sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
Sardonic can communicate with actor-controlled C2 servers by using a custom little-endian binary protocol.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
ShadowPad has used UDP for C2 communications.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
SombRAT has the ability to use TCP sockets to send data and ICMP to ping the C2 server.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
TSCookie can use ICMP to receive information on the destination server.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Taidoor can use TCP for C2 communications.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Umbreon provides access to the system via SSH or any other protocol that uses PAM to authenticate.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Uroburos can communicate through custom methodologies for UDP,  ICMP, and TCP that use distinct sessions to ride over the legitimate protocols.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
WINDSHIELD C2 traffic can communicate via TCP raw sockets.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
WarzoneRAT can communicate with its C2 server via TCP over port 5200.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
WellMail can use TCP for C2 communications.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Winnti for Linux has used ICMP, custom TCP, and UDP in outbound communications.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
Winnti for Windows can communicate using custom TCP.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
ZIPLINE can communicate with C2 using a custom binary protocol.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
gh0st RAT has used an encrypted protocol within TCP segments to communicate with the C2.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
metaMain can establish an indirect and raw TCP socket-based connection to the C2 server.
Technique: T1095 Non-Application Layer Protocol, Tactic: TA0011 Command and Control
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the `sp_addlinkedsrvlogin` command in MS-SQL to create a link between a created account and other servers in the network.
Technique: T1098 Account Manipulation, Tactic: TA0003 Persistence TA0004 Privilege Escalation
APT3 has been known to add created accounts to local admin groups to maintain elevated access.
Technique: T1098 Account Manipulation, Tactic: TA0003 Persistence TA0004 Privilege Escalation
APT41 has added user accounts to the User and Admin groups.
Technique: T1098 Account Manipulation, Tactic: TA0003 Persistence TA0004 Privilege Escalation
APT5 has created their own accounts with Local Administrator privileges to maintain access to systems with short-cycle credential rotation.
Technique: T1098 Account Manipulation, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Dragonfly has added newly created accounts to the administrators group to maintain elevated access.
Technique: T1098 Account Manipulation, Tactic: TA0003 Persistence TA0004 Privilege Escalation
FIN13 has assigned newly created accounts the sysadmin role to maintain persistence.
Technique: T1098 Account Manipulation, Tactic: TA0003 Persistence TA0004 Privilege Escalation
HAFNIUM has granted privileges to domain accounts.
Technique: T1098 Account Manipulation, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Kimsuky has added accounts to specific groups with `net localgroup`.
Technique: T1098 Account Manipulation, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Lazarus Group malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.
Technique: T1098 Account Manipulation, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Magic Hound has added a user named DefaultAccount to the Administrators and Remote Desktop Users groups.
Technique: T1098 Account Manipulation, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Calisto adds permissions and remote logins to all users.
Technique: T1098 Account Manipulation, Tactic: TA0003 Persistence TA0004 Privilege Escalation
DarkGate elevates accounts created through the malware to the local administration group during execution.
Technique: T1098 Account Manipulation, Tactic: TA0003 Persistence TA0004 Privilege Escalation
The Mimikatz credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality. The `LSADUMP::ChangeNTLM` and `LSADUMP::SetNTLM` modules can also manipulate the password hash of an account without knowing the clear text value.
Technique: T1098 Account Manipulation, Tactic: TA0003 Persistence TA0004 Privilege Escalation
SMOKEDHAM has added user accounts to local Admin groups.
Technique: T1098 Account Manipulation, Tactic: TA0003 Persistence TA0004 Privilege Escalation
ServHelper has added a user named "supportaccount" to the Remote Desktop Users and Administrators groups.
Technique: T1098 Account Manipulation, Tactic: TA0003 Persistence TA0004 Privilege Escalation
During C0027, Scattered Spider used aws_consoler  to create temporary federated credentials for fake users in order to obfuscate which AWS credential is compromised and enable pivoting from the AWS CLI to console sessions without MFA.
Technique: T1098.001 Account Manipulation: Additional Cloud Credentials, Tactic: TA0003 Persistence TA0004 Privilege Escalation
During the SolarWinds Compromise, APT29 added credentials to OAuth Applications and Service Principals.
Technique: T1098.001 Account Manipulation: Additional Cloud Credentials, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Pacu can generate SSH and API keys for AWS infrastructure and additional API keys for other IAM users.
Technique: T1098.001 Account Manipulation: Additional Cloud Credentials, Tactic: TA0003 Persistence TA0004 Privilege Escalation
During the SolarWinds Compromise, APT29 added their own devices as allowed IDs for active sync using `Set-CASMailbox`, allowing it to obtain copies of victim mailboxes. It also added additional permissions (such as Mail.Read and Mail.ReadWrite) to compromised Application or Service Principals.
Technique: T1098.002 Account Manipulation: Additional Email Delegate Permissions, Tactic: TA0003 Persistence TA0004 Privilege Escalation
APT28 has used a Powershell cmdlet to grant the `ApplicationImpersonation` role to a compromised account.
Technique: T1098.002 Account Manipulation: Additional Email Delegate Permissions, Tactic: TA0003 Persistence TA0004 Privilege Escalation
APT29 has used a compromised global administrator account in Azure AD to backdoor a service principal with `ApplicationImpersonation` rights to start collecting emails from targeted mailboxes; APT29 has also used compromised accounts holding `ApplicationImpersonation` rights in Exchange to collect emails.
Technique: T1098.002 Account Manipulation: Additional Email Delegate Permissions, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Magic Hound granted compromised email accounts read access to the email boxes of additional targeted accounts. The group then was able to authenticate to the intended victim's OWA (Outlook Web Access) portal and read hundreds of email communications for information on Middle East organizations.
Technique: T1098.002 Account Manipulation: Additional Email Delegate Permissions, Tactic: TA0003 Persistence TA0004 Privilege Escalation
During C0027, Scattered Spider used IAM manipulation to gain persistence and to assume or elevate privileges.
Technique: T1098.003 Account Manipulation: Additional Cloud Roles, Tactic: TA0003 Persistence TA0004 Privilege Escalation
During the SolarWinds Compromise, APT29 granted `company administrator` privileges to a newly created service principle.
Technique: T1098.003 Account Manipulation: Additional Cloud Roles, Tactic: TA0003 Persistence TA0004 Privilege Escalation
LAPSUS$ has added the global admin role to accounts they have created in the targeted organization's cloud instances.
Technique: T1098.003 Account Manipulation: Additional Cloud Roles, Tactic: TA0003 Persistence TA0004 Privilege Escalation
During C0027, Scattered Spider used IAM manipulation to gain persistence and to assume or elevate privileges.

Scattered Spider has also assigned user access admin roles in order to gain Tenant Root Group management permissions in Azure.
Technique: T1098.003 Account Manipulation: Additional Cloud Roles, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Earth Lusca has dropped an SSH-authorized key in the `/root/.ssh` folder in order to access a compromised server with SSH.
Technique: T1098.004 Account Manipulation: SSH Authorized Keys, Tactic: TA0003 Persistence TA0004 Privilege Escalation
TeamTNT has added RSA keys in `authorized_keys`.
Technique: T1098.004 Account Manipulation: SSH Authorized Keys, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Bundlore creates a new key pair with `ssh-keygen` and drops the newly created user key in `authorized_keys` to enable remote login.
Technique: T1098.004 Account Manipulation: SSH Authorized Keys, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Skidmap has the ability to add the public key of its handlers to the `authorized_keys` file to maintain persistence on an infected host.
Technique: T1098.004 Account Manipulation: SSH Authorized Keys, Tactic: TA0003 Persistence TA0004 Privilege Escalation
XCSSET will create an ssh key if necessary with the `ssh-keygen -t rsa -f $HOME/.ssh/id_rsa -P` command. XCSSET will upload a private key file to the server to remotely access the host without a password.
Technique: T1098.004 Account Manipulation: SSH Authorized Keys, Tactic: TA0003 Persistence TA0004 Privilege Escalation
During C0027, Scattered Spider registered devices for MFA to maintain persistence through victims' VPN.
Technique: T1098.005 Account Manipulation: Device Registration, Tactic: TA0003 Persistence TA0004 Privilege Escalation
During the SolarWinds Compromise, APT29 registered devices in order to enable mailbox syncing via the `Set-CASMailbox` command.
Technique: T1098.005 Account Manipulation: Device Registration, Tactic: TA0003 Persistence TA0004 Privilege Escalation
APT29 has enrolled their own devices into compromised cloud tenants, including enrolling a device in MFA to an Azure AD environment following a successful password guessing attack against a dormant account.
Technique: T1098.005 Account Manipulation: Device Registration, Tactic: TA0003 Persistence TA0004 Privilege Escalation
AADInternals can register a device to Azure AD.
Technique: T1098.005 Account Manipulation: Device Registration, Tactic: TA0003 Persistence TA0004 Privilege Escalation
During C0017, APT41 used the Cloudflare services for C2 communications.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
During C0027, Scattered Spider downloaded tools from sites including file.io, GitHub, and paste.ee.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
During Operation Spalax, the threat actors used OneDrive and MediaFire to host payloads.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
APT32 has used Dropbox, Amazon S3, and Google Drive to host malicious downloads.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
EXOTIC LILY has used file-sharing services including WeTransfer, TransferNow, and OneDrive to deliver payloads.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
Ember Bear has used Discord's content delivery network (CDN) to deliver malware and malicious scripts to a compromised host.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
FIN6 has used Pastebin and Google Storage to host content for their operations.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
FIN8 has used `sslip.io`, a free IP to domain mapping service that also makes SSL certificate generation easier for traffic encryption, as part of their command and control.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
Fox Kitten has used Amazon Web Services to host C2.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
Gamaredon Group has used GitHub repositories for downloaders which will be obtained by the group's .NET executable on the compromised system.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
Inception has incorporated at least five different cloud service providers into their C2 infrastructure including CloudMe.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
LazyScripter has used GitHub to host its payloads to operate spam campaigns.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
Mustang Panda has used DropBox URLs to deliver variants of PlugX.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
Rocke has used Pastebin, Gitee, and GitLab for Command and Control.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
TeamTNT has leveraged iplogger.org to send collected data back to C2.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
Turla has used legitimate web services including Pastebin, Dropbox, and GitHub for C2 communications.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
BADHATCH can be utilized to abuse `sslip.io`, a free IP to domain mapping service, as part of actor-controlled C2 channels.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
Bazar downloads have been hosted on Google Docs.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
BoomBox can download files from Dropbox using a hardcoded access token.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
Brute Ratel C4 can use legitimate websites for external C2 channels including Slack, Discord, and MS Teams.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
Bumblebee has been downloaded to victim's machines from OneDrive.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
Carbon can use Pastebin to receive C2 commands.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
CharmPower can download additional modules from actor-controlled Amazon S3 buckets.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
DarkTortilla can retrieve its primary payload from public sites such as Pastebin and Textbin.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
Doki has used the dogechain.info API to generate a C2 address.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
DropBook can communicate with its operators by exploiting the Simplenote, DropBox, and the social media platform, Facebook, where it can create fake accounts to control the backdoor and receive instructions.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
GuLoader has the ability to download malware from Google Drive.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
Hildegard has downloaded scripts from GitHub.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
NETWIRE has used web services including Paste.ee to host payloads.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
SMOKEDHAM has used Google Drive and Dropbox to host files downloaded by victims via malicious links.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
SharpStage has used a legitimate web service for evading detection.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
Sibot has used a legitimate compromised website to download DLLs to the victim's machine.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
Snip3 can download additional payloads from web services including Pastebin and top4top.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
SocGholish has used Amazon Web Services to host second-stage servers.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
WhisperGate can download additional payloads hosted on a Discord channel.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
ngrok has been used by threat actors to proxy C2 connections to ngrok service subdomains.
Technique: T1102 Web Service, Tactic: TA0011 Command and Control
During C0017, APT41 used dead drop resolvers on two separate tech community forums for their KEYPLUG Windows-version backdoor; notably APT41 updated the community forum posts frequently with new dead drop resolvers during the campaign.
Technique: T1102.001 Web Service: Dead Drop Resolver, Tactic: TA0011 Command and Control
APT41 used legitimate websites for C2 through dead drop resolvers (DDR), including GitHub, Pastebin, and Microsoft TechNet.
Technique: T1102.001 Web Service: Dead Drop Resolver, Tactic: TA0011 Command and Control
BRONZE BUTLER's MSGET downloader uses a dead drop resolver to access malicious payloads.
Technique: T1102.001 Web Service: Dead Drop Resolver, Tactic: TA0011 Command and Control
Patchwork hides base64-encoded and encrypted C2 server locations in comments on legitimate websites.
Technique: T1102.001 Web Service: Dead Drop Resolver, Tactic: TA0011 Command and Control
RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names.
Technique: T1102.001 Web Service: Dead Drop Resolver, Tactic: TA0011 Command and Control
Rocke has used Pastebin to check the version of beaconing malware and redirect to another Pastebin hosting updated malware.
Technique: T1102.001 Web Service: Dead Drop Resolver, Tactic: TA0011 Command and Control
Astaroth can store C2 information on cloud hosting services such as AWS and CloudFlare and websites like YouTube and Facebook.
Technique: T1102.001 Web Service: Dead Drop Resolver, Tactic: TA0011 Command and Control
BADNEWS collects C2 information via a dead drop resolver.
Technique: T1102.001 Web Service: Dead Drop Resolver, Tactic: TA0011 Command and Control
BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain a dead drop resolver containing an encoded tag with the IP address of a command and control server.
Technique: T1102.001 Web Service: Dead Drop Resolver, Tactic: TA0011 Command and Control
CharmPower can retrieve C2 domain information from actor-controlled S3 buckets.
Technique: T1102.001 Web Service: Dead Drop Resolver, Tactic: TA0011 Command and Control
Grandoreiro can obtain C2 information from Google Docs.
Technique: T1102.001 Web Service: Dead Drop Resolver, Tactic: TA0011 Command and Control
Javali can read C2 information from Google Documents and YouTube.
Technique: T1102.001 Web Service: Dead Drop Resolver, Tactic: TA0011 Command and Control
The KEYPLUG Windows variant has retrieved C2 addresses from encoded data in posts on tech community forums.
Technique: T1102.001 Web Service: Dead Drop Resolver, Tactic: TA0011 Command and Control
Metamorfo has used YouTube to store and hide C&C server domains.
Technique: T1102.001 Web Service: Dead Drop Resolver, Tactic: TA0011 Command and Control
Some MiniDuke components use Twitter to initially obtain the address of a C2 server or as a backup if no hard-coded C2 server responds.
Technique: T1102.001 Web Service: Dead Drop Resolver, Tactic: TA0011 Command and Control
PlugX uses Pastebin to store C2 addresses.
Technique: T1102.001 Web Service: Dead Drop Resolver, Tactic: TA0011 Command and Control
PolyglotDuke can use Twitter, Reddit, Imgur and other websites to get a C2 URL.
Technique: T1102.001 Web Service: Dead Drop Resolver, Tactic: TA0011 Command and Control
RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names. RTM has also hidden Pony C2 server IP addresses within transactions on the Bitcoin and Namecoin blockchain.
Technique: T1102.001 Web Service: Dead Drop Resolver, Tactic: TA0011 Command and Control
Xbash can obtain a webpage hosted on Pastebin to update its C2 domain list.
Technique: T1102.001 Web Service: Dead Drop Resolver, Tactic: TA0011 Command and Control
For Operation Ghost, APT29 used social media platforms to hide communications to C2 servers.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
APT12 has used blogs and WordPress for C2 infrastructure.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
APT28 has used Google Drive for C2.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
APT37 leverages social networking sites and cloud platforms (AOL, Twitter, Yandex, Mediafire, pCloud, Dropbox, and Box) for C2.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
APT39 has communicated with C2 through files uploaded to and downloaded from DropBox.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
Carbanak has used a VBScript named "ggldr" that uses Google Apps Script, Sheets, and Forms services for C2.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
FIN7 used legitimate services like Google Docs, Google Scripts, and Pastebin for C2.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
HEXANE has used cloud services, including OneDrive, for C2.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
Kimsuky has used Blogspot pages for C2.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
Lazarus Group has used GitHub as C2, pulling hosted image payloads then committing command execution output to files in specific directories.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
Magic Hound malware can use a SOAP Web service to communicate with its C2 server.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
MuddyWater has used web services including OneHub to distribute remote access tools.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
POLONIUM has used OneDrive and DropBox for C2.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
Sandworm Team has used the Telegram Bot API from Telegram Messenger to send and receive commands to its Python backdoor. Sandworm Team also used legitimate M.E.Doc software update check requests for sending and receiving commands and hosted malicious payloads on putdrive.com.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
A Turla JavaScript backdoor has used Google Apps Script as its C2 server.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
ZIRCONIUM has used Dropbox for C2 allowing upload and download of files as well as execution of arbitrary commands.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
BADNEWS can use multiple C2 channels, including RSS feeds, Github, forums, and blogs.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
BLACKCOFFEE has also obfuscated its C2 traffic as normal traffic to sites such as Github.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
BLUELIGHT can use different cloud providers for its C2.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
BoxCaon has used DropBox for C2 communications.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
The CALENDAR malware communicates through the use of events in Google Calendar.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
Clambling can use Dropbox to download malicious payloads, send commands, and receive information.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
One variant of CloudDuke uses a Microsoft OneDrive account to exchange commands and stolen data with its operators.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
ComRAT has the ability to use the Gmail web UI to receive commands and exfiltrate information.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
Comnie uses blogs and third-party sites (GitHub, tumbler, and BlogSpot) to avoid DNS-based blocking of their communication to the command and control server.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
CozyCar uses Twitter as a backup C2 channel to Twitter accounts specified in its configuration file.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
CreepyDrive can use OneDrive for C2.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
Crutch can use Dropbox to receive commands and upload stolen data.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
DOGCALL is capable of leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex for C2.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
Empire can use Dropbox and GitHub for C2.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
GLOOXMAIL communicates to servers operated by Google using the Jabber/XMPP protocol.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
Grandoreiro can utilize web services including Google sites to send and receive C2 data.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
KARAE can use public cloud-based storage providers for command and control.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
Kazuar has used compromised WordPress blogs as C2 servers.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
LOWBALL uses the Dropbox cloud storage service for command and control.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
Orz has used Technet and Pastebin web pages for command and control.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
POORAIM has used AOL Instant Messenger for C2.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
PowerStallion uses Microsoft OneDrive as a C2 server via a network drive mapped with `net use`.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
ROKRAT has used legitimate social networking sites and cloud platforms (including but not limited to Twitter, Yandex, Dropbox, and Mediafire) for C2 communications.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
RegDuke can use Dropbox as its C2 server.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
Revenge RAT used blogpost.com as its primary command and control server during a campaign.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
RogueRobin has used Google Drive as a Command and Control channel.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
SLOWDRIFT uses cloud based services for C2.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
Small Sieve has the ability to use the Telegram Bot API from Telegram Messenger to send and receive messages.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
UBoatRAT has used GitHub and a public blog service in Hong Kong for C2 communications.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
yty communicates to the C2 server by retrieving a Google Doc.
Technique: T1102.002 Web Service: Bidirectional Communication, Tactic: TA0011 Command and Control
Leviathan has received C2 instructions from user profiles created on legitimate websites such as Github and TechNet.
Technique: T1102.003 Web Service: One-Way Communication, Tactic: TA0011 Command and Control
EVILNUM has used a one-way communication method via GitLab and Digital Point to perform C2.
Technique: T1102.003 Web Service: One-Way Communication, Tactic: TA0011 Command and Control
The "tDiscoverer" variant of HAMMERTOSS establishes a C2 channel by downloading resources from Web services like Twitter and GitHub. HAMMERTOSS binaries contain an algorithm that generates a different Twitter handle for the malware to check for instructions every day.
Technique: T1102.003 Web Service: One-Way Communication, Tactic: TA0011 Command and Control
Metamorfo has downloaded a zip file for execution on the system.
Technique: T1102.003 Web Service: One-Way Communication, Tactic: TA0011 Command and Control
OnionDuke uses Twitter as a backup C2.
Technique: T1102.003 Web Service: One-Way Communication, Tactic: TA0011 Command and Control
An APT3 downloader first establishes a SOCKS5 connection to 192.157.198[.]103 using TCP port 1913; once the server response is verified, it then requests a connection to 192.184.60[.]229 on TCP port 81.
Technique: T1104 Multi-Stage Channels, Tactic: TA0011 Command and Control
APT41 used the storescyncsvc.dll BEACON backdoor to download a secondary backdoor.
Technique: T1104 Multi-Stage Channels, Tactic: TA0011 Command and Control
Lazarus Group has used multi-stage malware components that inject later stages into separate processes.
Technique: T1104 Multi-Stage Channels, Tactic: TA0011 Command and Control
MuddyWater has used one C2 to obtain enumeration scripts and monitor web logs, but a different C2 to send data back.
Technique: T1104 Multi-Stage Channels, Tactic: TA0011 Command and Control
BACKSPACE attempts to avoid detection by checking a first stage command and control server to determine if it should connect to the second stage server, which performs "louder" interactions with the malware.
Technique: T1104 Multi-Stage Channels, Tactic: TA0011 Command and Control
BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain an encoded tag containing the IP address of a command and control server and then communicates separately with that IP address for C2. If the C2 server is discovered or shut down, the threat actors can update the encoded IP address on TechNet to maintain control of the victims’ machines.
Technique: T1104 Multi-Stage Channels, Tactic: TA0011 Command and Control
The Bazar loader is used to download and execute the Bazar backdoor.
Technique: T1104 Multi-Stage Channels, Tactic: TA0011 Command and Control
After initial compromise, Chaos will download a second stage to establish a more permanent presence on the affected system.
Technique: T1104 Multi-Stage Channels, Tactic: TA0011 Command and Control
Snip3 can download and execute additional payloads and modules over separate communication channels.
Technique: T1104 Multi-Stage Channels, Tactic: TA0011 Command and Control
Individual Uroburos implants can use multiple communication channels based on one of four available modes of operation.
Technique: T1104 Multi-Stage Channels, Tactic: TA0011 Command and Control
Valak can download additional modules and malware capable of using separate C2 channels.
Technique: T1104 Multi-Stage Channels, Tactic: TA0011 Command and Control
During the 2015 Ukraine Electric Power Attack, Sandworm Team pushed additional malicious tools onto an infected system to steal user credentials, move laterally, and destroy data.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
During C0010, UNC3890 actors downloaded tools and malware onto a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
During C0015, the threat actors downloaded additional tools and files onto a compromised network.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
During C0017, APT41 downloaded malicious payloads onto compromised systems.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
During C0018, the threat actors downloaded additional tools, such as Mimikatz and Sliver, as well as Cobalt Strike and AvosLocker ransomware onto the victim network.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
During C0021, the threat actors downloaded additional tools and files onto victim machines.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
During C0026, the threat actors downloaded malicious payloads onto select compromised hosts.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
During C0027, Scattered Spider downloaded tools using victim organization systems.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
During CostaRicto, the threat actors downloaded malware and tools onto a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
During Cutting Edge, threat actors leveraged exploits to download remote files to Ivanti Connect Secure VPNs.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
During Frankenstein, the threat actors downloaded files and tools onto a victim machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
During FunnyDream, the threat actors downloaded additional droppers and backdoors onto a compromised system.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
During Night Dragon, threat actors used administrative utilities to deliver Trojan components to remote systems.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
During Operation Dream Job, Lazarus Group downloaded multistage malware and tools onto a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
During Operation Honeybee, the threat actors downloaded additional malware and malicious scripts onto a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
During Operation Sharpshooter, additional payloads were downloaded after a target was infected with a first-stage downloader.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
During Operation Wocao, threat actors downloaded additional files to the infected system.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
During the SolarWinds Compromise, APT29 downloaded additional malware, such as TEARDROP and Cobalt Strike, onto a compromised host following initial access.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
APT-C-36 has downloaded binary data from a specified domain after the malicious document is opened.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
APT18 can upload a file to the victim’s machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
APT28 has downloaded additional files, including by using a first-stage downloader to contact the C2 server to obtain the second-stage implant.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
APT29 has downloaded additional tools and malware onto compromised networks.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
APT3 has a tool that can copy files to remote machines.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
APT32 has added JavaScript to victim websites to download additional frameworks that profile and compromise website visitors.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
APT33 has downloaded additional files and programs from its C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
APT37 has downloaded second stage malware from compromised websites.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
APT38 used a backdoor, NESTEGG, that has the capability to download and upload files to and from a victim’s machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
APT39 has downloaded tools to compromised hosts.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
APT41 used certutil to download additional files. APT41 downloaded post-exploitation tools such as Cobalt Strike via command shell following initial access.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Ajax Security Team has used Wrapper/Gholee, custom-developed malware, which downloaded additional malware to the infected system.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Andariel has downloaded additional tools and malware onto compromised hosts.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Aquatic Panda has downloaded additional malware onto compromised hosts.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
BITTER has downloaded additional malware and tools onto a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
BRONZE BUTLER has used various tools to download files, including DGet (a similar tool to wget).
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
BackdoorDiplomacy has downloaded additional files and tools onto a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Chimera has remotely copied tools and malware onto targeted systems.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Cinnamon Tempest has downloaded files, including Cobalt Strike, to compromised hosts.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Cobalt Group has used public sites such as github.com and sendspace.com to upload files and then download them to victim computers. The group's JavaScript backdoor is also capable of downloading files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Confucius has downloaded additional files and payloads onto a compromised host following initial access.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Darkhotel has used first-stage payloads that download additional malware from C2 servers.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Dragonfly has copied and installed tools for operations once in the victim environment.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
The Ritsol backdoor trojan used by Elderwood can download files onto a compromised host from a remote location.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Ember Bear has used tools to download malicious code.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Evilnum can deploy additional components or tools as needed.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
FIN13 has downloaded additional tools and malware to compromised systems.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
FIN7 has downloaded additional malware to execute on the victim's machine, including by using a PowerShell script to launch shellcode that retrieves an additional payload.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
FIN8 has used remote code execution to download subsequent payloads.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Fox Kitten has downloaded additional tools including PsExec directly to endpoints.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
GALLIUM dropped additional tools to victims during their operation, including portqry.exe, a renamed cmd.exe file, winrar, and HTRAN.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Gamaredon Group has downloaded additional malware and tools onto a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Gorgon Group malware can download additional files from C2 servers.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
HAFNIUM has downloaded malware and tools--including Nishang and PowerCat--onto a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
HEXANE has downloaded additional payloads and malicious scripts onto a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
IndigoZebra has downloaded additional files and tools from its C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Indrik Spider has downloaded additional scripts, malware, and tools onto a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Ke3chang has used tools to download files to compromised machines.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Kimsuky has downloaded additional scripts, tools, and malware onto victim systems.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Lazarus Group has downloaded files, malware, and tools from its C2 onto a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
LazyScripter had downloaded additional tools to a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Leviathan has downloaded additional scripts and files from adversary-controlled servers.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
LuminousMoth has downloaded additional malware and tools onto a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Magic Hound has downloaded additional code and files from servers onto victims.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Metador has downloaded tools and malware onto a compromised system.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Molerats used executables to download malicious files from different sources.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Moses Staff has downloaded and installed web shells to following path `C:\inetpub\wwwroot\aspnet_client\system_web\IISpool.aspx`.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
MuddyWater has used malware that can upload additional files to the victim’s machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Mustang Panda has downloaded additional executables following the initial infection stage.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Mustard Tempest has deployed secondary payloads and third stage implants to compromised hosts.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Nomadic Octopus has used malicious macros to download additional files to the victim's machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
OilRig can download remote files onto victims.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
PLATINUM has transferred files using the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Patchwork payloads download additional files from the C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Rancor has downloaded additional malware, including by using certutil.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Rocke used malware to download additional malicious files to the target system.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Sandworm Team has pushed additional malicious tools onto an infected system to steal user credentials, move laterally, and destroy data.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
SideCopy has delivered trojanized executables via spearphishing emails that contacts actor-controlled servers to download malicious payloads.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Sidewinder has used LNK files to download remote files to the victim's network.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Silence has downloaded additional modules and malware to victim’s machines.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
TA2541 has used malicious scripts and macros with the ability to download additional payloads.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
TA505 has downloaded additional malware to execute on victim systems.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
TA551 has retrieved DLLs and installer binaries for malware execution from C2.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
TeamTNT has the `curl` and `wget` commands as well as batch scripts to download new tools.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Threat Group-3390 has downloaded additional malware and tools, including through the use of `certutil`, onto a compromised host .
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Tonto Team has downloaded malicious DLLs which served as a ShadowPad loader.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Tropic Trooper has used a delivered trojan to download additional files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Turla has used shellcode to download Meterpreter after compromising a victim.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Volatile Cedar can deploy additional tools.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
WIRTE has downloaded PowerShell code from the C2 server to be executed.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Whitefly has the ability to download additional tools from the C2.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Windshift has used tools to deploy additional payloads to compromised hosts.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Winnti Group has downloaded an auxiliary program named ff.exe to infected machines.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Wizard Spider can transfer malicious payloads such as ransomware to compromised machines.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
ZIRCONIUM has used tools to download malicious files to compromised hosts.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
menuPass has installed updates and new malware on victims.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
ABK has the ability to download files from C2.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
ANDROMEDA can download additional payloads from C2.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Action RAT has the ability to download additional payloads onto an infected machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Agent Tesla can download additional files for execution on the victim’s machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Agent.btz attempts to download an encrypted binary from a specified domain.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Amadey can download and execute files to further infect a host machine with additional malware.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Anchor can download additional payloads.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control