounts.
Technique: T1110.001 Brute Force: Password Guessing, Tactic: TA0006 Credential Access
HermeticWizard can use a list of hardcoded credentials in attempt to authenticate to SMB shares.
Technique: T1110.001 Brute Force: Password Guessing, Tactic: TA0006 Credential Access
Lucifer has attempted to brute force TCP ports 135 (RPC) and 1433 (MSSQL) with the default username or list of usernames and    passwords.
Technique: T1110.001 Brute Force: Password Guessing, Tactic: TA0006 Credential Access
P.A.S. Webshell can use predefined users and passwords to execute brute force attacks against SSH, FTP, POP3, MySQL, MSSQL, and PostgreSQL services.
Technique: T1110.001 Brute Force: Password Guessing, Tactic: TA0006 Credential Access
Pony has used a small dictionary of common passwords against a collected list of local accounts.
Technique: T1110.001 Brute Force: Password Guessing, Tactic: TA0006 Credential Access
SpeakUp can perform brute forcing using a pre-defined list of usernames and passwords in an attempt to log in to administrative panels.
Technique: T1110.001 Brute Force: Password Guessing, Tactic: TA0006 Credential Access
Xbash can obtain a list of weak passwords from the C2 server to use for brute forcing as well as attempt to brute force services with open ports.
Technique: T1110.001 Brute Force: Password Guessing, Tactic: TA0006 Credential Access
During Night Dragon, threat actors used Cain & Abel to crack password hashes.
Technique: T1110.002 Brute Force: Password Cracking, Tactic: TA0006 Credential Access
APT3 has been known to brute force password hashes to be able to leverage plain text credentials.
Technique: T1110.002 Brute Force: Password Cracking, Tactic: TA0006 Credential Access
APT41 performed password brute-force attacks on the local admin account.
Technique: T1110.002 Brute Force: Password Cracking, Tactic: TA0006 Credential Access
Dragonfly has dropped and executed tools used for password cracking, including Hydra and CrackMapExec.
Technique: T1110.002 Brute Force: Password Cracking, Tactic: TA0006 Credential Access
FIN6 has extracted password hashes from ntds.dit to crack offline.
Technique: T1110.002 Brute Force: Password Cracking, Tactic: TA0006 Credential Access
Net Crawler uses a list of known credentials gathered through credential dumping to guess passwords to accounts as it spreads throughout a network.
Technique: T1110.002 Brute Force: Password Cracking, Tactic: TA0006 Credential Access
APT28 has used a brute-force/password-spray tooling that operated in two modes: in password-spraying mode it conducted approximately four authentication attempts per hour per targeted account over the course of several days or weeks. APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password spray attacks.
Technique: T1110.003 Brute Force: Password Spraying, Tactic: TA0006 Credential Access
APT29 has conducted brute force password spray attacks.
Technique: T1110.003 Brute Force: Password Spraying, Tactic: TA0006 Credential Access
APT33 has used password spraying to gain access to target systems.
Technique: T1110.003 Brute Force: Password Spraying, Tactic: TA0006 Credential Access
Chimera has used multiple password spraying attacks against victim's remote services to obtain valid user and administrator accounts.
Technique: T1110.003 Brute Force: Password Spraying, Tactic: TA0006 Credential Access
HEXANE has used password spraying attacks to obtain valid credentials.
Technique: T1110.003 Brute Force: Password Spraying, Tactic: TA0006 Credential Access
Lazarus Group malware attempts to connect to Windows shares for lateral movement by using a generated list of usernames, which center around permutations of the username Administrator, and weak passwords.
Technique: T1110.003 Brute Force: Password Spraying, Tactic: TA0006 Credential Access
Leafminer used a tool called Total SMB BruteForcer to perform internal password spraying.
Technique: T1110.003 Brute Force: Password Spraying, Tactic: TA0006 Credential Access
Silent Librarian has used collected lists of names and e-mail accounts to use in password spraying attacks against private sector targets.
Technique: T1110.003 Brute Force: Password Spraying, Tactic: TA0006 Credential Access
Bad Rabbit’s `infpub.dat` file uses NTLM login credentials to brute force Windows machines.
Technique: T1110.003 Brute Force: Password Spraying, Tactic: TA0006 Credential Access
CrackMapExec can brute force credential authentication by using a supplied list of usernames and a single password.
Technique: T1110.003 Brute Force: Password Spraying, Tactic: TA0006 Credential Access
Linux Rabbit brute forces SSH passwords in order to attempt to gain access and install its malware onto the server.
Technique: T1110.003 Brute Force: Password Spraying, Tactic: TA0006 Credential Access
MailSniper can be used for password spraying against Exchange and Office 365.
Technique: T1110.003 Brute Force: Password Spraying, Tactic: TA0006 Credential Access
Chimera has used credential stuffing against victim's remote services to obtain valid accounts.
Technique: T1110.004 Brute Force: Credential Stuffing, Tactic: TA0006 Credential Access
TrickBot uses brute-force attack against RDP with rdpscanDll module.
Technique: T1110.004 Brute Force: Credential Stuffing, Tactic: TA0006 Credential Access
During Operation Wocao, threat actors used a custom collection method to intercept two-factor authentication soft tokens.
Technique: T1111 Multi-Factor Authentication Interception, Tactic: TA0006 Credential Access
Chimera has registered alternate phone numbers for compromised users to intercept 2FA codes sent via SMS.
Technique: T1111 Multi-Factor Authentication Interception, Tactic: TA0006 Credential Access
Kimsuky has used a proprietary tool to intercept one time passwords required for two-factor authentication.
Technique: T1111 Multi-Factor Authentication Interception, Tactic: TA0006 Credential Access
LAPSUS$ has replayed stolen session token and passwords to trigger simple-approval MFA prompts in hope of the legitimate user will grant necessary approval.
Technique: T1111 Multi-Factor Authentication Interception, Tactic: TA0006 Credential Access
SLOWPULSE can log credentials on compromised Pulse Secure VPNs during the `DSAuth::AceAuthServer::checkUsernamePassword`ACE-2FA authentication procedure.
Technique: T1111 Multi-Factor Authentication Interception, Tactic: TA0006 Credential Access
Sykipot is known to contain functionality that enables targeting of smart card technologies to proxy authentication for connections to restricted network resources using detected hardware tokens.
Technique: T1111 Multi-Factor Authentication Interception, Tactic: TA0006 Credential Access
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching `rundll32.exe`, which in-turn launches the malware and communicates with C2 servers over the Internet. .
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and manipulate the Registry.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
During Operation Honeybee, the threat actors used batch files that modified registry keys.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
During Operation Wocao, the threat actors enabled Wdigest by changing the `HKLM\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\WDigest` registry value from 0 (disabled) to 1 (enabled).
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
APT19 uses a Port 22 malware variant to modify several Registry keys.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
APT32's backdoor has modified the Windows Registry to store the backdoor's configuration.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
APT38 uses a tool called CLEANTOAD that has the capability to modify Registry keys.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Blue Mockingbird has used Windows Registry modifications to specify a DLL payload.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Dragonfly has modified the Registry to perform multiple techniques through the use of Reg.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Earth Lusca modified the registry using the command `reg add “HKEY_CURRENT_USER\Environment” /v UserInitMprLogonScript /t REG_SZ /d “[file path]”` for persistence.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Ember Bear has used an open source batch script to modify Windows Defender registry keys.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
FIN8 has deleted Registry keys during post compromise cleanup activities.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Gamaredon Group has removed security settings for VBA macro execution by changing registry values `HKCU\Software\Microsoft\Office\&lt;version&gt;\&lt;product&gt;\Security\VBAWarnings` and `HKCU\Software\Microsoft\Office\&lt;version&gt;\&lt;product&gt;\Security\AccessVBOM`.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Gorgon Group malware can deactivate security mechanisms in Microsoft Office by editing several keys and values under `HKCU\Software\Microsoft\Office\`.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Kimsuky has modified Registry settings for default file associations to enable all macros and for persistence.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
LuminousMoth has used malware that adds Registry keys for persistence.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Magic Hound has modified Registry settings for security tools.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
A Patchwork payload deletes Resiliency Registry keys created by Microsoft Office applications in an apparent effort to trick users into thinking there were no issues during application runs.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Silence can create, delete, or modify a specified Registry key or value.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
TA505 has used malware to disable Windows Defender through modification of the Registry.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
A Threat Group-3390 tool has created new Registry keys under `HKEY_CURRENT_USER\Software\Classes\` and `HKLM\SYSTEM\CurrentControlSet\services`.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Turla has modify Registry values to store payloads.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Wizard Spider has modified the Registry key `HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest` by setting the `UseLogonCredential` registry value to `1` in order to force credentials to be stored in clear text in memory. Wizard Spider has also modified the WDigest registry key to allow plaintext credentials to be cached in memory.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
AADInternals can modify registry keys as part of setting a new pass-through authentication agent.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
ADVSTORESHELL is capable of setting and deleting Registry values.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Agent Tesla can achieve persistence by modifying Registry key entries.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Amadey has overwritten registry keys for persistence.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Attor's dispatcher can modify the Run registry key.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Avaddon modifies several registry keys for persistence and UAC bypass.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
BACKSPACE is capable of deleting Registry keys, sub-keys, and values on a victim system.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
BADCALL modifies the firewall Registry key `SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfileGloballyOpenPorts\\List`.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Bankshot writes data into the Registry key `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Pniumj`.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Bisonal has deleted Registry keys to clean up its prior activity.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
BitPaymer can set values in the Registry to help in execution.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Black Basta can modify the Registry to enable itself to run in safe mode and to modify the icons and file extensions for encrypted files.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
BlackCat has the ability to add the following registry key on compromised networks to maintain persistence: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services \LanmanServer\Paramenters`
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
CHOPSTICK may modify Registry keys to store RC4 encrypted configuration information.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
CSPY Downloader can write to the Registry under the `%windir%` variable to execute tasks.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Cardinal RAT sets `HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load` to point to its executable.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Catchamas creates three Registry keys to establish persistence by adding a Windows Service.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Caterpillar WebShell has a command to modify a Registry key.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Chaes can modify Registry values to stored information and establish persistence.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
CharmPower can remove persistence-related artifacts from the Registry.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Clambling can set and delete Registry keys.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Clop can make modifications to Registry keys.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Cobalt Strike can modify Registry values within `HKEY_CURRENT_USER\Software\Microsoft\Office\<Excel Version>\Excel\Security\AccessVBOM\` to enable the execution of additional code.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
ComRAT has modified Registry values to store encrypted orchestrator code and payloads.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Conficker adds keys to the Registry at `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services` and various other Registry locations.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
CrackMapExec can create a registry key using wdigest.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
Crimson can set a Registry key to determine how long it has been installed and possibly to indicate the version number.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
DCSrv has created Registry keys for persistence.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
DarkComet adds a Registry value for its installation routine to the Registry Key `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System Enable LUA=”0”` and `HKEY_CURRENT_USER\Software\DC3_FEXEC`.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion
DarkTortilla has modified registry keys for persistence.
Technique: T1112 Modify Registry, Tactic: TA0005 Defense Evasion