sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
Mofang has compressed the ShimRat executable within malicious email attachments. Mofang has also encrypted payloads before they are downloaded to victims.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Molerats has delivered compressed executables within ZIP files to victims.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Moses Staff has used obfuscated web shells in their operations.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
OilRig has encrypted and encoded data in its malware, including by using base64.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Droppers used by Putter Panda use RC4 or a 16-byte XOR key consisting of the bytes 0xA0 – 0xAF to obfuscate payloads.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Sidewinder has used base64 encoding and ECDH-P256 encryption for payloads.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
TA2541 has used compressed and char-encoded scripts in operations.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
TA505 has password-protected malicious Word documents.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
TeamTNT has encrypted its binaries via AES and encoded files using Base64.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
A Threat Group-3390 tool can encrypt payloads using XOR. Threat Group-3390 malware is also obfuscated using Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Transparent Tribe has dropped encoded executables on compromised hosts.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Tropic Trooper has encrypted configuration files.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Whitefly has encrypted the payload used for C2.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
menuPass has encoded strings in its malware with base64 as well as with a simple, single-byte XOR obfuscation using key 0x40.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Aria-body has used an encrypted configuration file for its loader.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Astaroth has used an XOR-based algorithm to encrypt payloads twice with different keys.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Strings in Attor's components are encrypted with a XOR cipher, using a hardcoded key and the configuration data, log files and plugins are encrypted using a hybrid encryption scheme of Blowfish-OFB combined with RSA.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
AuditCred encrypts the configuration.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Avenger has the ability to XOR encrypt files to be sent to C2.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
BADHATCH can be compressed with the ApLib algorithm.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
BLINDINGCAN has obfuscated code using Base64 encoding.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
BLUELIGHT has a XOR-encoded payload.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
BOOSTWRITE has encoded its payloads using a ChaCha stream cipher with a 256-bit key and 64-bit Initialization vector (IV) to evade detection.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Bazar has used XOR, RSA2, and RC4 encrypted files.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
BendyBear has encrypted payloads using RC4 and XOR.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Bisonal's DLL file and non-malicious decoy file are encrypted with RC4 and some function name strings are obfuscated.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
BitPaymer has used RC4-encrypted strings and string hashes to avoid identifiable strings within the binary.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
CARROTBAT has the ability to download a base64 encoded payload.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Carberp has used XOR-based encryption to mask C2 server locations within the trojan.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Cardinal RAT encodes many of its artifacts and is encrypted (AES-128) when downloaded.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Chinoxy has encrypted its configuration file.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Chrommme can encrypt sections of its code to evade detection.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
The payload of CozyCar is encrypted with simple XOR with a rotating key. The CozyCar configuration file has been encrypted with RC4 keys.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
DCSrv's configuration is encrypted.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
DEADEYE has encrypted its payload.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
DOGCALL is encrypted using single-byte XOR.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Dacls can encrypt its configuration file with AES CBC.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
DanBot can Base64 encode its payload.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
DarkGate drops an encrypted PE file, pe.bin, and decrypts it during installation. DarkGate also uses custom base64 encoding schemas in later variations to obfuscate payloads.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
DarkWatchman has been delivered as compressed RAR payloads in ZIP files to victims.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Elise encrypts several of its files, including configuration files.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Variants of Emissary encrypt payloads using various XOR ciphers, as well as a custom algorithm that uses the "srand" and "rand" functions.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
EnvyScout can Base64 encode payloads.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Exaramel for Linux uses RC4 for encrypting the configuration.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
FELIXROOT encrypts strings in the backdoor using a custom XOR algorithm.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
The FIVEHANDS payload is encrypted with AES-128.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
FlawedGrace encrypts its C2 configuration files with AES in CBC mode.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
FoggyWeb has been XOR-encoded.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
FunnyDream can Base64 encode its C2 address stored in a template binary with the `xyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw_-` or
`xyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw_=` character sets.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Fysbis has been encrypted using XOR and RC4.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Gazer logs its actions into files that are encrypted with 3DES. It also uses RSA to encrypt resources.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Gelsemium has the ability to compress its components.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
GoldMax has written AES-encrypted and Base64-encoded configuration files to disk.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
GoldenSpy's uninstaller has base64-encoded its variables.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
The Grandoreiro payload has been delivered encrypted with a custom XOR-based algorithm and also as a base64-encoded ZIP file.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
GravityRAT supports file encryption (AES with the key "lolomycin2017").
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
GreyEnergy encrypts its configuration files with AES-256 and also encrypts its strings.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
HAWKBALL has encrypted the payload with an XOR-based algorithm.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Some strings in HOMEFRY are obfuscated with XOR x56.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
The Helminth config file is encrypted with RC4.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
HermeticWiper can compress 32-bit and 64-bit driver files with the Lempel-Ziv algorithm.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
HermeticWizard has the ability to encrypt PE files with a reverse XOR loop.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Heyoka Backdoor can encrypt its payload.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Hi-Zor uses various XOR techniques to obfuscate its components.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
HiddenWasp encrypts its configuration and payload.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Hildegard has encrypted an ELF file.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
HotCroissant has encrypted strings with single-byte XOR and base64 encoded RC4.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
HyperBro can be delivered encrypted to a compromised host.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
IcedID has utilzed encrypted binaries and base64 encoded strings.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
IronNetInjector can obfuscate variable names, encrypt strings, as well as base64 encode and Rijndael encrypt payloads.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Many strings in JHUHUGIT are obfuscated with a XOR algorithm.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
KEYPLUG can use a hardcoded one-byte XOR encoded configuration file.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
KGH_SPY has used encrypted strings in its installer.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
KONNI is heavily obfuscated and includes encrypted configuration files.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Kessel's configuration is hardcoded and RC4 encrypted within the binary.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Kevin has Base64-encoded its configuration file.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
In one version of KeyBoy, string obfuscation routines were used to hide many of the critical values referenced in the malware.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Kwampirs downloads additional files that are base64-encoded and encrypted with another cipher.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
LightNeuron encrypts its configuration files with AES-256.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
LoudMiner has encrypted DMG files.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Mafalda has been obfuscated and contains encrypted functions.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Metamorfo has encrypted payloads and strings.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Micropsia obfuscates the configuration with a custom Base64 and XOR.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Milan can encode files containing information about the targeted system.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Mispadu uses a custom algorithm to obfuscate its internal strings and uses hardcoded keys.

Mispadu also uses encoded configuration files and has encoded payloads using Base64.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
More_eggs's payload has been encrypted with a key that has the hostname and processor family information appended to the end.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Mosquito’s installer is obfuscated with a custom crypter to obfuscate the installer.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
NanHaiShu encodes files in Base64.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
The Ninja payload is XOR encrypted and compressed. Ninja has also XORed its configuration data with a constant value of `0xAA` and compressed it with the LZSS algorithm.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
OSX_OCEANLOTUS.D encrypts its strings in RSA256 and encodes them in a custom base64 scheme and XOR.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
PS1 is distributed as a set of encrypted files and scripts.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
PcShare has been encrypted with XOR using different 32-long Base16 strings and compressed with LZW algorithm.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Penquin has encrypted strings in the binary for obfuscation.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
PipeMon modules are stored encrypted on disk.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Some resources in Prikormka are encrypted with a simple XOR operation or encoded with Base64.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
PyDCrypt has been compiled and encrypted with PyInstaller, specifically using the --key flag during the build phase.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
RAPIDPULSE has the ability to RC4 encrypt and base64 encode decrypted files on compromised servers prior to writing them to stdout.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
RCSession can compress and obfuscate its strings to evade detection on a compromised host.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
REvil has used encrypted strings and configuration files.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Raindrop encrypted its payload using a simple XOR algorithm with a single-byte key.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
RainyDay has downloaded as a XOR-encrypted payload.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Reaver encrypts some of its files with XOR.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
A RedLeaves configuration file is encrypted with a simple XOR key, 0x53.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Remexi obfuscates its configuration data with XOR.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Some data in Remsec is encrypted using RC5 in CBC mode, AES-CBC with a hardcoded key, RC4, or Salsa20. Some data is also base64-encoded.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Rifdoor has encrypted strings with a single byte XOR algorithm.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Configuration data used by Rising Sun has been encrypted using an RC4 stream algorithm.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
STARWHALE has been obfuscated with hex-encoded strings.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
SUPERNOVA contained Base64-encoded strings.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Sakula uses single-byte XOR obfuscation to obfuscate many of its files.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
SamSam has been seen using AES or DES to encrypt payloads and payload components.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Seasalt obfuscates configuration data.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Shark can use encrypted and encoded files for C2 configuration.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Skidmap has encrypted it's main payload using 3DES.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Sliver can encrypt strings at compile time.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Smoke Loader uses a simple one-byte XOR method to obfuscate values in the malware.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
The SocGholish JavaScript payload has been delivered within a compressed ZIP archive. SocGholish has also single or double Base-64 encoded references to its second-stage server URLs.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
SpeakUp encodes its second-stage payload with Base64.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Squirrelwaffle has been obfuscated with a XOR-based algorithm.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
StoneDrill has obfuscated its module with an alphabet-based table or XOR encryption.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
StrongPity has used encrypted strings in its dropper component.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Stuxnet uses encrypted configuration blocks and writes encrypted files to disk.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
SysUpdate can encrypt and encode its configuration file.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
TINYTYPHON has used XOR with 0x90 to obfuscate its configuration file.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
APIs and strings in some TYPEFRAME variants are RC4 encrypted. Another variant is encoded with XOR.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Taidoor can use encrypted string blocks for obfuscation.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
ThreatNeedle has been compressed and obfuscated using RC4, AES, or XOR.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Torisma has been Base64 encoded and AES encrypted.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
TrickBot uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Most strings in USBStealer are encrypted using 3DES and XOR and reversed.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Uroburos can use AES and CAST-128 encryption to obfuscate resources.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Ursnif has used an XOR-based algorithm to encrypt Tor clients dropped to disk.	Ursnif droppers have also been delivered as password-protected zip files that execute base64 encoded PowerShell commands.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
VERMIN is obfuscated using the obfuscation tool called ConfuserEx.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
A Volgmer variant is encoded using a simple XOR cipher.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
The WastedLocker payload includes encrypted strings stored within the .bss section of the binary file.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Waterbear has used RC4 encrypted shellcode and encrypted functions.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
WhisperGate can Base64 encode strings, store downloaded files in reverse byte order,  and use the Eazfuscator tool to obfuscate its third stage.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
WindTail can be delivered as a compressed, encrypted, and encoded payload.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Winnti for Linux can encode its configuration file with single-byte XOR encoding.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Winnti for Windows has the ability to encrypt and compress its payload.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Woody RAT has used Base64 encoded strings and scripts.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
YAHOYAH encrypts its configuration file using a simple algorithm.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
ZeroT has encrypted its payload with RC4.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Zeus Panda encrypts strings with XOR. Zeus Panda also encrypts all configuration and settings in AES and RC4.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Zox has been encoded with Base64.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
ZxxZ has been encoded to avoid detection from static analysis tools.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
metaMain's module file has been encrypted via XOR.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
njRAT has included a base64 encoded executable.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Higaisa sent the victim computer identifier in a User-Agent string back to the C2 server every 10 minutes.
Technique: T1029 Scheduled Transfer, Tactic: TA0010 Exfiltration
ADVSTORESHELL collects, compresses, encrypts, and exfiltrates data to the C2 server every 10 minutes.
Technique: T1029 Scheduled Transfer, Tactic: TA0010 Exfiltration
Chrommme can set itself to sleep before requesting a new command from C2.
Technique: T1029 Scheduled Transfer, Tactic: TA0010 Exfiltration
Cobalt Strike can set its Beacon payload to reach out to the C2 server on an arbitrary and random interval.
Technique: T1029 Scheduled Transfer, Tactic: TA0010 Exfiltration
ComRAT has been programmed to sleep outside local business hours (9 to 5, Monday to Friday).
Technique: T1029 Scheduled Transfer, Tactic: TA0010 Exfiltration
Dipsind can be configured to only run during normal working hours, which would make its communications harder to distinguish from normal traffic.
Technique: T1029 Scheduled Transfer, Tactic: TA0010 Exfiltration
Flagpro has the ability to wait for a specified time interval between communicating with and executing commands from C2.
Technique: T1029 Scheduled Transfer, Tactic: TA0010 Exfiltration
Kazuar can sleep for a specific time and be set to communicate at specific intervals.
Technique: T1029 Scheduled Transfer, Tactic: TA0010 Exfiltration
LightNeuron can be configured to exfiltrate data during nighttime or working hours.
Technique: T1029 Scheduled Transfer, Tactic: TA0010 Exfiltration
Linfo creates a backdoor through which remote attackers can change the frequency at which compromised hosts contact remote C2 infrastructure.
Technique: T1029 Scheduled Transfer, Tactic: TA0010 Exfiltration
Machete sends stolen data to the C2 server every 10 minutes.
Technique: T1029 Scheduled Transfer, Tactic: TA0010 Exfiltration
Ninja can configure its agent to work only in specific time frames.
Technique: T1029 Scheduled Transfer, Tactic: TA0010 Exfiltration
POWERSTATS can sleep for a given number of seconds.
Technique: T1029 Scheduled Transfer, Tactic: TA0010 Exfiltration
ShadowPad has sent data back to C2 every 8 hours.
Technique: T1029 Scheduled Transfer, Tactic: TA0010 Exfiltration
Shark can pause C2 communications for a specified time.
Technique: T1029 Scheduled Transfer, Tactic: TA0010 Exfiltration
ShimRat can sleep when instructed to do so by the C2.
Technique: T1029 Scheduled Transfer, Tactic: TA0010 Exfiltration
TinyTurla contacts its C2 based on a scheduled timing set in its configuration.
Technique: T1029 Scheduled Transfer, Tactic: TA0010 Exfiltration
jRAT can be configured to reconnect at certain intervals.
Technique: T1029 Scheduled Transfer, Tactic: TA0010 Exfiltration
During C0015, the threat actors limited Rclone's bandwidth setting during exfiltration.
Technique: T1030 Data Transfer Size Limits, Tactic: TA0010 Exfiltration
During C0026, the threat actors split encrypted archives containing stolen files and information into 3MB parts prior to exfiltration.
Technique: T1030 Data Transfer Size Limits, Tactic: TA0010 Exfiltration
APT28 has split archived exfiltration files into chunks smaller than 1MB.
Technique: T1030 Data Transfer Size Limits, Tactic: TA0010 Exfiltration
APT41 transfers post-exploitation files dividing the payload into fixed-size chunks to evade detection.
Technique: T1030 Data Transfer Size Limits, Tactic: TA0010 Exfiltration
LuminousMoth has split archived files into multiple parts to bypass a 5MB limit.
Technique: T1030 Data Transfer Size Limits, Tactic: TA0010 Exfiltration
Threat Group-3390 actors have split RAR files for exfiltration into parts.
Technique: T1030 Data Transfer Size Limits, Tactic: TA0010 Exfiltration
AppleSeed has divided files if the size is 0x1000000 bytes or more.
Technique: T1030 Data Transfer Size Limits, Tactic: TA0010 Exfiltration
Carbanak exfiltrates data in compressed chunks if a message is larger than 4096 bytes .
Technique: T1030 Data Transfer Size Limits, Tactic: TA0010 Exfiltration
Cobalt Strike will break large data sets into smaller chunks for exfiltration.
Technique: T1030 Data Transfer Size Limits, Tactic: TA0010 Exfiltration
Helminth splits data into chunks up to 23 bytes and sends the data in DNS queries to its C2 server.
Technique: T1030 Data Transfer Size Limits, Tactic: TA0010 Exfiltration
Kessel can split the data to be exilftrated into chunks that will fit in subdomains of DNS queries.
Technique: T1030 Data Transfer Size Limits, Tactic: TA0010 Exfiltration
Kevin can exfiltrate data to the C2 server in 27-character chunks.
Technique: T1030 Data Transfer Size Limits, Tactic: TA0010 Exfiltration
Mythic supports custom chunk sizes used to upload/download files.
Technique: T1030 Data Transfer Size Limits, Tactic: TA0010 Exfiltration
ObliqueRAT can break large files of interest into smaller chunks to prepare them for exfiltration.
Technique: T1030 Data Transfer Size Limits, Tactic: TA0010 Exfiltration
OopsIE exfiltrates command output and collected files to its C2 server in 1500-byte blocks.
Technique: T1030 Data Transfer Size Limits, Tactic: TA0010 Exfiltration
POSHSPY uploads data in 2048-byte chunks.
Technique: T1030 Data Transfer Size Limits, Tactic: TA0010 Exfiltration
RDAT can upload a file via HTTP POST response to the C2 split into 102,400-byte portions. RDAT can also download data from the C2 which is split into 81,920-byte portions.
Technique: T1030 Data Transfer Size Limits, Tactic: TA0010 Exfiltration
The Rclone "chunker" overlay supports splitting large files in smaller chunks during upload to circumvent size limits.
Technique: T1030 Data Transfer Size Limits, Tactic: TA0010 Exfiltration
During C0017, APT41 used `whoami` to gather information from victim machines.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
During C0018, the threat actors collected `whoami` information via PowerShell scripts.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
During Frankenstein, the threat actors used Empire to enumerate hosts and gather username, machine name, and administrative permissions information.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
During Night Dragon, threat actors used password cracking and pass-the-hash tools to discover usernames and passwords.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
During Operation CuckooBees, the threat actors used the `query user` and `whoami` commands as part of their advanced reconnaissance.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
During Operation Wocao, threat actors enumerated sessions and users on a remote host, and identified privileged users logged into a targeted system.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
APT19 used an HTTP malware variant and a Port 22 malware variant to collect the victim’s username.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
An APT3 downloader uses the Windows command `"cmd.exe" /C whoami` to verify that it is running with the elevated privileges of “System.”
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
APT32 collected the victim's username and executed the `whoami` command on the victim's machine. APT32 executed shellcode to collect the username on the victim's machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
APT37 identifies the victim username.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
APT38 has identified primary users, currently logged in users, sets of users that commonly use a system, or inactive users.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
APT39 used Remexi to collect usernames from the system.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
APT41 has executed `whoami` commands, including using the WMIEXEC utility to execute this on remote machines.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Chimera has used the `quser` command to show currently logged on users.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Dragonfly used the command `query user` on victim hosts.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Earth Lusca collected information on user accounts via the `whoami` command.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
FIN10 has used Meterpreter to enumerate users on remote systems.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
FIN7 has used the command `cmd.exe /C quser` to collect user session information.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
FIN8 has executed the command `quser` to display the session details of a compromised machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
GALLIUM used `whoami` and `query user` to obtain information about the victim user.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
A Gamaredon Group file stealer can gather the victim's username to send to a C2 server.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
HAFNIUM has used `whoami` to gather user information.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
HEXANE has run `whoami` on compromised machines to identify the current user.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Ke3chang has used implants capable of collecting the signed-in username.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Various Lazarus Group malware enumerates logged-on users.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
LuminousMoth has used a malicious DLL to collect the username from compromised hosts.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Magic Hound malware has obtained the victim username and sent it to the C2 server.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
MuddyWater has used malware that can collect the victim’s username.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
OilRig has run `whoami` on a victim.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Patchwork collected the victim username and whether it was running as admin, then sent the information to its C2 server.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Sandworm Team has collected the username from a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Sidewinder has used tools to identify the user of a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Stealth Falcon malware gathers the registered user and primary owner name via WMI.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Threat Group-3390 has used `whoami` to collect system user information.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Tropic Trooper used `letmein` to scan for saved usernames on the target system.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Volt Typhoon has executed the PowerShell command `Get-EventLog security -instanceid 4624` to identify associated user and computer account names.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Windshift has used malware to identify the username on a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Wizard Spider has used "whoami" to identify the local user and their privileges.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
ZIRCONIUM has used a tool to capture the username on a compromised host in order to register it with C2.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Action RAT has the ability to collect the username from an infected host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Agent Tesla can collect the username from the victim’s machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Agent.btz obtains the victim username and saves it to a file.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Amadey has collected the user name from a compromised host using `GetUserNameA`.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Aria-body has the ability to identify the username on a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
AsyncRAT can check if the current user of a compromised system is an administrator.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
AuTo Stealer has the ability to collect the username from an infected host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Azorult can collect the username from the victim’s machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
BADHATCH can obtain logged user information from a compromised machine and can execute the command `whoami.exe`.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
BISCUIT has a command to gather the username from the system.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
BLUELIGHT can collect the username on a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
BabyShark has executed the `whoami` command.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Backdoor.Oldrea collects the current username from the victim.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Bazar can identify the username of the infected user.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
BlackCat can utilize `net use` commands to discover the user name on a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
BloodHound can collect information on user sessions.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Bonadan has discovered the username of the user running the backdoor.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
BoomBox can enumerate the username on a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Bumblebee has the ability to identify the user name.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Cannon can gather the username from the system.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Cardinal RAT can collect the username from a victim machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Caterpillar WebShell can obtain a list of user accounts from a victim's machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Chaes has collected the username and UID from the infected machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Chrommme can retrieve the username from a targeted system.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Clambling can identify the username on a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
CreepySnail can execute `getUsername` on compromised systems.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Crimson can identify the user on a targeted system.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Cryptoistic can gather data on the user of a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
DRATzarus can obtain a list of users from an infected machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
DarkComet gathers the username from the victim’s machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
DarkWatchman has collected the username from a victim machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Denis enumerates and collects the username from the victim’s machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
A Linux version of Derusbi checks if the victim user ID is anything other than zero (normally used for root), and the malware will not execute if it does not have root privileges. Derusbi also gathers the username of the victim.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Diavol can collect the username from a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
DnsSystem can use the Windows user name to create a unique identification for infected users and systems.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
DownPaper collects the victim username and sends it to the C2 server.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Dyre has the ability to identify the users on a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
EVILNUM can obtain the username from the victim's machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Egregor has used tools to gather information about users.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Emotet has enumerated all users connected to network shares.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Empire can enumerate the username on targeted hosts.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Epic collects the user name from the victim’s machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Exaramel for Linux can run `whoami` to identify the system owner.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Explosive has collected the username from the infected host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
FELIXROOT collects the username from the victim’s machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Felismus collects the current username and sends it to the C2 server.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Flagpro has been used to run the `whoami` command on the system.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
FlawedAmmyy enumerates the current user during the initial infection.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
FunnyDream has the ability to gather user information from the targeted system using `whoami/upn&whoami/fqdn&whoami/logonid&whoami/all`.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Gazer obtains the current user's security identifier.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Gelsemium has the ability to distinguish between a standard user and an administrator on a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Get2 has the ability to identify the current username of an infected host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Gold Dragon collects the endpoint victim's username and uses it as a basis for downloading additional components from the C2 server.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Goopy has the ability to enumerate the infected system's user name.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Grandoreiro can collect the username from the victim's machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
GravityRAT collects the victim username along with other account information (account type, description, full name, SID and status).
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
GrimAgent can identify the user id on a target machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
can collect the victim user name.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
HAWKBALL can collect the user name of the system.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
HotCroissant has the ability to collect the username on the infected host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
InvisiMole lists local users and session information.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Ixeshe collects the username from the victim’s machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
JPIN can obtain the victim user name.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
KONNI can collect the username from the victim’s machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
KOPILUWAK can conduct basic network reconnaissance on the victim machine with `whoami`, to get user details.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Kazuar gathers information on users.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery