sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
Leviathan has obtained valid accounts to gain initial access.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
OilRig has used compromised credentials to access other systems on a victim network.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
POLONIUM has used valid compromised credentials to gain access to victim environments.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
PittyTiger attempts to obtain legitimate credentials during operations.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Sandworm Team have used previously acquired legitimate credentials prior to attacks.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Silence has used compromised credentials to log on to other systems and escalate privileges.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Silent Librarian has used compromised credentials to obtain unauthorized access to online accounts.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Suckfly used legitimate account credentials that they dumped to navigate the internal victim network as though they were the legitimate account owner.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Threat Group-3390 actors obtain legitimate credentials using a variety of methods and use them to further lateral movement on victim networks.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Wizard Spider has used valid credentials for privileged accounts with the goal of accessing domain controllers.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
menuPass has used valid accounts including shared between Managed Service Providers and clients to move between the two environments.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Dtrack used hard-coded credentials to gain access to a network share.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Industroyer can use supplied user credentials to execute processes and stop services.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Kinsing has used valid SSH credentials to access remote hosts.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Linux Rabbit acquires valid SSH accounts through brute force.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Some SeaDuke samples have a module to extract email from Microsoft Exchange servers using compromised credentials.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
FIN13 has leveraged default credentials for authenticating myWebMethods (WMS) and QLogic web management interface to gain initial access.
Technique: T1078.001 Valid Accounts: Default Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Magic Hound enabled and used the default system managed account, DefaultAccount, via `"powershell.exe" /c net user DefaultAccount /active:yes` to connect to a targeted Exchange server over RDP.
Technique: T1078.001 Valid Accounts: Default Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
HyperStack can use default credentials to connect to IPC$ shares on remote machines.
Technique: T1078.001 Valid Accounts: Default Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Stuxnet infected WinCC machines via a hardcoded database server password.
Technique: T1078.001 Valid Accounts: Default Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
During Cutting Edge, threat actors used compromised VPN accounts for lateral movement on targeted networks.
Technique: T1078.002 Valid Accounts: Domain Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
During Night Dragon, threat actors used domain accounts to gain further access to victim systems.
Technique: T1078.002 Valid Accounts: Domain Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
During Operation CuckooBees, the threat actors used compromised domain administrator credentials as part of their lateral movement.
Technique: T1078.002 Valid Accounts: Domain Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
For Operation Ghost, APT29 used stolen administrator credentials for lateral movement on compromised networks.
Technique: T1078.002 Valid Accounts: Domain Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
During Operation Wocao, threat actors used domain credentials, including domain admin, for lateral movement and privilege escalation.
Technique: T1078.002 Valid Accounts: Domain Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
During the SolarWinds Compromise, APT29 used domain administrators' accounts to help facilitate lateral movement on compromised networks.
Technique: T1078.002 Valid Accounts: Domain Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
APT3 leverages valid accounts after gaining credentials for use within the victim domain.
Technique: T1078.002 Valid Accounts: Domain Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
APT5 has used legitimate account credentials to move laterally through compromised environments.
Technique: T1078.002 Valid Accounts: Domain Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Chimera has used compromised domain accounts to gain access to the target environment.
Technique: T1078.002 Valid Accounts: Domain Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Cinnamon Tempest has obtained highly privileged credentials such as domain administrator in order to deploy malware.
Technique: T1078.002 Valid Accounts: Domain Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Indrik Spider has collected credentials from infected systems, including domain accounts.
Technique: T1078.002 Valid Accounts: Domain Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Magic Hound has used domain administrator accounts after dumping LSASS process memory.
Technique: T1078.002 Valid Accounts: Domain Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Naikon has used administrator credentials for lateral movement in compromised networks.
Technique: T1078.002 Valid Accounts: Domain Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Sandworm Team has used stolen credentials to access administrative accounts within the domain.
Technique: T1078.002 Valid Accounts: Domain Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
TA505 has used stolen domain admin accounts to compromise additional hosts.
Technique: T1078.002 Valid Accounts: Domain Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Threat Group-1314 actors used compromised domain credentials for the victim's endpoint management platform, Altiris, to move laterally.
Technique: T1078.002 Valid Accounts: Domain Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
ToddyCat has used compromised domain admin credentials to mount local network shares.
Technique: T1078.002 Valid Accounts: Domain Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Volt Typhoon has used compromised domain accounts to authenticate to devices on compromised networks.
Technique: T1078.002 Valid Accounts: Domain Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Wizard Spider has used administrative accounts, including Domain Admin, to move laterally within a victim network.
Technique: T1078.002 Valid Accounts: Domain Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Cobalt Strike can use known credentials to run commands and spawn processes as a domain user account.
Technique: T1078.002 Valid Accounts: Domain Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
CreepySnail can use stolen credentials to authenticate on target networks.
Technique: T1078.002 Valid Accounts: Domain Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Ryuk can use stolen domain admin accounts to move laterally within a victim domain.
Technique: T1078.002 Valid Accounts: Domain Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
If Shamoon cannot access shares using current privileges, it attempts access using hard coded, domain-specific credentials gathered earlier in the intrusion.
Technique: T1078.002 Valid Accounts: Domain Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Stuxnet attempts to access network resources with a domain account’s credentials.
Technique: T1078.002 Valid Accounts: Domain Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
During Operation Wocao, threat actors used local account credentials found during the intrusion for lateral movement and privilege escalation.
Technique: T1078.003 Valid Accounts: Local Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
During the SolarWinds Compromise, APT29 used compromised local accounts to access victims' networks.
Technique: T1078.003 Valid Accounts: Local Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
APT29 targets dormant or inactive user accounts, accounts belonging to individuals no longer at the organization but whose accounts remain on the system, for access and persistence.
Technique: T1078.003 Valid Accounts: Local Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
APT32 has used legitimate local admin account credentials.
Technique: T1078.003 Valid Accounts: Local Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
FIN10 has moved laterally using the Local Administrator account.
Technique: T1078.003 Valid Accounts: Local Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
FIN7 has used compromised credentials for access as SYSTEM on Exchange servers.
Technique: T1078.003 Valid Accounts: Local Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
HAFNIUM has used the NT AUTHORITY\SYSTEM account to create files on Exchange servers.
Technique: T1078.003 Valid Accounts: Local Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Kimsuky has used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP.
Technique: T1078.003 Valid Accounts: Local Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
PROMETHIUM has created admin accounts on a compromised host.
Technique: T1078.003 Valid Accounts: Local Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Tropic Trooper has used known administrator account credentials to execute the backdoor directly.
Technique: T1078.003 Valid Accounts: Local Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Turla has abused local accounts that have the same password across the victim’s network.
Technique: T1078.003 Valid Accounts: Local Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Cobalt Strike can use known credentials to run commands and spawn processes as a local user account.
Technique: T1078.003 Valid Accounts: Local Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Emotet can brute force a local admin password, then use it to facilitate lateral movement.
Technique: T1078.003 Valid Accounts: Local Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
NotPetya can use valid credentials with PsExec or `wmic` to spread itself to remote systems.
Technique: T1078.003 Valid Accounts: Local Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Umbreon creates valid local users to provide access to the system.
Technique: T1078.003 Valid Accounts: Local Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
During C0027, Scattered Spider leveraged compromised credentials from victim users  to authenticate to Azure tenants.
Technique: T1078.004 Valid Accounts: Cloud Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
During the SolarWinds Compromise, APT29 used a compromised O365 administrator account to create a new Service Principal.
Technique: T1078.004 Valid Accounts: Cloud Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
APT28 has used compromised Office 365 service accounts with Global Administrator privileges to collect email from user inboxes.
Technique: T1078.004 Valid Accounts: Cloud Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
APT29 has gained access to a global administrator account in Azure AD and has used `Service Principal` credentials in Exchange.
Technique: T1078.004 Valid Accounts: Cloud Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
APT33 has used compromised Office 365 accounts in tandem with Ruler in an attempt to gain control of endpoints.
Technique: T1078.004 Valid Accounts: Cloud Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
APT5 has accessed Microsoft M365 cloud environments using stolen credentials.
Technique: T1078.004 Valid Accounts: Cloud Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Ke3chang has used compromised credentials to sign into victims’ Microsoft 365 accounts.
Technique: T1078.004 Valid Accounts: Cloud Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
LAPSUS$ has used compromised credentials to access cloud assets within a target organization.
Technique: T1078.004 Valid Accounts: Cloud Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Pacu leverages valid cloud accounts to perform most of its operations.
Technique: T1078.004 Valid Accounts: Cloud Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Peirates can use stolen service account tokens to perform its operations.
Technique: T1078.004 Valid Accounts: Cloud Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
ROADTools leverages valid cloud credentials to perform enumeration operations using the internal Azure AD Graph API.
Technique: T1078.004 Valid Accounts: Cloud Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
BRONZE BUTLER has placed malware on file shares and given it the same name as legitimate documents on the share.
Technique: T1080 Taint Shared Content, Tactic: TA0008 Lateral Movement
Cinnamon Tempest has deployed ransomware from a batch file in a network share.
Technique: T1080 Taint Shared Content, Tactic: TA0008 Lateral Movement
Darkhotel used a virus that propagates by infecting executables stored on shared drives.
Technique: T1080 Taint Shared Content, Tactic: TA0008 Lateral Movement
Gamaredon Group has injected malicious macros into all Word and Excel documents on mapped network drives.
Technique: T1080 Taint Shared Content, Tactic: TA0008 Lateral Movement
Conti can spread itself by infecting other remote machines via network shared drives.
Technique: T1080 Taint Shared Content, Tactic: TA0008 Lateral Movement
H1N1 has functionality to copy itself to network shares.
Technique: T1080 Taint Shared Content, Tactic: TA0008 Lateral Movement
InvisiMole can replace legitimate software or documents in the compromised network with their trojanized versions, in an attempt to propagate itself within the network.
Technique: T1080 Taint Shared Content, Tactic: TA0008 Lateral Movement
Miner-C copies itself into the public folder of Network Attached Storage (NAS) devices and infects new victims who open the file.
Technique: T1080 Taint Shared Content, Tactic: TA0008 Lateral Movement
Ramsay can spread itself by infecting other portable executable files on networks shared drives.
Technique: T1080 Taint Shared Content, Tactic: TA0008 Lateral Movement
Stuxnet infects remote servers via network shares and by infecting WinCC database views with malicious code.
Technique: T1080 Taint Shared Content, Tactic: TA0008 Lateral Movement
Ursnif has copied itself to and infected files in network drives for propagation.
Technique: T1080 Taint Shared Content, Tactic: TA0008 Lateral Movement
During C0017, APT41 issued `ping -n 1 ((cmd /c dir c:\|findstr Number).split()[-1]+` commands to find the volume serial number of compromised systems.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
During Cutting Edge, threat actors used the ENUM4LINUX Perl script for discovery on Windows and Samba hosts.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
During Frankenstein, the threat actors used Empire to obtain the compromised machine's name.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
During FunnyDream, the threat actors used Systeminfo to collect information on targeted hosts.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
During Operation CuckooBees, the threat actors used the `systeminfo` command to gather details about a compromised system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
During Operation Honeybee, the threat actors collected the computer name, OS, and other system information using `cmd /c systeminfo > %temp%\ temp.ini`.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
During Operation Wocao, threat actors discovered the local disks attached to the system and their hardware information including manufacturer and model, as well as the OS versions of systems connected to a targeted network.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
During the SolarWinds Compromise, APT29 used `fsutil` to check available free space before executing actions that might create large files on disk.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
APT18 can collect system information from the victim’s machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
APT19 collected system architecture information. APT19 used an HTTP malware variant and a Port 22 malware variant to gather the hostname and CPU information from the victim’s machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
APT3 has a tool that can obtain information about the local system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
APT32 has collected the OS version and computer name from victims. One of the group's backdoors can also query the Windows Registry to gather system information, and another macOS backdoor performs a fingerprint of the machine on its first connection to the C&C server. APT32 executed shellcode to identify the name of the infected host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
APT37 collects the computer name, the BIOS model, and execution path.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
APT38 has attempted to get detailed information about a compromised host, including the operating system, version, patches, hotfixes, and service packs.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
APT41 uses multiple built-in commands such as `systeminfo` and `net config Workstation` to enumerate victim system basic configuration information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Aquatic Panda has used native OS commands to understand privilege levels and system details.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Blue Mockingbird has collected hardware details for the victim's system, including CPU and memory information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Chimera has used `fsutil fsinfo drives`, `systeminfo`, and `vssadmin list shadows` for system information including shadow volumes and drive information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Confucius has used a file stealer that can examine system drives, including those other than the C drive.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Darkhotel has collected the hostname, OS version, service pack version, and the processor architecture from the victim’s machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
FIN13 has collected local host information by utilizing Windows commands `systeminfo`, `fsutil`, and `fsinfo`. FIN13 has also utilized a compromised Symantex Altiris console and LanDesk account to retrieve host information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
FIN8 has used PowerShell Scripts to check the architecture of a compromised machine before the selection of a 32-bit or 64-bit version of a malicious .NET loader.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
A Gamaredon Group file stealer can gather the victim's computer name and drive serial numbers to send to a C2 server.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
HEXANE has collected the hostname of a compromised machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Higaisa collected the system volume serial number, GUID, and computer name.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Inception has used a reconnaissance module to gather information about the operating system and hardware on the infected host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Ke3chang performs operating system information discovery using `systeminfo` and has used implants to identify the system language and computer name.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Kimsuky has enumerated drives, OS type, OS version, and other information using a script or the "systeminfo" command.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Several Lazarus Group malware families collect information on the type and version of the victim OS, as well as the victim computer name and CPU information. A Destover-like variant used by Lazarus Group also collects disk space information and sends it to its C2 server.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Magic Hound malware has used a PowerShell command to check the victim system architecture to determine if it is an x64 machine. Other malware has obtained the OS version, UUID, and computer/host name to send to the C2 server.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Malteiro collects the machine information, system architecture, the OS version, computer name, and Windows product name.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Moses Staff collected information about the infected host, including the machine names and OS architecture.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
MuddyWater has used malware that can collect the victim’s OS version and machine name.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Mustang Panda has gathered system information using `systeminfo`.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Mustard Tempest has used implants to perform system reconnaissance on targeted systems.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
OilRig has run `hostname` and `systeminfo` on a victim.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Patchwork collected the victim computer name, OS version, and architecture type and sent the information to its C2 server. Patchwork also enumerated all available drives on the victim's machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Rocke has used uname -m to collect the name and information about the infected system's kernel.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Sandworm Team used a backdoor to enumerate information about the infected system's operating system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
SideCopy has identified the OS version of a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Sidewinder has used tools to collect the computer name, OS version, installed hotfixes, as well as information regarding the memory and processor on a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Sowbug obtained OS version and hardware configuration from a victim.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Stealth Falcon malware gathers system information via WMI, including the system directory, build number, serial number, version, manufacturer, model, and total physical memory.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
TA2541 has collected system information prior to downloading malware on the targeted host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
TeamTNT has searched for system version, architecture, disk partition, logical volume, and hostname information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
ToddyCat has collected information on bootable drives including model, vendor, and serial numbers.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Tropic Trooper has detected a target system’s OS version and system volume information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Turla surveys a system upon check-in to discover operating system configuration details using the `systeminfo` and `set` commands.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Volt Typhoon has discovered file system types, drive names, size, and free space on compromised systems.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Windigo has used a script to detect which Linux distribution and version is currently installed on the system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Windshift has used malware to identify the computer name of a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Wizard Spider has used Systeminfo and similar commands to acquire detailed configuration information of a victim's machine. Wizard Spider has also utilized the PowerShell cmdlet `Get-ADComputer` to collect DNS hostnames, last logon dates, and operating system information from Active Directory.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
ZIRCONIUM has used a tool to capture the processor architecture of a compromised host in order to register it with C2.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about the OS: `ver >> %temp%\download` `systeminfo >> %temp%\download`
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
4H RAT sends an OS version identifier in its beacons.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
ADVSTORESHELL can run Systeminfo to gather information about the victim.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Agent Tesla can collect the system's computer name and also has the capability to collect information on the processor, memory, OS, and video card from the system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Akira uses the `GetSystemInfo` Windows function to determine the number of processors on a victim machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Amadey has collected the computer name and OS version from a compromised machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Anchor can determine the hostname and linux version on a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
AppleJeus has collected the victim host information after infection.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
AppleSeed can identify the OS version of a targeted system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Aria-body has the ability to identify the hostname, computer name, Windows version, processor speed, machine GUID, and disk information on a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Astaroth collects the machine name and keyboard language from the system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
AsyncRAT can check the disk size through the values obtained with `DeviceInfo.`
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Attor monitors the free disk space on the system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
AuTo Stealer has the ability to collect the hostname and OS information from an infected host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Avenger has the ability to identify the host volume ID and the OS architecture on a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Azorult can collect the machine information, system architecture, the OS version, computer name, Windows product name, the number of CPU cores, video card information, and the system language.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
During its initial execution, BACKSPACE extracts operating system information from the infected host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
BADCALL collects the computer name and host name on the compromised system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
BADFLICK has captured victim computer name, memory space, and CPU details.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
BADHATCH can obtain current system information from a compromised machine such as the `SHELL PID`, `PSVERSION`, `HOSTNAME`, `LOGONSERVER`, `LASTBOOTUP`, drive information, OS type/version, bitness, and hostname.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
BISCUIT has a command to collect the processor type, operation system, computer name, and whether the system is a laptop or PC.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
BLINDINGCAN has collected from a victim machine the system name, processor information, OS version, and disk information, including type and free space available.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
BLUELIGHT has collected the computer name and OS version from victim machines.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
BUBBLEWRAP collects system information, including the operating system version and hostname.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Babuk can enumerate disk volumes, get disk information, and query service status.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
BabyShark has executed the `ver` command.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
BackConfig has the ability to gather the victim's computer name.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Backdoor.Oldrea collects information about the OS and computer name.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
BadPatch collects the OS system, OS version, MAC address, and the computer name from the victim’s machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Bandook can collect information about the drives available on the system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Bankshot gathers system information, network addresses, disk type, disk free space, and the operation system version.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Bazar can fingerprint architecture, computer name, and OS version on the compromised host. Bazar can also check if the Russian language is installed on the infected machine and terminate if it is found.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Bisonal has used commands and API calls to gather system information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Black Basta can enumerate volumes and collect system boot configuration and CPU information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
BlackCat can obtain the computer name and UUID, and enumerate local drives.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
BlackEnergy has used Systeminfo to gather the OS version, as well as information on the system configuration, BIOS, the motherboard, and the processor.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
BlackMould can enumerate local drives on a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Bonadan has discovered the OS version, CPU model, and RAM size of the system it has been installed on.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
BoomBox can enumerate the hostname, domain, and IP of a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Brave Prince collects hard drive content and system configuration information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Bumblebee can enumerate the OS version and domain on a targeted system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Bundlore will enumerate the macOS version to determine which follow-on behaviors to execute using `/usr/bin/sw_vers -productVersion`.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
CARROTBAT has the ability to determine the operating system of the compromised host and whether Windows is being run with x86 or x64 architecture.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
CORESHELL collects hostname, volume serial number and OS version data from the victim and sends the information to its C2 server.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
CaddyWiper can use `DsRoleGetPrimaryDomainInformation` to determine the role of the infected machine. CaddyWiper can also halt execution if the compromised host is identified as a domain controller.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Cadelspy has the ability to discover information about the compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Cannon can gather system information from the victim’s machine such as the OS version, machine name, and drive information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Carberp has collected the operating system version from the infected system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Cardinal RAT can collect the hostname, Microsoft Windows version, and processor architecture from a victim machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Caterpillar WebShell has a module to gather information from the compromrised asset, including the computer version, computer name, IIS version, and more.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
ChChes collects the victim hostname, window resolution, and Microsoft Windows version.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Chaes has collected system information, including the machine name and OS version.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
CharmPower can enumerate the OS version and computer name on a targeted system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Chrommme has the ability to list drives and obtain the computer name of a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Clambling can discover the hostname, computer name, and Windows version of a targeted machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Comnie collects the hostname of the victim machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
A system info module in CozyCar gathers information on the victim host’s configuration.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
CrackMapExec can enumerate the system drives and associated system name.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Crimson contains a command to collect the victim PC name, disk drive information, and operating system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Cuba can enumerate local drives, disk type, and disk free space.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Cyclops Blink has the ability to query device information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
DEADEYE can enumerate a victim computer's volume serial number and host name.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
DEATHRANSOM can enumerate logical drives on a target system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
DarkComet can collect the computer name, RAM used, and operating system version from the victim’s machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
DarkGate uses the Delphi methods `Sysutils::DiskSize` and `GlobalMemoryStatusEx` to collect disk size and physical memory as part of the malware's anti-analysis checks for running in a virtualized environment. DarkGate will gather various system information such as display adapter description, operating system type and version, processor type, and RAM amount.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
DarkTortilla can obtain system information by querying the `Win32_ComputerSystem`, `Win32_BIOS`, `Win32_MotherboardDevice`, `Win32_PnPEntity`, and `Win32_DiskDrive` WMI objects.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
DarkWatchman can collect the OS version, system architecture, and computer name.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Denis collects OS information and the computer name from the victim’s machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Derusbi gathers the name of the local host, version of GNU Compiler Collection (GCC), and the system information about the CPU, machine, and operating system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Diavol can collect the computer name and OS version from the system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
DownPaper collects the victim host name and serial number, and then sends the information to the C2 server.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Dridex has collected the computer name and OS architecture information from the system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
DropBook has checked for the presence of Arabic language in the infected machine's settings.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Dtrack can collect the victim's computer name, hostname and adapter information to create a unique identifier.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
DustySky extracts basic information about the operating system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Dyre has the ability to identify the computer name, OS version, and hardware configuration on a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
EVILNUM can obtain the computer name from the victim's system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Egregor can perform a language check of the infected system and can query the CPU information (cupid).
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Elise executes `systeminfo` after initial communication is made to the remote server.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Emissary has the capability to execute ver and systeminfo commands.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Empire can enumerate host system information like OS, architecture, domain name, applied patches, and more.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
EnvyScout can determine whether the ISO payload was received by a Windows or iOS device.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Epic collects the OS version, hardware information, computer name, available system memory status, disk space information, and system and user language settings.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Explosive has collected the computer name from the infected host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
FALLCHILL can collect operating system (OS) version information, processor information, system name, and information about installed disks from the victim.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
FELIXROOT collects the victim’s computer name, processor architecture, OS version, volume serial number, and system type.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
FatDuke can collect the user name, Windows version, computer name, and available space on discs from a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Felismus collects the system information, including hostname and OS version, and sends it to the C2 server.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Ferocious can use `GET.WORKSPACE` in Microsoft Excel to determine the OS version of the compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
FinFisher checks if the victim OS is 32 or 64-bit.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Final1stspy obtains victim Microsoft Windows version information and CPU architecture.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
FlawedAmmyy can collect the victim's operating system and computer name during the initial infection.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
FunnyDream can enumerate all logical drives on a targeted machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Fysbis has used the command `ls /etc | egrep -e"fedora\*|debian\*|gentoo\*|mandriva\*|mandrake\*|meego\*|redhat\*|lsb-\*|sun-\*|SUSE\*|release"` to determine which Linux OS version is running.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
GRIFFON has used a reconnaissance module that can be used to retrieve information about a victim's computer, including the resolution of the workstation .
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Gelsemium can determine the operating system and whether a targeted machine has a 32 or 64 bit architecture.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Get2 has the ability to identify the computer name and Windows version of an infected host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Gold Dragon collects endpoint information using the `systeminfo` command.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
GoldenSpy has gathered operating system information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Grandoreiro can collect the computer name and OS version from a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
GravityRAT collects the MAC address, computer name, and CPU information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Green Lambert can use `uname` to identify the operating system name, version, and processor type.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
GrimAgent can collect the OS, and build version on a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
HALFBAKED can obtain information about the OS, processor, and BIOS.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
can collect system information, including computer name, system manufacturer, IsDebuggerPresent state, and execution path.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery