sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
Patchwork developed a file stealer to search C:\ and collect files with certain extensions. Patchwork also executed a script to enumerate all drives, store them as a list, and upload generated files to the C2 server.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
Sidewinder has used tools to automatically collect system and network configuration information.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
Tropic Trooper has collected information automatically using the adversary's USBferry attack.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
menuPass has used the Csvde tool to collect Active Directory files and data.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
Attor has automatically collected data about the compromised system.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
BADNEWS monitors USB devices and copies files with certain extensions to a predefined directory.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
Bankshot recursively generates a list of files within a directory and sends them back to the control server.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
Comnie executes a batch script to store discovery information in %TEMP%\info.dat and then uploads the temporarily file to the remote C2 server.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
Crutch can automatically monitor removable drives in a loop and copy interesting files.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
DarkGate searches for stored credentials associated with cryptocurrency wallets and notifies the command and control server when identified.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
Empire can automatically gather the username, domain name, machine name, and other information from a compromised system.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
FunnyDream can monitor files for changes and automatically collect them.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
GoldFinder logged and stored information related to the route or hops a packet took from a compromised machine to a hardcoded C2 server, including the target C2 URL, HTTP response/status code, HTTP response headers and values, and data received from the C2 node.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
A Helminth VBScript receives a batch script to execute a set of commands in a command prompt.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
InvisiMole can sort and collect specific documents as well as generate a list of all files on a newly inserted drive and store them in an encrypted file.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
LightNeuron can be configured to automatically collect files under a specified directory.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
LoFiSe can collect all the files from the working directory every three hours and place them into a password-protected archive for further exfiltration.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
MESSAGETAP checks two files, keyword_parm.txt and parm.txt, for instructions on how to target and save data parsed and extracted from SMS message data from the network traffic. If an SMS message contained either a phone number, IMSI number, or keyword that matched the predefined list, it is saved to a CSV file for later theft by the threat actor.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
Metamorfo has automatically collected mouse clicks, continuous screenshots on the machine, and set timers to collect the contents of the clipboard and website browsing.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
Micropsia executes an RAR tool to recursively archive files based on a predefined list of file extensions (*.xls, *.xlsx, *.csv, *.odt, *.doc, *.docx, *.ppt, *.pptx, *.pdf, *.mdb, *.accdb, *.accde, *.txt).
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
Mythic supports scripting of file downloads from agents.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
NETWIRE can automatically archive collected data.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
OutSteel can automatically scan for and collect files with specific extensions.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
PACEMAKER can enter a loop to read `/proc/` entries every 2 seconds in order to read a target application's memory.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
Pacu can automatically collect data, such as CloudFormation templates, EC2 user data, AWS Inspector reports, and IAM credential reports.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
PoetRAT used file system monitoring to track modification and enable automatic exfiltration.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
PoshC2 contains a module for recursively parsing through files and directories to gather valid credit card numbers.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
Proxysvc automatically collects data about the victim and sends it to the control server.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
ROADTools automatically gathers data from Azure AD environments using the Azure Graph API.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
RTM monitors browsing activity and automatically captures screenshots if a victim browses to a URL matching one of a list of strings.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
Ramsay can conduct an initial scan for Microsoft Word documents on the local system, removable media, and connected network drives, before tagging and collecting them. It can continue tagging documents to collect with follow up scans.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
Depending on the Linux distribution, RotaJakiro executes a set of commands to collect device information and sends the collected information to the C2 server.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
Rover automatically collects files from the local system and removable drives based on a predefined list of file extensions on a regular timeframe.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
ShimRatReporter gathered information automatically, without instruction from a C2, related to the user and host machine that is compiled into a report and sent to the operators.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
StrongPity has a file searcher component that can automatically collect and archive files based on a predefined list of file extensions.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
T9000 searches removable storage devices for files with a pre-defined list of file extensions (e.g. * .doc, *.ppt, *.xls, *.docx, *.pptx, *.xlsx). Any matching files are encrypted and written to a local user directory.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
TajMahal has the ability to index and compress files into a send queue for exfiltration.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
For all non-removable drives on a victim, USBStealer executes automated collection of certain files for later exfiltration.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
VERMIN saves each collected file with the automatically generated format {0:dd-MM-yyyy}.txt .
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
Valak can download a module to search for and build a report of harvested credential data.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
WindTail can identify and add files that possess specific file extensions to an array for archiving.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
Zebrocy scans the system and automatically collects files with the following extensions: .doc, .docx, ,.xls, .xlsx, .pdf, .pptx, .rar, .zip, .jpg, .jpeg, .bmp, .tiff, .kum, .tlg, .sbx, .cr, .hse, .hsf, and .lhz.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
ccf32 can be used to automatically collect files from a compromised host.
Technique: T1119 Automated Collection, Tactic: TA0009 Collection
During Operation CuckooBees, the threat actors used the `fsutil fsinfo drives` command as part of their advanced reconnaissance.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
During Operation Wocao, threat actors discovered removable disks attached to a system.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
BackdoorDiplomacy has used an executable to detect removable media, such as USB flash drives.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
Equation has used tools with the functionality to search for specific information about the attached hard drive that could be used to identify and overwrite the firmware.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
Gamaredon Group tools have contained an application to check performance of USB flash drives. Gamaredon Group has also used malware to scan for removable drives.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
OilRig has used tools to identify if a mouse is connected to a targeted system.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
TeamTNT has searched for attached VGA devices using lspci.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
Turla has used `fsutil fsinfo drives` to list connected drives.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
ADVSTORESHELL can list connected devices.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
Attor has a plugin that collects information about inserted storage devices, modems, and phone devices.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
BADNEWS checks for new hard drives on the victim, such as USB devices, by listening for the WM_DEVICECHANGE window message.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
Bandook can detect USB devices.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
BlackEnergy can gather very specific information about attached USB devices, to include device instance ID and drive geometry.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
Cadelspy has the ability to steal information about printers and the documents sent to printers.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
Crimson has the ability to discover pluggable/removable drives to extract files from.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
Crutch can monitor for removable drives being plugged into the compromised machine.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
DarkWatchman can list signed PnP drivers for smartcard readers.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
DustySky can detect connected USB devices.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
Ferocious can run `GET.WORKSPACE` in Microsoft Excel to check if a mouse is present.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
FlawedAmmyy will attempt to detect if a usable smart card is current inserted into a card reader.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
The FunnyDream FilepakMonitor component can detect removable drive insertion.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
Heyoka Backdoor can identify removable media attached to victim's machines.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
Machete detects the insertion of new devices by listening for the WM_DEVICECHANGE window message.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
Mongall can identify removable media attached to compromised hosts.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
MoonWind obtains the number of removable drives from the victim.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
NightClub has the ability to monitor removable drives.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
ObliqueRAT can discover pluggable/removable drives to extract files from.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
A module in Prikormka collects information on available printers and disk drives.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
QakBot can identify peripheral devices on targeted systems.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
QuietSieve can identify and search removable drives for specific file name extensions.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
RTM can obtain a list of smart card readers attached to the victim.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
Ragnar Locker may attempt to connect to removable drives and mapped network drives.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
Ramsay can scan for removable media which may contain documents for collection.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
SVCReady can check for the number of devices plugged into an infected host.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
SharpDisco has dropped a plugin to monitor external drives to `C:\Users\Public\It3.exe`.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
Stuxnet enumerates removable drives for infection.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
T9000 searches through connected drives for removable storage devices.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
TajMahal has the ability to identify connected Apple devices.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
Turian can scan for removable media to collect data.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
USBStealer monitors victims for insertion of removable drives. When dropped onto a second victim, it also enumerates drives connected to the system.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
USBferry can check for connected USB devices.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
WannaCry contains a thread that will attempt to scan for new attached drives every few seconds. If one is identified, it will encrypt the files on the attached device.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
WastedLocker can enumerate removable drives prior to the encryption process.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
Zebrocy enumerates information about connected storage devices.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
jRAT can map UPnP ports.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
njRAT will attempt to detect if the victim system has a camera during the initial infection. njRAT can also detect any removable drives connected to the system.
Technique: T1120 Peripheral Device Discovery, Tactic: TA0007 Discovery
APT37 has used an audio capturing utility known as SOUNDWAVE that captures microphone input.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
Attor's has a plugin that is capable of recording audio using available input sound devices.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
Bandook has modules that are capable of capturing audio.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
Cadelspy has the ability to record audio from the compromised host.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
Cobian RAT has a feature to perform voice recording on the victim’s machine.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
Crimson can perform audio surveillance using microphones.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
DOGCALL can capture microphone data from the victim's machine.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
DarkComet can listen in to victims' conversations through the system’s microphone.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
Derusbi is capable of performing audio captures.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
EvilGrab has the capability to capture audio from a victim machine.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
Flame can record audio using any existing hardware recording devices.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
Imminent Monitor has a remote microphone monitoring capability.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
InvisiMole can record sound using input audio devices.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
Janicab captured audio and sent it out to a C2 server.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
MacMa has the ability to record audio.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
MacSpy can record the sounds from microphones on a computer.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
Machete captures audio from the computer’s microphone.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
Micropsia can perform microphone recording.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
NanoCore can capture audio feeds from the system.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
NightClub can load a module to leverage the LAME encoder and `mciSendStringW` to control and capture audio.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
PowerSploit's `Get-MicrophoneAudio` Exfiltration module can record system microphone audio.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
Pupy can record sound with the microphone.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
ROKRAT has an audio capture and eavesdropping module.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
Remcos can capture data from the system’s microphone.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
Revenge RAT has a plugin for microphone interception.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
T9000 uses the Skype API to record audio and video calls. It writes encrypted data to `%APPDATA%\Intel\Skype`.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
TajMahal has the ability to capture VoiceIP application audio on an infected host.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
VERMIN can perform audio capture.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
jRAT can capture microphone recordings.
Technique: T1123 Audio Capture, Tactic: TA0009 Collection
During C0015, the threat actors used the command `net view /all time` to gather the local time of a compromised network.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
During Operation CuckooBees, the threat actors used the `net time` command as part of their advanced reconnaissance.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
During Operation Wocao, threat actors used the `time` command to retrieve the current time of a compromised system.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
BRONZE BUTLER has used `net time` to check the local time on a target system.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Chimera has used `time /t` and `net time \\ip/hostname` for system time discovery.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Darkhotel malware can obtain system time from a compromised host.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Higaisa used a function to gather the current time.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
A Destover-like implant used by Lazarus Group can obtain the current system time and send it to the C2 server.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Sidewinder has used tools to obtain the current system time.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
The White Company has checked the current date on the victim system.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Turla surveys a system upon check-in to discover the system time by using the `net time` command.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
ZIRCONIUM has used a tool to capture the time on a compromised host in order to register it with C2.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Agent Tesla can collect the timestamp from the victim’s machine.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
AppleSeed can pull a timestamp from the victim's machine.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Astaroth collects the timestamp from the infected machine.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
AvosLocker has checked the system time before and after encryption.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Azorult can collect the time zone information from the system.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
BADHATCH can obtain the `DATETIME` and `UPTIME` from a compromised machine.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
BISCUIT has a command to collect the system `UPTIME`.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
BLUELIGHT can collect the local time on a compromised host.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Bazar can collect the time on the compromised host.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
BendyBear has the ability to determine local time on a compromised host.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Bisonal can check the system time set on the infected host.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Cannon can collect the current time zone information from the victim’s machine.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Carbon uses the command `net time \\127.0.0.1` to get information the system’s time.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Clambling can determine the current time.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
ComRAT has checked the victim system's date and time to perform tasks during business hours (9 to 5, Monday to Friday).
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Conficker uses the current UTC victim system date for domain generation and connects to time servers to determine the current date.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Crimson has the ability to determine the date and time on a compromised host.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
DCSrv can compare the current time on an infected host with a configuration value to determine when to start the encryption process.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
DRATzarus can use the `GetTickCount` and `GetSystemTimeAsFileTime` API calls to inspect system time.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
DarkGate creates a log file for capturing keylogging, clipboard, and related data using the victim host's current date for the filename. DarkGate queries victim system epoch time during execution. DarkGate captures system time information as part of automated profiling on initial installation.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
DarkWatchman can collect time zone information and system `UPTIME`.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Egregor contains functionality to query the local/system time.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Epic uses the `net time` command  to get the system time from the machine and collect the current date and time zone information.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
EvilBunny has used the API calls NtQuerySystemTime, GetSystemTimeAsFileTime, and GetTickCount to gather time metrics as part of its checks to see if the malware is running in a sandbox.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
FELIXROOT gathers the time zone information from the victim’s machine.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
FunnyDream can check system time to help determine when changes were made to specified files.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
GRIFFON has used a reconnaissance module that can be used to retrieve the date and time of the system.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
GoldMax can check the current date-time value of the compromised system, comparing it to the hardcoded execution trigger and can send the current timestamp to the C2 server.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Grandoreiro can determine the time on the victim machine via IPinfo.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
GravityRAT can obtain the date and time of a system.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Green Lambert can collect the date and time from a compromised host.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
HOPLIGHT has been observed collecting system time from victim machines.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
InvisiMole gathers the local system time from the victim’s machine.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
KEYPLUG can obtain the current tick count of an infected computer.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Metamorfo uses JavaScript to get the system time.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
MoonWind obtains the victim's current time.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
NOKKI can collect the current timestamp of the victim's machine.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
The `net time` command can be used in Net to determine the local or remote system time.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Okrum can obtain the date and time of the compromised system.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
OopsIE checks to see if the system is configured with "Daylight" time and checks for a specific region to be set for the timezone.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
PipeMon can send time zone information from a compromised host to C2.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
PowerDuke has commands to get the time the machine was built, the time, and the time zone.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
As part of the data reconnaissance phase, Proxysvc grabs the system time to send back to the control server.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
QakBot can identify the system time on a targeted host.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
RTM can obtain the victim time zone.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
SHARPSTATS has the ability to identify the current date and time on the compromised host.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
SILENTTRINITY can collect start time information from a compromised host.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
SUNBURST collected device `UPTIME`.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
SVCReady can collect time zone information.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
ShadowPad has collected the current date and time of the victim system.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Shamoon obtains the system time and will only activate if it is greater than a preset date.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
SombRAT can execute `getinfo`  to discover the current time on a compromised host.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
StoneDrill can obtain the current date and time of the victim machine.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
StrifeWater can collect the time zone from the victim's machine.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Stuxnet collects the time and date of a system when it is infected.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
T9000 gathers and beacons the system time during installation.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
TAINTEDSCRIBE can execute `GetLocalTime` for time discovery.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Taidoor can use `GetLocalTime` and `GetSystemTime` to collect system time.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
TajMahal has the ability to determine local time on a compromised host.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Torisma can collect the current time on a victim machine.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
UPPERCUT has the capability to obtain the time zone information and current timestamp of the victim’s machine.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
WindTail has the ability to generate the current date and time.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Zebrocy gathers the current time zone and date information from the system.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
Zeus Panda collects the current system time (UTC) and sends it back to the C2 server.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
build_downer has the ability to determine the local time to ensure malware installation only happens during the hours that the infected system is active.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
ccf32 can determine the local time on targeted machines.
Technique: T1124 System Time Discovery, Tactic: TA0007 Discovery
FIN7 created a custom video recording capability that could be used to monitor operations in the victim's environment.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
Silence has been observed making videos of victims to observe bank employees day to day activities.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
Agent Tesla can access the victim’s webcam and record video.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
AsyncRAT can record screen content on targeted systems.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
Bandook has modules that are capable of capturing video from a victim's webcam.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
Clambling can record screen content in AVI format.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
Cobian RAT has a feature to access the webcam on the victim’s machine.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
ConnectWise can record video on remote hosts.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
Crimson can capture webcam video on targeted systems.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
DarkComet can access the victim’s webcam to take pictures.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
Derusbi is capable of capturing video.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
Empire can capture webcam data on Windows and macOS systems.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
EvilGrab has the capability to capture video from a victim machine.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
Imminent Monitor has a remote webcam monitoring capability.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
InvisiMole can remotely activate the victim’s webcam to capture content.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
Kazuar captures images from the webcam.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
Machete takes photos from the computer’s web camera.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
NanoCore can access the victim's webcam and capture data.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
ObliqueRAT can capture images from webcams on compromised hosts.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
PcShare can capture camera video as part of its collection process.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
PoetRAT has used a Python tool named Bewmac to record the webcam on compromised hosts.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
Pupy can access a connected webcam and capture pictures.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
QuasarRAT can perform webcam viewing.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
Remcos can access a system’s webcam and take pictures.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
Revenge RAT has the ability to access the webcam.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
SDBbot has the ability to record video on a compromised host.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
T9000 uses the Skype API to record audio and video calls. It writes encrypted data to `%APPDATA%\Intel\Skype`.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
TajMahal has the ability to capture webcam video.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
WarzoneRAT can access the webcam on a victim's machine.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
ZxShell has a command to perform video device spying.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
jRAT has the capability to capture video from a webcam.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
njRAT can access the victim's webcam.
Technique: T1125 Video Capture, Tactic: TA0009 Collection
During Frankenstein, the threat actors used MSbuild to execute an actor-created file.
Technique: T1127.001 Trusted Developer Utilities Proxy Execution: MSBuild, Tactic: TA0005 Defense Evasion
Empire can use built-in modules to abuse trusted utilities like MSBuild.exe.
Technique: T1127.001 Trusted Developer Utilities Proxy Execution: MSBuild, Tactic: TA0005 Defense Evasion
A version of PlugX loads as shellcode within a .NET Framework project using msbuild.exe, presumably to bypass application control techniques.
Technique: T1127.001 Trusted Developer Utilities Proxy Execution: MSBuild, Tactic: TA0005 Defense Evasion
Astaroth uses the LoadLibraryExW() function to load additional modules.
Technique: T1129 Shared Modules, Tactic: TA0002 Execution
Attor's dispatcher can execute additional plugins by loading the respective DLLs.
Technique: T1129 Shared Modules, Tactic: TA0002 Execution
BLINDINGCAN has loaded and executed DLLs in memory during runtime on a victim machine.
Technique: T1129 Shared Modules, Tactic: TA0002 Execution
BOOSTWRITE has used the DWriteCreateFactory() function to load additional modules.
Technique: T1129 Shared Modules, Tactic: TA0002 Execution
Bumblebee can use `LoadLibrary` to attempt to execute GdiPlus.dll.
Technique: T1129 Shared Modules, Tactic: TA0002 Execution
DarkWatchman can load DLLs.
Technique: T1129 Shared Modules, Tactic: TA0002 Execution
Dtrack contains a function that calls `LoadLibrary` and `GetProcAddress`.
Technique: T1129 Shared Modules, Tactic: TA0002 Execution
FoggyWeb's loader can call the `load()` function to load the FoggyWeb dll into an Application Domain on a compromised AD FS server.
Technique: T1129 Shared Modules, Tactic: TA0002 Execution
Hydraq creates a backdoor through which remote attackers can load and call DLL functions.
Technique: T1129 Shared Modules, Tactic: TA0002 Execution
KillDisk loads and executes functions from a DLL.
Technique: T1129 Shared Modules, Tactic: TA0002 Execution
Metamorfo had used AutoIt to load and execute the DLL payload.
Technique: T1129 Shared Modules, Tactic: TA0002 Execution
For network communications, OSX_OCEANLOTUS.D loads a dynamic library (`.dylib` file) using `dlopen()` and obtains a function pointer to execute within that shared library using `dlsym()`.
Technique: T1129 Shared Modules, Tactic: TA0002 Execution
PUNCHBUGGY can load a DLL using the LoadLibrary API.
Technique: T1129 Shared Modules, Tactic: TA0002 Execution
PipeMon has used call to `LoadLibrary` to load its installer. PipeMon loads its modules using reflective loading or custom shellcode.
Technique: T1129 Shared Modules, Tactic: TA0002 Execution
RotaJakiro uses dynamically linked shared libraries (`.so` files) to execute additional functionality using `dlopen()` and `dlsym()`.
Technique: T1129 Shared Modules, Tactic: TA0002 Execution
Stuxnet calls LoadLibrary then executes exports from a DLL.
Technique: T1129 Shared Modules, Tactic: TA0002 Execution
TajMahal has the ability to inject the `LoadLibrary` call template DLL into running processes.
Technique: T1129 Shared Modules, Tactic: TA0002 Execution
gh0st RAT can load DLLs into memory.
Technique: T1129 Shared Modules, Tactic: TA0002 Execution
After encrypting C2 data, BADNEWS converts it into a hexadecimal representation and then encodes it into base64.
Technique: T1132 Data Encoding, Tactic: TA0011 Command and Control
H1N1 obfuscates C2 traffic with an altered version of base64.
Technique: T1132 Data Encoding, Tactic: TA0011 Command and Control
Linux Rabbit sends the payload from the C2 server as an encoded URL parameter.
Technique: T1132 Data Encoding, Tactic: TA0011 Command and Control
Mythic provides various transform functions to encode and/or randomize C2 data.
Technique: T1132 Data Encoding, Tactic: TA0011 Command and Control
Ursnif has used encoded data in HTTP URLs for C2.
Technique: T1132 Data Encoding, Tactic: TA0011 Command and Control
An APT19 HTTP malware variant used Base64 to encode communications to the C2 server.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
APT33 has used base64 to encode command and control traffic.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Several BRONZE BUTLER tools encode data with base64 when posting it to a C2 server.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
HAFNIUM has used ASCII encoding for C2 traffic.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
A Lazarus Group malware sample encodes data with base64.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
MuddyWater has used tools to encode C2 communications including Base64 encoding.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Patchwork used Base64 to encode C2 traffic.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Sandworm Team's BCS-server tool uses base64 encoding and HTML tags for the communication traffic between the C2 server.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
TA551 has used encoded ASCII text for initial C2 communications.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Tropic Trooper has used base64 encoding to hide command strings delivered from the C2.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Astaroth encodes data using Base64 before sending it to the C2 server.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
AutoIt backdoor has sent a C2 response that was base64-encoded.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
BADNEWS encodes C2 traffic with base64.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
BLINDINGCAN has encoded its C2 traffic with Base64.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
BS2005 uses Base64 encoding for communication in the message body of an HTTP request.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
BabyShark has encoded data using certutil before exfiltration.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Some Backdoor.Oldrea samples use standard Base64 + bzip2, and some use standard Base64 + reverse XOR + RSA-2048 to decrypt data received from C2 servers.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Bisonal has encoded binary data with Base64 and ASCII.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Bumblebee has the ability to base64 encode C2 server responses.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
CORESHELL C2 messages are Base64-encoded.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Carbanak encodes the message body of HTTP traffic with Base64.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
ChChes can encode C2 data with a custom technique that utilizes Base64.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Chaes has used Base64 to encode C2 communications.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
CharmPower can send additional modules over C2 encoded with base64.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Cobalt Strike can use Base64, URL-safe Base64, or NetBIOS encoding in its C2 traffic.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Cobian RAT obfuscates communications with the C2 server using Base64 encoding.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
CreepySnail can use Base64 to encode its C2 traffic.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
DarkWatchman encodes data using hexadecimal representation before sending it to the C2 server.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Daserf uses custom base64 encoding to obfuscate HTTP traffic.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Denis encodes the data sent to the server in Base64.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Dipsind encodes C2 traffic with base64.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
DnsSystem can Base64 encode data sent to C2.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Ebury has encoded C2 traffic in hexadecimal format.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Elise exfiltrates data using cookie values that are Base64-encoded.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Emotet has used Google’s Protobufs to serialize data sent to and from the C2 server.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Some Felismus samples use a custom method for C2 traffic that utilizes Base64.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Flagpro has encoded bidirectional data communications between a target system and C2 server using Base64.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Fysbis can use Base64 to encode its C2 traffic.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
GLASSTOKEN has hexadecimal and Base64 encoded C2 content.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
GrimAgent can base64 encode C2 replies.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
HOPLIGHT has utilized Zlib compression to obfuscate the communications payload.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
For C2 over HTTP, Helminth encodes data with base64 and sends it via the "Cookie" field of HTTP requests. For C2 over DNS, Helminth converts ASCII characters into their hexadecimal values and sends the data in cleartext.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Ixeshe uses custom Base64 encoding schemes to obfuscate command and control traffic in the message body of HTTP requests.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
A JHUHUGIT variant encodes C2 POST data base64.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
KONNI has used a custom base64 key to encode stolen data before exfiltration.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Kazuar encodes communications to the C2 server in Base64.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Kessel has exfiltrated data via hexadecimal-encoded subdomain fields of DNS queries.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Kevin can Base32 encode chunks of output files during exfiltration.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Machete has used base64 encoding.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Mafalda can encode data using Base64 prior to exfiltration.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
MechaFlounder has the ability to use base16 encoded strings in C2.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Mis-Type uses Base64 encoding for C2 traffic.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Misdat network traffic is Base64-encoded plaintext.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Mongall can use Base64 to encode information sent to its C2.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
More_eggs has used basE91 encoding, along with encryption, for C2 communication.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Mori can use Base64 encoded JSON libraries used in C2.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
OSX_OCEANLOTUS.D has used `zlib` to compress all data after 0x52 for the custom TCP C2 protocol.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Octopus has encoded C2 communications in Base64.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Okrum has used base64 to encode C2 communication.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
OopsIE encodes data in hexadecimal format over the C2 channel.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control