sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
During Operation CuckooBees, the threat actors used the `dsquery` and `dsget` commands to get domain environment information and to query users in administrative groups.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
During Operation Dream Job, Lazarus Group queried compromised victim's active directory servers to obtain the list of employees including administrator accounts.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
During Operation Wocao, threat actors used the `net` command to retrieve information about domain accounts.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
During the SolarWinds Compromise, APT29 used PowerShell to discover domain accounts by exectuing `Get-ADUser` and `Get-ADGroupMember`.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
APT41 used built-in `net` commands to enumerate domain administrator users.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
BRONZE BUTLER has used `net user /domain` to identify account information.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
Chimera has has used `net user /dom` and `net user Administrator` to enumerate domain accounts including administrator accounts.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
Dragonfly has used batch scripts to enumerate users on a victim domain controller.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
FIN13 can identify user accounts associated with a Service Principal Name and query Service Principal Names within the domain by utilizing the following scripts: `GetUserSPNs.vbs` and `querySpn.vbs`.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
Fox Kitten has used the Softerra LDAP browser to browse documentation on service accounts.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
Ke3chang performs account discovery using commands such as `net localgroup administrators` and `net group "REDACTED" /domain` on specific permissions groups.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
LAPSUS$ has used the AD Explorer tool to enumerate users on a victim's network.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
MuddyWater has used `cmd.exe net user /domain` to enumerate domain users.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
OilRig has run `net user`, `net user /domain`, `net group “domain admins” /domain`, and `net group “Exchange Trusted Subsystem” /domain` to get account listings on a victim.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
Poseidon Group searches for administrator accounts on both the local victim machine and the network.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about usernames listed in AD.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
Scattered Spider leverages legitimate domain accounts to gain access to the target environment.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
ToddyCat has run `net user %USER% /dom` for account discovery.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
Turla has used `net user /domain` to enumerate domain accounts.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
Volt Typhoon has run `net group /dom` and `net group "Domain Admins" /dom` in compromised environments for account discovery.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
Wizard Spider has identified domain admins through the use of `net group "Domain admins" /DOMAIN`. Wizard Spider has also leveraged the PowerShell cmdlet `Get-ADComputer` to collect account names from Active Directory data.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
menuPass has used the Microsoft administration tool csvde.exe to export Active Directory data.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
AdFind can enumerate domain users.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
Bankshot gathers domain and account names/information through process monitoring.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
Bazar has the ability to identify domain administrator accounts.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
BlackCat can utilize `net use` commands to identify domain users.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
BloodHound can collect information about domain users, including identification of domain admin accounts.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
BoomBox has the ability to execute an LDAP query to enumerate the distinguished name, SAM account name, and display name for all domain users.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
Brute Ratel C4 can use LDAP queries, `net group "Domain Admins" /domain` and `net user /domain` for discovery.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
Cobalt Strike can determine if the user on an infected machine is in the admin or domain admin group.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
CrackMapExec can enumerate the domain user accounts on a targeted system.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
Empire can acquire local and domain user account information.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
The IceApple Active Directory Querier module  can perform authenticated requests against an Active Directory server.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
IcedID can query LDAP to identify additional users on the network to infect.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
Net commands used with the `/domain` flag can be used to gather information about and manipulate user accounts on the current domain.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
OSInfo enumerates local and domain users
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
POWRUNER may collect user account information by running `net user /domain` or a series of other commands on a victim.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
PoshC2 can enumerate local and domain user account information.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
SILENTTRINITY can use `System.Security.AccessControl` namespaces to retrieve domain user information.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
SoreFang can enumerate domain accounts via `net.exe user /domain`.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
Stuxnet enumerates user accounts of the domain.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
Sykipot may use `net group "domain admins" /domain` to display accounts in the "domain admins" permissions group and `net localgroup "administrators"` to list local system administrator group membership.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
Valak has the ability to enumerate domain admin accounts.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
dsquery can be used to gather information on user accounts within a domain.
Technique: T1087.002 Account Discovery: Domain Account, Tactic: TA0007 Discovery
During C0027, Scattered Spider accessed Azure AD to identify email addresses.
Technique: T1087.003 Account Discovery: Email Account, Tactic: TA0007 Discovery
Magic Hound has used Powershell to discover email accounts.
Technique: T1087.003 Account Discovery: Email Account, Tactic: TA0007 Discovery
Sandworm Team used malware to enumerate email settings, including usernames and passwords, from the M.E.Doc application.
Technique: T1087.003 Account Discovery: Email Account, Tactic: TA0007 Discovery
TA505 has used the tool EmailStealer to steal and send lists of e-mail addresses to a remote server.
Technique: T1087.003 Account Discovery: Email Account, Tactic: TA0007 Discovery
Backdoor.Oldrea collects address book information from Outlook.
Technique: T1087.003 Account Discovery: Email Account, Tactic: TA0007 Discovery
BoomBox can execute an LDAP query to discover e-mail accounts for domain users.
Technique: T1087.003 Account Discovery: Email Account, Tactic: TA0007 Discovery
Emotet has been observed leveraging a module that can scrape email addresses from Outlook.
Technique: T1087.003 Account Discovery: Email Account, Tactic: TA0007 Discovery
Grandoreiro can parse Outlook .pst files to extract e-mail addresses.
Technique: T1087.003 Account Discovery: Email Account, Tactic: TA0007 Discovery
Lizar can collect email accounts from Microsoft Outlook and Mozilla Thunderbird.
Technique: T1087.003 Account Discovery: Email Account, Tactic: TA0007 Discovery
MailSniper can be used to obtain account names from Exchange and Office 365 using the `Get-GlobalAddressList` cmdlet.
Technique: T1087.003 Account Discovery: Email Account, Tactic: TA0007 Discovery
Ruler can be used to enumerate Exchange users and dump the GAL.
Technique: T1087.003 Account Discovery: Email Account, Tactic: TA0007 Discovery
TrickBot collects email addresses from Outlook.
Technique: T1087.003 Account Discovery: Email Account, Tactic: TA0007 Discovery
During C0027, Scattered Spider accessed Azure AD to download bulk lists of group members and to identify privileged users, along with the email addresses and AD attributes.
Technique: T1087.004 Account Discovery: Cloud Account, Tactic: TA0007 Discovery
APT29 has conducted enumeration of Azure AD accounts.
Technique: T1087.004 Account Discovery: Cloud Account, Tactic: TA0007 Discovery
AADInternals can enumerate Azure AD users.
Technique: T1087.004 Account Discovery: Cloud Account, Tactic: TA0007 Discovery
Pacu can enumerate IAM users, roles, and groups.
Technique: T1087.004 Account Discovery: Cloud Account, Tactic: TA0007 Discovery
ROADTools can enumerate Azure AD users.
Technique: T1087.004 Account Discovery: Cloud Account, Tactic: TA0007 Discovery
During C0017, APT41 used the Cloudflare CDN to proxy C2 traffic.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
During C0027, Scattered Spider installed the open-source rsocx reverse proxy tool on a targeted ESXi appliance.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
For Operation Sharpshooter, the threat actors used the ExpressVPN service to hide their location.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
During Operation Wocao, threat actors used a custom proxy tool called "Agent" which has support for multiple hops.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
APT41 used a tool called CLASSFON to covertly proxy network communications.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
Blue Mockingbird has used frp, ssf, and Venom to establish SOCKS proxy connections.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
Cinnamon Tempest has used a customized version of the Iox port-forwarding and proxy tool.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
CopyKittens has used the AirVPN service for operational activity.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
Earth Lusca adopted Cloudflare as a proxy for compromised servers.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
Fox Kitten has used the open source reverse proxy tools including FRPC and Go Proxy to establish connections from C2 to local servers.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
LAPSUS$ has leverage NordVPN for its egress points when targeting intended victims.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
Magic Hound has used Fast Reverse Proxy (FRP) for RDP traffic.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
MoustachedBouncer has used a reverse proxy tool similar to the GitHub repository revsocks.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
POLONIUM has used the AirVPN service for operational activity.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
Sandworm Team's BCS-server tool can create an internal proxy server to redirect traffic from the adversary-controlled C2 to internal servers which may not be connected to the internet, but are interconnected locally.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
Turla RPC backdoors have included local UPnP RPC proxies.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
Volt Typhoon has used compromised devices and customized versions of open source tools  such as Fast Reverse Proxy (FRP), Earthworm, and Impacket to proxy network traffic.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
Windigo has delivered a generic Windows proxy Win32/Glubteta.M. Windigo has also used multiple reverse proxy chains as part of their C2 infrastructure.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
Aria-body has the ability to use a reverse SOCKS proxy module.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
AuditCred can utilize proxy for communications.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
BADCALL functions as a proxy server between the victim and C2 server.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
BADHATCH can use SOCKS4 and SOCKS5 proxies to connect to actor-controlled C2 servers. BADHATCH can also emulate a reverse proxy on a compromised machine to connect with actor-controlled C2 servers.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
Bisonal has supported use of a proxy server.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
Cardinal RAT can act as a reverse proxy.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
Dridex contains a backconnect module for tunneling network traffic through a victim's computer. Infected computers become part of a P2P botnet that can relay C2 traffic to other infected peers.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
FunnyDream can identify and use configured proxies in a compromised network for C2 communication.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
Green Lambert can use proxies for C2 traffic.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
HARDRAIN uses the command `cmd.exe /c netsh firewall add portopening TCP 443 "adp"` and makes the victim machine function as a proxy server.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
HOPLIGHT has multiple proxy options that mask traffic between the malware and the remote operators.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
HTRAN can proxy TCP socket connections to obfuscate command and control infrastructure.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
KEYPLUG has used Cloudflare CDN associated infrastructure to redirect C2 communications to malicious domains.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
KOCTOPUS has deployed a modified version of Invoke-Ngrok to expose open local ports to the Internet.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
Kessel can use a proxy during exfiltration if set in the configuration.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
LITTLELAMB.WOOLTEA has the ability to function as a SOCKS proxy.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
NETWIRE can implement use of proxies to pivot traffic.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
PLEAD has the ability to proxy network communications.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
PoshC2 contains modules that allow for use of proxies in command and control.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
QuasarRAT can communicate over a reverse proxy using SOCKS5.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
RainyDay can use proxy tools including boost_proxy_client for reverse proxy functionality.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
Remcos uses the infected hosts as SOCKS5 proxies to allow for tunneling and proxying.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
SDBbot has the ability to use port forwarding to establish a proxy between a target host and C2.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
Samurai has the ability to proxy connections to specified remote IPs and ports through a a proxy module.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
Socksbot can start SOCKS proxy threads.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
SombRAT has the ability to use an embedded SOCKS proxy in C2 communications.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
TSCookie has the ability to proxy communications with command and control (C2) servers.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
A TYPEFRAME variant can force the compromised system to function as a proxy server.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
Ursnif has used a peer-to-peer (P2P) network for C2.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
Vasport is capable of tunneling though a proxy.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
WarzoneRAT has the capability to act as a reverse proxy.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
XTunnel relays traffic between a C2 server and a victim.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
ZIPLINE can create a proxy server on compromised hosts.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
ZxShell can set up an HTTP or SOCKS proxy.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
jRAT can serve as a SOCKS proxy server.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
netsh can be used to set up a proxy tunnel to allow remote host access to an infected host.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
ngrok can be used to proxy connections to machines located behind NAT or firewalls.
Technique: T1090 Proxy, Tactic: TA0011 Command and Control
During Operation Wocao, threat actors proxied traffic through multiple infected systems.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
During the SolarWinds Compromise, APT29 used SSH port forwarding capabilities on public-facing systems, and configured at least one instance of Cobalt Strike to use a network pipe over SMB.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
APT39 used custom tools to create SOCK5 and custom protocol proxies between infected hosts.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
FIN13 has utilized a proxy tool to communicate between compromised assets.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
Higaisa discovered system proxy settings and used them if available.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
Lazarus Group has used a compromised router to serve as a proxy between a victim network's corporate and restricted segments.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
Strider has used local servers with both local network and Internet access to act as internal proxy nodes to exfiltrate data from other parts of the network without direct Internet access.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
Turla has compromised internal network systems to act as a proxy to forward traffic to C2.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
Volt Typhoon has used the built-in netsh `port proxy` command to create proxies on compromised systems to facilitate access.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
The "ZJ" variant of BACKSPACE allows "ZJ link" infections with Internet access to relay traffic from "ZJ listen" to a command server.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
CHOPSTICK used a proxy server between victims and the C2 server.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
Cobalt Strike can be configured to have commands relayed over a peer-to-peer network of infected hosts. This can be used to limit the number of egress points, or provide access to a host without direct internet access.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
Drovorub can use a port forwarding rule on its agent module to relay network traffic through the client module to a remote host on the same network.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
Duqu can be configured to have commands relayed over a peer-to-peer network of infected hosts if some of the hosts do not have Internet access.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
FatDuke can used pipes to connect machines with restricted internet access to remote machines via other infected hosts.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
Hikit supports peer connections.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
InvisiMole can function as a proxy to create a server that relays communication between the client and C&C server, or between two clients.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
Kazuar has used internal nodes on the compromised network for C2 communications.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
Mafalda can create a named pipe to listen for and send data to a named pipe-based C2 server.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
MiniDuke can can use a named pipe to forward communications from one compromised machine with internet access to other compromised machines.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
Mythic can leverage a peer-to-peer C2 profile between agents.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
Ninja can proxy C2 communications including to and from internal agents without internet connectivity.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
Pay2Key has designated machines in the compromised network to serve as reverse proxy pivot points to channel communications with C2.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
Stuxnet installs an RPC server for P2P communications.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
The Winnti for Windows HTTP/S C2 mode can make use of a local proxy.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
metaMain can create a named pipe to listen for and send data to a named pipe-based C2 server.
Technique: T1090.001 Proxy: Internal Proxy, Tactic: TA0011 Command and Control
APT28 used other victims as proxies to relay command traffic, for instance using a compromised Georgian military email server as a hop point to NATO victims. The group has also used a tool that acts as a proxy to allow C2 even if the victim is behind a router. APT28 has also used a machine to relay and obscure communications between CHOPSTICK and their server.
Technique: T1090.002 Proxy: External Proxy, Tactic: TA0011 Command and Control
APT29 uses compromised residential endpoints as proxies for defense evasion and network access.
Technique: T1090.002 Proxy: External Proxy, Tactic: TA0011 Command and Control
An APT3 downloader establishes SOCKS5 connections for its initial C2.
Technique: T1090.002 Proxy: External Proxy, Tactic: TA0011 Command and Control
APT39 has used various tools to proxy C2 communications.
Technique: T1090.002 Proxy: External Proxy, Tactic: TA0011 Command and Control
FIN5 maintains access to victim environments by using FLIPSIDE to create a proxy for a backup RDP tunnel.
Technique: T1090.002 Proxy: External Proxy, Tactic: TA0011 Command and Control
GALLIUM used a modified version of HTRAN to redirect connections between networks.
Technique: T1090.002 Proxy: External Proxy, Tactic: TA0011 Command and Control
Lazarus Group has used multiple proxies to obfuscate network traffic from victims.
Technique: T1090.002 Proxy: External Proxy, Tactic: TA0011 Command and Control
MuddyWater has controlled POWERSTATS from behind a proxy network to obfuscate the C2 location. MuddyWater has used a series of compromised websites that victims connected to randomly to relay information to command and control (C2).
Technique: T1090.002 Proxy: External Proxy, Tactic: TA0011 Command and Control
Silence has used ProxyBot, which allows the attacker to redirect traffic from the current node to the backconnect server via Sock4\Socks5.
Technique: T1090.002 Proxy: External Proxy, Tactic: TA0011 Command and Control
Tonto Team has routed their traffic through an external server in order to obfuscate their location.
Technique: T1090.002 Proxy: External Proxy, Tactic: TA0011 Command and Control
menuPass has used a global service provider's IP as a proxy for C2 traffic from a victim.
Technique: T1090.002 Proxy: External Proxy, Tactic: TA0011 Command and Control
InvisiMole InvisiMole can identify proxy servers used by the victim and use them for C2 communication.
Technique: T1090.002 Proxy: External Proxy, Tactic: TA0011 Command and Control
Mythic can leverage a modified SOCKS5 proxy to tunnel egress C2 traffic.
Technique: T1090.002 Proxy: External Proxy, Tactic: TA0011 Command and Control
Okrum can identify proxy servers configured and used by the victim, and use it to make HTTP requests to C2 its server.
Technique: T1090.002 Proxy: External Proxy, Tactic: TA0011 Command and Control
POWERSTATS has connected to C2 servers through proxies.
Technique: T1090.002 Proxy: External Proxy, Tactic: TA0011 Command and Control
QUIETEXIT can proxy traffic via SOCKS.
Technique: T1090.002 Proxy: External Proxy, Tactic: TA0011 Command and Control
QakBot has a module that can proxy C2 communications.
Technique: T1090.002 Proxy: External Proxy, Tactic: TA0011 Command and Control
Regin leveraged several compromised universities as proxies to obscure its origin.
Technique: T1090.002 Proxy: External Proxy, Tactic: TA0011 Command and Control
ShimRat can use pre-configured HTTP proxies.
Technique: T1090.002 Proxy: External Proxy, Tactic: TA0011 Command and Control
TrickBot has been known to reach a command and control server via one of nine proxy IP addresses.
Technique: T1090.002 Proxy: External Proxy, Tactic: TA0011 Command and Control
The Winnti for Windows HTTP/S C2 mode can make use of an external proxy.
Technique: T1090.002 Proxy: External Proxy, Tactic: TA0011 Command and Control
During CostaRicto, the threat actors used a layer of proxies to manage C2 communications.
Technique: T1090.003 Proxy: Multi-hop Proxy, Tactic: TA0011 Command and Control
During Operation Wocao, threat actors executed commands through the installed web shell via Tor exit nodes.
Technique: T1090.003 Proxy: Multi-hop Proxy, Tactic: TA0011 Command and Control
APT28 has routed traffic over Tor and VPN servers to obfuscate their activities.
Technique: T1090.003 Proxy: Multi-hop Proxy, Tactic: TA0011 Command and Control
A backdoor used by APT29 created a Tor hidden service to forward traffic from the Tor client to local ports 3389 (RDP), 139 (Netbios), and 445 (SMB) enabling full remote access from outside the network and has also used TOR.
Technique: T1090.003 Proxy: Multi-hop Proxy, Tactic: TA0011 Command and Control
FIN4 has used Tor to log in to victims' email accounts.
Technique: T1090.003 Proxy: Multi-hop Proxy, Tactic: TA0011 Command and Control
Inception used chains of compromised routers to proxy C2 communications between them and cloud service providers.
Technique: T1090.003 Proxy: Multi-hop Proxy, Tactic: TA0011 Command and Control
Leviathan has used multi-hop proxies to disguise the source of their malicious traffic.
Technique: T1090.003 Proxy: Multi-hop Proxy, Tactic: TA0011 Command and Control
Attor has used Tor for C2 communication.
Technique: T1090.003 Proxy: Multi-hop Proxy, Tactic: TA0011 Command and Control
Cyclops Blink has used Tor nodes for C2 traffic.
Technique: T1090.003 Proxy: Multi-hop Proxy, Tactic: TA0011 Command and Control
Dok downloads and installs Tor via homebrew.
Technique: T1090.003 Proxy: Multi-hop Proxy, Tactic: TA0011 Command and Control
Dridex can use multiple layers of proxy servers to hide terminal nodes in its infrastructure.
Technique: T1090.003 Proxy: Multi-hop Proxy, Tactic: TA0011 Command and Control
GreyEnergy has used Tor relays for Command and Control servers.
Technique: T1090.003 Proxy: Multi-hop Proxy, Tactic: TA0011 Command and Control
Industroyer used Tor nodes for C2.
Technique: T1090.003 Proxy: Multi-hop Proxy, Tactic: TA0011 Command and Control
Keydnap uses a copy of tor2web proxy for HTTPS communications.
Technique: T1090.003 Proxy: Multi-hop Proxy, Tactic: TA0011 Command and Control
Kobalos can chain together multiple compromised machines as proxies to reach their final targets.
Technique: T1090.003 Proxy: Multi-hop Proxy, Tactic: TA0011 Command and Control
MacSpy uses Tor for command and control.
Technique: T1090.003 Proxy: Multi-hop Proxy, Tactic: TA0011 Command and Control
NGLite has abused NKN infrastructure for its C2 communication.
Technique: T1090.003 Proxy: Multi-hop Proxy, Tactic: TA0011 Command and Control
NKAbuse has abused the NKN public blockchain protocol for its C2 communications.
Technique: T1090.003 Proxy: Multi-hop Proxy, Tactic: TA0011 Command and Control
Ninja has the ability to use a proxy chain with up to 255 hops when using TCP.
Technique: T1090.003 Proxy: Multi-hop Proxy, Tactic: TA0011 Command and Control
Siloscape uses Tor to communicate with C2.
Technique: T1090.003 Proxy: Multi-hop Proxy, Tactic: TA0011 Command and Control
StrongPity can use multiple layers of proxy servers to hide terminal nodes in its infrastructure.
Technique: T1090.003 Proxy: Multi-hop Proxy, Tactic: TA0011 Command and Control
Traffic traversing the Tor network will be forwarded to multiple nodes before exiting the Tor network and continuing on to its intended destination.
Technique: T1090.003 Proxy: Multi-hop Proxy, Tactic: TA0011 Command and Control
Uroburos can use implants on multiple compromised machines to proxy communications through its worldwide P2P network.
Technique: T1090.003 Proxy: Multi-hop Proxy, Tactic: TA0011 Command and Control
Ursnif has used Tor for C2.
Technique: T1090.003 Proxy: Multi-hop Proxy, Tactic: TA0011 Command and Control
WannaCry uses Tor for command and control traffic.
Technique: T1090.003 Proxy: Multi-hop Proxy, Tactic: TA0011 Command and Control
APT29 has used the meek domain fronting plugin for Tor to hide the destination of C2 traffic.
Technique: T1090.004 Proxy: Domain Fronting, Tactic: TA0011 Command and Control
Cobalt Strike has the ability to accept a value for HTTP Host Header to enable domain fronting.
Technique: T1090.004 Proxy: Domain Fronting, Tactic: TA0011 Command and Control
Mythic supports domain fronting via custom request headers.
Technique: T1090.004 Proxy: Domain Fronting, Tactic: TA0011 Command and Control
SMOKEDHAM has used a fronted domain to obfuscate its hard-coded C2 server domain.
Technique: T1090.004 Proxy: Domain Fronting, Tactic: TA0011 Command and Control
meek uses Domain Fronting to disguise the destination of network traffic as another server that is hosted in the same Content Delivery Network (CDN) as the intended destination.
Technique: T1090.004 Proxy: Domain Fronting, Tactic: TA0011 Command and Control
APT28 uses a tool to infect connected USB devices and transmit itself to air-gapped computers when the infected USB device is inserted.
Technique: T1091 Replication Through Removable Media, Tactic: TA0001 Initial Access TA0008 Lateral Movement
Aoqin Dragon has used a dropper that employs a worm infection strategy using a removable device to breach a secure network environment.
Technique: T1091 Replication Through Removable Media, Tactic: TA0001 Initial Access TA0008 Lateral Movement
Darkhotel's selective infector modifies executables stored on removable media as a method of spreading across computers.
Technique: T1091 Replication Through Removable Media, Tactic: TA0001 Initial Access TA0008 Lateral Movement
FIN7 actors have mailed USB drives to potential victims containing malware that downloads and installs various backdoors, including in some cases for ransomware operations.
Technique: T1091 Replication Through Removable Media, Tactic: TA0001 Initial Access TA0008 Lateral Movement
LuminousMoth has used malicious DLLs to spread malware to connected removable USB drives on infected machines.
Technique: T1091 Replication Through Removable Media, Tactic: TA0001 Initial Access TA0008 Lateral Movement
Mustang Panda has used a customized PlugX variant which could spread through USB connections.
Technique: T1091 Replication Through Removable Media, Tactic: TA0001 Initial Access TA0008 Lateral Movement
Tropic Trooper has attempted to transfer USBferry from an infected USB device by copying an Autorun function to the target machine.
Technique: T1091 Replication Through Removable Media, Tactic: TA0001 Initial Access TA0008 Lateral Movement
ANDROMEDA has been spread via infected USB keys.
Technique: T1091 Replication Through Removable Media, Tactic: TA0001 Initial Access TA0008 Lateral Movement
Agent.btz drops itself onto removable media devices and creates an autorun.inf file with an instruction to run that file. When the device is inserted into another system, it opens autorun.inf and loads the malware.
Technique: T1091 Replication Through Removable Media, Tactic: TA0001 Initial Access TA0008 Lateral Movement
Part of APT28's operation involved using CHOPSTICK modules to copy itself to air-gapped machines and using files written to USB sticks to transfer data and command traffic.
Technique: T1091 Replication Through Removable Media, Tactic: TA0001 Initial Access TA0008 Lateral Movement
Conficker variants used the Windows AUTORUN feature to spread through USB propagation.
Technique: T1091 Replication Through Removable Media, Tactic: TA0001 Initial Access TA0008 Lateral Movement
Crimson can spread across systems by infecting removable media.
Technique: T1091 Replication Through Removable Media, Tactic: TA0001 Initial Access TA0008 Lateral Movement
DustySky searches for removable media and duplicates itself onto it.
Technique: T1091 Replication Through Removable Media, Tactic: TA0001 Initial Access TA0008 Lateral Movement
Flame contains modules to infect USB sticks and spread laterally to other Windows systems the stick is plugged into using Autorun functionality.
Technique: T1091 Replication Through Removable Media, Tactic: TA0001 Initial Access TA0008 Lateral Movement
H1N1 has functionality to copy itself to removable media.
Technique: T1091 Replication Through Removable Media, Tactic: TA0001 Initial Access TA0008 Lateral Movement
QakBot has the ability to use removable drives to spread through compromised networks.
Technique: T1091 Replication Through Removable Media, Tactic: TA0001 Initial Access TA0008 Lateral Movement
Ramsay can spread itself by infecting other portable executable files on removable drives.
Technique: T1091 Replication Through Removable Media, Tactic: TA0001 Initial Access TA0008 Lateral Movement
APT30 may have used the SHIPSHAPE malware to move onto air-gapped networks. SHIPSHAPE targets removable drives to spread to other systems by modifying the drive to use Autorun to execute or by hiding legitimate document files and copying an executable to the folder with the same name as the legitimate document.
Technique: T1091 Replication Through Removable Media, Tactic: TA0001 Initial Access TA0008 Lateral Movement
Stuxnet can propagate via removable media using an autorun.inf file or the CVE-2010-2568 LNK vulnerability.
Technique: T1091 Replication Through Removable Media, Tactic: TA0001 Initial Access TA0008 Lateral Movement
USBStealer drops itself onto removable media and relies on Autorun to execute the malicious file when a user opens the removable media on another system.
Technique: T1091 Replication Through Removable Media, Tactic: TA0001 Initial Access TA0008 Lateral Movement
USBferry can copy its installer to attached USB storage devices.
Technique: T1091 Replication Through Removable Media, Tactic: TA0001 Initial Access TA0008 Lateral Movement
Unknown Logger is capable of spreading to USB devices.
Technique: T1091 Replication Through Removable Media, Tactic: TA0001 Initial Access TA0008 Lateral Movement
Ursnif has copied itself to and infected removable drives for propagation.
Technique: T1091 Replication Through Removable Media, Tactic: TA0001 Initial Access TA0008 Lateral Movement
njRAT can be configured to spread via removable drives.
Technique: T1091 Replication Through Removable Media, Tactic: TA0001 Initial Access TA0008 Lateral Movement
APT28 uses a tool that captures information from air-gapped computers via an infected USB and transfers it to network-connected computer when the USB is inserted.
Technique: T1092 Communication Through Removable Media, Tactic: TA0011 Command and Control
Part of APT28's operation involved using CHOPSTICK modules to copy itself to air-gapped machines, using files written to USB sticks to transfer data and command traffic.
Technique: T1092 Communication Through Removable Media, Tactic: TA0011 Command and Control
USBStealer drops commands for a second victim onto a removable media drive inserted into the first victim, and commands are executed when the drive is inserted into the second victim.
Technique: T1092 Communication Through Removable Media, Tactic: TA0011 Command and Control
During the 2022 Ukraine Electric Power Attack, Sandworm Team proxied C2 communications within a TLS-based tunnel.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
During C0021, the threat actors used TCP for some C2 communications.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
During Cutting Edge, threat actors used the Unix socket and a reverse TCP shell for C2 communications.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
During Operation Wocao, threat actors used a custom protocol for command and control.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
An APT3 downloader establishes SOCKS5 connections for its initial C2.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
BITTER has used TCP for C2 communications.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
BackdoorDiplomacy has used EarthWorm for network tunneling with a SOCKS5 server and port transfer functionalities.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
FIN6 has used Metasploit Bind and Reverse TCP stagers.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
HAFNIUM has used TCP for C2.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Metador has used TCP for C2.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
PLATINUM has used the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel for command and control.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
ToddyCat has used a passive backdoor that receives commands with UDP packets.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Anchor has used ICMP in C2 communications.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Aria-body has used TCP in C2 communications.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
AuTo Stealer can use TCP to communicate with command and control servers.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
BUBBLEWRAP can communicate using SOCKS.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Bandook has a command built in to use a raw TCP socket.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Bisonal has used raw sockets for network communication.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Brute Ratel C4 has the ability to use TCP for external C2.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
COATHANGER uses ICMP for transmitting configuration information to and from its command and control server.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Carbon uses TCP and UDP for C2.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Clambling has the ability to use TCP and UDP for communication.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Cobalt Strike can be configured to use TCP, ICMP, and UDP for C2 communications.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Crimson uses a custom TCP protocol for C2.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Cryptoistic can use TCP in communications with C2.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Derusbi binds to a raw socket on a random source port between 31800 and 31900 for C2.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Drovorub can use TCP to communicate between its agent and client modules.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Some variants of FakeM use SSL to communicate with C2 servers.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
FunnyDream can communicate with C2 over TCP and UDP.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Gelsemium has the ability to use TCP and UDP in C2 communications.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
HiddenWasp communicates with a simple network protocol over TCP.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
InvisiMole has used TCP to download additional modules.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
KEYPLUG can use TCP and KCP (KERN Communications Protocol) over UDP for C2 communication.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
LITTLELAMB.WOOLTEA can function as a stand-alone backdoor communicating over the `/tmp/clientsDownload.sock` socket.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
LookBack uses a custom binary protocol over sockets for C2 communications.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
MacMa has used a custom JSON-based protocol for its C&C communications.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Mafalda can use raw TCP for C2.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Metamorfo has used raw TCP for C2.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Mis-Type network traffic can communicate over a raw socket.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Misdat network traffic communicates over a raw socket.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
MoonWind completes network communication via raw sockets.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Mythic supports WebSocket and TCP-based C2 profiles.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
If NETEAGLE does not detect a proxy configured on the infected machine, it will send beacons via UDP/6000. Also, after retrieving a C2 IP address and Port Number, NETEAGLE will initiate a TCP connection to this socket. The ensuing connection is a plaintext C2 channel in which commands are specified by DWORDs.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
NETWIRE can use TCP in C2 communications.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Nebulae can use TCP in C2 communications.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Ninja can forward TCP packets between the C2 and a remote host.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
OSX_OCEANLOTUS.D has used a custom binary protocol over port 443 for C2 traffic.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
PHOREAL communicates via ICMP for C2.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Pay2Key has sent its public key to the C2 server over TCP.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
The Penquin C2 mechanism is based on TCP and UDP packets.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
PingPull variants have the ability to communicate with C2 servers using ICMP or TCP.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
The PipeMon communication module can use a custom protocol based on TLS over TCP.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
PlugX can be configured to use raw TCP or UDP for command and control.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
QUIETEXIT can establish a TCP connection as part of its initial connection to the C2.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
QakBot has the ability use TCP to send or receive C2 packets.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
QuasarRAT can use TCP for C2 communication.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
RARSTONE uses SSL to encrypt its communication with its C2 server.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
RCSession has the ability to use TCP and UDP in C2 communications.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
RainyDay can use TCP in C2 communications.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Some Reaver variants use raw TCP for C2.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
The Regin malware platform can use ICMP to communicate between infected computers.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Remsec is capable of using ICMP, TCP, and UDP for C2.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
RotaJakiro uses a custom binary protocol using a type, length, value format over TCP.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Royal establishes a TCP socket for C2 communication using the API `WSASocketW`.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
SDBbot has the ability to communicate with C2 with TCP over port 443.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
SUGARUSH has used TCP for C2.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Samurai can use a proxy module to forward TCP packets to external hosts.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control