sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
POWERSTATS encoded C2 traffic with base64.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
POWRUNER can use base64 encoded C2 communications.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
PULSECHECK can base-64 encode encrypted data sent through C2.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
PingPull can encode C2 traffic with Base64.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Responses from the Pisloader C2 server are base32-encoded.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
PowerShower has the ability to encode C2 communications with base64 encoding.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Prikormka encodes C2 traffic with Base64.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
QUADAGENT encodes C2 communications with base64.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
QUIETCANARY can base64 encode C2 communications.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
QakBot can Base64 encode system information sent to C2.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
RDAT can communicate with the C2 via base32-encoded subdomains.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Ramsay has used base64 to encode its C2 traffic.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Revenge RAT uses Base64 to encode information sent to the C2 server.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
RogueRobin base64 encodes strings that are sent to the C2 over its DNS tunnel.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
RotaJakiro uses ZLIB Compression to compresses data sent to the C2 server in the `payload` section network communication packet.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
S-Type uses Base64 encoding for C2 traffic.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
SLIGHTPULSE can base64 encode all incoming and outgoing C2 messages.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
SMOKEDHAM has encoded its C2 traffic with Base64.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
STARWHALE has the ability to hex-encode collected data from an infected host.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
STEADYPULSE can transmit URL encoded data over C2.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
SUNBURST used Base64 encoding in its C2 traffic.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Saint Bot has used Base64 to encode its C2 communications.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Samurai can base64 encode data sent in C2 communications prior to its encryption.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Sardonic can encode client ID data in 32 uppercase hex characters and transfer to the actor-controlled C2 server.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
SeaDuke C2 traffic is base64-encoded.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
SideTwist has used Base64 for encoded C2 traffic.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Sliver can use standard encoding techniques like gzip and hex to ASCII to encode the C2 communication payload.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Spark has encoded communications with the C2 server with base64.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
SpeakUp encodes C&C communication using Base64.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Squirrelwaffle has encoded its communications to C2 servers using Base64.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Stuxnet transforms encrypted binary data into an ASCII string in order to use it as a URL parameter value.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
SysUpdate has used Base64 to encode its C2 traffic.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Torisma has encoded C2 communications with Base64.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
TrickBot can Base64-encode C2 commands.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Valak has returned C2 data as encoded ASCII.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
WARPWIRE can Base64 encode captured credentials with `btoa()` prior to sending to C2.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
WIREFIRE can Base64 encode process output sent to C2.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
WellMess has used Base64 encoding to uniquely identify communication to and from the C2.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Zebrocy has used URL/Percent Encoding on data exfiltrated via HTTP POST requests.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
down_new has the ability to base64 encode C2 communications.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
gh0st RAT has used Zlib to compress C2 communications data before encrypting it.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
njRAT uses Base64 encoding for C2 traffic.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
xCaon has used Base64 to encode its C2 traffic.
Technique: T1132.001 Data Encoding: Standard Encoding, Tactic: TA0011 Command and Control
Newer variants of BACKSPACE will encode C2 communications with a custom system.
Technique: T1132.002 Data Encoding: Non-Standard Encoding, Tactic: TA0011 Command and Control
Bankshot encodes commands from the control server using a range of characters and gzip.
Technique: T1132.002 Data Encoding: Non-Standard Encoding, Tactic: TA0011 Command and Control
Cyclops Blink can use a custom binary scheme to encode messages with specific commands and parameters to be executed.
Technique: T1132.002 Data Encoding: Non-Standard Encoding, Tactic: TA0011 Command and Control
InvisiMole can use a modified base32 encoding to encode data within the subdomain of C2 requests.
Technique: T1132.002 Data Encoding: Non-Standard Encoding, Tactic: TA0011 Command and Control
NightClub has used a non-standard encoding in DNS tunneling removing any `=` from the result of base64 encoding, and replacing `/` characters with `-s` and `+` characters with `-p`.
Technique: T1132.002 Data Encoding: Non-Standard Encoding, Tactic: TA0011 Command and Control
Ninja can encode C2 communications with a base64 algorithm using a custom alphabet.
Technique: T1132.002 Data Encoding: Non-Standard Encoding, Tactic: TA0011 Command and Control
OceanSalt can encode data with a NOT operation before sending the data to the control server.
Technique: T1132.002 Data Encoding: Non-Standard Encoding, Tactic: TA0011 Command and Control
PowGoop can use a modified Base64 encoding mechanism to send data to and from the C2 server.
Technique: T1132.002 Data Encoding: Non-Standard Encoding, Tactic: TA0011 Command and Control
RDAT can communicate with the C2 via subdomains that utilize base64 with character substitutions.
Technique: T1132.002 Data Encoding: Non-Standard Encoding, Tactic: TA0011 Command and Control
ShadowPad has encoded data as readable Latin characters.
Technique: T1132.002 Data Encoding: Non-Standard Encoding, Tactic: TA0011 Command and Control
Small Sieve can use a custom hex byte swapping encoding scheme to obfuscate tasking traffic.
Technique: T1132.002 Data Encoding: Non-Standard Encoding, Tactic: TA0011 Command and Control
Uroburos can use a custom base62 and a de-facto base32 encoding that uses digits 0-9 and lowercase letters a-z in C2 communications.
Technique: T1132.002 Data Encoding: Non-Standard Encoding, Tactic: TA0011 Command and Control
During the 2015 Ukraine Electric Power Attack, Sandworm Team installed a modified Dropbear SSH client as the backdoor to target systems.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
During C0027, Scattered Spider used Citrix and VPNs to persist in compromised environments.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
During the C0032 campaign, TEMP.Veles used VPN access to persist in the victim environment.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
During CostaRicto, the threat actors set up remote tunneling using an SSH tool to maintain access to a compromised environment.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
During Night Dragon, threat actors used compromised VPN accounts to gain access to victim systems.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
During Operation CuckooBees, the threat actors enabled WinRM over HTTP/HTTPS as a backup persistence mechanism using the following command: `cscript //nologo "C:\Windows\System32\winrm.vbs" set winrm/config/service@{EnableCompatibilityHttpsListener="true"}`.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
During Operation Wocao, threat actors used stolen credentials to connect to the victim's network via VPN.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
For the SolarWinds Compromise, APT29 used compromised identities to access networks via SSH, VPNs, and other remote access tools.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
APT18 actors leverage legitimate credentials to log into external remote services.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
APT28 has used Tor and a variety of commercial VPN services to route brute force authentication attempts.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
APT29 has used compromised identities to access networks via VPNs and Citrix.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
APT41 compromised an online billing/payment service using VPN access between a third-party service provider and the targeted payment service.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
Akira uses compromised VPN accounts for initial access to victim networks.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
Chimera has used legitimate credentials to login to an external VPN, Citrix, SSH, and other remote services.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
Dragonfly has used VPNs and Outlook Web Access (OWA) to maintain access to victim networks.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
FIN13 has gained access to compromised environments via remote access services such as the corporate virtual private network (VPN).
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
FIN5 has used legitimate VPN, Citrix, or VNC credentials to maintain access to a victim environment.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
GALLIUM has used VPN services, including SoftEther VPN, to access and maintain persistence in victim environments.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
GOLD SOUTHFIELD has used publicly-accessible RDP and remote management and monitoring (RMM) servers to gain access to victim machines.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
Ke3chang has gained access through VPNs including with compromised accounts and stolen VPN certificates.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
Kimsuky has used RDP to establish persistence.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
LAPSUS$ has gained access to internet-facing systems and applications, including virtual private network (VPN), remote desktop protocol (RDP), and virtual desktop infrastructure (VDI) including Citrix.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
Leviathan has used external remote services such as virtual private networks (VPN) to gain initial access.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
OilRig uses remote services such as VPN, Citrix, or OWA to persist in an environment.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
Sandworm Team has used Dropbear SSH with a hardcoded backdoor password to maintain persistence within the target network. Sandworm Team has also used VPN tunnels established in legitimate software company infrastructure to gain access to internal networks of that software company's users.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
Scattered Spider has leveraged legitimate remote management tools to maintain persistent access.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
TeamTNT has used open-source tools such as Weave Scope to target exposed Docker API ports and gain initial access to victim environments. TeamTNT has also targeted exposed kubelets for Kubernetes environments.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
Threat Group-3390 actors look for and use VPN profiles during an operation to access the network using external VPN services. Threat Group-3390 has also obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
Wizard Spider has accessed victim networks by using stolen credentials to access the corporate VPN infrastructure.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
Doki was executed through an open Docker daemon API port.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
Hildegard was executed through an unsecure kubelet that allowed anonymous access to the victim environment.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
Kinsing was executed in an Ubuntu container deployed via an open Docker daemon API.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
Linux Rabbit attempts to gain access to the server via SSH.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
Mafalda can establish an SSH connection from a compromised host to a server.
Technique: T1133 External Remote Services, Tactic: TA0001 Initial Access TA0003 Persistence
During C0017, APT41 used a ConfuserEx obfuscated BADPOTATO exploit to abuse named-pipe impersonation for local `NT AUTHORITY\SYSTEM` privilege escalation.
Technique: T1134 Access Token Manipulation, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Blue Mockingbird has used JuicyPotato to abuse the `SeImpersonate` token privilege to escalate from web application pool accounts to NT Authority\SYSTEM.
Technique: T1134 Access Token Manipulation, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
FIN6 has used has used Metasploit’s named-pipe impersonation technique to escalate privileges.
Technique: T1134 Access Token Manipulation, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
AppleSeed can gain system level privilege by passing `SeDebugPrivilege` to the `AdjustTokenPrivilege` API.
Technique: T1134 Access Token Manipulation, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
BlackCat has the ability modify access tokens.
Technique: T1134 Access Token Manipulation, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Cuba has used `SeDebugPrivilege` and `AdjustTokenPrivileges` to elevate privileges.
Technique: T1134 Access Token Manipulation, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Duqu examines running system processes for tokens that have specific system privileges. If it finds one, it will copy the token and store it for later use. Eventually it will start new processes with the stored token attached. It can also steal tokens to acquire administrative privileges.
Technique: T1134 Access Token Manipulation, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Empire can use PowerSploit's `Invoke-TokenManipulation` to manipulate access tokens.
Technique: T1134 Access Token Manipulation, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Gelsemium can use token manipulation to bypass UAC on Windows7 systems.
Technique: T1134 Access Token Manipulation, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
HermeticWiper can use `AdjustTokenPrivileges` to grant itself privileges for debugging with `SeDebugPrivilege`, creating backups with `SeBackupPrivilege`, loading drivers with `SeLoadDriverPrivilege`, and shutting down a local system with `SeShutdownPrivilege`.
Technique: T1134 Access Token Manipulation, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Hydraq creates a backdoor through which remote attackers can adjust token privileges.
Technique: T1134 Access Token Manipulation, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
KillDisk has attempted to get the access token of a process by calling `OpenProcessToken`. If KillDisk gets the access token, then it attempt to modify the token privileges with `AdjustTokenPrivileges`.
Technique: T1134 Access Token Manipulation, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Mafalda can use `AdjustTokenPrivileges()` to elevate privileges.
Technique: T1134 Access Token Manipulation, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
MegaCortex can enable `SeDebugPrivilege` and adjust token privileges.
Technique: T1134 Access Token Manipulation, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
PoshC2 can use Invoke-TokenManipulation for manipulating tokens.
Technique: T1134 Access Token Manipulation, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
PowerSploit's `Invoke-TokenManipulation` Exfiltration module can be used to manipulate tokens.
Technique: T1134 Access Token Manipulation, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Ryuk has attempted to adjust its token privileges to have the `SeDebugPrivilege`.
Technique: T1134 Access Token Manipulation, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
SUNSPOT modified its security token to grants itself debugging privileges by adding `SeDebugPrivilege`.
Technique: T1134 Access Token Manipulation, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Sliver has the ability to manipulate user tokens on targeted Windows systems.
Technique: T1134 Access Token Manipulation, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
SslMM contains a feature to manipulate process privileges and tokens.
Technique: T1134 Access Token Manipulation, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
APT28 has used CVE-2015-1701 to access the SYSTEM token and copy it into the current process as part of privilege escalation.
Technique: T1134.001 Access Token Manipulation: Token Impersonation/Theft, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
FIN8 has used a malicious framework designed to impersonate the lsass.exe/vmtoolsd.exe token.
Technique: T1134.001 Access Token Manipulation: Token Impersonation/Theft, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Aria-body has the ability to duplicate a token from ntprint.exe.
Technique: T1134.001 Access Token Manipulation: Token Impersonation/Theft, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
BADHATCH can impersonate a `lsass.exe` or `vmtoolsd.exe` token.
Technique: T1134.001 Access Token Manipulation: Token Impersonation/Theft, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
BitPaymer can use the tokens of users to create processes on infected systems.
Technique: T1134.001 Access Token Manipulation: Token Impersonation/Theft, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Cobalt Strike can steal access tokens from exiting processes.
Technique: T1134.001 Access Token Manipulation: Token Impersonation/Theft, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Emotet has the ability to duplicate the user’s token.
Technique: T1134.001 Access Token Manipulation: Token Impersonation/Theft, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
FinFisher uses token manipulation with NtFilterToken as part of UAC bypass.
Technique: T1134.001 Access Token Manipulation: Token Impersonation/Theft, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Okrum can impersonate a logged-on user's security context using a call to the ImpersonateLoggedOnUser API.
Technique: T1134.001 Access Token Manipulation: Token Impersonation/Theft, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Pupy can obtain a list of SIDs and provide the option for selecting process tokens to impersonate.
Technique: T1134.001 Access Token Manipulation: Token Impersonation/Theft, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
REvil can obtain the token from the user that launched the explorer.exe process to avoid affecting the desktop of the SYSTEM user.
Technique: T1134.001 Access Token Manipulation: Token Impersonation/Theft, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
SILENTTRINITY can find a process owned by a specific user and impersonate the associated token.
Technique: T1134.001 Access Token Manipulation: Token Impersonation/Theft, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Shamoon can impersonate tokens using `LogonUser`, `ImpersonateLoggedOnUser`, and `ImpersonateNamedPipeClient`.
Technique: T1134.001 Access Token Manipulation: Token Impersonation/Theft, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Siloscape impersonates the main thread of `CExecSvc.exe` by calling `NtImpersonateThread`.
Technique: T1134.001 Access Token Manipulation: Token Impersonation/Theft, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Stuxnet attempts to impersonate an anonymous token to enumerate bindings in the service control manager.
Technique: T1134.001 Access Token Manipulation: Token Impersonation/Theft, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Tarrask leverages token theft to obtain `lsass.exe` security permissions.
Technique: T1134.001 Access Token Manipulation: Token Impersonation/Theft, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Lazarus Group keylogger KiloAlfa obtains user tokens from interactive sessions to execute itself with API call `CreateProcessAsUserA` under that user's context.
Technique: T1134.002 Access Token Manipulation: Create Process with Token, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Turla RPC backdoors can impersonate or steal process tokens before executing commands.
Technique: T1134.002 Access Token Manipulation: Create Process with Token, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Aria-body has the ability to execute a process using `runas`.
Technique: T1134.002 Access Token Manipulation: Create Process with Token, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Azorult can call WTSQueryUserToken and CreateProcessAsUser to start a new process with local system privileges.
Technique: T1134.002 Access Token Manipulation: Create Process with Token, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Bankshot grabs a user token using WTSQueryUserToken and then creates a process by impersonating a logged-on user.
Technique: T1134.002 Access Token Manipulation: Create Process with Token, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Empire can use `Invoke-RunAs` to make tokens.
Technique: T1134.002 Access Token Manipulation: Create Process with Token, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
KONNI has duplicated the token of a high integrity process to spawn an instance of cmd.exe under an impersonated user.
Technique: T1134.002 Access Token Manipulation: Create Process with Token, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
PipeMon can attempt to gain administrative privileges using token impersonation.
Technique: T1134.002 Access Token Manipulation: Create Process with Token, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
PoshC2 can use Invoke-RunAs to make tokens.
Technique: T1134.002 Access Token Manipulation: Create Process with Token, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
REvil can launch an instance of itself with administrative rights using runas.
Technique: T1134.002 Access Token Manipulation: Create Process with Token, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
The WhisperGate third stage can use the AdvancedRun.exe tool to execute commands in the context of the Windows TrustedInstaller group via `%TEMP%\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run`.
Technique: T1134.002 Access Token Manipulation: Create Process with Token, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
ZxShell has a command called RunAs, which creates a new process as another user or process context.
Technique: T1134.002 Access Token Manipulation: Create Process with Token, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
FIN13 has utilized tools such as Incognito V2 for token manipulation and impersonation.
Technique: T1134.003 Access Token Manipulation: Make and Impersonate Token, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Cobalt Strike can make tokens from known credentials.
Technique: T1134.003 Access Token Manipulation: Make and Impersonate Token, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Mafalda can create a token for a different user.
Technique: T1134.003 Access Token Manipulation: Make and Impersonate Token, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Cobalt Strike can spawn processes with alternate PPIDs.
Technique: T1134.004 Access Token Manipulation: Parent PID Spoofing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
DarkGate relies on parent PID spoofing as part of its "rootkit-like" functionality to evade detection via Task Manager or Process Explorer.
Technique: T1134.004 Access Token Manipulation: Parent PID Spoofing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
KONNI has used parent PID spoofing to spawn a new `cmd` process using `CreateProcessW` and a handle to `Taskmgr.exe`.
Technique: T1134.004 Access Token Manipulation: Parent PID Spoofing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
PipeMon can use parent PID spoofing to elevate privileges.
Technique: T1134.004 Access Token Manipulation: Parent PID Spoofing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Empire can add a SID-History to a user if on a domain controller.
Technique: T1134.005 Access Token Manipulation: SID-History Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Mimikatz's `MISC::AddSid` module can append any SID or user/group account to a user's SID-History. Mimikatz also utilizes SID-History Injection to expand the scope of other components such as generated Kerberos Golden Tickets and DCSync beyond a single domain.
Technique: T1134.005 Access Token Manipulation: SID-History Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
During C0015, the threat actors executed the PowerView ShareFinder module to identify open shares.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
During Operation CuckooBees, the threat actors used the `net share` command as part of their advanced reconnaissance.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
During Operation Wocao, threat actors discovered network disks mounted to the system using netstat.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
APT1 listed connected network shares.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
APT32 used the `net view` command to show all shares available, including the administrative shares such as `C$` and `ADMIN$`.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
APT38 has enumerated network shares on a compromised host.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
APT39 has used the post exploitation tool CrackMapExec to enumerate network shares.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
APT41 used the `net share` command as part of network reconnaissance.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Chimera has used `net share` and `net view` to identify network shares of interest.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
DarkVishnya scanned the network for public shared folders.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Dragonfly has identified and browsed file servers in the victim network, sometimes , viewing files pertaining to ICS or Supervisory Control and Data Acquisition (SCADA) systems.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
FIN13 has executed net view commands for enumeration of open shares on compromised machines.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Sowbug listed remote shared drives that were accessible from a victim.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Tonto Team has used tools such as NBTscan to enumerate network shares.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Tropic Trooper used `netview` to scan target systems for shared resources.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Wizard Spider has used the “net view” command to locate mapped network shares.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Akira can identify remote file shares for encryption.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Avaddon has enumerated shared folders and mapped volumes.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
AvosLocker has enumerated shared drives on a compromised network.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
BADHATCH can check a user's access to the C$ share on a compromised machine.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Babuk has the ability to enumerate network shares.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Bad Rabbit enumerates open SMB shares on internal victim networks.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Bazar can enumerate shared drives on the domain.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
BitPaymer can search for network shares on the domain or workgroup using `net view <host>`.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
BlackCat has the ability to discover network shares on compromised networks.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Clambling has the ability to enumerate network shares.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Clop can enumerate network shares.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Cobalt Strike can query shared drives on the local system.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Conti can enumerate remote open SMB network shares using `NetShareEnum()`.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
CrackMapExec can enumerate the shared folders and associated permissions for a targeted network.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Cuba can discover shared resources using the `NetShareEnum` API call.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
DEATHRANSOM has the ability to use loop operations to enumerate network resources.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Diavol has a `ENMDSKS` command to enumerates available network shares.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Emotet has enumerated non-hidden network shares using `WNetEnumResourceW`.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Empire can find shared drives on the local system.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
FIVEHANDS can enumerate network shares and mounted drives on a network.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Flagpro has been used to execute `net view` to discover mapped network shares.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
HELLOKITTY has the ability to enumerate network resources.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
InvisiMole can gather network share information.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
KOPILUWAK can use netstat and Net to discover network shares.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Koadic can scan local network for open SMB.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Kwampirs collects a list of network shares with the command `net share`.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
MURKYTOP has the capability to retrieve information about shares on remote hosts.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
The `net view \\remotesystem` and `net share` commands in Net can be used to find shared drives and directories on remote and local systems respectively.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
OSInfo discovers shares on the network
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Olympic Destroyer will attempt to enumerate mapped network shares to later attempt to wipe all files on those shares.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
PlugX has a module to enumerate network shares.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Pupy can list local and remote shared drives and folders over SMB.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
QakBot can use `net share` to identify network shares for use in lateral movement.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
QuietSieve can identify and search networked drives for specific file name extensions.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Ramsay can scan for network drives which may contain documents for collection.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Royal can enumerate the shared resources of a given IP addresses using the API call `NetShareEnum`.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
SILENTTRINITY can enumerate shares on a compromised host.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Sardonic has the ability to execute the `net view` command.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
ShimRat can enumerate connected drives for infected host machines.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Stuxnet enumerates the directories of a network resource.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
TrickBot module shareDll/mshareDll discovers network shares via the WNetOpenEnumA API.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
WastedLocker can identify network adjacent and accessible drives.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
WhisperGate can enumerate connected remote logical drives.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
Zebrocy identifies network drives when they are added to victim systems.
Technique: T1135 Network Share Discovery, Tactic: TA0007 Discovery
During the 2016 Ukraine Electric Power Attack, Sandworm Team added a login to a SQL Server with `sp_addlinkedsrvlogin`.
Technique: T1136 Create Account, Tactic: TA0003 Persistence
Indrik Spider used `wmic.exe` to add a new user to the system.
Technique: T1136 Create Account, Tactic: TA0003 Persistence
Scattered Spider creates new user identities within the compromised organization.
Technique: T1136 Create Account, Tactic: TA0003 Persistence
APT3 has been known to create or enable accounts, such as `support_388945a0`.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
APT39 has created accounts on multiple compromised hosts to perform actions within the network.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
APT41 has created user accounts.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
APT5 has created Local Administrator accounts to maintain access to systems with short-cycle credential rotation.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
Dragonfly has created accounts on victims, including administrator accounts, some of which appeared to be tailored to each individual staging target.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
FIN13 has created MS-SQL local accounts in a compromised network.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
Fox Kitten has created a local user account with administrator privileges.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
Kimsuky has created accounts with `net user`.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
Leafminer used a tool called Imecab to set up a persistent remote access account on the victim machine.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
Magic Hound has created local accounts named `help` and `DefaultAccount` on compromised machines.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
TeamTNT has created local privileged users on victim machines.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
Wizard Spider has created local administrator accounts to maintain persistence in compromised networks.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
Calisto has the capability to add its own account to the victim's machine.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
Carbanak can create a Windows account.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
DarkGate creates a local user account, `SafeMode`, via `net user` commands.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
Empire has a module for creating a local user if permissions allow.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
Flame can create backdoor accounts with login “HelpAssistant” on domain connected systems if appropriate rights are available.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
GoldenSpy can create new users on an infected system.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
HiddenWasp creates a user account as a means to provide initial persistence to the compromised machine.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
Hildegard has created a user named “monerodaemon”.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
Mis-Type may create a temporary user on the system named `Lost_{Unique Identifier}`.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
The `net user username \password` commands in Net can be used to create a local account.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
Pupy can user PowerView to execute “net user” commands and create local system accounts.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
S-Type may create a temporary user on the system named `Lost_{Unique Identifier}` with the password `pond~!@6”{Unique Identifier}`.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
SMOKEDHAM has created user accounts.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
ServHelper has created a new user named "supportaccount".
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
ZxShell has a feature to create local user accounts.
Technique: T1136.001 Create Account: Local Account, Tactic: TA0003 Persistence
During the 2015 Ukraine Electric Power Attack, Sandworm Team created privileged domain accounts to be used for further exploitation and lateral movement.
Technique: T1136.002 Create Account: Domain Account, Tactic: TA0003 Persistence
During the 2016 Ukraine Electric Power Attack, Sandworm Team created two new accounts, “admin” and “система” (System). The accounts were then assigned to a domain matching local operation and were delegated new privileges.
Technique: T1136.002 Create Account: Domain Account, Tactic: TA0003 Persistence
GALLIUM created high-privileged domain user accounts to maintain access to victim networks.
Technique: T1136.002 Create Account: Domain Account, Tactic: TA0003 Persistence
HAFNIUM has created domain accounts.
Technique: T1136.002 Create Account: Domain Account, Tactic: TA0003 Persistence
Wizard Spider has created and used new accounts within a victim's Active Directory environment to maintain persistence.
Technique: T1136.002 Create Account: Domain Account, Tactic: TA0003 Persistence
Empire has a module for creating a new domain user if permissions allow.
Technique: T1136.002 Create Account: Domain Account, Tactic: TA0003 Persistence
The `net user username \password \domain` commands in Net can be used to create a domain account.
Technique: T1136.002 Create Account: Domain Account, Tactic: TA0003 Persistence
PsExec has the ability to remotely create accounts on target systems.
Technique: T1136.002 Create Account: Domain Account, Tactic: TA0003 Persistence
Pupy can user PowerView to execute “net user” commands and create domain accounts.
Technique: T1136.002 Create Account: Domain Account, Tactic: TA0003 Persistence
APT29 can create new users through Azure AD.
Technique: T1136.003 Create Account: Cloud Account, Tactic: TA0003 Persistence
LAPSUS$ has created global admin accounts in the targeted organization's cloud instances to gain persistence.
Technique: T1136.003 Create Account: Cloud Account, Tactic: TA0003 Persistence
AADInternals can create new Azure AD users.
Technique: T1136.003 Create Account: Cloud Account, Tactic: TA0003 Persistence
APT32 have replaced Microsoft Outlook's VbaProject.OTM file to install a backdoor macro for persistence.
Technique: T1137 Office Application Startup, Tactic: TA0003 Persistence
Gamaredon Group has inserted malicious macros into existing documents, providing persistence when they are reopened. Gamaredon Group has loaded the group's previously delivered VBA project by relaunching Microsoft Outlook with the `/altvba` option, once the Application.Startup event is received.
Technique: T1137 Office Application Startup, Tactic: TA0003 Persistence
MuddyWater has used a Word Template, Normal.dotm, for persistence.
Technique: T1137.001 Office Application Startup: Office Template Macros, Tactic: TA0003 Persistence
BackConfig has the ability to use hidden columns in Excel spreadsheets to store executable files or commands for VBA macros.
Technique: T1137.001 Office Application Startup: Office Template Macros, Tactic: TA0003 Persistence
Cobalt Strike has the ability to use an Excel Workbook to execute additional code by enabling Office to trust macros and execute code without user permission.
Technique: T1137.001 Office Application Startup: Office Template Macros, Tactic: TA0003 Persistence
APT28 has used the Office Test persistence mechanism within Microsoft Office by adding the Registry key `HKCU\Software\Microsoft\Office test\Special\Perf` to execute code.
Technique: T1137.002 Office Application Startup: Office Test, Tactic: TA0003 Persistence
Ruler can be used to automate the abuse of Outlook Forms to establish persistence.
Technique: T1137.003 Office Application Startup: Outlook Forms, Tactic: TA0003 Persistence
OilRig has abused the Outlook Home Page feature for persistence. OilRig has also used CVE-2017-11774 to roll back the initial patch designed to protect against Home Page abuse.
Technique: T1137.004 Office Application Startup: Outlook Home Page, Tactic: TA0003 Persistence
Ruler can be used to automate the abuse of Outlook Home Pages to establish persistence.
Technique: T1137.004 Office Application Startup: Outlook Home Page, Tactic: TA0003 Persistence
Ruler can be used to automate the abuse of Outlook Rules to establish persistence.
Technique: T1137.005 Office Application Startup: Outlook Rules, Tactic: TA0003 Persistence
Naikon has used the RoyalRoad exploit builder to drop a second stage loader, intel.wll, into the Word Startup folder on the compromised host.
Technique: T1137.006 Office Application Startup: Add-ins, Tactic: TA0003 Persistence
Bisonal has been loaded through a `.wll` extension added to the ` %APPDATA%\microsoft\word\startup\` repository.
Technique: T1137.006 Office Application Startup: Add-ins, Tactic: TA0003 Persistence
During C0017, APT41 used the DUSTPAN loader to decrypt embedded payloads.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
During C0021, the threat actors deobfuscated encoded PowerShell commands including use of the specific string `'FromBase'+0x40+'String'`, in place of `FromBase64String` which is normally used to decode base64.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
During Frankenstein, the threat actors deobfuscated Base64-encoded commands following the execution of a malicious script, which revealed a small script designed to obtain an additional payload.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
During Operation Dust Storm, attackers used VBS code to decode payloads.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
During Operation Honeybee, malicious files were decoded prior to execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
For Operation Spalax, the threat actors used a variety of packers and droppers to decrypt malicious payloads.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
During the SolarWinds Compromise, APT29 used 7-Zip to decode their Raindrop malware.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
An APT19 HTTP malware variant decrypts strings using single-byte XOR keys.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
An APT28 macro uses the command `certutil -decode` to decode contents of a .txt file storing the base64 encoded payload.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion