sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
FIN6 has used the Stealer One credential stealer to target e-mail and file transfer utilities including FTP.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
HEXANE has run `cmdkey` on victim machines to identify stored credentials.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
Leafminer used several tools for retrieving login and password information, including LaZagne.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
Malteiro has obtained credentials from mail clients via NirSoft MailPassView.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
MuddyWater has performed credential dumping with LaZagne and other tools, including by dumping passwords saved in victim email.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
Stealth Falcon malware gathers passwords from multiple sources, including Windows Credential Vault and Outlook.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
Volt Typhoon has attempted to obtain credentials from OpenSSH, realvnc, and PuTTY.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
Agent Tesla has the ability to steal credentials from FTP clients and wireless profiles.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
Astaroth uses an external software known as NetPass to recover passwords.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
Carberp's passw.plug plugin can gather account information from multiple instant messaging, email, and social media services, as well as FTP, VNC, and VPN clients.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
CosmicDuke collects user credentials, including passwords, for various programs including popular instant messaging applications and email clients as well as WLAN keys.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
DarkGate use Nirsoft Network Password Recovery or NetPass tools to steal stored RDP credentials in some malware versions.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
KGH_SPY can collect credentials from WINSCP.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
LaZagne can obtain credentials from databases, mail, and WiFi across multiple platforms.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
Lokibot has stolen credentials from multiple applications and data sources including Windows OS credentials, email clients, FTP, and SFTP clients.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
Matryoshka is capable of stealing Outlook passwords.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the credential vault and DPAPI.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
Mispadu has obtained credentials from mail clients via NirSoft MailPassView.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
NETWIRE can retrieve passwords from messaging and mail client applications.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
OLDBAIT collects credentials from several email clients.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
PLEAD has the ability to steal saved passwords from Microsoft Outlook.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated with many sources such as The Bat!, Yahoo!, Mail.ru, Passport.Net, Google Talk, and Microsoft Outlook.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
PoshC2 can decrypt passwords stored in the RDCMan configuration file.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
A module in Prikormka collects passwords stored in applications installed on the victim.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
Pupy can use Lazagne for harvesting credentials.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
QuasarRAT can obtain passwords from common FTP clients.
Technique: T1555 Credentials from Password Stores, Tactic: TA0006 Credential Access
Calisto collects Keychain storage data and copies those passwords/tokens to a file.
Technique: T1555.001 Credentials from Password Stores: Keychain, Tactic: TA0006 Credential Access
Green Lambert can use Keychain Services API functions to find and collect passwords, such as `SecKeychainFindInternetPassword` and `SecKeychainItemCopyAttributesAndData`.
Technique: T1555.001 Credentials from Password Stores: Keychain, Tactic: TA0006 Credential Access
LaZagne can obtain credentials from macOS Keychains.
Technique: T1555.001 Credentials from Password Stores: Keychain, Tactic: TA0006 Credential Access
MacMa can dump credentials from the macOS keychain.
Technique: T1555.001 Credentials from Password Stores: Keychain, Tactic: TA0006 Credential Access
Proton gathers credentials in files for keychains.
Technique: T1555.001 Credentials from Password Stores: Keychain, Tactic: TA0006 Credential Access
iKitten collects the keychains on the system.
Technique: T1555.001 Credentials from Password Stores: Keychain, Tactic: TA0006 Credential Access
Keydnap uses the keychaindump project to read securityd memory.
Technique: T1555.002 Credentials from Password Stores: Securityd Memory, Tactic: TA0006 Credential Access
During the SolarWinds Compromise, APT29 stole users' saved passwords from Chrome.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
APT3 has used tools to dump passwords from browsers.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
APT33 has used a variety of publicly available tools like LaZagne to gather credentials.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
APT37 has used a credential stealer known as ZUMKONG that can harvest usernames and passwords stored in browsers.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Ajax Security Team has used FireMalv custom-developed malware, which collected passwords from the Firefox browser storage.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
FIN6 has used the Stealer One credential stealer to target web browsers.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
HEXANE has used a Mimikatz-based tool and a PowerShell script to steal passwords from Google Chrome.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Inception used a browser plugin to steal passwords and sessions from Internet Explorer, Chrome, Opera, Firefox, Torch, and Yandex.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Kimsuky has used browser extensions including Google Chrome to steal passwords and cookies from browsers. Kimsuky has also used Nirsoft's WebBrowserPassView tool to dump the passwords obtained from victims.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
LAPSUS$ has obtained passwords and session tokens with the use of the Redline password stealer.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Leafminer used several tools for retrieving login and password information, including LaZagne.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Malteiro has stolen credentials stored in the victim’s browsers via software tool NirSoft WebBrowserPassView.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Molerats used the public tool BrowserPasswordDump10 to dump passwords saved in browsers on victims.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
MuddyWater has run tools including Browser64 to steal passwords saved in victim web browsers.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access. OilRig has also used tool named PICKPOCKET to dump passwords from web browsers.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Patchwork dumped the login data database from `\AppData\Local\Google\Chrome\User Data\Default\Login Data`.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Sandworm Team's CredRaptor tool can collect saved passwords from various internet browsers.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Stealth Falcon malware gathers passwords from multiple sources, including Internet Explorer, Firefox, and Chrome.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
TA505 has used malware to gather credentials from Internet Explorer.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
ZIRCONIUM has used a tool to steal credentials from installed web browsers including Microsoft Internet Explorer and Google Chrome.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Agent Tesla can gather credentials from a number of browsers.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Azorult can steal credentials from the victim's browser.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
BLUELIGHT can collect passwords stored in web browers, including Internet Explorer, Edge, Chrome, and Naver Whale.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Some Backdoor.Oldrea samples contain a publicly available Web browser password recovery tool.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
BlackEnergy has used a plug-in to gather credentials from web browsers including FireFox, Google Chrome, and Internet Explorer.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Carberp's passw.plug plugin can gather passwords saved in Opera, Internet Explorer, Safari, Firefox, and Chrome.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
ChChes steals credentials stored inside Internet Explorer.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Chaes can steal login credentials and stored financial information from the browser.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
CookieMiner can steal saved usernames and passwords in Chrome as well as credit card credentials.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
CosmicDuke collects user credentials, including passwords, for various programs including Web browsers.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Crimson contains a module to steal credentials from Web browsers on the victim machine.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Emotet has been observed dropping browser password grabber modules.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Empire can use modules that extract passwords from common web browsers such as Firefox and Chrome.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Grandoreiro can steal cookie data and credentials from Google Chrome.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
H1N1 dumps usernames and passwords from Firefox, Internet Explorer, and Outlook.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Imminent Monitor has a PasswordRecoveryPacket module for recovering browser passwords.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Javali can capture login credentials from open browsers including Firefox, Chrome, Internet Explorer, and Edge.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
KGH_SPY has the ability to steal data from the Chrome, Edge, Firefox, Thunderbird, and Opera browsers.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
KONNI can steal profiles (containing credential information) from Firefox, Chrome, and Opera.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
KeyBoy attempts to collect passwords from browsers.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
LaZagne can obtain credentials from web browsers such as Google Chrome, Internet Explorer, and Firefox.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Lizar has a module to collect usernames and passwords stored in browsers.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Lokibot has demonstrated the ability to steal credentials from multiple applications and data sources including Safari and the Chromium and Mozilla Firefox-based web browsers.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Machete collects stored credentials from several web browsers.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Melcoz has the ability to steal credentials from web browsers.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from DPAPI.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Mispadu can steal credentials from Google Chrome.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
NETWIRE has the ability to steal credentials from web browsers including Internet Explorer, Opera, Yandex, and Chrome.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
OLDBAIT collects credentials from Internet Explorer, Mozilla Firefox, and Eudora.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Olympic Destroyer contains a module that tries to obtain stored credentials from web browsers.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
PLEAD can harvest saved credentials from browsers such as Google Chrome, Microsoft Internet Explorer, and Mozilla Firefox.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated with many sources such as Netscape Navigator, Mozilla Firefox, Mozilla Thunderbird, and Internet Explorer.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
PoetRAT has used a Python tool named Browdec.exe to steal browser credentials.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
A module in Prikormka gathers logins and passwords stored in applications on the victims, including Google Chrome, Mozilla Firefox, and several other browsers.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Proton gathers credentials for Google Chrome.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Pupy can use Lazagne for harvesting credentials.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
QakBot has collected usernames and passwords from Firefox and Chrome.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
QuasarRAT can obtain passwords from common web browsers.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
ROKRAT can steal credentials stored in Web browsers by querying the sqlite database.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
RainyDay can use tools to collect credentials from web browsers.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
RedLeaves can gather browser usernames and passwords.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
SILENTTRINITY can collect clear text web credentials for Internet Explorer/Edge.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
SUGARDUMP variants have harvested credentials from browsers such as Firefox, Chrome, Opera, and Edge.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Smoke Loader searches for credentials stored from web browsers.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
TSCookie has the ability to steal saved passwords from the Internet Explorer, Edge, Firefox, and Chrome browsers.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge, sometimes using esentutl.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Trojan.Karagany can steal data and credentials from browsers.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Unknown Logger is capable of stealing usernames and passwords from browsers on the victim machine.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
WarzoneRAT has the capability to grab passwords from numerous web browsers as well as from Outlook and Thunderbird email clients.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
XAgentOSX contains the getFirefoxPassword function to attempt to locate Firefox passwords.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
Zebrocy has the capability to upload dumper tools that extract credentials from web browsers and store them in database files.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
jRAT can capture passwords from common web browsers such as Internet Explorer, Google Chrome, and Firefox.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
njRAT has a module that steals passwords saved in victim web browsers.
Technique: T1555.003 Credentials from Password Stores: Credentials from Web Browsers, Tactic: TA0006 Credential Access
OilRig has used credential dumping tool named VALUEVAULT to steal credentials from the Windows Credential Manager.
Technique: T1555.004 Credentials from Password Stores: Windows Credential Manager, Tactic: TA0006 Credential Access
Stealth Falcon malware gathers passwords from the Windows Credential Vault.
Technique: T1555.004 Credentials from Password Stores: Windows Credential Manager, Tactic: TA0006 Credential Access
Turla has gathered credentials from the Windows Credential Manager tool.
Technique: T1555.004 Credentials from Password Stores: Windows Credential Manager, Tactic: TA0006 Credential Access
Wizard Spider has used PowerShell cmdlet `Invoke-WCMDump` to enumerate Windows credentials in the Credential Manager in a compromised network.
Technique: T1555.004 Credentials from Password Stores: Windows Credential Manager, Tactic: TA0006 Credential Access
KGH_SPY can collect credentials from the Windows Credential Manager.
Technique: T1555.004 Credentials from Password Stores: Windows Credential Manager, Tactic: TA0006 Credential Access
LaZagne can obtain credentials from Vault files.
Technique: T1555.004 Credentials from Password Stores: Windows Credential Manager, Tactic: TA0006 Credential Access
Lizar has a plugin that can retrieve credentials from Internet Explorer and Microsoft Edge using `vaultcmd.exe` and another that can collect RDP access credentials using the `CredEnumerateW` function.
Technique: T1555.004 Credentials from Password Stores: Windows Credential Manager, Tactic: TA0006 Credential Access
Mimikatz contains functionality to acquire credentials from the Windows Credential Manager.
Technique: T1555.004 Credentials from Password Stores: Windows Credential Manager, Tactic: TA0006 Credential Access
PowerSploit contains a collection of Exfiltration modules that can harvest credentials from Windows vault credential objects.
Technique: T1555.004 Credentials from Password Stores: Windows Credential Manager, Tactic: TA0006 Credential Access
ROKRAT can steal credentials by leveraging the Windows Vault mechanism.
Technique: T1555.004 Credentials from Password Stores: Windows Credential Manager, Tactic: TA0006 Credential Access
RainyDay can use the QuarksPwDump tool to obtain local passwords and domain cached credentials.
Technique: T1555.004 Credentials from Password Stores: Windows Credential Manager, Tactic: TA0006 Credential Access
SILENTTRINITY can gather Windows Vault credentials.
Technique: T1555.004 Credentials from Password Stores: Windows Credential Manager, Tactic: TA0006 Credential Access
Valak can use a .NET compiled module named exchgrabber to enumerate credentials from the Credential Manager.
Technique: T1555.004 Credentials from Password Stores: Windows Credential Manager, Tactic: TA0006 Credential Access
During Operation Wocao, threat actors accessed and collected credentials from password managers.
Technique: T1555.005 Credentials from Password Stores: Password Managers, Tactic: TA0006 Credential Access
Fox Kitten has used scripts to access credential information from the KeePass database.
Technique: T1555.005 Credentials from Password Stores: Password Managers, Tactic: TA0006 Credential Access
LAPSUS$ has accessed local password managers and databases to obtain further credentials from a compromised network.
Technique: T1555.005 Credentials from Password Stores: Password Managers, Tactic: TA0006 Credential Access
Threat Group-3390 obtained a KeePass database from a compromised host.
Technique: T1555.005 Credentials from Password Stores: Password Managers, Tactic: TA0006 Credential Access
MarkiRAT can gather information from the Keepass password manager.
Technique: T1555.005 Credentials from Password Stores: Password Managers, Tactic: TA0006 Credential Access
Proton gathers credentials in files for 1password.
Technique: T1555.005 Credentials from Password Stores: Password Managers, Tactic: TA0006 Credential Access
TrickBot can steal passwords from the KeePass open source password manager.
Technique: T1555.005 Credentials from Password Stores: Password Managers, Tactic: TA0006 Credential Access
Pacu can retrieve secrets from the AWS Secrets Manager via the enum_secrets module.
Technique: T1555.006 Credentials from Password Stores: Cloud Secrets Management Stores, Tactic: TA0006 Credential Access
FIN13 has replaced legitimate KeePass binaries with trojanized versions to collect passwords from numerous applications.
Technique: T1556 Modify Authentication Process, Tactic: TA0006 Credential Access TA0005 Defense Evasion TA0003 Persistence
Ebury can intercept private keys using a trojanized `ssh-add` function.
Technique: T1556 Modify Authentication Process, Tactic: TA0006 Credential Access TA0005 Defense Evasion TA0003 Persistence
Kessel has trojanized the <sode>ssh_login</code> and `user-auth_pubkey` functions to steal plaintext credentials.
Technique: T1556 Modify Authentication Process, Tactic: TA0006 Credential Access TA0005 Defense Evasion TA0003 Persistence
SILENTTRINITY can create a backdoor in KeePass using a malicious config file and in TortoiseSVN using a registry hook.
Technique: T1556 Modify Authentication Process, Tactic: TA0006 Credential Access TA0005 Defense Evasion TA0003 Persistence
Chimera's malware has altered the NTLM authentication program on domain controllers to allow Chimera to login without a valid credential.
Technique: T1556.001 Modify Authentication Process: Domain Controller Authentication, Tactic: TA0006 Credential Access TA0005 Defense Evasion TA0003 Persistence
Skeleton Key is used to patch an enterprise domain controller authentication process with a backdoor password. It allows adversaries to bypass the standard authentication system to use a defined password for all accounts authenticating to that domain controller.
Technique: T1556.001 Modify Authentication Process: Domain Controller Authentication, Tactic: TA0006 Credential Access TA0005 Defense Evasion TA0003 Persistence
Strider has registered its persistence module on domain controllers as a Windows LSA (Local System Authority) password filter to acquire credentials any time a domain, local user, or administrator logs in or changes a password.
Technique: T1556.002 Modify Authentication Process: Password Filter DLL, Tactic: TA0006 Credential Access TA0005 Defense Evasion TA0003 Persistence
Remsec harvests plain-text credentials as a password filter registered on domain controllers.
Technique: T1556.002 Modify Authentication Process: Password Filter DLL, Tactic: TA0006 Credential Access TA0005 Defense Evasion TA0003 Persistence
Ebury can deactivate PAM modules to tamper with the sshd configuration.
Technique: T1556.003 Modify Authentication Process: Pluggable Authentication Modules, Tactic: TA0006 Credential Access TA0005 Defense Evasion TA0003 Persistence
Skidmap has the ability to replace the pam_unix.so file on an infected machine with its own malicious version that accepts a specific backdoor password for all users.
Technique: T1556.003 Modify Authentication Process: Pluggable Authentication Modules, Tactic: TA0006 Credential Access TA0005 Defense Evasion TA0003 Persistence
SLOWPULSE can modify LDAP and two factor authentication flows by inspecting login credentials and forcing successful authentication if the provided password matches a chosen backdoor password.
Technique: T1556.004 Modify Authentication Process: Network Device Authentication, Tactic: TA0006 Credential Access TA0005 Defense Evasion TA0003 Persistence
SYNful Knock has the capability to add its own custom backdoor password when it modifies the operating system of the affected network device.
Technique: T1556.004 Modify Authentication Process: Network Device Authentication, Tactic: TA0006 Credential Access TA0005 Defense Evasion TA0003 Persistence
After compromising user accounts, Scattered Spider registers their own MFA tokens.
Technique: T1556.006 Modify Authentication Process: Multi-Factor Authentication, Tactic: TA0006 Credential Access TA0005 Defense Evasion TA0003 Persistence
The AADInternals `Set-AADIntUserMFA` command can be used to disable MFA for a specified user.
Technique: T1556.006 Modify Authentication Process: Multi-Factor Authentication, Tactic: TA0006 Credential Access TA0005 Defense Evasion TA0003 Persistence
SLOWPULSE can insert malicious logic to bypass RADIUS and ACE two factor authentication (2FA) flows if a designated attacker-supplied password is provided.
Technique: T1556.006 Modify Authentication Process: Multi-Factor Authentication, Tactic: TA0006 Credential Access TA0005 Defense Evasion TA0003 Persistence
APT29 has edited the `Microsoft.IdentityServer.Servicehost.exe.config` file to load a malicious DLL into the AD FS process, thereby enabling persistent access to any service federated with AD FS for a user with a specified User Principal Name.
Technique: T1556.007 Modify Authentication Process: Hybrid Identity, Tactic: TA0006 Credential Access TA0005 Defense Evasion TA0003 Persistence
AADInternals can inject a malicious DLL (`PTASpy`) into the `AzureADConnectAuthenticationAgentService` to backdoor Azure AD Pass-Through Authentication.
Technique: T1556.007 Modify Authentication Process: Hybrid Identity, Tactic: TA0006 Credential Access TA0005 Defense Evasion TA0003 Persistence
Scattered Spider has added additional trusted locations to Azure AD conditional access policies.
Technique: T1556.009 Modify Authentication Process: Conditional Access Policies, Tactic: TA0006 Credential Access TA0005 Defense Evasion TA0003 Persistence
Kimsuky has used modified versions of PHProxy to examine web traffic between the victim and the accessed website.
Technique: T1557 Adversary-in-the-Middle, Tactic: TA0009 Collection TA0006 Credential Access
Dok proxies web traffic to potentially monitor and alter victim HTTP(S) traffic.
Technique: T1557 Adversary-in-the-Middle, Tactic: TA0009 Collection TA0006 Credential Access
Lazarus Group executed Responder using the command `[Responder file path] -i [IP address] -rPv` on a compromised host to harvest credentials and move laterally.
Technique: T1557.001 Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay, Tactic: TA0009 Collection TA0006 Credential Access
Wizard Spider has used the Invoke-Inveigh PowerShell cmdlets, likely for name service poisoning.
Technique: T1557.001 Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay, Tactic: TA0009 Collection TA0006 Credential Access
Empire can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks.
Technique: T1557.001 Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay, Tactic: TA0009 Collection TA0006 Credential Access
Impacket modules like ntlmrelayx and smbrelayx can be used in conjunction with Network Sniffing and LLMNR/NBT-NS Poisoning and SMB Relay to gather NetNTLM credentials for Brute Force or relay attacks that can gain code execution.
Technique: T1557.001 Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay, Tactic: TA0009 Collection TA0006 Credential Access
PoshC2 can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks.
Technique: T1557.001 Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay, Tactic: TA0009 Collection TA0006 Credential Access
Pupy can sniff plaintext network credentials and use NBNS Spoofing to poison name services.
Technique: T1557.001 Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay, Tactic: TA0009 Collection TA0006 Credential Access
Responder is used to poison name services to gather hashes and credentials from systems within a local network.
Technique: T1557.001 Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay, Tactic: TA0009 Collection TA0006 Credential Access
Cleaver has used custom tools to facilitate ARP cache poisoning.
Technique: T1557.002 Adversary-in-the-Middle: ARP Cache Poisoning, Tactic: TA0009 Collection TA0006 Credential Access
LuminousMoth has used ARP spoofing to redirect a compromised machine to an actor-controlled website.
Technique: T1557.002 Adversary-in-the-Middle: ARP Cache Poisoning, Tactic: TA0009 Collection TA0006 Credential Access
Ke3chang has used Mimikatz to generate Kerberos golden tickets.
Technique: T1558.001 Steal or Forge Kerberos Tickets: Golden Ticket, Tactic: TA0006 Credential Access
Empire can leverage its implementation of Mimikatz to obtain and use golden tickets.
Technique: T1558.001 Steal or Forge Kerberos Tickets: Golden Ticket, Tactic: TA0006 Credential Access
Mimikatz's kerberos module can create golden tickets.
Technique: T1558.001 Steal or Forge Kerberos Tickets: Golden Ticket, Tactic: TA0006 Credential Access
Rubeus can forge a ticket-granting ticket.
Technique: T1558.001 Steal or Forge Kerberos Tickets: Golden Ticket, Tactic: TA0006 Credential Access
AADInternals can be used to forge Kerberos tickets using the password hash of the AZUREADSSOACC account.
Technique: T1558.002 Steal or Forge Kerberos Tickets: Silver Ticket, Tactic: TA0006 Credential Access
Empire can leverage its implementation of Mimikatz to obtain and use silver tickets.
Technique: T1558.002 Steal or Forge Kerberos Tickets: Silver Ticket, Tactic: TA0006 Credential Access
Mimikatz's kerberos module can create silver tickets.
Technique: T1558.002 Steal or Forge Kerberos Tickets: Silver Ticket, Tactic: TA0006 Credential Access
Rubeus can create silver tickets.
Technique: T1558.002 Steal or Forge Kerberos Tickets: Silver Ticket, Tactic: TA0006 Credential Access
During Operation Wocao, threat actors used PowerSploit's `Invoke-Kerberoast` module to request encrypted service tickets and bruteforce the passwords of Windows service accounts offline.
Technique: T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting, Tactic: TA0006 Credential Access
During the SolarWinds Compromise, APT29 obtained Ticket Granting Service (TGS) tickets for Active Directory Service Principle Names to crack offline.
Technique: T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting, Tactic: TA0006 Credential Access
FIN7 has used Kerberoasting PowerShell commands such as, `Invoke-Kerberoast` for credential access and to enable lateral movement.
Technique: T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting, Tactic: TA0006 Credential Access
Wizard Spider has used Rubeus, MimiKatz Kerberos module, and the Invoke-Kerberoast cmdlet to steal AES hashes.
Technique: T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting, Tactic: TA0006 Credential Access
Brute Ratel C4 can decode Kerberos 5 tickets and convert it to hashcat format for subsequent cracking.
Technique: T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting, Tactic: TA0006 Credential Access
Empire uses PowerSploit's `Invoke-Kerberoast` to request service tickets and return crackable ticket hashes.
Technique: T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting, Tactic: TA0006 Credential Access
Impacket modules like GetUserSPNs can be used to get Service Principal Names (SPNs) for user accounts. The output is formatted to be compatible with cracking tools like John the Ripper and Hashcat.
Technique: T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting, Tactic: TA0006 Credential Access
PowerSploit's `Invoke-Kerberoast` module can request service tickets and return crackable ticket hashes.
Technique: T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting, Tactic: TA0006 Credential Access
Rubeus can use the `KerberosRequestorSecurityToken.GetRequest` method to request kerberoastable service tickets.
Technique: T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting, Tactic: TA0006 Credential Access
SILENTTRINITY contains a module to conduct Kerberoasting.
Technique: T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting, Tactic: TA0006 Credential Access
Rubeus can reveal the credentials of accounts that have Kerberos pre-authentication disabled through AS-REP roasting.
Technique: T1558.004 Steal or Forge Kerberos Tickets: AS-REP Roasting, Tactic: TA0006 Credential Access
Cyclops Blink has the ability to create a pipe to enable inter-process communication.
Technique: T1559 Inter-Process Communication, Tactic: TA0002 Execution
HyperStack can connect to the IPC$ share on remote machines.
Technique: T1559 Inter-Process Communication, Tactic: TA0002 Execution
Ninja can use pipes to redirect the standard input and the standard output.
Technique: T1559 Inter-Process Communication, Tactic: TA0002 Execution
PITSTOP can listen over the Unix domain socket located at `/data/runtime/cockpit/wd.fd`.
Technique: T1559 Inter-Process Communication, Tactic: TA0002 Execution
When executing with non-root permissions, RotaJakiro uses the the `shmget API` to create shared memory between other known RotaJakiro processes. This allows processes to communicate with each other and share their PID.
Technique: T1559 Inter-Process Communication, Tactic: TA0002 Execution
Uroburos has the ability to move data between its kernel and user mode components, generally using named pipes.
Technique: T1559 Inter-Process Communication, Tactic: TA0002 Execution
Gamaredon Group malware can insert malicious macros into documents using a `Microsoft.Office.Interop` object.
Technique: T1559.001 Inter-Process Communication: Component Object Model, Tactic: TA0002 Execution
MuddyWater has used malware that has the capability to execute malicious code via COM, DCOM, and Outlook.
Technique: T1559.001 Inter-Process Communication: Component Object Model, Tactic: TA0002 Execution
Bumblebee can use a COM object to execute queries to gather system information.
Technique: T1559.001 Inter-Process Communication: Component Object Model, Tactic: TA0002 Execution
DarkTortilla has used the `WshShortcut` COM object to create a .lnk shortcut file in the Windows startup folder.
Technique: T1559.001 Inter-Process Communication: Component Object Model, Tactic: TA0002 Execution
FunnyDream can use com objects identified with `CLSID_ShellLink`(`IShellLink` and `IPersistFile`) and `WScript.Shell`(`RegWrite` method) to enable persistence mechanisms.
Technique: T1559.001 Inter-Process Communication: Component Object Model, Tactic: TA0002 Execution
Gelsemium can use the `IARPUinstallerStringLauncher` COM interface are part of its UAC bypass process.
Technique: T1559.001 Inter-Process Communication: Component Object Model, Tactic: TA0002 Execution
HermeticWizard can execute files on remote machines using DCOM.
Technique: T1559.001 Inter-Process Communication: Component Object Model, Tactic: TA0002 Execution
InvisiMole can use the `ITaskService`, `ITaskDefinition` and `ITaskSettings` COM interfaces to schedule a task.
Technique: T1559.001 Inter-Process Communication: Component Object Model, Tactic: TA0002 Execution
Milan can use a COM component to generate scheduled tasks.
Technique: T1559.001 Inter-Process Communication: Component Object Model, Tactic: TA0002 Execution
Neoichor can use the Internet Explorer (IE) COM interface to connect and receive commands from C2.
Technique: T1559.001 Inter-Process Communication: Component Object Model, Tactic: TA0002 Execution
POWERSTATS can use DCOM (targeting the 127.0.0.1 loopback address) to execute additional payloads on compromised hosts.
Technique: T1559.001 Inter-Process Communication: Component Object Model, Tactic: TA0002 Execution
Ramsay can use the Windows COM API to schedule tasks and maintain persistence.
Technique: T1559.001 Inter-Process Communication: Component Object Model, Tactic: TA0002 Execution
TrickBot used COM to setup scheduled task for persistence.
Technique: T1559.001 Inter-Process Communication: Component Object Model, Tactic: TA0002 Execution
Ursnif droppers have used COM objects to execute the malware's full executable payload.
Technique: T1559.001 Inter-Process Communication: Component Object Model, Tactic: TA0002 Execution
During Operation Sharpshooter, threat actors sent malicious Word OLE documents to victims.
Technique: T1559.002 Inter-Process Communication: Dynamic Data Exchange, Tactic: TA0002 Execution
APT28 has delivered JHUHUGIT and Koadic by executing PowerShell commands through DDE in Word documents.
Technique: T1559.002 Inter-Process Communication: Dynamic Data Exchange, Tactic: TA0002 Execution
APT37 has used Windows DDE for execution of commands and a malicious VBS.
Technique: T1559.002 Inter-Process Communication: Dynamic Data Exchange, Tactic: TA0002 Execution
BITTER has executed OLE objects using Microsoft Equation Editor to download and run malicious payloads.
Technique: T1559.002 Inter-Process Communication: Dynamic Data Exchange, Tactic: TA0002 Execution
Cobalt Group has sent malicious Word OLE compound documents to victims.
Technique: T1559.002 Inter-Process Communication: Dynamic Data Exchange, Tactic: TA0002 Execution
FIN7 spear phishing campaigns have included malicious Word documents with DDE execution.
Technique: T1559.002 Inter-Process Communication: Dynamic Data Exchange, Tactic: TA0002 Execution
Gallmaker attempted to exploit Microsoft’s DDE protocol in order to gain access to victim machines and for execution.
Technique: T1559.002 Inter-Process Communication: Dynamic Data Exchange, Tactic: TA0002 Execution
Leviathan has utilized OLE as a method to insert malicious content inside various phishing documents.
Technique: T1559.002 Inter-Process Communication: Dynamic Data Exchange, Tactic: TA0002 Execution
MuddyWater has used malware that can execute PowerShell scripts via DDE.
Technique: T1559.002 Inter-Process Communication: Dynamic Data Exchange, Tactic: TA0002 Execution
Patchwork leveraged the DDE protocol to deliver their malware.
Technique: T1559.002 Inter-Process Communication: Dynamic Data Exchange, Tactic: TA0002 Execution
Sidewinder has used the ActiveXObject utility to create OLE objects to obtain execution through Internet Explorer.
Technique: T1559.002 Inter-Process Communication: Dynamic Data Exchange, Tactic: TA0002 Execution
TA505 has leveraged malicious Word documents that abused DDE.
Technique: T1559.002 Inter-Process Communication: Dynamic Data Exchange, Tactic: TA0002 Execution
GravityRAT has been delivered via Word documents using DDE for execution.
Technique: T1559.002 Inter-Process Communication: Dynamic Data Exchange, Tactic: TA0002 Execution
HAWKBALL has used an OLE object that uses Equation Editor to drop the embedded shellcode.
Technique: T1559.002 Inter-Process Communication: Dynamic Data Exchange, Tactic: TA0002 Execution
KeyBoy uses the Dynamic Data Exchange (DDE) protocol to download remote payloads.
Technique: T1559.002 Inter-Process Communication: Dynamic Data Exchange, Tactic: TA0002 Execution
POWERSTATS can use DDE to execute additional payloads on compromised hosts.
Technique: T1559.002 Inter-Process Communication: Dynamic Data Exchange, Tactic: TA0002 Execution
PoetRAT was delivered with documents using DDE to execute malicious code.
Technique: T1559.002 Inter-Process Communication: Dynamic Data Exchange, Tactic: TA0002 Execution
RTM can search for specific strings within browser tabs using a Dynamic Data Exchange mechanism.
Technique: T1559.002 Inter-Process Communication: Dynamic Data Exchange, Tactic: TA0002 Execution
Ramsay has been delivered using OLE objects in malicious documents.
Technique: T1559.002 Inter-Process Communication: Dynamic Data Exchange, Tactic: TA0002 Execution
Valak can execute tasks via OLE.
Technique: T1559.002 Inter-Process Communication: Dynamic Data Exchange, Tactic: TA0002 Execution
APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
APT32's backdoor has used LZMA compression and RC4 encryption before exfiltration.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Axiom has compressed and encrypted data prior to exfiltration.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Dragonfly has compressed data into .zip files prior to exfiltration.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Following data collection, FIN6 has compressed log files into a ZIP archive prior to staging and exfiltration.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
The Ke3chang group has been known to compress data before exfiltration.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Lazarus Group has compressed exfiltrated data with RAR and used RomeoDelta malware to archive specified directories in .zip format, encrypt the .zip file, and upload it to C2.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Leviathan has archived victim's data prior to exfiltration.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
LuminousMoth has manually archived stolen files from victim machines before exfiltration.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Patchwork encrypted the collected files' path with AES and then encoded them with base64.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
menuPass has encrypted files and information before exfiltration.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
ADVSTORESHELL encrypts with the 3DES algorithm and a hardcoded key prior to exfiltration.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Agent Tesla can encrypt data with 3DES before sending it over to a C2 server.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
AppleSeed has compressed collected data before exfiltration.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Aria-body has used ZIP to compress data gathered on a compromised host.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
BLUELIGHT can zip files before exfiltration.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Backdoor.Oldrea writes collected data to a temporary file in an encrypted form before exfiltration to a C2 server.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
BloodHound can compress data collected by its SharpHound ingestor into a ZIP file to be written to disk.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection