sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
BLACKCOFFEE has the capability to enumerate files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
BLINDINGCAN can search, read, write, move, and execute files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
BLUELIGHT can enumerate files and collect associated metadata.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Babuk has the ability to enumerate files on a targeted system.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
BabyShark has used `dir` to search for "programfiles" and "appdata".
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
BackConfig has the ability to identify folders and files related to previous infections.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Backdoor.Oldrea collects information about available drives, default browser, desktop file list, My Documents, Internet history, program files, and root of available drives. It also searches for ICS-related software files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
BadPatch searches for files with specific file extensions.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Bandook has a command to list files on a system.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Bankshot searches for files on the victim's machine.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Bazar can enumerate the victim's desktop.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Bisonal can retrieve a file listing from the system.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Black Basta can enumerate specific files for encryption.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
BlackCat can enumerate files for encryption.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
BlackEnergy gathers a list of installed apps from the uninstall program Registry. It also gathers registered mail, browser, and instant messaging clients from the Registry. BlackEnergy has searched for given file types.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
BlackMould has the ability to find files on the targeted system.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
BoomBox can search for specific files and directories on a machine.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
BoxCaon has searched for files on the system, such as documents located in the desktop folder.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Brave Prince gathers file and directory information from the victim’s machine.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
An older version of CHOPSTICK has a module that monitors all mounted volumes for files with the extensions .doc, .docx, .pgp, .gpg, .m2f, or .m2o.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
COATHANGER will survey the contents of system files during installation.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
CORALDECK searches for specified files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
CaddyWiper can enumerate all files and directories on a compromised host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Cannon can obtain victim drive information as well as a list of folders in C:\Program Files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Cardinal RAT checks its current working directory upon execution and also contains watchdog functionality that ensures its executable is located in the correct path (else it will rewrite the payload).
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Caterpillar WebShell can search for files in directories.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
ChChes collects the victim's %TEMP% directory path and version of Internet Explorer.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
CharmPower can enumerate drives and list the contents of the C: drive on a victim's computer.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Cheerscrypt can search for log and VMware-related files with .log, .vmdk, .vmem, .vswp, and .vmsn extensions.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
China Chopper's server component can list directory contents.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Clambling can browse directories on a compromised host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Clop has searched folders and subfolders for files to encrypt.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Cobalt Strike can explore files on a compromised system.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Conti can discover files on a local system.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
CookieMiner has looked for files in the user's home directory with "wallet" in their name using `find`.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
CosmicDuke searches attached and mounted drives for file extensions and keywords that match a predefined list.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
CrackMapExec can discover specified filetypes and log files on a targeted system.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
CreepyDrive can specify the local file path to upload files from.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Crimson contains commands to list files and directories, as well as search for files matching certain extensions from a defined list.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
CrossRAT can list all files on a system.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Cryptoistic can scan a directory to identify files for deletion.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Cuba can enumerate files by using a variety of functions.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Cyclops Blink can use the Linux API `statvfs` to enumerate the current working directory.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
DDKONG lists files on the victim’s machine.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
DEATHRANSOM can use loop operations to enumerate directories on a compromised host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Dacls can scan directories on a compromised host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Some versions of DarkGate search for the hard-coded folder `C:\Program Files\e Carte Bleue`.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
DarkWatchman has the ability to enumerate file and folder names.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Denis has several commands to search directories for files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Derusbi is capable of obtaining directory, file, and drive listings.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Diavol has a command to traverse the files and directories in a given path.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Doki has resolved the path of a process PID to use as a script argument.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
DropBook can collect the names of all files and folders in the Program Files directories.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Dtrack can list files on available disk volumes.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
DustySky scans the victim for files that contain certain keywords and document types including PDF, DOC, DOCX, XLS, and XLSX, from a list that is obtained from the C2 as a text file. It can also identify logical drives for the infected machine.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
ELMER is capable of performing directory listings.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Ebury can list directory entries.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
A variant of Elise executes `dir C:\progra~1` when initially run.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Empire includes various modules for finding files of interest on hosts and network shares.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Epic recursively searches for all .doc files on the system and collects a directory listing of the Desktop, %TEMP%, and %WINDOWS%\Temp directories.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
FALLCHILL can search files on a victim.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
FIVEHANDS has the ability to enumerate files on a compromised host in order to encrypt files with specific extensions.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system and removable media.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
FYAnti can search the `C:\Windows\Microsoft.NET\` directory for files of a specified size.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
FatDuke can enumerate directories on target machines.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
FinFisher enumerates directories and scans for certain files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
FoggyWeb's loader can check for the FoggyWeb backdoor .pri file on a compromised AD FS server.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Forfiles can be used to locate certain types of files/directories in a system.(ex: locate all files with a specific extension, name, and/or age)
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
FruitFly looks for specific files and file types.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
FunnyDream can identify files with .doc, .docx, .ppt, .pptx, .xls, .xlsx, and .pdf extensions and specific timestamps for collection.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Fysbis has the ability to search for files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Gelsemium can retrieve data from specific Windows directories, as well as open random files as part of Virtualization/Sandbox Evasion.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
GeminiDuke collects information from the victim, including installed drivers, programs previously executed by users, programs and services configured to automatically run at startup, files and folders present in any user's home folder, files and folders present in any user's My Documents, programs installed to the Program Files folder, and recently accessed files, folders, and programs.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Gold Dragon lists the directories for Desktop, program files, and the user’s recently accessed files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
GoldenSpy has included a program "ExeProtector", which monitors for the existence of GoldenSpy on the infected system and redownloads if necessary.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
GravityRAT collects the volumes mapped on the system, and also steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
GrimAgent has the ability to enumerate files and directories on a compromised host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
HOPLIGHT has been observed enumerating system drives and partitions.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
HTTPBrowser is capable of listing files, folders, and drives on a victim.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
HermeticWiper can enumerate common folders such as My Documents, Desktop, and AppData.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Heyoka Backdoor has the ability to search the compromised host for files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
HotCroissant has the ability to retrieve a list of files in a given directory as well as drives and drive types.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Hydraq creates a backdoor through which remote attackers can check for the existence of files, including its own components, as well as retrieve a list of logical drives.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
The IceApple Directory Lister module can list information about files and directories including creation time, last write time, name, and size.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Imminent Monitor has a dynamic debugging feature to check whether it is located in the %TEMP% directory, otherwise it copies itself there.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Industroyer’s data wiper component enumerates specific files on all the Windows drives.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
InnaputRAT enumerates directories and obtains file attributes on a system.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
InvisiMole can list information about files in a directory and recently opened or used documents. InvisiMole can also search for specific files by supplied file mask.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Ixeshe can list file and directory information.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
JPIN can enumerate drives and their types. It can also change file permissions using cacls.exe.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
KEYMARBLE has a command to search for files on the victim’s machine.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
KGH_SPY can enumerate files and directories on a compromised host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
A version of KONNI searches for filenames created with a previous version of the malware, suggesting different versions targeted the same victims and the versions may work together.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Kasidet has the ability to search for a given filename on a victim.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Kazuar finds a specified directory, lists the files and metadata about those files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
KeyBoy has a command to launch a file browser or explorer on the system.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
KillDisk has used the `FindNextFile` command as part of its file deletion process.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Kinsing has used the find command to search for specific files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Kivars has the ability to list drives on the infected host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Koadic can obtain a list of directories.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Kwampirs collects a list of files and directories in C:\ with the command `dir /s /a c:\ >> "C:\windows\TEMP\[RANDOM].tmp"`.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
LITTLELAMB.WOOLTEA can monitor for system upgrade events by checking for the presence of `/tmp/data/root/dev`.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Linfo creates a backdoor through which remote attackers can list contents of drives and search for files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
LoFiSe can monitor the file system to identify files less than 6.4 MB in size with file extensions including .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pdf, .rtf, .tif, .odt, .ods, .odp, .eml, and .msg.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Lokibot can search for specific files on an infected host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
LookBack can retrieve file listings from the victim machine.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
MESSAGETAP checks for the existence of two configuration files (keyword_parm.txt and parm.txt) and attempts to read the files every 30 seconds.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
MacMa can search for a specific file on the compromised computer and can enumerate files in Desktop, Downloads, and Documents folders.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Machete produces file listings in order to search for files to be exfiltrated.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Mafalda can search for files and directories.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
MarkiRAT can look for files carrying specific extensions such as: .rtf, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pps, .ppsx, .txt, .gpg, .pkr, .kdbx, .key, and .jpb.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
MegaCortex can parse the available drives and directories to determine which files to encrypt.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Metamorfo has searched the Program Files directories for specific folders and has searched for strings related to its mutexes.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Micropsia can perform a recursive directory listing for all volume drives available on the victim's machine and can also fetch specific files by their paths.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
MiniDuke can enumerate local drives.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Misdat is capable of running commands to obtain a list of files and directories, as well as enumerating logical drives.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Mispadu searches for various filesystem paths to determine what banking applications are installed on the victim’s machine.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
MobileOrder has a command to upload to its C2 server information about files on the victim mobile device, including SD card size, installed app list, SMS content, contacts, and calling history.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
MoonWind has a command to return a directory listing for a specified directory.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
NDiskMonitor can obtain a list of all files and directories as well as logical drives.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
NETEAGLE allows adversaries to enumerate and modify the infected host's file system. It supports searching for directories, creating directories, listing directory contents, reading and writing to files, retrieving file attributes, and retrieving volume information.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
NETWIRE has the ability to search for files on the compromised host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Nebulae can list files and directories on a compromised host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
NightClub can use a file monitor to identify .lnk, .doc, .docx, .xls, .xslx, and .pdf files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Ninja has the ability to enumerate directory content.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
NotPetya searches for files ending with dozens of different file extensions prior to encryption.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
OSX/Shlayer has used the command `appDir="$(dirname $(dirname "$currentDir"))"` and `$(dirname "$(pwd -P)")` to construct installation paths.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
ObliqueRAT has the ability to recursively enumerate files on an infected endpoint.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
OceanSalt can extract drive information from the endpoint and search files on the system.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Octopus can collect information on the Windows directory and searches for compressed RAR files on the host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Okrum has used DriveLetterView to enumerate drive information.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Orz can gather victim drive information.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
OutSteel can search for specific file extensions, including zipped files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
OwaAuth has a command to list its directory and logical drives.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
P.A.S. Webshell has the ability to list files and file characteristics including extension, size, ownership, and permissions.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
PACEMAKER can parse `/proc/"process_name"/cmdline` to look for the string `dswsd` within the command line.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
PLEAD has the ability to list drives and files on the compromised host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
POORAIM can conduct file browsing.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
POWRUNER may enumerate user directories on a victim.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Pasam creates a backdoor through which remote attackers can retrieve lists of files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Pcexter has the ability to search for files in specified directories.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Penquin can use the command code `do_vslist` to send file names, size, and status to C2.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Peppy can identify specific files for exfiltration.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
PinchDuke searches for files created within a certain timeframe and whose file extension matches a predefined list.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
PingPull can enumerate storage volumes and folder contents of a compromised host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Pisloader has commands to list drives on the victim machine and to list file information for a given directory.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
PlugX has a module to enumerate drives and find files recursively.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
PoetRAT has the ability to list files upon receiving the `ls` command from C2.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
PoshC2 can enumerate files on the local file system and includes a module for enumerating recently accessed files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
PowerDuke has commands to get the current directory name as well as the size of a file. It also has commands to obtain information about logical drives, drive type, and free space.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Prestige can traverse the file system to discover files to encrypt by identifying specific extensions defined in a hardcoded list.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
A module in Prikormka collects information about the paths, size, and creation time of files with specific file extensions, but not the actual content of the file.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Proxysvc lists files in directories.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Psylo has commands to enumerate all storage devices and to find all files that start with a particular string.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Pteranodon identifies files matching certain file extension and copies them to subdirectories it created.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Pupy can walk through directories and recursively search for strings in files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
QakBot can identify whether it has been run previously on a host by checking for a specified folder.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
QuietSieve can search files on the target host by extension, including doc, docx, xls, rtf, odt, txt, jpg, pdf, rar, zip, and 7z.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
RARSTONE obtains installer properties from Uninstall Registry Key entries to obtain information about installed applications and how to uninstall certain applications.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
REvil has the ability to identify specific files and directories that are not to be encrypted.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
ROKRAT has the ability to gather a list of files and directories on the infected system.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
RTM can check for specific files and directories associated with virtualization and malware analysis.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
RainyDay can use a file exfiltration tool to collect recently changed files with specific extensions.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Ramsay can collect directory and file lists.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Rclone can list files and directories with the `ls`, `lsd`, and `lsl` commands.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
RedLeaves can enumerate and search for files and directories.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Remcos can search for files on the infected machine.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Remexi searches for files on the system.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
RemoteUtilities can enumerate files and directories on a target machine.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Remsec is capable of listing contents of folders on the victim. Remsec also searches for custom network encryption software on victims.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Rising Sun can enumerate information about files from the infected system, including file size, attributes, creation time, last access time, and write time. Rising Sun can enumerate the compilation timestamp of Windows executable files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Rover automatically searches for files on local drives based on a predefined list of file extensions.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Royal can identify specific files and directories to exclude from the encryption process.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Ryuk has enumerated files and folders on all mounted drives.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
SDBbot has the ability to get directory listings or drive information on a compromised host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
SHOTPUT has a command to obtain a directory listing.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
SILENTTRINITY has several modules, such as `ls.py`, `pwd.py`, and `recentFiles.py`, to enumerate directories and files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
SLOTHFULMEDIA can enumerate files and directories.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
SOUNDBITE is capable of enumerating and manipulating files and directories.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
SPACESHIP identifies files and directories for collection by searching for specific file extensions or file modification time.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
SUGARDUMP can search for and collect data from specific Chrome, Opera, Microsoft Edge, and Firefox files, including any folders that have the string `Profile` in its name.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
SUNBURST had commands to enumerate files and directories.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
SUNSPOT enumerated the Orion software Visual Studio solution directory path.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Saint Bot can search a compromised host for specific files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Samurai can use a specific module for file enumeration.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Seasalt has the capability to identify the drive type on a victim.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
SharpDisco can identify recently opened files by using an LNK format parser to extract the original file path from LNK files found in either `%USERPROFILE%\Recent` (Windows XP) or `%APPDATA%\Microsoft\Windows\Recent` (newer Windows versions) .
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
ShimRat can list directories.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
SideTwist has the ability to search for specific files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Siloscape searches for the Kubernetes config file and other related files using a regular expression.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Skidmap has checked for the existence of specific files including `/usr/sbin/setenforce` and ` /etc/selinux/config`. It also has the ability to monitor the cryptocurrency miner file and process.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Sliver can enumerate files on a target system.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Smoke Loader recursively searches through directories for files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
SombRAT can execute `enum` to enumerate files in storage on a compromised system.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
SoreFang has the ability to list directories.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
StreamEx has the ability to enumerate drive types.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
StrifeWater can enumerate files on a compromised host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
StrongPity can parse the hard drive on a compromised host to identify specific file extensions.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Stuxnet uses a driver to scan for specific filesystem driver objects.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
SynAck checks its directory location in an attempt to avoid launching in a sandbox.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
SysUpdate can search files on a compromised host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
TAINTEDSCRIBE can use `DirectoryList` to enumerate files in a specified directory.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
TINYTYPHON searches through the drive containing the OS, then all drive letters C through to Z, for documents matching certain extensions.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
TSCookie has the ability to discover drive information on the infected host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
TYPEFRAME can search directories for files on the victim’s machine.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Taidoor can search for specific files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
TajMahal has the ability to index files from drives, user profiles, and removable drives.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
ThreatNeedle can obtain file and directory information.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
TrickBot searches the system for all of the following file extensions: .avi, .mov, .mkv, .mpeg, .mpeg4, .mp4, .mp3, .wav, .ogg, .jpeg, .jpg, .png, .bmp, .gif, .tiff, .ico, .xlsx, and .zip. It can also obtain browsing history, cookies, and plug-in information.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Trojan.Karagany can enumerate files and directories on a compromised host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Turian can search for specific files and list directories.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
UPPERCUT has the capability to gather the victim's current directory.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
USBStealer searches victim drives for files matching certain extensions (“.skr”,“.pkr” or “.key”) or names.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
USBferry can detect the victim's file or folder list.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Uroburos can search for specific files on a compromised system.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Volgmer can list directories on a victim.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
WINERACK can enumerate files and directories.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
WannaCry searches for variety of user files by file extension before encrypting them using RSA and AES, including Office, PDF, image, audio, video, source code, archive/compression format, and key and certificate files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
WarzoneRAT can enumerate directories on a compromise host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
WastedLocker can enumerate files and directories just prior to encryption.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
WhisperGate can locate files based on hardcoded file extensions.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
WinMM sets a WH_CBT Windows hook to search for and capture files on the victim.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
WindTail has the ability to enumerate the users home directory and the path to its own application bundle.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Winnti for Windows can check for the presence of specific files prior to moving to the next phase of execution.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Woody RAT can list all files and their associated attributes, including filename, type, owner, creation time, last access time, last write time, size, and permissions.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
XAgentOSX contains the readFiles function to return a detailed listing (sometimes recursive) of a specified directory. XAgentOSX contains the showBackupIosFolder function to check for IOS device backups by running `ls -la ~/Library/Application\ Support/MobileSync/Backup/`.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
XCSSET has used `mdfind` to enumerate a list of apps known to grant screen sharing permissions.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
ZIPLINE can find and append specific files on Ivanti Connect Secure VPNs based upon received commands.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
ZLib has the ability to enumerate files and drives.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Zebrocy searches for files that are 60mb and less and contain the following extensions: .doc, .docx, .xls, .xlsx, .ppt, .pptx, .exe, .zip, and .rar. Zebrocy also runs the `echo %APPDATA%` command to list the contents of the directory. Zebrocy can obtain the current execution path as well as perform drive enumeration.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Zeus Panda searches for specific directories on the victim’s machine.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Zox can enumerate files on a compromised host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
ZxShell has a command to open a file manager and explorer on the system.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
ccf32 can parse collected files to identify specific file extensions.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
cmd can be used to find files and directories with native functionality such as `dir` commands.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
down_new has the ability to list the directories on a compromised host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
jRAT can browse file systems.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
metaMain can recursively enumerate files in an operator-provided directory.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
njRAT can browse file systems using a file manager module.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
yty gathers information on victim’s drives and has a plugin for document listing.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
zwShell can browse the file system.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
During the SolarWinds Compromise, APT29 obtained a list of users and their roles from an Exchange server using `Get-ManagementRoleAssignment`.
Technique: T1087 Account Discovery, Tactic: TA0007 Discovery
FIN13 has enumerated all users and their roles from a victim's main treasury system.
Technique: T1087 Account Discovery, Tactic: TA0007 Discovery
ShimRatReporter listed all non-privileged and privileged accounts available on the machine.
Technique: T1087 Account Discovery, Tactic: TA0007 Discovery
Woody RAT can identify administrator accounts on an infected machine.
Technique: T1087 Account Discovery, Tactic: TA0007 Discovery
XCSSET attempts to discover accounts from various locations such as a user's Evernote, AppleID, Telegram, Skype, and WeChat data.
Technique: T1087 Account Discovery, Tactic: TA0007 Discovery
During Operation CuckooBees, the threat actors used the `net user` command to gather account information.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
APT1 used the commands `net localgroup`,`net user`, and `net group` to find accounts on the system.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
APT3 has used a tool that can obtain info about local and global group users, power users, and administrators.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
APT32 enumerated administrative users using the commands `net localgroup administrators`.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
APT41 used built-in `net` commands to enumerate local administrator groups.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
Chimera has used `net user` for account discovery.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
Fox Kitten has accessed ntuser.dat and UserClass.dat on compromised hosts.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
Ke3chang performs account discovery using commands such as `net localgroup administrators` and `net group "REDACTED" /domain` on specific permissions groups.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
Moses Staff has collected the administrator username from a compromised host.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
OilRig has run `net user`, `net user /domain`, `net group “domain admins” /domain`, and `net group “Exchange Trusted Subsystem” /domain` to get account listings on a victim.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
Poseidon Group searches for administrator accounts on both the local victim machine and the network.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
Threat Group-3390 has used `net user` to conduct internal discovery of systems.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
Turla has used `net user` to enumerate local accounts on the system.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
admin@338 actors used the following commands following exploitation of a machine with LOWBALL malware to enumerate user accounts: `net user >> %temp%\download` `net user /domain >> %temp%\download`
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
Agent Tesla can collect account information from the victim’s machine.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
Bankshot gathers domain and account names/information through process monitoring.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
Bazar can identify administrator accounts on an infected host.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
BitPaymer can enumerate the sessions for each user logged onto the infected host.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
BloodHound can identify users with local administrator rights.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
Comnie uses the `net user` command.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
The discovery modules used with Duqu can collect information on accounts and permissions.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
Elise executes `net user` after initial communication is made to the remote server.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
Empire can acquire local and domain user account information.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
Epic gathers a list of all user accounts, privilege classes, and time of last logon.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
GeminiDuke collects information on local user accounts from the victim.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
HyperStack can enumerate all account names on a remote share.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
InvisiMole has a command to list account information on the victim’s machine.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
Kazuar gathers information on local groups and members on the victim’s machine.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
Kwampirs collects a list of accounts with the command `net users`.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
MURKYTOP has the capability to retrieve information about users on remote hosts.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
Milan has run `C:\Windows\system32\cmd.exe /c cmd /c dir c:\users\ /s 2>&1` to discover local accounts.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
Mis-Type may create a file containing the results of the command `cmd.exe /c net user {Username}`.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
Commands under `net user` can be used in Net to gather information about and manipulate user accounts.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
OSInfo enumerates local and domain users
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
P.A.S. Webshell can display the /etc/passwd file on a compromised host.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
POWERSTATS can retrieve usernames from compromised hosts.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
PUNCHBUGGY can gather user names.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
Pony has used the `NetUserEnum` function to enumerate local accounts.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
PoshC2 can enumerate local and domain user account information.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
PowerSploit's `Get-ProcessTokenGroup` Privesc-PowerUp module can enumerate all SIDs associated with its current token.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
Pupy uses PowerView and Pywerview to perform discovery commands such as net user, net group, net local group, etc.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
RATANKBA uses the `net user` command.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
Remsec can obtain a list of users.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
S-Type has run the command `net user` on a victim.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
SHOTPUT has a command to retrieve information about connected users.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
SMOKEDHAM has used `net.exe user` and `net.exe users` to enumerate local accounts on a compromised host.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
SoreFang can collect usernames from the local system via `net.exe user`.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
Stuxnet enumerates user accounts of the local host.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
TrickBot collects the users of the system.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
USBferry can use `net user` to gather information about local accounts.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery
Valak has the ability to enumerate local admin accounts.
Technique: T1087.001 Account Discovery: Local Account, Tactic: TA0007 Discovery