sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
Olympic Destroyer uses PsExec to interact with the `ADMIN$` network share to execute commands on remote systems.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
PsExec, a tool that has been used by adversaries, writes programs to the `ADMIN$` network share to execute commands on remote systems.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
The Regin malware platform can use Windows admin shares to move laterally.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Royal can use SMB to connect to move laterally.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Ryuk has used the C$ network share for lateral movement.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Shamoon accesses network share(s), enables share access to the target device, copies an executable payload to the target system, and uses a Scheduled Task/Job to execute the malware.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Stuxnet propagates to available network shares.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Zox has the ability to use SMB for communication.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
zwShell has been copied over network shares to move laterally.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Cobalt Strike can deliver Beacon payloads for lateral movement by leveraging remote COM execution.
Technique: T1021.003 Remote Services: Distributed Component Object Model, Tactic: TA0008 Lateral Movement
Empire can utilize `Invoke-DCOM` to leverage remote COM execution for lateral movement.
Technique: T1021.003 Remote Services: Distributed Component Object Model, Tactic: TA0008 Lateral Movement
SILENTTRINITY can use `System` namespace methods to execute lateral movement using DCOM.
Technique: T1021.003 Remote Services: Distributed Component Object Model, Tactic: TA0008 Lateral Movement
During the C0032 campaign, TEMP.Veles relied on encrypted SSH-based tunnels to transfer tools and for remote command/program execution.
Technique: T1021.004 Remote Services: SSH, Tactic: TA0008 Lateral Movement
During Cutting Edge, threat actors used SSH for lateral movement.
Technique: T1021.004 Remote Services: SSH, Tactic: TA0008 Lateral Movement
APT39 used secure shell (SSH) to move laterally among their targets.
Technique: T1021.004 Remote Services: SSH, Tactic: TA0008 Lateral Movement
APT5 has used SSH for lateral movement in compromised environments including for enabling access to ESXi host servers.
Technique: T1021.004 Remote Services: SSH, Tactic: TA0008 Lateral Movement
BlackTech has used Putty for remote access.
Technique: T1021.004 Remote Services: SSH, Tactic: TA0008 Lateral Movement
FIN13 has remotely accessed compromised environments via secure shell (SSH) for lateral movement.
Technique: T1021.004 Remote Services: SSH, Tactic: TA0008 Lateral Movement
FIN7 has used SSH to move laterally through victim environments.
Technique: T1021.004 Remote Services: SSH, Tactic: TA0008 Lateral Movement
Fox Kitten has used the PuTTY and Plink tools for lateral movement.
Technique: T1021.004 Remote Services: SSH, Tactic: TA0008 Lateral Movement
GCMAN uses Putty for lateral movement.
Technique: T1021.004 Remote Services: SSH, Tactic: TA0008 Lateral Movement
Lazarus Group used SSH and the PuTTy PSCP utility to gain access to a restricted segment of a compromised network.
Technique: T1021.004 Remote Services: SSH, Tactic: TA0008 Lateral Movement
Leviathan used ssh for internal reconnaissance.
Technique: T1021.004 Remote Services: SSH, Tactic: TA0008 Lateral Movement
OilRig has used Putty to access compromised systems.
Technique: T1021.004 Remote Services: SSH, Tactic: TA0008 Lateral Movement
Rocke has spread its coinminer via SSH.
Technique: T1021.004 Remote Services: SSH, Tactic: TA0008 Lateral Movement
TeamTNT has used SSH to connect back to victim machines. TeamTNT has also used SSH to transfer tools and payloads onto victim hosts and execute them.
Technique: T1021.004 Remote Services: SSH, Tactic: TA0008 Lateral Movement
menuPass has used Putty Secure Copy Client (PSCP) to transfer data.
Technique: T1021.004 Remote Services: SSH, Tactic: TA0008 Lateral Movement
Cobalt Strike can SSH to a remote service.
Technique: T1021.004 Remote Services: SSH, Tactic: TA0008 Lateral Movement
Empire contains modules for executing commands over SSH as well as in-memory VNC agent injection.
Technique: T1021.004 Remote Services: SSH, Tactic: TA0008 Lateral Movement
Kinsing has used SSH for lateral movement.
Technique: T1021.004 Remote Services: SSH, Tactic: TA0008 Lateral Movement
FIN7 has used TightVNC to control compromised hosts.
Technique: T1021.005 Remote Services: VNC, Tactic: TA0008 Lateral Movement
Fox Kitten has installed TightVNC server and client on compromised servers and endpoints for lateral movement.
Technique: T1021.005 Remote Services: VNC, Tactic: TA0008 Lateral Movement
GCMAN uses VNC for lateral movement.
Technique: T1021.005 Remote Services: VNC, Tactic: TA0008 Lateral Movement
Gamaredon Group has used VNC tools, including UltraVNC, to remotely interact with compromised hosts.
Technique: T1021.005 Remote Services: VNC, Tactic: TA0008 Lateral Movement
Carberp can start a remote VNC session by downloading a new plugin.
Technique: T1021.005 Remote Services: VNC, Tactic: TA0008 Lateral Movement
DanBot can use VNC for remote access to targeted systems.
Technique: T1021.005 Remote Services: VNC, Tactic: TA0008 Lateral Movement
Proton uses VNC to connect into systems.
Technique: T1021.005 Remote Services: VNC, Tactic: TA0008 Lateral Movement
TrickBot has used a VNC module to monitor the victim and collect information to pivot to valuable systems on the network
Technique: T1021.005 Remote Services: VNC, Tactic: TA0008 Lateral Movement
WarzoneRAT has the ability of performing remote desktop access via a VNC console.
Technique: T1021.005 Remote Services: VNC, Tactic: TA0008 Lateral Movement
ZxShell supports functionality for VNC sessions.
Technique: T1021.005 Remote Services: VNC, Tactic: TA0008 Lateral Movement
During the SolarWinds Compromise, APT29 used WinRM via PowerShell to execute commands and payloads on remote hosts.
Technique: T1021.006 Remote Services: Windows Remote Management, Tactic: TA0008 Lateral Movement
Chimera has used WinRM for lateral movement.
Technique: T1021.006 Remote Services: Windows Remote Management, Tactic: TA0008 Lateral Movement
FIN13 has leveraged `WMI` to move laterally within a compromised network via application servers and SQL servers.
Technique: T1021.006 Remote Services: Windows Remote Management, Tactic: TA0008 Lateral Movement
Threat Group-3390 has used WinRM to enable remote execution.
Technique: T1021.006 Remote Services: Windows Remote Management, Tactic: TA0008 Lateral Movement
Wizard Spider has used Window Remote Management to move laterally through a victim network.
Technique: T1021.006 Remote Services: Windows Remote Management, Tactic: TA0008 Lateral Movement
Brute Ratel C4 can use WinRM for pivoting.
Technique: T1021.006 Remote Services: Windows Remote Management, Tactic: TA0008 Lateral Movement
Cobalt Strike can use `WinRM` to execute a payload on a remote host.
Technique: T1021.006 Remote Services: Windows Remote Management, Tactic: TA0008 Lateral Movement
SILENTTRINITY tracks `TrustedHosts` and can move laterally to these targets via WinRM.
Technique: T1021.006 Remote Services: Windows Remote Management, Tactic: TA0008 Lateral Movement
During C0027, Scattered Spider used compromised Azure credentials for credential theft activity and lateral movement to on-premises systems.
Technique: T1021.007 Remote Services: Cloud Services, Tactic: TA0008 Lateral Movement
APT29 has leveraged compromised high-privileged on-premises accounts synced to Office 365 to move laterally into a cloud environment, including through the use of Azure AD PowerShell.
Technique: T1021.007 Remote Services: Cloud Services, Tactic: TA0008 Lateral Movement
During C0027, Scattered Spider used compromised Azure credentials for credential theft activity and lateral movement to on-premises systems.

Scattered Spider has also leveraged pre-existing AWS EC2 instances for lateral movement and data collection purposes.
Technique: T1021.007 Remote Services: Cloud Services, Tactic: TA0008 Lateral Movement
An APT28 backdoor may collect the entire contents of an inserted USB device.
Technique: T1025 Data from Removable Media, Tactic: TA0009 Collection
A Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.
Technique: T1025 Data from Removable Media, Tactic: TA0009 Collection
Turla RPC backdoors can collect files from USB thumb drives.
Technique: T1025 Data from Removable Media, Tactic: TA0009 Collection
AppleSeed can find and collect data from removable media devices.
Technique: T1025 Data from Removable Media, Tactic: TA0009 Collection
Aria-body has the ability to collect data from USB devices.
Technique: T1025 Data from Removable Media, Tactic: TA0009 Collection
BADNEWS copies files with certain extensions from USB devices to
a predefined directory.
Technique: T1025 Data from Removable Media, Tactic: TA0009 Collection
CosmicDuke steals user files from removable media with file extensions and keywords that match a predefined list.
Technique: T1025 Data from Removable Media, Tactic: TA0009 Collection
Crimson contains a module to collect data from removable drives.
Technique: T1025 Data from Removable Media, Tactic: TA0009 Collection
Crutch can monitor removable drives and exfiltrate files matching a given extension list.
Technique: T1025 Data from Removable Media, Tactic: TA0009 Collection
Explosive can scan all .exe files located in the USB drive.
Technique: T1025 Data from Removable Media, Tactic: TA0009 Collection
FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on removable media and copies them to a staging area. The default file types copied would include data copied to the drive by SPACESHIP.
Technique: T1025 Data from Removable Media, Tactic: TA0009 Collection
The FunnyDream FilePakMonitor component has the ability to collect files from removable devices.
Technique: T1025 Data from Removable Media, Tactic: TA0009 Collection
GravityRAT steals files based on an extension list if a USB drive is connected to the system.
Technique: T1025 Data from Removable Media, Tactic: TA0009 Collection
InvisiMole can collect jpeg files from connected MTP devices.
Technique: T1025 Data from Removable Media, Tactic: TA0009 Collection
Machete can find, encrypt, and upload files from fixed and removable drives.
Technique: T1025 Data from Removable Media, Tactic: TA0009 Collection
ObliqueRAT has the ability to extract data from removable devices connected to the endpoint.
Technique: T1025 Data from Removable Media, Tactic: TA0009 Collection
Prikormka contains a module that collects documents with certain extensions from removable media or fixed drives connected via USB.
Technique: T1025 Data from Removable Media, Tactic: TA0009 Collection
Ramsay can collect data from removable media and stage it for exfiltration.
Technique: T1025 Data from Removable Media, Tactic: TA0009 Collection
Remsec has a package that collects documents from any inserted USB sticks.
Technique: T1025 Data from Removable Media, Tactic: TA0009 Collection
Rover searches for files on attached removable drives based on a predefined list of file extensions every five seconds.
Technique: T1025 Data from Removable Media, Tactic: TA0009 Collection
TajMahal has the ability to steal written CD images and files of interest from previously connected removable drives when they become available again.
Technique: T1025 Data from Removable Media, Tactic: TA0009 Collection
Once a removable media device is inserted back into the first victim, USBStealer collects data from it that was exfiltrated from a second victim.
Technique: T1025 Data from Removable Media, Tactic: TA0009 Collection
During the 2016 Ukraine Electric Power Attack, Sandworm Team used heavily obfuscated code with Industroyer in its Windows Notepad backdoor.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
During C0015, the threat actors used Base64-encoded strings.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
During C0017, APT41 broke malicious binaries, including DEADEYE and KEYPLUG, into multiple sections on disk to evade detection.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
APT-C-36 has used ConfuserEx to obfuscate its variant of Imminent Monitor, compressed payload and RAT packages, and password protected encrypted email attachments to avoid detection.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
APT3 obfuscates files or information to help evade defensive measures.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
APT37 obfuscates strings and payloads.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
APT41 used VMProtected binaries in multiple intrusions.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
BackdoorDiplomacy has obfuscated tools and malware it uses with VMProtect.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
BlackOasis's first stage shellcode contains a NOP sled with alternative instructions that was likely designed to bypass antivirus tools.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Earth Lusca used Base64 to encode strings.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Ember Bear has obfuscated malware to help avoid detection.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
GALLIUM used a modified version of HTRAN in which they obfuscated strings such as debug messages in an apparent attempt to evade detection.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Gallmaker obfuscated shellcode used during execution.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Gamaredon Group has delivered self-extracting 7z archive files within malicious document attachments.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Ke3chang has used Base64-encoded shellcode strings.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Kimsuky has obfuscated binary strings including the use of XOR encryption and Base64 encoding. Kimsuky has also modified the first byte of DLL implants targeting victims to prevent recognition of the executable file format.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Mustang Panda has delivered initial payloads hidden using archives and encoding measures.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Rocke has modified UPX headers after packing files to break unpackers.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Sandworm Team has used Base64 encoding within malware variants.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Windshift has used string encoding with floating point calculations.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Most of the strings in ADVSTORESHELL are encrypted with an XOR-based algorithm; some strings are also encrypted with 3DES and reversed. API function names are also reversed, presumably to avoid detection in memory.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Action RAT's commands, strings, and domains can be Base64 encoded within the payload.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Agent Tesla has had its code obfuscated in an apparent attempt to make analysis difficult. Agent Tesla has used the Rijndael symmetric encryption algorithm to encrypt strings.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Amadey has obfuscated strings such as antivirus vendor names, domains, files, and others.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Anchor has obfuscated code with stack strings and string encryption.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
AppleJeus has XOR-encrypted collected system information prior to sending to a C2. AppleJeus has also used the open source ADVObfuscation library for its components.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
AppleSeed has the ability to Base64 encode its payload and custom encrypt API calls.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Avaddon has used encrypted strings.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
AvosLocker has used XOR-encoded strings.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
BUSHWALK can encrypt the resulting data generated from C2 commands with RC4.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
BoomBox can encrypt data using AES prior to exfiltration.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
BoxCaon used the "StackStrings" obfuscation technique to hide malicious functionalities.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Brute Ratel C4 has used encrypted payload files and maintains an encrypted configuration structure in memory.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Bumblebee has been delivered as password-protected zipped ISO files and used control-flow-flattening to obfuscate the flow of functions.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Bundlore has obfuscated data with base64, AES, RC4, and bz2.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
CARROTBALL has used a custom base64 alphabet to decode files.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
COATHANGER can store obfuscated configuration information in the last 56 bytes of the file `/date/.bd.key/preload.so`.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
CORESHELL obfuscates strings using a custom stream cipher.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Carbanak encrypts strings to make analysis more difficult.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Carbon encrypts configuration files and tasks for the malware to complete using CAST-128 algorithm.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
The Clambling executable has been obfuscated when dropped on a compromised host.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Cobalt Strike can hash functions to obfuscate calls to the Windows API and use a public/private key pair to encrypt Beacon session metadata.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
CoinTicker initially downloads a hidden encoded file.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
ComRAT has encrypted its virtual file system using AES-256 in XTS mode.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Comnie uses RC4 and Base64 to obfuscate strings.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Conficker has obfuscated its code to prevent its removal from host machines.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Conti can use compiler-based obfuscation for its code, encrypt DLLs, and hide Windows API calls.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Cuba has used multiple layers of obfuscation to avoid analysis, including its Base64 encoded payload.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
DRATzarus can be partly encrypted with XOR.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
DarkGate uses a hard-coded string as a seed, along with the victim machine hardware identifier and input text, to generate a unique string used as an internal mutex value to evade static detection based on mutexes.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
DarkTortilla has been obfuscated with the DeepSea .NET and ConfuserEx code obfuscators.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Daserf uses encrypted Windows APIs and also encrypts data using the alternative base64+RC4 or the Caesar cipher.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Denis obfuscates its code and encrypts the API names.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Diavol has Base64 encoded the RSA public key used for encrypting files.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Donut can generate encrypted, compressed/encoded, or otherwise obfuscated code modules.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Dridex's strings are obfuscated using RC4.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Drovorub has used XOR encrypted payloads in WebSocket client to server messages.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
The DustySky dropper uses a function to obfuscate the name of functions and other parts of the malware.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
ECCENTRICBANDWAGON has encrypted strings with RC4.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
EKANS uses encoded strings in its process kill list.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Ebury has obfuscated its strings with a simple XOR encryption with a static key.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Ecipekac can use XOR, AES, and DES to encrypt loader shellcode.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Epic heavily obfuscates its code to make analysis more difficult.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
FatDuke can use base64 encoding, string stacking, and opaque predicates for obfuscation.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
FinFisher is heavily obfuscated in many ways, including through the use of spaghetti code in its functions in an effort to confuse disassembly programs. It also uses a custom XOR algorithm to obfuscate code.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Final1stspy obfuscates strings with base64 encoding.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Flagpro has been delivered within ZIP or RAR password-protected archived files.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Goopy's decrypter have been inflated with junk code in between legitimate API functions, and also included infinite loops to avoid analysis.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Green Lambert has encrypted strings.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
GrimAgent has used Rotate on Right (RoR) and Rotate on Left (RoL) functionality to encrypt strings.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
H1N1 uses multiple techniques to obfuscate strings, including XOR.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
HTTPBrowser's code may be obfuscated through structured exception handling and return-oriented programming.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Hancitor has used Base64 to encode malicious links. Hancitor has also delivered compressed payloads in ZIP files to victims.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Hydraq uses basic obfuscation in the form of spaghetti code.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
ISMInjector is obfuscated with the off-the-shelf SmartAssembly .NET obfuscator created by red-gate.com.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Imminent Monitor has encrypted the spearphish attachments to avoid detection from email gateways; the debugger also encrypts information before sending to the C2.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Industroyer uses heavily obfuscated code in its Windows Notepad backdoor.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
InnaputRAT uses an 8-byte XOR key to obfuscate API names and other strings contained in the payload.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
InvisiMole avoids analysis by encrypting all strings, internal files, configuration data and by using a custom executable format.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
A JPIN uses a encrypted and compressed payload that is disguised as a bitmap within the resource section of the installer.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Kazuar is obfuscated using the open source ConfuserEx protector. Kazuar also obfuscates the name of created files/folders/mutexes and encrypts debug messages written to log files using the Rijndael cipher.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Kerrdown can encrypt, encode, and compress multiple layers of shellcode.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
KillDisk uses VMProtect to make reverse engineering the malware more difficult.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Kobalos encrypts all strings using RC4 and bundles all functionality into a single function call.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Lokibot has obfuscated strings with base64 encoding.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
MCMD can Base64 encode output strings prior to sending to C2.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Matryoshka obfuscates API function names using a substitute cipher combined with Base64 encoding.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Maze has decrypted strings and other important information during the encryption process. Maze also calls certain functions dynamically to hinder analysis.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
MiniDuke can use control flow flattening to obscure code.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
NETWIRE has used a custom obfuscation algorithm to hide strings including Registry keys, APIs, and DLL names.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
NOKKI uses Base64 encoding for strings.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
NanoCore’s plugins were obfuscated with Eazfuscater.NET 3.3.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
NightClub can obfuscate strings using the congruential generator `(LCG): staten+1 = (690069 × staten + 1) mod 232`.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
OLDBAIT obfuscates internal strings and unpacks them at startup.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
OopsIE uses the Confuser protector to obfuscate an embedded .Net Framework assembly used for C2. OopsIE also encodes collected data in hexadecimal format before writing to files on disk and obfuscates strings.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Some Orz strings are base64 encoded, such as the embedded DLL known as MockDll.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Out1 has the ability to encode data.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
P.A.S. Webshell can use encryption and base64 encoding to hide strings and to enforce access control once deployed.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
POSHSPY appends a file signature header (randomly selected from six file types) to encrypted data prior to upload or download.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
PUNCHBUGGY has hashed most its code's functions and encrypted payloads with base64 and XOR.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
PUNCHTRACK is loaded and executed by a highly obfuscated launcher.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Pandora has the ability to compress stings with QuickLZ.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Pillowmint has been compressed and stored within a registry key. Pillowmint has also obfuscated the AES key used for encryption.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Pisloader obfuscates files by splitting strings into smaller sub-strings and including "garbage" strings that are never used. The malware also uses return-oriented programming (ROP) technique and single-byte XOR to obfuscate data.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
PlugX can use API hashing and modify the names of strings to evade detection.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
PoetRAT has used a custom encryption scheme for communication between scripts.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
PoisonIvy hides any strings related to its own indicators of compromise.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
PolyglotDuke can custom encrypt strings.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Pony attachments have been delivered via compressed archive files. Pony also obfuscates the memory flow by adding junk instructions when executing to make analysis more difficult.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
PowerStallion uses a XOR cipher to encrypt command output written to its OneDrive C2 server.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
QakBot has hidden code within Excel spreadsheets by turning the font color to white and splitting it across multiple cells.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
ROKRAT can encrypt data prior to exfiltration by using an RSA public key.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
RTM strings, network data, configuration, and modules are encrypted with a modified RC4 algorithm. RTM has also been delivered to targets as various archive files including ZIP, 7-ZIP, and RAR.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Ramsay has base64-encoded its portable executable and hidden itself under a JPG header. Ramsay can also embed information within document footers.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
RegDuke can use control-flow flattening or the commercially available .NET Reactor for obfuscation.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Remcos uses RC4 and base64 to obfuscate data, including Registry entries and file paths.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Ryuk can use anti-disassembly and code transformation obfuscation techniques.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
SDBbot has the ability to XOR the strings for its installer component with a hardcoded 128 byte key.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
SHOTPUT is obscured using XOR encoding and appended to a valid GIF file.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
SLOWPULSE can hide malicious code in the padding regions between legitimate functions in the Pulse Secure `libdsplibs.so` file.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
SUNBURST strings were compressed and encoded in Base64. SUNBURST also obfuscated collected system information using a FNV-1a + XOR algorithm.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
SUNSPOT encrypted log entries it collected with the stream cipher RC4 using a hard-coded key. It also uses AES128-CBC encrypted blobs for SUNBURST source code and data extracted from the SolarWinds Orion <MsBuild.exe</code> process.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
SVCReady can encrypt victim data with an RC4 cipher.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Saint Bot has been obfuscated to help avoid detection.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Samurai can encrypt the names of requested APIs and deliver its final payload as a compressed, encrypted and base64 encoded blob.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Sardonic can use certain ConfuserEx features for obfuscation and can be encoded in a base64 string.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
ShadowPad has encrypted its payload, a virtual file system, and various files.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Shamoon contains base64-encoded strings.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
ShimRat has been delivered as a package that includes compressed DLL and shellcode payloads within a .dat file.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
ShimRatReporter encrypted gathered information with a combination of shifting and XOR using a static key.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Siloscape itself is obfuscated and uses obfuscated API calls.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Small Sieve has the ability to use a custom hex byte swapping encoding scheme combined with an obfuscated Base64 function to protect program strings and Telegram credentials.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Snip3 has the ability to obfuscate strings using XOR encryption.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
SodaMaster can use "stackstrings" for obfuscation.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
SombRAT can encrypt strings with XOR-based routines and use a custom AES storage format for plugins, configuration, C2 domains, and harvested data.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
SoreFang has the ability to encode and RC6 encrypt data sent to C2.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
StreamEx obfuscates some commands by using statically programmed fragments of strings when starting a DLL. It also uses a one-byte xor against 0x91 to encode configuration data.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
SynAck payloads are obfuscated prior to compilation to inhibit analysis and/or reverse engineering.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
TEARDROP created and read from a file with a fake JPG header, and its payload was encrypted with a simple rotating XOR cipher.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
TajMahal has used an encrypted Virtual File System to store plugins.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
TrickBot uses non-descriptive names to hide functionality.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Trojan.Karagany can base64 encode and AES-128-CBC encrypt data prior to transmission.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Turian can use VMProtect for obfuscation.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
Valak has the ability to base64 encode and XOR encrypt strings.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
A version of XTunnel introduced in July 2015 obfuscated the binary using opaque predicates and other techniques in a likely attempt to obfuscate it and bypass security products.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
jRAT’s Java payload is encrypted with AES. Additionally, backdoor files are encrypted using DES as a stream cipher. Later variants of jRAT also incorporated AV evasion methods such as Java bytecode obfuscation via the commercial Allatori obfuscation tool.
Technique: T1027 Obfuscated Files or Information, Tactic: TA0005 Defense Evasion
APT29 used large size files to avoid detection by security solutions with hardcoded size limits.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
APT32 includes garbage code to mislead anti-malware software and researchers.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
BRONZE BUTLER downloader code has included "0" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
Ember Bear has added extra spaces between JavaScript code characters to increase the overall file size.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
FIN7 has used random junk code to obfuscate malware code.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
Gamaredon Group has obfuscated .NET executables by inserting junk code.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
Higaisa performed padding with null bytes before calculating its hash.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
Leviathan has inserted garbage characters into code, presumably to avoid anti-virus detection.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
Moafee has been known to employ binary padding.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
Mustang Panda has used junk code within their DLL files to hinder analysis.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
Bisonal has appended random binary data to the end of itself to generate a large binary.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
Black Basta had added data prior to the Portable Executable (PE) header to prevent automatic scanners from identifying the payload.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
CORESHELL contains unused machine instructions in a likely attempt to hinder analysis.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
Comnie appends a total of 64MB of garbage data to a file to deter any security products in place that may be scanning files on disk.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
CostaBricks has added the entire unobfuscated code of the legitimate open source application Blink to its code.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
A variant of Emissary appends junk data to the end of its DLL file to create a large file that may exceed the maximum size that anti-virus programs can scan.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
FatDuke has been packed with junk code and strings.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
FinFisher contains junk code in its functions in an effort to confuse disassembly programs.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
Gelsemium can use junk code to hide functions and evade detection.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
Goopy has had null characters padded in its malicious DLL payload.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
Grandoreiro has added BMP images to the resources section of its Portable Executable (PE) file increasing each binary to at least 300MB in size.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
GrimAgent has the ability to add bytes to change the file hash.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
Javali can use large obfuscated libraries to hinder detection and analysis.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
Before writing to disk, Kwampirs inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
Maze has inserted large blocks of junk code, including some components to decrypt strings and other important information for later in the encryption process.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
POWERSTATS has used useless code blocks to counter analysis.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
QakBot can use large file sizes to evade detection.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
Rifdoor has added four additional bytes of data upon launching, then saved the changed version as `C:\ProgramData\Initech\Initech.exe`.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
SamSam has used garbage code to pad some of its malware components.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
Snip3 can obfuscate strings using junk Chinese characters.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
TAINTEDSCRIBE can execute `FileRecvWriteRand` to append random bytes to the end of a file received from C2.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
WastedLocker contains junk code to increase its entropy and hide the actual code.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
A version of XTunnel introduced in July 2015 inserted junk code into the binary in a likely attempt to obfuscate it and bypass security products.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
ZeroT has obfuscated DLLs and functions using dummy API calls inserted between real instructions.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
yty contains junk code in its binary, likely to confuse malware analysts.
Technique: T1027.001 Obfuscated Files or Information: Binary Padding, Tactic: TA0005 Defense Evasion
During the 2016 Ukraine Electric Power Attack, Sandworm Team used UPX to pack a copy of Mimikatz.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
During C0017, APT41 used VMProtect to slow the reverse engineering of malicious binaries.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
During Night Dragon, threat actors used software packing in its tools.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
During Operation Dream Job, Lazarus Group packed malicious .db files with Themida to evade detection.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
For Operation Dust Storm, the threat actors used UPX to pack some payloads.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
For Operation Spalax, the threat actors used a variety of packers, including CyaX, to obfuscate malicious executables.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
APT29 used UPX to pack files.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
APT3 has been known to pack their tools.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium, to pack their implants.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
APT39 has packed tools with UPX, and has repacked a modified version of Mimikatz to thwart anti-virus detection.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
APT41 uses packers such as Themida to obfuscate malicious files.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Aoqin Dragon has used the Themida packer to obfuscate malicious payloads.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Dark Caracal has used UPX to pack Bandook.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Elderwood has packed malware payloads before delivery to victims.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Ember Bear has packed malware to help avoid detection.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
GALLIUM packed some payloads using different types of packers, both known and custom.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Kimsuky has packed malware with UPX.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
MoustachedBouncer has used malware plugins packed with Themida.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
A Patchwork payload was packed with UPX.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion