sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
Prior to executing a backdoor ToddyCat  has run `cmd /c start /b netsh advfirewall firewall add rule name="SGAccessInboundRule" dir=in protocol=udp action=allow localport=49683` to allow the targeted system to receive UDP packets on port 49683.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
The "ZR" variant of BACKSPACE will check to see if known host-based firewalls are installed on the infected systems. BACKSPACE will attempt to establish a C2 channel, then will examine open windows to identify a pop-up from the firewall software and will simulate a mouse-click to allow the connection to proceed.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
BADCALL disables the Windows firewall before binding to a port.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
CookieMiner has checked for the presence of "Little Snitch", macOS network monitoring and application firewall software, stopping and exiting if it is found.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
Cyclops Blink can modify the Linux iptables firewall to enable C2 communication on network devices via a stored list of port numbers.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
DarkComet can disable Security Center functions like the Windows Firewall.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
Grandoreiro can block the Deibold Warsaw GAS Tecnologia security tool at the firewall level.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
H1N1 kills and disables services for Windows Firewall.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
HARDRAIN opens the Windows Firewall to modify incoming connections.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
HOPLIGHT has modified the firewall using netsh.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
InvisiMole has a command to disable routing and the Firewall on the victim’s machine.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
Kasidet has the ability to change firewall settings to allow a plug-in to be downloaded.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
NanoCore can modify the victim's firewall.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
PyDCrypt has modified firewall rules to allow incoming SMB, NetBIOS, and RPC connections using `netsh.exe` on remote machines.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
Remsec can add or remove applications or ports on the Windows firewall or disable it entirely.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
TYPEFRAME can open the Windows Firewall on the victim’s machine to allow incoming connections.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
ZxShell can disable the firewall by modifying the registry key `HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile`.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
netsh can be used to disable local firewall settings.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
njRAT has modified the Windows firewall to allow itself to communicate through the firewall.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
APT41 developed a custom injector that enables an Event Tracing for Windows (ETW) bypass, making malicious processes invisible to Windows logging.
Technique: T1562.006 Impair Defenses: Indicator Blocking, Tactic: TA0005 Defense Evasion
APT5 has used the CLEANPULSE utility to insert command line strings into a targeted process to prevent certain log events from occurring.
Technique: T1562.006 Impair Defenses: Indicator Blocking, Tactic: TA0005 Defense Evasion
Brute Ratel C4 has the ability to hide memory artifacts and to patch Event Tracing for Windows (ETW) and the Anti Malware Scan Interface (AMSI).
Technique: T1562.006 Impair Defenses: Indicator Blocking, Tactic: TA0005 Defense Evasion
Ebury can hook logging functions so that nothing from the backdoor gets sent to the logging facility.
Technique: T1562.006 Impair Defenses: Indicator Blocking, Tactic: TA0005 Defense Evasion
HUI Loader has the ability to disable Windows Event Tracing for Windows (ETW) and Antimalware Scan Interface (AMSI) functions.
Technique: T1562.006 Impair Defenses: Indicator Blocking, Tactic: TA0005 Defense Evasion
HermeticWiper has the ability to set the `HKLM:\SYSTEM\\CurrentControlSet\\Control\\CrashControl\CrashDumpEnabled` Registry key to `0` in order to disable crash dumps.
Technique: T1562.006 Impair Defenses: Indicator Blocking, Tactic: TA0005 Defense Evasion
Waterbear can hook the `ZwOpenProcess` and `GetExtendedTcpTable` APIs called by the process of a security product to hide PIDs and TCP records from detection.
Technique: T1562.006 Impair Defenses: Indicator Blocking, Tactic: TA0005 Defense Evasion
Woody RAT has suppressed all error reporting by calling `SetErrorMode` with 0x8007 as a parameter.
Technique: T1562.006 Impair Defenses: Indicator Blocking, Tactic: TA0005 Defense Evasion
Pacu can allowlist IP addresses in AWS GuardDuty.
Technique: T1562.007 Impair Defenses: Disable or Modify Cloud Firewall, Tactic: TA0005 Defense Evasion
APT29 has disabled Purview Audit on targeted accounts prior to stealing emails from  Microsoft 365 tenants.
Technique: T1562.008 Impair Defenses: Disable or Modify Cloud Logs, Tactic: TA0005 Defense Evasion
Pacu can disable or otherwise restrict various AWS logging services, such as AWS CloudTrail and VPC flow logs.
Technique: T1562.008 Impair Defenses: Disable or Modify Cloud Logs, Tactic: TA0005 Defense Evasion
AvosLocker can restart a compromised machine in safe mode.
Technique: T1562.009 Impair Defenses: Safe Mode Boot, Tactic: TA0005 Defense Evasion
Black Basta can reboot victim machines in safe mode with networking via `bcdedit /set safeboot network`.
Technique: T1562.009 Impair Defenses: Safe Mode Boot, Tactic: TA0005 Defense Evasion
REvil can force a reboot in safe mode with networking.
Technique: T1562.009 Impair Defenses: Safe Mode Boot, Tactic: TA0005 Defense Evasion
Axiom has targeted victims with remote administration tools including RDP.
Technique: T1563.002 Remote Service Session Hijacking: RDP Hijacking, Tactic: TA0008 Lateral Movement
WannaCry enumerates current remote desktop sessions and tries to execute the malware on each session.
Technique: T1563.002 Remote Service Session Hijacking: RDP Hijacking, Tactic: TA0008 Lateral Movement
Bundlore uses the `mktemp` utility to make unique file and directory names for payloads, such as `TMP_DIR=`mktemp -d -t x`.
Technique: T1564 Hide Artifacts, Tactic: TA0005 Defense Evasion
DarkTortilla has used `%HiddenReg%` and `%HiddenKey%` as part of its persistence via the Windows registry.
Technique: T1564 Hide Artifacts, Tactic: TA0005 Defense Evasion
OSX/Shlayer has used the `mktemp` utility to make random and unique filenames for payloads, such as `export tmpDir="$(mktemp -d /tmp/XXXXXXXXXXXX)"` or `mktemp -t Installer`.
Technique: T1564 Hide Artifacts, Tactic: TA0005 Defense Evasion
Tarrask is able to create “hidden” scheduled tasks by deleting the Security Descriptor (`SD`) registry value.
Technique: T1564 Hide Artifacts, Tactic: TA0005 Defense Evasion
WarzoneRAT can masquerade the Process Environment Block on a compromised host to hide it's attempts to elevate privileges through `IFileOperation`.
Technique: T1564 Hide Artifacts, Tactic: TA0005 Defense Evasion
APT28 has saved files with hidden file attributes.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
APT32's macOS backdoor hides the clientID file via a chflags function.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
FIN13 has created hidden files and folders within a compromised Linux system `/tmp` directory. FIN13 also has used `attrib.exe` to hide gathered local host information.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
HAFNIUM has hidden files on a compromised host.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
Lazarus Group has used a VBA Macro to set its file attributes to System and Hidden and has named files with a dot prefix to hide them from the Finder application.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
LuminousMoth has used malware to store malicious binaries in hidden directories on victim's USB drives.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
Mustang Panda's PlugX variant has created a hidden folder on USB drives named `RECYCLE.BIN` to store malicious executables and collected data.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
Rocke downloaded a file "libprocesshider", which could hide files on the target system.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
Transparent Tribe can hide legitimate directories and replace them with malicious copies of the same name.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
Tropic Trooper has created a hidden directory under `C:\ProgramData\Apple\Updates\` and `C:\Users\Public\Documents\Flash\`.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
Agent Tesla has created hidden folders.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
AppleJeus has added a leading `.` to plist filenames, unlisting them from the Finder app and default Terminal directory listings.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
Attor can set attributes of log files and directories to HIDDEN, SYSTEM, ARCHIVE, or a combination of those.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
BackConfig has the ability to set folders or files to be hidden from the Windows Explorer default view.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
COATHANGER creates and installs itself to a hidden installation directory.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
Calisto uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
Carberp has created a hidden file in the Startup folder of the current user.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
Clambling has the ability to set its file attributes to hidden.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
CoinTicker downloads the following hidden files to evade detection and maintain persistence: /private/tmp/.info.enc, /private/tmp/.info.py, /private/tmp/.server.sh, ~/Library/LaunchAgents/.espl.plist, ~/Library/Containers/.[random string]/[random string].
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
Dacls has had its payload named with a dot prefix to make it hidden from view in the Finder application.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
DarkGate initial installation involves dropping several files to a hidden directory named after the victim machine name.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
EnvyScout can use hidden directories and files to hide malicious executables.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
Explosive has commonly set file and path attributes to hidden.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
FruitFly saves itself with a leading "." to make it a hidden file.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
Imminent Monitor has a dynamic debugging feature to set the file attribute to hidden.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
InvisiMole can create hidden system directories.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
Ixeshe sets its own executable file's attributes to hidden.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
The Komplex payload is stored in a hidden directory at `/Users/Shared/.local/kextd`.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
Lokibot has the ability to copy itself to a hidden file and directory.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
LoudMiner has set the attributes of the VirtualBox directory and VBoxVmService parent directory to "hidden".
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
MacSpy stores itself in `~/Library/.DS_Stores/`
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
Machete has the capability to exfiltrate stolen data to a hidden folder on a removable drive.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
Micropsia creates a new hidden directory to store all components' outputs in a dedicated sub-folder for each.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
NETWIRE can copy itself to and launch itself from hidden folders.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
OSX/Shlayer has executed a .command script from a hidden directory in a mounted DMG.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
OSX_OCEANLOTUS.D sets the main loader file’s attributes to hidden.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
Before exfiltration, Okrum's backdoor has used hidden files to store logs and outputs from backdoor commands.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
PlugX can modify the characteristics of folders to hide them from the compromised user.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
PoetRAT has the ability to hide and unhide files.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
QakBot has placed its payload in hidden subdirectories.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
QuasarRAT has the ability to set file attributes to "hidden" to hide files from the compromised user's view in Windows File Explorer.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
Rising Sun can modify file attributes to hide files.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
SLOTHFULMEDIA has been created with a hidden attribute to insure it's not visible to the victim.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
SysUpdate has the ability to set file attributes to hidden.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
ThiefQuest hides a copy of itself in the user's `~/Library` directory by using a `.` at the beginning of the file name followed by 9 random characters.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
WannaCry uses `attrib +h` to make some of its files hidden.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
WastedLocker has copied a random file from the Windows System32 folder to the `%APPDATA%` location under a different hidden filename.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
XCSSET uses a hidden folder named `.xcassets` and `.git` to embed itself in Xcode.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
ccf32 has created a hidden directory on targeted systems, naming it after the current local time (year, month, and day).
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
iKitten saves itself with a leading "." so that it's hidden from users by default.
Technique: T1564.001 Hide Artifacts: Hidden Files and Directories, Tactic: TA0005 Defense Evasion
Dragonfly has modified the Registry to hide created user accounts.
Technique: T1564.002 Hide Artifacts: Hidden Users, Tactic: TA0005 Defense Evasion
Kimsuky has run `reg add ‘HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList’ /v` to hide a newly created user.
Technique: T1564.002 Hide Artifacts: Hidden Users, Tactic: TA0005 Defense Evasion
SMOKEDHAM has modified the Registry to hide created user accounts from the Windows logon screen.
Technique: T1564.002 Hide Artifacts: Hidden Users, Tactic: TA0005 Defense Evasion
APT19 used `-W Hidden` to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
APT28 has used the WindowStyle parameter to conceal PowerShell windows.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
APT3 has been known to use `-WindowStyle Hidden` to conceal PowerShell windows.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
APT32 has used the WindowStyle parameter to conceal PowerShell windows.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
CopyKittens has used `-w hidden` and `-windowstyle hidden` to conceal PowerShell windows.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
DarkHydrus has used `-WindowStyle Hidden` to conceal PowerShell windows.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
Deep Panda has used `-w hidden` to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
Gamaredon Group has used `hidcon` to run batch files in a hidden console window.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
Gorgon Group has used `-W Hidden` to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
Higaisa used a payload that creates a hidden window.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
Kimsuky has used an information gathering module that will hide an AV software window from the victim.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
Magic Hound malware has a function to determine whether the C2 server wishes to execute the newly dropped file in a hidden window.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
Nomadic Octopus executed PowerShell in a hidden window.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
ToddyCat has hidden malicious scripts using `powershell.exe -windowstyle hidden`.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
Agent Tesla has used `ProcessWindowStyle.Hidden` to hide windows.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
Astaroth loads its module with the XSL script parameter `vShow` set to zero, which opens the application with a hidden window.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
AsyncRAT can hide the execution of scheduled tasks using `ProcessWindowStyle.Hidden`.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
AvosLocker has hidden its console window by using the `ShowWindow` API function.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
BONDUPDATER uses `-windowstyle hidden` to conceal a PowerShell window that downloads a payload.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
Cuba has executed hidden PowerShell windows.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
HAMMERTOSS has used `-WindowStyle hidden` to conceal PowerShell windows.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
HotCroissant has the ability to hide the window for operations performed on a given file.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
InvisiMole has executed legitimate tools in hidden windows.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
KOCTOPUS has used `-WindowsStyle Hidden` to hide the command window.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
Kevin can hide the current window from the targeted user via the `ShowWindow` API function.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
KeyBoy uses `-w Hidden` to conceal a PowerShell window that downloads a payload.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
Kivars has the ability to conceal its activity through hiding active windows.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
Koadic has used the command `Powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden` to hide its window.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
MCMD can modify processes to prevent them from being visible on the desktop.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
Metamorfo has hidden its GUI using the ShowWindow() WINAPI call.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
Meteor can hide its console window upon execution to decrease its visibility to a victim.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
PowerShower has added a registry key so future powershell.exe instances are spawned with coordinates for a window position off-screen by default.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
QUIETCANARY can execute processes in a hidden window.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
QuasarRAT can hide process windows and make web requests invisible to the compromised user. Requests marked as invisible have been sent with user-agent string `Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A` though QuasarRAT can only be run on Windows systems.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
QuietSieve has the ability to execute payloads in a hidden window.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
SILENTTRINITY has the ability to set its window state to hidden.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
SharpDisco can hide windows using `ProcessWindowStyle.Hidden`.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
Snip3 can execute PowerShell scripts in a hidden window.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
StrongPity has the ability to hide the console window for its document search module from the user.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
TrickBot has used a hidden VNC (hVNC) window to monitor the victim and collect information stealthily.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
Ursnif droppers have used COM properties to execute malware in hidden windows.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
WarzoneRAT has the ability of performing remote desktop access via a hVNC window for decreased visibility.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
WindTail can instruct the OS to execute an application without a dock icon or menu.
Technique: T1564.003 Hide Artifacts: Hidden Window, Tactic: TA0005 Defense Evasion
APT32 used NTFS alternate data streams to hide their payloads.
Technique: T1564.004 Hide Artifacts: NTFS File Attributes, Tactic: TA0005 Defense Evasion
Anchor has used NTFS to hide files.
Technique: T1564.004 Hide Artifacts: NTFS File Attributes, Tactic: TA0005 Defense Evasion
Astaroth can abuse alternate data streams (ADS) to store content for malicious payloads.
Technique: T1564.004 Hide Artifacts: NTFS File Attributes, Tactic: TA0005 Defense Evasion
BitPaymer has copied itself to the `:bin` alternate data stream of a newly created file.
Technique: T1564.004 Hide Artifacts: NTFS File Attributes, Tactic: TA0005 Defense Evasion
The DEADEYE.EMBED variant of DEADEYE can embed its payload in an alternate data stream of a local file.
Technique: T1564.004 Hide Artifacts: NTFS File Attributes, Tactic: TA0005 Defense Evasion
Expand can be used to download or copy a file into an alternate data stream.
Technique: T1564.004 Hide Artifacts: NTFS File Attributes, Tactic: TA0005 Defense Evasion
Gazer stores configuration items in alternate data streams (ADSs) if the Registry is not accessible.
Technique: T1564.004 Hide Artifacts: NTFS File Attributes, Tactic: TA0005 Defense Evasion
LoJax has loaded an embedded NTFS DXE driver to be able to access and write to NTFS partitions.
Technique: T1564.004 Hide Artifacts: NTFS File Attributes, Tactic: TA0005 Defense Evasion
If the victim is using PowerShell 3.0 or later, POWERSOURCE writes its decoded payload to an alternate data stream (ADS) named kernel32.dll that is saved in `%PROGRAMDATA%\Windows\`.
Technique: T1564.004 Hide Artifacts: NTFS File Attributes, Tactic: TA0005 Defense Evasion
PowerDuke hides many of its backdoor payloads in an alternate data stream (ADS).
Technique: T1564.004 Hide Artifacts: NTFS File Attributes, Tactic: TA0005 Defense Evasion
The Regin malware platform uses Extended Attributes to store encrypted executables.
Technique: T1564.004 Hide Artifacts: NTFS File Attributes, Tactic: TA0005 Defense Evasion
Valak has the ability save and execute files as alternate data streams (ADS).
Technique: T1564.004 Hide Artifacts: NTFS File Attributes, Tactic: TA0005 Defense Evasion
WastedLocker has the ability to save and execute files as an alternate data stream (ADS).
Technique: T1564.004 Hide Artifacts: NTFS File Attributes, Tactic: TA0005 Defense Evasion
Some variants of the Zeroaccess Trojan have been known to store data in Extended Attributes.
Technique: T1564.004 Hide Artifacts: NTFS File Attributes, Tactic: TA0005 Defense Evasion
esentutl can be used to read and write alternate data streams.
Technique: T1564.004 Hide Artifacts: NTFS File Attributes, Tactic: TA0005 Defense Evasion
Equation has used an encrypted virtual file system stored in the Windows Registry.
Technique: T1564.005 Hide Artifacts: Hidden File System, Tactic: TA0005 Defense Evasion
Strider has used a hidden file system that is stored as a file on disk.
Technique: T1564.005 Hide Artifacts: Hidden File System, Tactic: TA0005 Defense Evasion
BOOTRASH has used unallocated disk space between partitions for a hidden file system that stores components of the Nemesis bootkit.
Technique: T1564.005 Hide Artifacts: Hidden File System, Tactic: TA0005 Defense Evasion
ComRAT has used a portable FAT16 partition image placed in %TEMP% as a hidden file system.
Technique: T1564.005 Hide Artifacts: Hidden File System, Tactic: TA0005 Defense Evasion
Regin has used a hidden file system to store some of its components.
Technique: T1564.005 Hide Artifacts: Hidden File System, Tactic: TA0005 Defense Evasion
Uroburos can use concealed storage mechanisms including an NTFS or FAT-16 filesystem encrypted with CAST-128 in CBC mode.
Technique: T1564.005 Hide Artifacts: Hidden File System, Tactic: TA0005 Defense Evasion
LoudMiner has used QEMU and VirtualBox to run a Tiny Core Linux virtual machine, which runs XMRig and makes connections to the C2 server for updates.
Technique: T1564.006 Hide Artifacts: Run Virtual Instance, Tactic: TA0005 Defense Evasion
Maze operators have used VirtualBox and a Windows 7 virtual machine to run the ransomware; the virtual machine's configuration file mapped the shared network drives of the target company, presumably so Maze can encrypt files on the shared drives as well as the local machine.
Technique: T1564.006 Hide Artifacts: Run Virtual Instance, Tactic: TA0005 Defense Evasion
Ragnar Locker has used VirtualBox and a stripped Windows XP virtual machine to run itself. The use of a shared folder specified in the configuration enables Ragnar Locker to encrypt files on the host operating system, including files on any mapped drives.
Technique: T1564.006 Hide Artifacts: Run Virtual Instance, Tactic: TA0005 Defense Evasion
FIN4 has created rules in victims' Microsoft Outlook accounts to automatically delete emails containing words such as “hacked," "phish," and “malware" in a likely attempt to prevent organizations from communicating about their activities.
Technique: T1564.008 Hide Artifacts: Email Hiding Rules, Tactic: TA0005 Defense Evasion
Scattered Spider creates inbound rules on the compromised email accounts of security personnel to automatically delete emails from vendor security products.
Technique: T1564.008 Hide Artifacts: Email Hiding Rules, Tactic: TA0005 Defense Evasion
Keydnap uses a resource fork to present a macOS JPEG or text file icon rather than the executable's icon assigned by the operating system.
Technique: T1564.009 Hide Artifacts: Resource Forking, Tactic: TA0005 Defense Evasion
OSX/Shlayer has used a resource fork to hide a compressed binary file of itself from the terminal, Finder, and potentially evade traditional scanners.
Technique: T1564.009 Hide Artifacts: Resource Forking, Tactic: TA0005 Defense Evasion
Cobalt Strike can use spoof arguments in spawned processes that execute beacon commands.
Technique: T1564.010 Hide Artifacts: Process Argument Spoofing, Tactic: TA0005 Defense Evasion
SombRAT has the ability to modify its process memory to hide process command-line arguments.
Technique: T1564.010 Hide Artifacts: Process Argument Spoofing, Tactic: TA0005 Defense Evasion
The GoldMax Linux variant has been executed with the `nohup` command to ignore hangup signals and continue to run if the terminal session was terminated.
Technique: T1564.011 Hide Artifacts: Ignore Process Interrupts, Tactic: TA0005 Defense Evasion
OSX/Shlayer has used the `nohup` command to instruct executed payloads to ignore hangup signals.
Technique: T1564.011 Hide Artifacts: Ignore Process Interrupts, Tactic: TA0005 Defense Evasion
FIN13 has injected fraudulent transactions into compromised networks that mimic legitimate behavior to siphon off incremental amounts of money.
Technique: T1565 Data Manipulation, Tactic: TA0040 Impact
APT38 has used DYEPACK to create, delete, and alter records in databases used for SWIFT transactions.
Technique: T1565.001 Data Manipulation: Stored Data Manipulation, Tactic: TA0040 Impact
SUNSPOT created a copy of the SolarWinds Orion software source file with a `.bk` extension to backup the original content, wrote SUNBURST using the same filename but with a `.tmp` extension, and then moved SUNBURST using `MoveFileEx` to the original filename with a `.cs` extension so it could be compiled within Orion software.
Technique: T1565.001 Data Manipulation: Stored Data Manipulation, Tactic: TA0040 Impact
APT38 has used DYEPACK to manipulate SWIFT messages en route to a printer.
Technique: T1565.002 Data Manipulation: Transmitted Data Manipulation, Tactic: TA0040 Impact
LightNeuron is capable of modifying email content, headers, and attachments during transit.
Technique: T1565.002 Data Manipulation: Transmitted Data Manipulation, Tactic: TA0040 Impact
Melcoz can monitor the clipboard for cryptocurrency addresses and change the intended address to one controlled by the adversary.
Technique: T1565.002 Data Manipulation: Transmitted Data Manipulation, Tactic: TA0040 Impact
Metamorfo has a function that can watch the contents of the system clipboard for valid bitcoin addresses, which it then overwrites with the attacker's address.
Technique: T1565.002 Data Manipulation: Transmitted Data Manipulation, Tactic: TA0040 Impact
APT38 has used DYEPACK.FOX to manipulate PDF data as it is accessed to remove traces of fraudulent SWIFT transactions from the data displayed to the end user.
Technique: T1565.003 Data Manipulation: Runtime Data Manipulation, Tactic: TA0040 Impact
Axiom has used spear phishing to initially compromise victims.
Technique: T1566 Phishing, Tactic: TA0001 Initial Access
GOLD SOUTHFIELD has conducted malicious spam (malspam) campaigns to gain access to victim's machines.
Technique: T1566 Phishing, Tactic: TA0001 Initial Access
Hikit has been spread through spear phishing.
Technique: T1566 Phishing, Tactic: TA0001 Initial Access
Royal has been spread through the use of phishing campaigns including "call back phishing" where victims are lured into calling a number provided through email.
Technique: T1566 Phishing, Tactic: TA0001 Initial Access
During the 2015 Ukraine Electric Power Attack, Sandworm Team obtained their initial foothold into many IT systems using Microsoft Office attachments delivered through phishing emails.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
During C0011, Transparent Tribe sent malicious attachments via email to student targets in India.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
For C0015, security researchers assessed the threat actors likely used a phishing campaign to distribute a weaponized attachment to victims.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
During Frankenstein, the threat actors likely used spearphishing emails to send malicious Microsoft Word documents.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
During Operation Dream Job, Lazarus Group sent emails with malicious attachments to gain unauthorized access to targets' computers.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
During Operation Dust Storm, the threat actors sent spearphishing emails that contained a malicious Microsoft Word document.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
During Operation Spalax, the threat actors sent phishing emails that included a PDF document that in some cases led to the download and execution of malware.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
APT-C-36 has used spearphishing emails with password protected RAR attachment to avoid being detected by the email gateway.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
APT1 has sent spearphishing emails containing malicious attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
APT12 has sent emails with malicious Microsoft Office documents and PDFs attached.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
APT19 sent spearphishing emails with malicious attachments in RTF and XLSM formats to deliver initial exploits.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
APT28 sent spearphishing emails containing malicious Microsoft Office and RAR attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
APT29 has used spearphishing emails with an attachment to deliver files with exploits to initial victims.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
APT30 has used spearphishing emails with malicious DOC attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
APT32 has sent spearphishing emails with a malicious executable disguised as a document or spreadsheet.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
APT33 has sent spearphishing e-mails with archive attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
APT37 delivers malware using spearphishing emails with malicious HWP attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
APT38 has conducted spearphishing campaigns using malicious email attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
APT39 leveraged spearphishing emails with malicious attachments to initially compromise victims.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
APT41 sent spearphishing emails with attachments such as compiled HTML (.chm) files to initially compromise their victims.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Ajax Security Team has used personalized spearphishing attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Andariel has conducted spearphishing campaigns that included malicious Word or Excel attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
BITTER has sent spearphishing emails with a malicious RTF document or Excel spreadsheet.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
BRONZE BUTLER used spearphishing emails with malicious Microsoft Word attachments to infect victims.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
BlackTech has used spearphishing e-mails with malicious password-protected archived files (ZIP or RAR) to deliver malware.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Cobalt Group has sent spearphishing emails with various attachment types to corporate and personal email accounts of victim organizations. Attachment types have included .rtf, .doc, .xls, archives containing LNK files, and password protected archives containing .exe and .scr executables.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Confucius has crafted and sent victims malicious attachments to gain initial access.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
DarkHydrus has sent spearphishing emails with password-protected RAR archives containing malicious Excel Web Query files (.iqy). The group has also sent spearphishing emails that contained malicious Microsoft Office documents that use the “attachedTemplate” technique to load a template from a remote server.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Darkhotel has sent spearphishing emails with malicious RAR and .LNK attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Dragonfly has sent emails with malicious attachments to gain initial access.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
EXOTIC LILY conducted an e-mail thread-hijacking campaign with malicious ISO attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing malicious attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Ember Bear has sent spearphishing emails containing malicious attachments in the form of PDFs, Word documents, JavaScript files, and Control Panel File (CPL) executables.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
FIN4 has used spearphishing emails containing attachments (which are often stolen, legitimate documents sent from compromised accounts) with embedded malicious macros.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
FIN6 has targeted victims with e-mails containing malicious attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
FIN7 sent spearphishing emails with either malicious Microsoft Documents or RTF files attached.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
FIN8 has distributed targeted emails containing Word documents with embedded malicious macros.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Ferocious Kitten has conducted spearphishing campaigns containing malicious documents to lure victims to open the attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Gallmaker sent emails with malicious Microsoft Office documents attached.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Gamaredon Group has delivered spearphishing emails with malicious attachments to targets.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Gorgon Group sent emails to victims with malicious Microsoft Office documents attached.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Higaisa has sent spearphishing emails containing malicious attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Inception has used weaponized documents attached to spearphishing emails for reconnaissance and initial compromise.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
IndigoZebra sent spearphishing emails containing malicious password-protected RAR attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Kimsuky has used emails containing Word, Excel and/or HWP (Hangul Word Processor) documents in their spearphishing campaigns.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Lazarus Group has targeted victims with spearphishing emails containing malicious Microsoft Word documents.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
LazyScripter has used spam emails weaponized with archive or document files as its initial infection vector.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Leviathan has sent spearphishing emails with malicious attachments, including .rtf, .doc, and .xls files.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Machete has delivered spearphishing emails that contain a zipped file with malicious contents.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Malteiro has sent spearphishing emails containing malicious .zip files.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Mofang delivered spearphishing emails with malicious documents, PDFs, or Excel files attached.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Molerats has sent phishing emails with malicious Microsoft Word and PDF attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Mustang Panda has used spearphishing attachments to deliver initial access payloads.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Naikon has used malicious e-mail attachments to deliver malware.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Nomadic Octopus has targeted victims with spearphishing emails containing malicious attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
OilRig has sent spearphising emails with malicious attachments to potential victims using compromised and/or spoofed email accounts.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
PLATINUM has sent spearphishing emails with attachments to victims as its primary initial access vector.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Patchwork has used spearphishing with an attachment to deliver files with exploits to initial victims.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
RTM has used spearphishing attachments to distribute its malware.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Rancor has attached a malicious document to an email to gain initial access.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Sandworm Team has delivered malicious Microsoft Office attachments via spearphishing emails.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
SideCopy has sent spearphishing emails with malicious hta file attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Sidewinder has sent e-mails with malicious attachments often crafted for specific targets.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Silence has sent emails with malicious DOCX, CHM, LNK and ZIP attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
TA2541 has sent phishing emails with malicious attachments for initial access including MS Word documents.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
TA459 has targeted victims using spearphishing emails with malicious Microsoft Word attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
TA505 has used spearphishing emails with malicious attachments to initially compromise victims.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
TA551 has sent spearphishing attachments with password protected ZIP files.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
The White Company has sent phishing emails with malicious Microsoft Word attachments to victims.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Threat Group-3390 has used e-mail to deliver malicious attachments to victims.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Tonto Team has delivered payloads via spearphishing attachments.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access
Transparent Tribe has sent spearphishing e-mails with attachments to deliver malicious payloads.
Technique: T1566.001 Phishing: Spearphishing Attachment, Tactic: TA0001 Initial Access