sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
During Operation Honeybee, threat actors relied on a victim to enable macros within a malicious Word document.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
During Operation Sharpshooter, the threat actors relied on victims executing malicious Microsoft Word or PDF files.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
During Operation Spalax, the threat actors relied on a victim to open a PDF document and click on an embedded malicious link to download malware.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
APT-C-36 has prompted victims to accept macros in order to execute the subsequent payload.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
APT12 has attempted to get victims to open malicious Microsoft Word and PDF attachment sent via spearphishing.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
APT19 attempted to get users to launch malicious attachments delivered via spearphishing emails.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
APT28 attempted to get users to click on Microsoft Office attachments containing malicious macro scripts.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
APT29 has used various forms of spearphishing attempting to get a user to open attachments, including, but not limited to, malicious Microsoft Word documents, .pdf, and .lnk files.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
APT30 has relied on users to execute malicious file attachments delivered via spearphishing emails.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
APT32 has attempted to lure users to execute a malicious dropper delivered via a spearphishing attachment.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
APT33 has used malicious e-mail attachments to lure victims into executing malware.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
APT37 has sent spearphishing attachments attempting to get a user to open them.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
APT38  has attempted to lure victims into enabling malicious macros within email attachments.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious attachment.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Ajax Security Team has lured victims into executing malicious files.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Andariel has attempted to lure victims into enabling malicious macros within email attachments.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Aoqin Dragon has lured victims into opening weaponized documents, fake external drives, and fake antivirus to execute malicious payloads.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
BITTER has attempted to lure victims into opening malicious attachments delivered via spearphishing.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
BRONZE BUTLER has attempted to get users to launch malicious Microsoft Word attachments delivered via spearphishing emails.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
BlackTech has used e-mails with malicious documents to lure victims into installing malware.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
CURIUM has lured users into opening malicious files delivered via social media.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Cobalt Group has sent emails containing malicious attachments that require users to execute a file or macro to infect the victim machine.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Confucius has lured victims to execute malicious attachments included in crafted spearphishing emails related to current topics.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Dark Caracal makes their malware look like Flash Player, Office, or PDF documents in order to entice a user to click on it.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
DarkHydrus has sent malware that required users to hit the enable button in Microsoft Excel to allow an .iqy file to be downloaded.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Darkhotel has sent spearphishing emails in an attempt to lure users into clicking on a malicious attachments.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Dragonfly has used various forms of spearphishing in attempts to get users to open malicious attachments.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
EXOTIC LILY has gained execution through victims clicking on malicious LNK files contained within ISO files, which can execute hidden DLLs within the ISO.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Earth Lusca required users to click on a malicious file for the loader to activate.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open attachments.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Ember Bear has attempted to lure victims into executing malicious files.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
FIN4 has lured victims to launch malicious attachments delivered via spearphishing emails (often sent from compromised accounts).
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
FIN6 has used malicious documents to lure victims into allowing execution of PowerShell scripts.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
FIN7 lured victims to double-click on images in the attachments they sent which would then execute the hidden LNK file.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
FIN8 has used malicious e-mail attachments to lure victims into executing malware.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Ferocious Kitten has attempted to convince victims to enable malicious content within a spearphishing email by including an odd decoy message.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Gallmaker sent victims a lure document with a warning that asked victims to “enable content” for execution.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Gamaredon Group has attempted to get users to click on Office attachments with malicious macros embedded.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Gorgon Group attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
HEXANE has relied on victim's executing malicious file attachments delivered via email or embedded within actor-controlled websites to deliver malware.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Higaisa used malicious e-mail attachments to lure victims into executing LNK files.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Inception lured victims into clicking malicious files for machine reconnaissance and to execute malware.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
IndigoZebra sent spearphishing emails containing malicious attachments that urged recipients to review modifications in the file which would trigger the attack.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Indrik Spider has attempted to get users to click on a malicious zipped file.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Kimsuky has used attempted to lure victims into opening malicious e-mail attachments.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Lazarus Group has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
LazyScripter has lured users to open malicious email attachments.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Leviathan has sent spearphishing attachments attempting to get a user to click.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Machete has relied on users opening malicious attachments delivered through spearphishing to execute malware.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Magic Hound has attempted to lure victims into opening malicious email attachments.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Malteiro has relied on users to execute .zip file attachments containing malicious URLs.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Mofang's malicious spearphishing attachments required a user to open the file after receiving.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Molerats has sent malicious files via email that tricked users into clicking Enable Content to run an embedded macro and to download malicious archives.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
MuddyWater has attempted to get users to open malicious PDF attachment and to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Mustang Panda has sent malicious files requiring direct victim interaction to execute.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Naikon has convinced victims to open malicious attachments to execute malware.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Nomadic Octopus as attempted to lure victims into clicking on malicious attachments within spearphishing emails.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
OilRig has delivered macro-enabled documents that required targets to click the "enable content" button to execute the payload on the system.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
PLATINUM has attempted to get users to open malicious files by sending spearphishing emails with attachments to victims.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
PROMETHIUM has attempted to get users to execute compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Patchwork embedded a malicious macro in a Word document and lured the victim to click on an icon to execute the malware.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
RTM has attempted to lure victims into opening e-mail attachments to execute malicious code.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Rancor attempted to get users to click on an embedded macro within a Microsoft Office Excel document to launch their malware.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Sandworm Team has tricked unwitting recipients into clicking on spearphishing attachments and enabling malicious macros embedded within files.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
SideCopy has attempted to lure victims into clicking on malicious embedded archive files sent via spearphishing campaigns.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Sidewinder has lured targets to click on malicious files to gain execution in the target environment.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Silence attempts to get users to launch malicious attachments delivered via spearphishing emails.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
TA2541 has used macro-enabled MS Word documents to lure victims into executing malicious payloads.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
TA459 has attempted to get victims to open malicious Microsoft Word attachment sent via spearphishing.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
TA505 has used lures to get users to enable content in malicious attachments and execute malicious files contained in archives. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
TA551 has prompted users to enable macros within spearphishing attachments to install malware.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
The White Company has used phishing lure documents that trick users into opening them and infecting their computers.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Threat Group-3390 has lured victims into opening malicious files containing malware.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Tonto Team has relied on user interaction to open their malicious RTF documents.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Transparent Tribe has used weaponized documents in e-mail to compromise targeted systems.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Tropic Trooper has lured victims into executing malware via malicious e-mail attachments.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
WIRTE has attempted to lure users into opening malicious MS Word and Excel files to execute malicious payloads.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Whitefly has used malicious .exe or .dll files disguised as documents or images.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Windshift has used e-mail attachments to lure victims into executing malicious code.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Wizard Spider has lured victims to execute malware with spearphishing attachments containing macros to download either Emotet, Bokbot, TrickBot, or Bazar.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
admin@338 has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
menuPass has attempted to get victims to open malicious files such as Windows Shortcuts (.lnk) and/or Microsoft Office documents, sent via email as part of spearphishing campaigns.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Agent Tesla has been executed through malicious e-mail attachments
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
AppleJeus has required user execution of a malicious MSI installer.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
AppleSeed can achieve execution through users running malicious file attachments distributed via email.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Astaroth has used malicious files including VBS, LNK, and HTML for execution.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
BADFLICK has relied upon users clicking on a malicious attachment delivered through spearphishing.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
BLINDINGCAN has lured victims into executing malicious macros embedded within Microsoft Office documents.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Bad Rabbit has been executed through user installation of an executable disguised as a flash installer.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Bandook has used lure documents to convince the user to enable macros.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Bisonal has relied on users to execute malicious file attachments delivered via spearphishing emails.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Black Basta has been downloaded and executed from malicious Excel files.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
BoomBox has gained execution through user interaction with a malicious file.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Brute Ratel C4 has gained execution through users opening malicious documents.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Bumblebee has relied upon a user opening an ISO file to enable execution of malicious shortcut files and DLLs.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Bundlore has attempted to get users to execute a malicious .app file that looks like a Flash Player update.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
CARROTBALL has been executed through users being lured into opening malicious e-mail attachments.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
CSPY Downloader has been delivered via malicious documents with embedded macros.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Cardinal RAT lures victims into executing malicious macros embedded within Microsoft Excel documents.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Chaes requires the user to click on the malicious Word document to execute the next part of the attack.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Clambling has gained execution through luring victims into opening malicious files.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
DanBot has relied on victims' opening a malicious file for initial execution.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
DarkGate initial infection payloads can masquerade as pirated media content requiring user interaction for code execution. DarkGate is distributed through phishing links to VBS or MSI objects requiring user interaction for execution.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
DarkTortilla has relied on a user to open a malicious document or archived file delivered via email for initial execution.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Disco has been executed through inducing user interaction with malicious .zip and .msi files.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
DnsSystem has lured victims into opening macro-enabled Word documents for execution.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Dridex has relied upon users clicking on a malicious attachment delivered through spearphishing.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Emotet has relied upon users clicking on a malicious attachment delivered through spearphishing.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
EnvyScout has been executed through malicious files attached to e-mails.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Flagpro has relied on users clicking a malicious attachment delivered through spearphishing.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Grandoreiro has infected victims via malicious attachments.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
The GuLoader executable has been retrieved via embedded macros in malicious Word documents.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Hancitor has used malicious Microsoft Word documents, sent via email, which prompted the victim to enable macros.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Heyoka Backdoor has been spread through malicious document lures.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
IcedID has been executed through Word documents with malicious embedded macros.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
InvisiMole can deliver trojanized versions of software and documents, relying on user execution.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
JCry has achieved execution by luring users to click on a file that appeared to be an Adobe Flash Player update installer.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
JSS Loader has been executed through malicious attachments contained in spearphishing emails.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Javali has achieved execution through victims opening malicious attachments, including MSI files with embedded VBScript.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
KGH_SPY has been spread through Word documents containing malicious macros.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
KOCTOPUS has relied on victims clicking a malicious document for execution.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
KONNI has relied on a victim to enable malicious macros within an attachment delivered via email.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
KOPILUWAK has gained execution through malicious attachments.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Kerrdown has gained execution through victims opening malicious files.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Lokibot has tricked recipients into enabling malicious macros by getting victims to click "enable content" in email attachments.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Metamorfo requires the user to double-click the executable to run the malicious HTA file or to download a malicious installer.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Mispadu has relied on users to execute malicious files in order to gain execution on victim machines.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Mongall has relied on a user opening a malicious document for execution.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
NETWIRE has been executed through luring victims into opening malicious documents.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
NativeZone can display an RTF document to the user  to enable execution of  Cobalt Strike stage shellcode.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Ninja has gained execution through victims opening malicious executable files embedded in zip archives.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
OSX/Shlayer has relied on users mounting and executing a malicious DMG file.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Octopus has relied upon users clicking on a malicious attachment delivered through spearphishing.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
OutSteel has relied on a user to execute a malicious attachment delivered via spearphishing.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
PLEAD has been executed via malicious e-mail attachments.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
PoetRAT has used spearphishing attachments to infect victims.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Pony has attempted to lure targets into downloading an attached executable (ZIP, RAR, or CAB archives) or document (PDF or other MS Office format).
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
QakBot has gained execution through users opening malicious attachments.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
REvil has been executed via malicious MS Word e-mail attachments.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
ROKRAT has relied upon users clicking on a malicious attachment delivered through spearphishing.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
RTM has relied on users opening malicious email attachments, decompressing the attached archive, and double-clicking the executable within.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Ramsay has been executed through malicious e-mail attachments.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Rifdoor has been executed from malicious Excel or Word documents containing macros.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
SQLRat relies on users clicking on an embedded image to execute the scripts.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
STARWHALE has relied on victims opening a malicious Excel file for execution.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Some SUGARDUMP variants required a user to enable a macro within a malicious .xls file for execution.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
SVCReady has relied on users clicking a malicious attachment delivered through spearphishing.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
SYSCON has been executed by luring victims to open malicious e-mail attachments.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Saint Bot has relied upon users to execute a malicious attachment delivered via spearphishing.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Snip3 can gain execution through the download of visual basic files.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Squirrelwaffle has relied on users enabling malicious macros within Microsoft Excel and Word attachments.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
StrongPity has been executed via compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
A Word document delivering TYPEFRAME prompts the user to enable macro execution.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Taidoor has relied upon a victim to click on a malicious email attachment.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
ThreatNeedle relies on a victim to click on a malicious document for initial execution.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
TrickBot has attempted to get users to launch malicious documents to deliver its payload.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Valak has been executed via Microsoft Word documents containing malicious macros.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
WarzoneRAT has relied on a victim to open a malicious attachment within an email for execution.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
Woody RAT has relied on users opening a malicious email attachment for execution.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
ZxxZ has relied on victims to open a malicious attachment delivered via email.
Technique: T1204.002 User Execution: Malicious File, Tactic: TA0002 Execution
TeamTNT has relied on users to download and execute malicious Docker images.
Technique: T1204.003 User Execution: Malicious Image, Tactic: TA0002 Execution
During Cutting Edge, threat actors sent a magic 48-byte sequence to enable the PITSOCK backdoor to communicate via the `/tmp/clientsDownload.sock` socket.
Technique: T1205 Traffic Signaling, Tactic: TA0011 Command and Control TA0005 Defense Evasion TA0003 Persistence
BUSHWALK can modify the `DSUserAgentCap.pm` Perl module on Ivanti Connect Secure VPNs and either activate or deactivate depending on the value of the user agent in incoming HTTP requests.
Technique: T1205 Traffic Signaling, Tactic: TA0011 Command and Control TA0005 Defense Evasion TA0003 Persistence
Chaos provides a reverse shell is triggered upon receipt of a packet with a special string, sent to any port.
Technique: T1205 Traffic Signaling, Tactic: TA0011 Command and Control TA0005 Defense Evasion TA0003 Persistence
Kobalos is triggered by an incoming TCP connection to a legitimate service from a specific source port.
Technique: T1205 Traffic Signaling, Tactic: TA0011 Command and Control TA0005 Defense Evasion TA0003 Persistence
Pandora can identify if incoming HTTP traffic contains a token and if so it will intercept the traffic and process the received command.
Technique: T1205 Traffic Signaling, Tactic: TA0011 Command and Control TA0005 Defense Evasion TA0003 Persistence
Penquin will connect to C2 only after sniffing a "magic packet" value in TCP or UDP packets matching specific conditions.
Technique: T1205 Traffic Signaling, Tactic: TA0011 Command and Control TA0005 Defense Evasion TA0003 Persistence
Ryuk has used Wake-on-Lan to power on turned off systems for lateral movement.
Technique: T1205 Traffic Signaling, Tactic: TA0011 Command and Control TA0005 Defense Evasion TA0003 Persistence
SYNful Knock can be sent instructions via special packets to change its functionality. Code for new functionality can be included in these messages.
Technique: T1205 Traffic Signaling, Tactic: TA0011 Command and Control TA0005 Defense Evasion TA0003 Persistence
Umbreon provides additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet.
Technique: T1205 Traffic Signaling, Tactic: TA0011 Command and Control TA0005 Defense Evasion TA0003 Persistence
Uroburos can intercept the first client to server packet in the 3-way TCP handshake to determine if the packet contains the correct unique value for a specific Uroburos implant. If the value does not match, the packet and the rest of the TCP session are passed to the legitimate listening application.
Technique: T1205 Traffic Signaling, Tactic: TA0011 Command and Control TA0005 Defense Evasion TA0003 Persistence
Winnti for Linux has used a passive listener, capable of identifying a specific magic value before executing tasking, as a secondary command and control (C2) mechanism.
Technique: T1205 Traffic Signaling, Tactic: TA0011 Command and Control TA0005 Defense Evasion TA0003 Persistence
ZIPLINE can identify a specific string in intercepted network traffic, `SSH-2.0-OpenSSH_0.3xx.`, to trigger its command functionality.
Technique: T1205 Traffic Signaling, Tactic: TA0011 Command and Control TA0005 Defense Evasion TA0003 Persistence
PROMETHIUM has used a script that configures the knockd service and firewall to only accept C2 connections from systems that use a specified sequence of knock ports.
Technique: T1205.001 Traffic Signaling: Port Knocking, Tactic: TA0011 Command and Control TA0005 Defense Evasion TA0003 Persistence
Mafalda can use port-knocking to authenticate itself to another implant called Cryshell to establish an indirect connection to the C2 server.
Technique: T1205.001 Traffic Signaling: Port Knocking, Tactic: TA0011 Command and Control TA0005 Defense Evasion TA0003 Persistence
metaMain has authenticated itself to a different implant, Cryshell, through a port knocking and handshake procedure.
Technique: T1205.001 Traffic Signaling: Port Knocking, Tactic: TA0011 Command and Control TA0005 Defense Evasion TA0003 Persistence
PITSTOP can listen and evaluate incoming commands on the domain socket, created by PITHOOK malware, located at `/data/runtime/cockpit/wd.fd` for a predefined magic byte sequence. PITSTOP can then duplicate the socket for further communication over TLS.
Technique: T1205.002 Traffic Signaling: Socket Filters, Tactic: TA0011 Command and Control TA0005 Defense Evasion TA0003 Persistence
Penquin installs a `TCP` and `UDP` filter on the `eth0` interface.
Technique: T1205.002 Traffic Signaling: Socket Filters, Tactic: TA0011 Command and Control TA0005 Defense Evasion TA0003 Persistence
Mimikatz’s `LSADUMP::DCShadow` module can be used to make AD updates by temporarily setting a computer to be a DC.
Technique: T1207 Rogue Domain Controller, Tactic: TA0005 Defense Evasion
APT28 exploited a Windows SMB Remote Code Execution Vulnerability to conduct lateral movement.
Technique: T1210 Exploitation of Remote Services, Tactic: TA0008 Lateral Movement
Dragonfly has exploited a Windows Netlogon vulnerability (CVE-2020-1472) to obtain access to Windows Active Directory servers.
Technique: T1210 Exploitation of Remote Services, Tactic: TA0008 Lateral Movement
Earth Lusca has used Mimikatz to exploit a domain controller via the ZeroLogon exploit (CVE-2020-1472).
Technique: T1210 Exploitation of Remote Services, Tactic: TA0008 Lateral Movement
FIN7 has exploited ZeroLogon (CVE-2020-1472) against vulnerable domain controllers.
Technique: T1210 Exploitation of Remote Services, Tactic: TA0008 Lateral Movement
Fox Kitten has exploited known vulnerabilities in remote services including RDP.
Technique: T1210 Exploitation of Remote Services, Tactic: TA0008 Lateral Movement
MuddyWater has exploited the Microsoft Netlogon vulnerability (CVE-2020-1472).
Technique: T1210 Exploitation of Remote Services, Tactic: TA0008 Lateral Movement
Threat Group-3390 has exploited MS17-010 to move laterally to other systems on the network.
Technique: T1210 Exploitation of Remote Services, Tactic: TA0008 Lateral Movement
Tonto Team has used EternalBlue exploits for lateral movement.
Technique: T1210 Exploitation of Remote Services, Tactic: TA0008 Lateral Movement
Wizard Spider has exploited or attempted to exploit Zerologon (CVE-2020-1472) and EternalBlue (MS17-010) vulnerabilities.
Technique: T1210 Exploitation of Remote Services, Tactic: TA0008 Lateral Movement
menuPass has used tools to exploit the ZeroLogon vulnerability (CVE-2020-1472).
Technique: T1210 Exploitation of Remote Services, Tactic: TA0008 Lateral Movement
Bad Rabbit used the EternalRomance SMB exploit to spread through victim networks.
Technique: T1210 Exploitation of Remote Services, Tactic: TA0008 Lateral Movement
Conficker exploited the MS08-067 Windows vulnerability for remote code execution through a crafted RPC request.
Technique: T1210 Exploitation of Remote Services, Tactic: TA0008 Lateral Movement
Emotet has been seen exploiting SMB via a vulnerability exploit like EternalBlue (MS17-010) to achieve lateral movement and propagation.
Technique: T1210 Exploitation of Remote Services, Tactic: TA0008 Lateral Movement
Empire has a limited number of built-in modules for exploiting remote SMB, JBoss, and Jenkins servers.
Technique: T1210 Exploitation of Remote Services, Tactic: TA0008 Lateral Movement
Flame can use MS10-061 to exploit a print spooler vulnerability in a remote system with a shared printer in order to move laterally.
Technique: T1210 Exploitation of Remote Services, Tactic: TA0008 Lateral Movement
InvisiMole can spread within a network via the BlueKeep (CVE-2019-0708) and EternalBlue (CVE-2017-0144) vulnerabilities in RDP and SMB respectively.
Technique: T1210 Exploitation of Remote Services, Tactic: TA0008 Lateral Movement
Lucifer can exploit multiple vulnerabilities including EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0144).
Technique: T1210 Exploitation of Remote Services, Tactic: TA0008 Lateral Movement
NotPetya can use two exploits in SMBv1, EternalBlue and EternalRomance, to spread itself to other remote systems on the network.
Technique: T1210 Exploitation of Remote Services, Tactic: TA0008 Lateral Movement
PoshC2 contains a module for exploiting SMB via EternalBlue.
Technique: T1210 Exploitation of Remote Services, Tactic: TA0008 Lateral Movement
QakBot can move laterally using worm-like functionality through exploitation of SMB.
Technique: T1210 Exploitation of Remote Services, Tactic: TA0008 Lateral Movement
Stuxnet propagates using the MS10-061 Print Spooler and MS08-067 Windows Server Service vulnerabilities.
Technique: T1210 Exploitation of Remote Services, Tactic: TA0008 Lateral Movement
TrickBot utilizes EternalBlue and EternalRomance exploits for lateral movement in the modules wormwinDll, wormDll, mwormDll, nwormDll, tabDll.
Technique: T1210 Exploitation of Remote Services, Tactic: TA0008 Lateral Movement
WannaCry uses an exploit in SMBv1 to spread itself to other remote systems on a network.
Technique: T1210 Exploitation of Remote Services, Tactic: TA0008 Lateral Movement
APT28 has used CVE-2015-4902 to bypass security features.
Technique: T1211 Exploitation for Defense Evasion, Tactic: TA0005 Defense Evasion
During the SolarWinds Compromise, APT29 accessed victims' internal knowledge repositories (wikis) to view sensitive corporate information on products, services, and internal business operations.
Technique: T1213 Data from Information Repositories, Tactic: TA0009 Collection
APT28 has collected files from various information repositories.
Technique: T1213 Data from Information Repositories, Tactic: TA0009 Collection
FIN6 has collected schemas and user accounts from systems running SQL Server.
Technique: T1213 Data from Information Repositories, Tactic: TA0009 Collection
Fox Kitten has accessed victim security and IT environments and Microsoft Teams to mine valuable information.
Technique: T1213 Data from Information Repositories, Tactic: TA0009 Collection
LAPSUS$ has searched a victim's network for organization collaboration channels like MS Teams or Slack to discover further high-privilege account credentials.
Technique: T1213 Data from Information Repositories, Tactic: TA0009 Collection
Sandworm Team exfiltrates data of interest from enterprise databases using Adminer.
Technique: T1213 Data from Information Repositories, Tactic: TA0009 Collection
Turla has used a custom .NET tool to collect documents from an organization's internal central database.
Technique: T1213 Data from Information Repositories, Tactic: TA0009 Collection
P.A.S. Webshell has the ability to list and extract data from SQL databases.
Technique: T1213 Data from Information Repositories, Tactic: TA0009 Collection
LAPSUS$ has searched a victim's network for collaboration platforms like Confluence and JIRA to discover further high-privilege account credentials.
Technique: T1213.001 Data from Information Repositories: Confluence, Tactic: TA0009 Collection
During C0027, Scattered Spider accessed victim SharePoint environments to search for VPN and MFA enrollment information, help desk instructions, and new hire guides.
Technique: T1213.002 Data from Information Repositories: Sharepoint, Tactic: TA0009 Collection
APT28 has collected information from Microsoft SharePoint services within target networks.
Technique: T1213.002 Data from Information Repositories: Sharepoint, Tactic: TA0009 Collection
Akira has accessed and downloaded information stored in SharePoint instances as part of data gathering and exfiltration activity.
Technique: T1213.002 Data from Information Repositories: Sharepoint, Tactic: TA0009 Collection
Chimera has collected documents from the victim's SharePoint.
Technique: T1213.002 Data from Information Repositories: Sharepoint, Tactic: TA0009 Collection
Ke3chang used a SharePoint enumeration and data dumping tool known as spwebmember.
Technique: T1213.002 Data from Information Repositories: Sharepoint, Tactic: TA0009 Collection
LAPSUS$ has searched a victim's network for collaboration platforms like SharePoint to discover further high-privilege account credentials.
Technique: T1213.002 Data from Information Repositories: Sharepoint, Tactic: TA0009 Collection
spwebmember is used to enumerate and dump information from Microsoft SharePoint.
Technique: T1213.002 Data from Information Repositories: Sharepoint, Tactic: TA0009 Collection
During the SolarWinds Compromise, APT29 downloaded source code from code repositories.
Technique: T1213.003 Data from Information Repositories: Code Repositories, Tactic: TA0009 Collection
APT41 cloned victim user Git repositories during intrusions.
Technique: T1213.003 Data from Information Repositories: Code Repositories, Tactic: TA0009 Collection
LAPSUS$ has searched a victim's network for code repositories like GitLab and GitHub to discover further high-privilege account credentials.
Technique: T1213.003 Data from Information Repositories: Code Repositories, Tactic: TA0009 Collection
Scattered Spider enumerates data stored within victim code repositories, such as internal GitHub repositories.
Technique: T1213.003 Data from Information Repositories: Code Repositories, Tactic: TA0009 Collection
APT32 has used PubPrn.vbs within execution scripts to execute malware, possibly bypassing defenses.
Technique: T1216.001 System Script Proxy Execution: PubPrn, Tactic: TA0005 Defense Evasion
APT38 has collected browser bookmark information to learn more about compromised hosts, obtain personal information about users, and acquire details about internal network resources.
Technique: T1217 Browser Information Discovery, Tactic: TA0007 Discovery
Chimera has used `type \\<hostname>\c$\Users\<username>\Favorites\Links\Bookmarks bar\Imported From IE\*citrix*` for bookmark discovery.
Technique: T1217 Browser Information Discovery, Tactic: TA0007 Discovery
Fox Kitten has used Google Chrome bookmarks to identify internal resources and assets.
Technique: T1217 Browser Information Discovery, Tactic: TA0007 Discovery
Scattered Spider retrieves browser histories via infostealer malware such as Raccoon Stealer.
Technique: T1217 Browser Information Discovery, Tactic: TA0007 Discovery
Calisto collects information on bookmarks from Google Chrome.
Technique: T1217 Browser Information Discovery, Tactic: TA0007 Discovery
DarkWatchman can retrieve browser history.
Technique: T1217 Browser Information Discovery, Tactic: TA0007 Discovery
Dtrack can retrieve browser history.
Technique: T1217 Browser Information Discovery, Tactic: TA0007 Discovery
Empire has the ability to gather browser data such as bookmarks and visited sites.
Technique: T1217 Browser Information Discovery, Tactic: TA0007 Discovery
Lizar can retrieve browser history and database files.
Technique: T1217 Browser Information Discovery, Tactic: TA0007 Discovery
Machete retrieves the user profile data (e.g., browsers) from Chrome and Firefox browsers.
Technique: T1217 Browser Information Discovery, Tactic: TA0007 Discovery
Mafalda can collect the contents of the `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\LocalState` file.
Technique: T1217 Browser Information Discovery, Tactic: TA0007 Discovery
Mispadu can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.
Technique: T1217 Browser Information Discovery, Tactic: TA0007 Discovery
MobileOrder has a command to upload to its C2 server victim browser bookmarks.
Technique: T1217 Browser Information Discovery, Tactic: TA0007 Discovery
PowerLess has a browser info stealer module that can read Chrome and Edge browser database files.
Technique: T1217 Browser Information Discovery, Tactic: TA0007 Discovery
SUGARDUMP has collected browser bookmark and history information.
Technique: T1217 Browser Information Discovery, Tactic: TA0007 Discovery
Lazarus Group lnk files used for persistence have abused the Windows Update Client (`wuauclt.exe`) to execute a malicious DLL.
Technique: T1218 System Binary Proxy Execution, Tactic: TA0005 Defense Evasion
APT38 has used CHM files to move concealed payloads.
Technique: T1218.001 System Binary Proxy Execution: Compiled HTML File, Tactic: TA0005 Defense Evasion
APT41 used compiled HTML (.chm) files for targeting.
Technique: T1218.001 System Binary Proxy Execution: Compiled HTML File, Tactic: TA0005 Defense Evasion
Dark Caracal leveraged a compiled HTML file that contained a command to download and run an executable.
Technique: T1218.001 System Binary Proxy Execution: Compiled HTML File, Tactic: TA0005 Defense Evasion
OilRig has used a CHM payload to load and execute another malicious file once delivered to a victim.
Technique: T1218.001 System Binary Proxy Execution: Compiled HTML File, Tactic: TA0005 Defense Evasion
Silence has weaponized CHM files in their phishing campaigns.
Technique: T1218.001 System Binary Proxy Execution: Compiled HTML File, Tactic: TA0005 Defense Evasion
Astaroth uses ActiveX objects for file execution and manipulation.
Technique: T1218.001 System Binary Proxy Execution: Compiled HTML File, Tactic: TA0005 Defense Evasion
Ember Bear has used control panel files (CPL), delivered via e-mail, for execution.
Technique: T1218.002 System Binary Proxy Execution: Control Panel, Tactic: TA0005 Defense Evasion
InvisiMole can register itself for execution and persistence via the Control Panel.
Technique: T1218.002 System Binary Proxy Execution: Control Panel, Tactic: TA0005 Defense Evasion
Reaver drops and executes a malicious CPL file as its payload.
Technique: T1218.002 System Binary Proxy Execution: Control Panel, Tactic: TA0005 Defense Evasion
Cobalt Group has used the command `cmstp.exe /s /ns C:\Users\ADMINI~W\AppData\Local\Temp\XKNqbpzl.txt` to bypass AppLocker and launch a malicious script.
Technique: T1218.003 System Binary Proxy Execution: CMSTP, Tactic: TA0005 Defense Evasion
MuddyWater has used CMSTP.exe and a malicious INF to execute its POWERSTATS payload.
Technique: T1218.003 System Binary Proxy Execution: CMSTP, Tactic: TA0005 Defense Evasion
Mustang Panda has used `InstallUtil.exe` to execute a malicious Beacon stager.
Technique: T1218.004 System Binary Proxy Execution: InstallUtil, Tactic: TA0005 Defense Evasion
menuPass has used `InstallUtil.exe` to execute malicious software.
Technique: T1218.004 System Binary Proxy Execution: InstallUtil, Tactic: TA0005 Defense Evasion
Chaes has used Installutill to download content.
Technique: T1218.004 System Binary Proxy Execution: InstallUtil, Tactic: TA0005 Defense Evasion
Saint Bot had used `InstallUtil.exe` to download and deploy executables.
Technique: T1218.004 System Binary Proxy Execution: InstallUtil, Tactic: TA0005 Defense Evasion
WhisperGate has used `InstallUtil.exe` as part of its process to disable Windows Defender.
Technique: T1218.004 System Binary Proxy Execution: InstallUtil, Tactic: TA0005 Defense Evasion
During C0015, the threat actors used `mshta` to execute DLLs.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
During Operation Dust Storm, the threat actors executed JavaScript code via `mshta.exe`.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
APT29 has use `mshta` to execute malicious scripts on a compromised host.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
APT32 has used mshta.exe for code execution.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
Confucius has used mshta.exe to execute malicious VBScript.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion
Earth Lusca has used `mshta.exe` to load an HTA script within a malicious .LNK file.
Technique: T1218.005 System Binary Proxy Execution: Mshta, Tactic: TA0005 Defense Evasion