sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
During Operation Honeybee, the threat actors uploaded stolen files to their C2 servers.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
During Operation Honeybee, the threat actors used batch files that reduced their fingerprint on a compromised system by deleting malware-related files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
During Operation Honeybee, the threat actors had the ability to use FTP for C2.
MITRE ATT&CK technique: T1071.002: Application Layer Protocol- File Transfer Protocols
During Operation Honeybee, the threat actors used a malicious DLL to search for files with specific keywords.
MITRE ATT&CK technique: T1083: File and Directory Discovery
During Operation Honeybee, the threat actors downloaded additional malware and malicious scripts onto a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
During Operation Honeybee, stolen data was copied into a text file using the format `From .txt` prior to compression, encoding, and exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
During Operation Honeybee, threat actors relied on a victim to enable macros within a malicious Word document.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
During Operation Honeybee, the threat actors modified the MaoCheng dropper so its icon appeared as a Word document.
MITRE ATT&CK technique: T1036: Masquerading
During Operation Honeybee, the threat actors used a legitimate Windows executable and secure directory for their payloads to bypass UAC.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
During Operation Honeybee, the threat actors used batch files that modified registry keys.
MITRE ATT&CK technique: T1112: Modify Registry
During Operation Honeybee, the threat actors deployed malware that used API calls, including `CreateProcessAsUser`.
MITRE ATT&CK technique: T1106: Native API
During Operation Honeybee, the threat actors obtained a list of running processes on a victim machine using `cmd /c tasklist > %temp%\temp.ini`.
MITRE ATT&CK technique: T1057: Process Discovery
For Operation Honeybee, at least one identified persona was used to register for a free account for a control server.
MITRE ATT&CK technique: T1583.004: Acquire Infrastructure- Server
During Operation Honeybee, threat actors ran sc start to start the COMSysApp as part of the service hijacking and sc stop to stop and reconfigure the COMSysApp.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
During Operation Honeybee, the threat actors used a batch file that modified the COMSysApp service to load a malicious ipnet.dll payload and to load a DLL into the `svchost.exe` process.
MITRE ATT&CK technique: T1574.011: Hijack Execution Flow- Services Registry Permissions Weakness
During Operation Honeybee, the threat actors collected the computer name, OS, and other system information using `cmd /c systeminfo > %temp%\ temp.ini`.
MITRE ATT&CK technique: T1082: System Information Discovery
For Operation Honeybee, the threat actors used a Visual Basic script embedded within a Word document to download an implant.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
During Operation Honeybee, various implants used batch scripting and `cmd.exe` for execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
During Operation Honeybee, threat actors installed DLLs and backdoors as Windows services.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
During Operation Sharpshooter, threat actors sent malicious Word OLE documents to victims.
MITRE ATT&CK technique: T1559.002: Inter-Process Communication- Dynamic Data Exchange
During Operation Sharpshooter, additional payloads were downloaded after a target was infected with a first-stage downloader.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
During Operation Sharpshooter, the threat actors relied on victims executing malicious Microsoft Word or PDF files.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
For Operation Sharpshooter, the threat actors used the Rising Sun modular backdoor.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
During Operation Sharpshooter, threat actors installed Rising Sun in the Startup folder and disguised it as `mssync.exe`.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
During Operation Sharpshooter, the first stage downloader resolved various Windows libraries and APIs, including `LoadLibraryA`, `GetProcAddress`, and `CreateProcessA`.
MITRE ATT&CK technique: T1106: Native API
During Operation Sharpshooter, threat actors leveraged embedded shellcode to inject a downloader into the memory of Word.
MITRE ATT&CK technique: T1055: Process Injection
For Operation Sharpshooter, the threat actors used the ExpressVPN service to hide their location.
MITRE ATT&CK technique: T1090: Proxy
During Operation Sharpshooter, a first-stage downloader installed Rising Sun to `%Startup%\mssync.exe` on a compromised host.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
For Operation Sharpshooter, the threat actors compromised a server they used as part of the campaign's infrastructure.
MITRE ATT&CK technique: T1584.004: Compromise Infrastructure- Server
For Operation Sharpshooter, the threat actors staged malicious files on Dropbox and other websites.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
During Operation Sharpshooter, the threat actors used a VBA macro to execute a simple downloader that installed Rising Sun.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
For Operation Sharpshooter, the threat actors used Dropbox to host lure documents and their first-stage downloader.
MITRE ATT&CK technique: T1583.006: Acquire Infrastructure- Web Services
For Operation Spalax, the threat actors used Nullsoft Scriptable Install System scripts to install malware.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
For Operation Spalax, the threat actors used a variety of packers and droppers to decrypt malicious payloads.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
For Operation Spalax, the threat actors registered hundreds of domains using Duck DNS and DNS Exit.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
For Operation Spalax, the threat actors used dynamic DNS services, including Duck DNS and DNS Exit, as part of their C2 infrastructure.
MITRE ATT&CK technique: T1568: Dynamic Resolution
For Operation Spalax, the threat actors used XOR-encrypted payloads.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
During Operation Spalax, the threat actors relied on a victim to open a PDF document and click on an embedded malicious link to download malware.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
During Operation Spalax, the threat actors relied on a victim to click on a malicious link distributed via phishing emails.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
For Operation Spalax, the threat actors obtained malware, including Remcos, njRAT, and AsyncRAT.
MITRE ATT&CK technique: T1588.001: Obtain Capabilities- Malware
During Operation Spalax, the threat actors used `rundll32.exe` to execute malicious installers.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
For Operation Spalax, the threat actors used a variety of packers, including CyaX, to obfuscate malicious executables.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
During Operation Spalax, the threat actors sent phishing emails that included a PDF document that in some cases led to the download and execution of malware.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
During Operation Spalax, the threat actors sent phishing emails to victims that contained a malicious link.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
For Operation Spalax, the threat actors used packers that read pixel data from images contained in PE files' resource sections and build the next layer of execution from the data.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
For Operation Spalax, the threat actors obtained packers such as CyaX.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
For Operation Spalax, the threat actors staged malware and malicious files in legitimate hosting services such as OneDrive or MediaFire.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
During Operation Spalax, the threat actors used droppers that would run anti-analysis checks before executing malware on a compromised host.
MITRE ATT&CK technique: T1497: Virtualization/Sandbox Evasion
During Operation Spalax, the threat actors used OneDrive and MediaFire to host payloads.
MITRE ATT&CK technique: T1102: Web Service
During Operation Wocao, threat actors archived collected files with WinRAR, prior to exfiltration.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
During Operation Wocao, threat actors' proxy implementation "Agent" upgraded the socket in use to a TLS socket.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
During Operation Wocao, threat actors used a script to collect information about the infected system.
MITRE ATT&CK technique: T1119: Automated Collection
During Operation Wocao, the threat actors deleted all Windows system and security event logs using `/Q /c wevtutil cl system` and `/Q /c wevtutil cl security`.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
During Operation Wocao, threat actors collected clipboard data in plaintext.
MITRE ATT&CK technique: T1115: Clipboard Data
During Operation Wocao, threat actors executed PowerShell commands which were encoded or compressed using Base64, zlib, and XOR.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
During Operation Wocao, threat actors used Mimikatz's DCSync to dump credentials from the memory of the targeted system.
MITRE ATT&CK technique: T1003.006: OS Credential Dumping- DCSync
During Operation Wocao, threat actors encrypted IP addresses used for "Agent" proxy hops with RC4.
MITRE ATT&CK technique: T1001: Data Obfuscation
During Operation Wocao, threat actors exfiltrated files and directories of interest from the targeted system.
MITRE ATT&CK technique: T1005: Data from Local System
During Operation Wocao, threat actors used PowerShell to add and delete rules in the Windows firewall.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
During Operation Wocao, threat actors used the `net` command to retrieve information about domain accounts.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
During Operation Wocao, threat actors used domain credentials, including domain admin, for lateral movement and privilege escalation.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
For Operation Wocao, the threat actors registered email accounts to use during the campaign.
MITRE ATT&CK technique: T1585.002: Establish Accounts- Email Accounts
During Operation Wocao, threat actors used the XServer backdoor to exfiltrate data.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
During Operation Wocao, threat actors gained initial access by exploiting vulnerabilities in JBoss webservers.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
During Operation Wocao, threat actors used stolen credentials to connect to the victim's network via VPN.
MITRE ATT&CK technique: T1133: External Remote Services
During Operation Wocao, the threat actors consistently removed traces of their activity by first overwriting a file using `/c cd /d c:\windows\temp\ & copy \\\c$\windows\system32\devmgr.dll \\\c$\windows\temp\LMAKSW.ps1 /y` and then deleting the overwritten file using `/c cd /d c:\windows\temp\ & del \\\c$\windows\temp\LMAKSW.ps1`.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
During Operation Wocao, threat actors gathered a recursive directory listing to find files and directories of interest.
MITRE ATT&CK technique: T1083: File and Directory Discovery
During Operation Wocao, threat actors targeted people based on their organizational roles and privileges.
MITRE ATT&CK technique: T1589: Gather Victim Identity Information
During Operation Wocao, threat actors edited variable names within the Impacket suite to avoid automated detection.
MITRE ATT&CK technique: T1027.005: Obfuscated Files or Information- Indicator Removal from Tools
During Operation Wocao, threat actors downloaded additional files to the infected system.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
During Operation Wocao, threat actors proxied traffic through multiple infected systems.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy
During Operation Wocao, threat actors used a Visual Basic script that checked for internet connectivity.
MITRE ATT&CK technique: T1016.001: System Network Configuration Discovery- Internet Connection Discovery
During Operation Wocao, threat actors used PowerSploit's `Invoke-Kerberoast` module to request encrypted service tickets and bruteforce the passwords of Windows service accounts offline.
MITRE ATT&CK technique: T1558.003: Steal or Forge Kerberos Tickets- Kerberoasting
During Operation Wocao, threat actors obtained the password for the victim's password manager via a custom keylogger.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
During Operation Wocao, threat actors used ProcDump to dump credentials from memory.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
During Operation Wocao, threat actors used SMB to copy files to and from target systems.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
During Operation Wocao, threat actors used local account credentials found during the intrusion for lateral movement and privilege escalation.
MITRE ATT&CK technique: T1078.003: Valid Accounts- Local Accounts
During Operation Wocao, threat actors staged archived files in a temporary directory prior to exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
During Operation Wocao, threat actors used the command `net localgroup administrators` to list all administrators part of a local group.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
During Operation Wocao, threat actors developed their own custom webshells to upload to compromised servers.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
During Operation Wocao, the threat actors renamed some tools and executables to appear as legitimate programs.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
During Operation Wocao, the threat actors enabled Wdigest by changing the `HKLM\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\WDigest` registry value from 0 to 1 .
MITRE ATT&CK technique: T1112: Modify Registry
During Operation Wocao, threat actors used a custom collection method to intercept two-factor authentication soft tokens.
MITRE ATT&CK technique: T1111: Multi-Factor Authentication Interception
During Operation Wocao, threat actors executed commands through the installed web shell via Tor exit nodes.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
During Operation Wocao, threat actors used the `CreateProcessA` and `ShellExecute` API functions to launch commands after being injected into a selected process.
MITRE ATT&CK technique: T1106: Native API
During Operation Wocao, threat actors scanned for open ports and used nbtscan to find NETBIOS nameservers.
MITRE ATT&CK technique: T1046: Network Service Discovery
During Operation Wocao, threat actors discovered network disks mounted to the system using netstat.
MITRE ATT&CK technique: T1135: Network Share Discovery
During Operation Wocao, threat actors used a custom protocol for command and control.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
During Operation Wocao, the threat actors used uncommon high ports for its backdoor C2, including ports 25667 and 47000.
MITRE ATT&CK technique: T1571: Non-Standard Port
During Operation Wocao, threat actors accessed and collected credentials from password managers.
MITRE ATT&CK technique: T1555.005: Credentials from Password Stores- Password Managers
During Operation Wocao, threat actors discovered removable disks attached to a system.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
During Operation Wocao, threat actors used PowerShell on compromised systems.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
During Operation Wocao, threat actors used Mimikatz to dump certificates and private keys from the Windows certificate store.
MITRE ATT&CK technique: T1552.004: Unsecured Credentials- Private Keys
During Operation Wocao, the threat actors used `tasklist` to collect a list of running processes on an infected system.
MITRE ATT&CK technique: T1057: Process Discovery
During Operation Wocao, threat actors injected code into a selected process, which in turn launches a command as a child process of the original.
MITRE ATT&CK technique: T1055: Process Injection
During Operation Wocao, threat actors used a custom proxy tool called "Agent" which has support for multiple hops.
MITRE ATT&CK technique: T1090: Proxy
During Operation Wocao, threat actors' backdoors were written in Python and compiled with py2exe.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
During Operation Wocao, the threat actors executed `/c cd /d c:\windows\temp\ & reg query HKEY_CURRENT_USER\Software\\PuTTY\Sessions\` to detect recent PuTTY sessions, likely to further lateral movement.
MITRE ATT&CK technique: T1012: Query Registry
During Operation Wocao, threat actors used `nbtscan` and `ping` to discover remote systems, as well as `dsquery subnet` on a domain controller to retrieve all subnets in the Active Directory.
MITRE ATT&CK technique: T1018: Remote System Discovery
During Operation Wocao, threat actors used Impacket's smbexec.py as well as accessing the C$ and IPC$ shares to move laterally.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
During Operation Wocao, threat actors used scheduled tasks to execute malicious PowerShell code on remote systems.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
During Operation Wocao, threat actors used scripts to detect security software.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
For Operation Wocao, the threat actors purchased servers with Bitcoin to use during the operation.
MITRE ATT&CK technique: T1583.004: Acquire Infrastructure- Server
During Operation Wocao, threat actors created services on remote systems for execution purposes.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
During Operation Wocao, threat actors collected a list of installed software on the infected system.
MITRE ATT&CK technique: T1518: Software Discovery
During Operation Wocao, threat actors discovered the local disks attached to the system and their hardware information including manufacturer and model, as well as the OS versions of systems connected to a targeted network.
MITRE ATT&CK technique: T1082: System Information Discovery
During Operation Wocao, threat actors discovered the local network configuration with `ipconfig`.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
During Operation Wocao, threat actors collected a list of open connections on the infected system using `netstat` and checks whether it has an internet connection.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
During Operation Wocao, threat actors enumerated sessions and users on a remote host, and identified privileged users logged into a targeted system.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
During Operation Wocao, threat actors used the `tasklist` command to search for one of its backdoors.
MITRE ATT&CK technique: T1007: System Service Discovery
During Operation Wocao, threat actors used the `time` command to retrieve the current time of a compromised system.
MITRE ATT&CK technique: T1124: System Time Discovery
For Operation Wocao, the threat actors obtained a variety of open source tools, including JexBoss, KeeThief, and BloodHound.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
During Operation Wocao, threat actors used valid VPN credentials to gain initial access.
MITRE ATT&CK technique: T1078: Valid Accounts
During Operation Wocao, threat actors used VBScript to conduct reconnaissance on targeted systems.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
During Operation Wocao, threat actors’ XServer tool communicated using HTTP and HTTPS.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
During Operation Wocao, threat actors used their own web shells, as well as those previously placed on target systems by other threat actors, for reconnaissance and lateral movement.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
During Operation Wocao, threat actors spawned a new `cmd.exe` process to execute commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
During Operation Wocao, threat actors has used WMI to execute commands.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Pikabot Distribution February 2024 utilized a tampered legitimate executable, `grepWinNP3.exe`, for its first stage Pikabot loader, modifying the open-source tool to execute malicious code when launched.
MITRE ATT&CK technique: T1574: Hijack Execution Flow
Pikabot Distribution February 2024 utilized obfuscated JavaScript files for initial Pikabot payload download.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Pikabot Distribution February 2024 passed execution from obfuscated JavaScript files to PowerShell scripts to download and install Pikabot.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Pikabot Distribution February 2024 utilized emails with hyperlinks leading to malicious ZIP archive files containing scripts to download and install Pikabot.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
During the SolarWinds Compromise, APT29 obtained a list of users and their roles from an Exchange server using `Get-ManagementRoleAssignment`.
MITRE ATT&CK technique: T1087: Account Discovery
During the SolarWinds Compromise, APT29 added credentials to OAuth Applications and Service Principals.
MITRE ATT&CK technique: T1098.001: Account Manipulation- Additional Cloud Credentials
During the SolarWinds Compromise, APT29 granted `company administrator` privileges to a newly created service principle.
MITRE ATT&CK technique: T1098.003: Account Manipulation- Additional Cloud Roles
During the SolarWinds Compromise, APT29 added their own devices as allowed IDs for active sync using `Set-CASMailbox`, allowing it to obtain copies of victim mailboxes. It also added additional permissions to compromised Application or Service Principals.
MITRE ATT&CK technique: T1098.002: Account Manipulation- Additional Email Delegate Permissions
During the SolarWinds Compromise, APT29 used compromised service principals to make changes to the Office 365 environment.
MITRE ATT&CK technique: T1550.001: Use Alternate Authentication Material- Application Access Token
During the SolarWinds Compromise, APT29 used 7-Zip to compress stolen emails into password-protected archives prior to exfltration; APT29 also compressed text files into zipped archives.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
During the SolarWinds Compromise, APT29 removed evidence of email export requests using `Remove-MailboxExportRequest`.
MITRE ATT&CK technique: T1070.008: Indicator Removal- Clear Mailbox Data
During the SolarWinds Compromise, APT29 used a compromised O365 administrator account to create a new Service Principal.
MITRE ATT&CK technique: T1078.004: Valid Accounts- Cloud Accounts
During the SolarWinds Compromise, APT29 downloaded source code from code repositories.
MITRE ATT&CK technique: T1213.003: Data from Information Repositories- Code Repositories
During the SolarWinds Compromise, APT29 was able to get SUNBURST signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
During the SolarWinds Compromise, APT29 gained initial network access to some victims via a trojanized update of SolarWinds Orion software.
MITRE ATT&CK technique: T1195.002: Supply Chain Compromise- Compromise Software Supply Chain
For the SolarWinds Compromise, APT29 conducted credential theft operations to obtain credentials to be used for access to victim environments.
MITRE ATT&CK technique: T1589.001: Gather Victim Identity Information- Credentials
During the SolarWinds Compromise, APT29 used account credentials they obtained to attempt access to Group Managed Service Account passwords.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
During the SolarWinds Compromise, APT29 stole users' saved passwords from Chrome.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
During the SolarWinds Compromise, APT29 used privileged accounts to replicate directory service data with domain controllers.
MITRE ATT&CK technique: T1003.006: OS Credential Dumping- DCSync
During the SolarWinds Compromise, APT29 accessed victims' internal knowledge repositories to view sensitive corporate information on products, services, and internal business operations.
MITRE ATT&CK technique: T1213: Data from Information Repositories
During the SolarWinds Compromise, APT29 extracted files from compromised networks.
MITRE ATT&CK technique: T1005: Data from Local System
During the SolarWinds Compromise, APT29 used 7-Zip to decode their Raindrop malware.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
During the SolarWinds Compromise, APT29 registered devices in order to enable mailbox syncing via the `Set-CASMailbox` command.
MITRE ATT&CK technique: T1098.005: Account Manipulation- Device Registration
During the SolarWinds Compromise, APT29, used `AUDITPOL` to prevent the collection of audit logs.
MITRE ATT&CK technique: T1562.002: Impair Defenses- Disable Windows Event Logging
During the SolarWinds Compromise, APT29 used `netsh` to configure firewall rules that limited certain UDP outbound packets.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
During the SolarWinds Compromise, APT29 used the service control manager on a remote system to disable services associated with security monitoring products.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
During the SolarWinds Compromise, APT29 used PowerShell to discover domain accounts by exectuing `Get-ADUser` and `Get-ADGroupMember`.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
During the SolarWinds Compromise, APT29 used domain administrators' accounts to help facilitate lateral movement on compromised networks.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
During the SolarWinds Compromise, APT29 used AdFind to enumerate domain groups.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
During the SolarWinds Compromise, APT29 used the `Get-AcceptedDomain` PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell. They also used AdFind to enumerate domains and to discover trust between federated domains.
MITRE ATT&CK technique: T1482: Domain Trust Discovery
For the SolarWinds Compromise, APT29 acquired C2 domains, sometimes through resellers.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
For the SolarWinds Compromise, APT29 compromised domains to use for C2.
MITRE ATT&CK technique: T1584.001: Compromise Infrastructure- Domains
During the SolarWinds Compromise, APT29 used dynamic DNS resolution to construct and resolve to randomly-generated subdomains for C2.
MITRE ATT&CK technique: T1568: Dynamic Resolution
During the SolarWinds Compromise, APT29 exfiltrated collected data over a simple HTTPS request to a password-protected archive staged on a victim's OWA servers.
MITRE ATT&CK technique: T1048.002: Exfiltration Over Alternative Protocol- Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
During the SolarWinds Compromise, APT29 exploited CVE-2020-0688 against the Microsoft Exchange Control Panel to regain access to a network.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
For the SolarWinds Compromise, APT29 used compromised identities to access networks via SSH, VPNs, and other remote access tools.
MITRE ATT&CK technique: T1133: External Remote Services
During the SolarWinds Compromise, APT29 routinely removed their tools, including custom backdoors, once remote access was achieved.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
During the SolarWinds Compromise, APT29 obtained information about the configured Exchange virtual directory using `Get-WebServicesVirtualDirectory`.
MITRE ATT&CK technique: T1083: File and Directory Discovery
During the SolarWinds Compromise, APT29 set the hostnames of their C2 infrastructure to match legitimate hostnames in the victim environment. They also used IP addresses originating from the same country as the victim for their VPN infrastructure.
MITRE ATT&CK technique: T1665: Hide Infrastructure
During the SolarWinds Compromise, APT29 temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.
MITRE ATT&CK technique: T1070: Indicator Removal
During the SolarWinds Compromise, APT29 downloaded additional malware, such as TEARDROP and Cobalt Strike, onto a compromised host following initial access.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
During the SolarWinds Compromise, APT29 used SSH port forwarding capabilities on public-facing systems, and configured at least one instance of Cobalt Strike to use a network pipe over SMB.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy
During the SolarWinds Compromise, APT29 used GoldFinder to perform HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request travels through.
MITRE ATT&CK technique: T1016.001: System Network Configuration Discovery- Internet Connection Discovery
During the SolarWinds Compromise, APT29 obtained Ticket Granting Service tickets for Active Directory Service Principle Names to crack offline.
MITRE ATT&CK technique: T1558.003: Steal or Forge Kerberos Tickets- Kerberoasting
During the SolarWinds Compromise, APT29 used compromised local accounts to access victims' networks.
MITRE ATT&CK technique: T1078.003: Valid Accounts- Local Accounts
For the SolarWinds Compromise, APT29 used numerous pieces of malware that were likely developed for or by the group, including SUNBURST, SUNSPOT, Raindrop, and TEARDROP.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
During the SolarWinds Compromise, APT29 named tasks `\Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager` in order to appear legitimate.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
During the SolarWinds Compromise, APT29 renamed software and DLLs with legitimate names to appear benign.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
During the SolarWinds Compromise, APT29 used the `Get-ManagementRoleAssignment` PowerShell cmdlet to enumerate Exchange management role assignments through an Exchange Management Shell.
MITRE ATT&CK technique: T1069: Permission Groups Discovery
During the SolarWinds Compromise, APT29 used PowerShell to create new tasks on remote machines, identify configuration settings, exfiltrate data, and execute other commands.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
During the SolarWinds Compromise, APT29 obtained PKI keys, certificate files, and the private encryption key from an Active Directory Federation Services container to decrypt corresponding SAML signing certificates.
MITRE ATT&CK technique: T1552.004: Unsecured Credentials- Private Keys
During the SolarWinds Compromise, APT29 used multiple command-line utilities to enumerate running processes.
MITRE ATT&CK technique: T1057: Process Discovery
During the SolarWinds Compromise, APT29 staged data and files in password-protected archives on a victim's OWA server.
MITRE ATT&CK technique: T1074.002: Data Staged- Remote Data Staging
During the SolarWinds Compromise, APT29 used RDP sessions from public-facing systems to internal servers.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
During the SolarWinds Compromise, APT29 collected emails from specific individuals, such as executives and IT staff, using `New-MailboxExportRequest` followed by `Get-MailboxExportRequest`.
MITRE ATT&CK technique: T1114.002: Email Collection- Remote Email Collection
During the SolarWinds Compromise, APT29 used AdFind to enumerate remote systems.
MITRE ATT&CK technique: T1018: Remote System Discovery
During the SolarWinds Compromise, APT29 used `Rundll32.exe` to execute payloads.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
During the SolarWinds Compromise, APT29 created tokens using compromised SAML signing certificates.
MITRE ATT&CK technique: T1606.002: Forge Web Credentials- SAML Tokens
During the SolarWinds Compromise, APT29 used administrative accounts to connect over SMB to targeted users.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
During the SolarWinds Compromise, APT29 used `scheduler` and `schtasks` to create new tasks on remote host as part of their lateral movement. They manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration. APT29 also created a scheduled task to maintain SUNSPOT persistence when the host booted.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
During the SolarWinds Compromise, APT29 stole Chrome browser cookies by copying the Chrome profile directories of targeted users.
MITRE ATT&CK technique: T1539: Steal Web Session Cookie
During the SolarWinds Compromise, APT29 used `fsutil` to check available free space before executing actions that might create large files on disk.
MITRE ATT&CK technique: T1082: System Information Discovery
During the SolarWinds Compromise, APT29 modified timestamps of backdoors to match legitimate Windows files.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
During the SolarWinds Compromise, APT29 changed domain federation trust settings using Azure AD administrative permissions to configure the domain to accept authorization tokens signed by their own SAML signing certificate.
MITRE ATT&CK technique: T1484.002: Domain or Tenant Policy Modification- Trust Modification
During the SolarWinds Compromise, APT29 gained access through compromised accounts at cloud solution partners, and used compromised certificates issued by Mimecast to authenticate to Mimecast customer systems.
MITRE ATT&CK technique: T1199: Trusted Relationship
During the SolarWinds Compromise, APT29 used forged SAML tokens that allowed the actors to impersonate users and bypass MFA, enabling APT29 to access enterprise cloud applications and services.
MITRE ATT&CK technique: T1550: Use Alternate Authentication Material
During the SolarWinds Compromise, APT29 used different compromised credentials for remote access and to move laterally.
MITRE ATT&CK technique: T1078: Valid Accounts
For the SolarWinds Compromise, APT29 wrote malware such as Sibot in Visual Basic.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
During the SolarWinds Compromise, APT29 bypassed MFA set on OWA accounts by generating a cookie value from a previously stolen secret key.
MITRE ATT&CK technique: T1606.001: Forge Web Credentials- Web Cookies
During the SolarWinds Compromise, APT29 used HTTP for C2 and data exfiltration.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
During the SolarWinds Compromise, APT29 used stolen cookies to access cloud resources and a forged `duo-sid` cookie to bypass MFA set on an email account.
MITRE ATT&CK technique: T1550.004: Use Alternate Authentication Material- Web Session Cookie
During the SolarWinds Compromise, APT29 used `cmd.exe` to execute commands on remote machines.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
During the SolarWinds Compromise, APT29 used WMI for the remote execution of files for lateral movement.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
During the SolarWinds Compromise, APT29 used a WMI event filter to invoke a command-line event consumer at system boot time to launch a backdoor with `rundll32.exe`.
MITRE ATT&CK technique: T1546.003: Event Triggered Execution- Windows Management Instrumentation Event Subscription
During the SolarWinds Compromise, APT29 used WinRM via PowerShell to execute commands and payloads on remote hosts.
MITRE ATT&CK technique: T1021.006: Remote Services- Windows Remote Management
In the Triton Safety Instrumented System Attack, TEMP.Veles engaged in network reconnaissance against targets of interest.
MITRE ATT&CK technique: T1595: Active Scanning
In the Triton Safety Instrumented System Attack, TEMP.Veles used cryptcat binaries to encrypt their traffic.
MITRE ATT&CK technique: T1573: Encrypted Channel
In the Triton Safety Instrumented System Attack, TEMP.Veles modified files based on the open-source project cryptcat in an apparent attempt to decrease anti-virus detection rates.
MITRE ATT&CK technique: T1027.005: Obfuscated Files or Information- Indicator Removal from Tools
In the Triton Safety Instrumented System Attack, TEMP.Veles used Mimikatz.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
In the Triton Safety Instrumented System Attack, TEMP.Veles developed, prior to the attack, malware capabilities that would require access to specific and specialized hardware and software.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
In the Triton Safety Instrumented System Attack, TEMP.Veles renamed files to look like legitimate files, such as Windows update files or Schneider Electric application files.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
In the Triton Safety Instrumented System Attack, TEMP.Veles used a publicly available PowerShell-based tool, WMImplant.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
In the Triton Safety Instrumented System Attack, TEMP.Veles installed scheduled tasks defined in XML files.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
In the Triton Safety Instrumented System Attack, TEMP.Veles used tools such as Mimikatz and other open-source software.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
In the Triton Safety Instrumented System Attack, TEMP.Veles captured credentials as they were being changed by redirecting text-based login codes to websites they controlled.
MITRE ATT&CK technique: T1056.003: Input Capture- Web Portal Capture
Versa Director Zero Day Exploitation used HTTPS for command and control of compromised Versa Director servers.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Versa Director Zero Day Exploitation involved exploitation of a vulnerability in Versa Director servers, since identified as CVE-2024-39717, for initial access and code execution.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
Versa Director Zero Day Exploitation intercepted and harvested credentials from user logins to compromised devices.
MITRE ATT&CK technique: T1056: Input Capture
Versa Director Zero Day Exploitation involved the development of a new web shell variant, VersaMem.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
Versa Director Zero Day Exploitation used compromised small office/home office devices to interact with vulnerable Versa Director servers.
MITRE ATT&CK technique: T1584.008: Compromise Infrastructure- Network Devices
Versa Director Zero Day Exploitation used a non-standard TCP session to initialize communication prior to establishing HTTPS command and control.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Versa Director Zero Day Exploitation established HTTPS communications from adversary-controlled SOHO devices over port 443 with compromised Versa Director servers.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Versa Director Zero Day Exploitation resulted in the deployment of the VersaMem web shell for follow-on activity.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
Water Curupira Pikabot Distribution used highly obfuscated JavaScript files as one initial installer for Pikabot.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Water Curupira Pikabot Distribution utilizes thread spoofing of existing email threads in order to execute spear phishing operations.
MITRE ATT&CK technique: T1589.002: Gather Victim Identity Information- Email Addresses
Water Curupira Pikabot Distribution used Curl.exe to download the Pikabot payload from an external server, saving the file to the victim machine's temporary directory.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Water Curupira Pikabot Distribution initial delivery included obfuscated JavaScript objects stored in password-protected ZIP archives.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Water Curupira Pikabot Distribution delivered Pikabot installers as password-protected ZIP files containing heavily obfuscated JavaScript, or IMG files containing an LNK mimicking a Word document and a malicious DLL.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Water Curupira Pikabot Distribution distributed a PDF attachment containing a malicious link to a Pikabot installer.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Water Curupira Pikabot Distribution utilizes rundll32.exe to execute the final Pikabot payload, using the named exports `Crash` or `Limit` depending on the variant.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Water Curupira Pikabot Distribution attached password-protected ZIP archives to deliver Pikabot installers.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Water Curupira Pikabot Distribution requires users to interact with malicious attachments in order to start Pikabot installation.
MITRE ATT&CK technique: T1204: User Execution
Water Curupira Pikabot Distribution installation via JavaScript will launch follow-on commands via cmd.exe.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
APT-C-36 has downloaded binary data from a specified domain after the malicious document is opened.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
APT-C-36 has prompted victims to accept macros in order to execute the subsequent payload.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
APT-C-36 has disguised its scheduled tasks as those used by Google.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
APT-C-36 has used port 4050 for C2 communications.
MITRE ATT&CK technique: T1571: Non-Standard Port
APT-C-36 has used ConfuserEx to obfuscate its variant of Imminent Monitor, compressed payload and RAT packages, and password protected encrypted email attachments to avoid detection.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
APT-C-36 has used spearphishing emails with password protected RAR attachment to avoid being detected by the email gateway.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
APT-C-36 obtained and used a modified variant of Imminent Monitor.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
APT1 has used RAR to compress files before moving them outside of the victim network.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
APT1 used a batch script to perform a series of discovery techniques and saves it to a text file.
MITRE ATT&CK technique: T1119: Automated Collection
APT1 has collected files from a local victim.
MITRE ATT&CK technique: T1005: Data from Local System
APT1 has registered hundreds of domains for use in operations.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
APT1 hijacked FQDNs associated with legitimate websites hosted by hop points.
MITRE ATT&CK technique: T1584.001: Compromise Infrastructure- Domains
APT1 has created email accounts for later use in social engineering, phishing, and when registering domains.
MITRE ATT&CK technique: T1585.002: Establish Accounts- Email Accounts
APT1 has been known to use credential dumping using Mimikatz.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
APT1 used the commands net localgroup,net user, and net group to find accounts on the system.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
APT1 uses two utilities, GETMAIL and MAPIGET, to steal email. GETMAIL extracts emails from archived Outlook .pst files.
MITRE ATT&CK technique: T1114.001: Email Collection- Local Email Collection
APT1 used publicly available malware for privilege escalation.
MITRE ATT&CK technique: T1588.001: Obtain Capabilities- Malware
The file name AcroRD32.exe, a legitimate process name for Adobe's Acrobat Reader, was used by APT1 as a name for malware.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
APT1 listed connected network shares.
MITRE ATT&CK technique: T1135: Network Share Discovery
The APT1 group is known to have used pass the hash.
MITRE ATT&CK technique: T1550.002: Use Alternate Authentication Material- Pass the Hash
APT1 gathered a list of running processes on the system using tasklist /v.
MITRE ATT&CK technique: T1057: Process Discovery
The APT1 group is known to have used RDP during operations.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
APT1 uses two utilities, GETMAIL and MAPIGET, to steal email. MAPIGET steals email still on Exchange servers that has not yet been archived.
MITRE ATT&CK technique: T1114.002: Email Collection- Remote Email Collection
APT1 has sent spearphishing emails containing malicious attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
APT1 has sent spearphishing emails containing hyperlinks to malicious files.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
APT1 used the ipconfig /all command to gather network configuration information.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
APT1 used the net use command to get a listing on network connections.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
APT1 used the commands net start and tasklist to get a listing of the services on the system.
MITRE ATT&CK technique: T1007: System Service Discovery
APT1 has used various open-source tools for privilege escalation purposes.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
APT12 has used blogs and WordPress for C2 infrastructure.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication