sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Mofang's malicious spearphishing attachments required a user to open the file after receiving.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Mofang's spearphishing emails required a user to click the link to connect to a compromised website.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Mofang delivered spearphishing emails with malicious documents, PDFs, or Excel files attached.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Mofang delivered spearphishing emails with malicious links included.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Molerats has used forged Microsoft code-signing certificates on malware.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Molerats used the public tool BrowserPasswordDump10 to dump passwords saved in browsers on victims.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Molerats decompresses ZIP files once on the victim machine.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Molerats has delivered compressed executables within ZIP files to victims.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Molerats used executables to download malicious files from different sources.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Molerats used various implants, including those built with JS, on target machines.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Molerats has sent malicious files via email that tricked users into clicking Enable Content to run an embedded macro and to download malicious archives.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Molerats has sent malicious links via email trick users into opening a RAR archive and running an executable.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Molerats has used msiexec.exe to execute an MSI payload.
MITRE ATT&CK technique: T1218.007: System Binary Proxy Execution- Msiexec
Molerats used PowerShell implants on target machines.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.
MITRE ATT&CK technique: T1057: Process Discovery
Molerats saved malicious files within the AppData and Startup folders to maintain persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Molerats has created scheduled tasks to persistently run VBScripts.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Molerats has sent phishing emails with malicious Microsoft Word and PDF attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Molerats has sent phishing emails with malicious links included.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Molerats used various implants, including those built with VBScript, on target machines.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Moonstone Sleet deployed malware such as YouieLoader capable of capturing victim system browser information.
MITRE ATT&CK technique: T1217: Browser Information Discovery
Moonstone Sleet has distributed a trojanized version of PuTTY software for initial access to victims.
MITRE ATT&CK technique: T1195.002: Supply Chain Compromise- Compromise Software Supply Chain
Moonstone Sleet has deployed ransomware in victim environments.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Moonstone Sleet delivered payloads using multiple rounds of obfuscation and encoding to evade defenses and analysis.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Moonstone Sleet developed malicious npm packages for delivery to or retrieval by victims.
MITRE ATT&CK technique: T1587: Develop Capabilities
Moonstone Sleet registered domains to develop effective personas for fake companies used in phishing activity.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
Moonstone Sleet has created email accounts to interact with victims, including for phishing purposes.
MITRE ATT&CK technique: T1585.002: Establish Accounts- Email Accounts
Moonstone Sleet gathered victim email address information for follow-on phishing activity.
MITRE ATT&CK technique: T1589.002: Gather Victim Identity Information- Email Addresses
Moonstone Sleet embedded payloads in trojanized software for follow-on execution.
MITRE ATT&CK technique: T1027.009: Obfuscated Files or Information- Embedded Payloads
Moonstone Sleet has used encrypted payloads within files for follow-on execution and defense evasion.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Moonstone Sleet has gathered information on victim organizations through email and social media interaction.
MITRE ATT&CK technique: T1591: Gather Victim Org Information
Moonstone Sleet retrieved a final stage payload from command and control infrastructure during initial installation on victim systems.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Moonstone Sleet retrieved credentials from LSASS memory.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Moonstone Sleet relied on users interacting with malicious files, such as a trojanized PuTTY installer, for initial execution.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Moonstone Sleet has developed custom malware, including a malware delivery mechanism masquerading as a legitimate game.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
Moonstone Sleet delivers encrypted payloads in pieces that are then combined together to form a new portable executable file during installation.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Moonstone Sleet has interacted with victims to gather information via email.
MITRE ATT&CK technique: T1598: Phishing for Information
Moonstone Sleet used registry run keys for process execution during initial victim infection.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Moonstone Sleet used scheduled tasks for program execution during initial access to victim machines.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Moonstone Sleet used intermediate loader malware such as YouieLoader and SplitLoader that create malicious services.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Moonstone Sleet has created social media accounts to interact with victims.
MITRE ATT&CK technique: T1585.001: Establish Accounts- Social Media Accounts
Moonstone Sleet delivered various payloads to victims as spearphishing attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Moonstone Sleet used spearphishing messages containing items such as tracking pixels to determine if users interacted with malicious messages.
MITRE ATT&CK technique: T1598.003: Phishing for Information- Spearphishing Link
Moonstone Sleet has used social media services to spear phish victims to deliver trojainized software.
MITRE ATT&CK technique: T1566.003: Phishing- Spearphishing via Service
Moonstone Sleet has gathered information on victim systems.
MITRE ATT&CK technique: T1082: System Information Discovery
Moonstone Sleet has gathered information on victim network configuration.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Moonstone Sleet deployed various malware such as YouieLoader that can perform system user discovery actions.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Moonstone Sleet staged malicious capabilities online for follow-on download by victims or malware.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
Moonstone Sleet registered virtual private servers to host payloads for download.
MITRE ATT&CK technique: T1583.003: Acquire Infrastructure- Virtual Private Server
Moonstone Sleet used curl to connect to adversary-controlled infrastructure and retrieve additional payloads.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Moses Staff has used signed drivers from an open source tool called DiskCryptor to evade detection.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Moses Staff has used batch scripts that can disable the Windows firewall on specific remote machines.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
Moses Staff has used obfuscated web shells in their operations.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Moses Staff has exploited known vulnerabilities in public-facing infrastructure such as Microsoft Exchange Servers.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
Moses Staff has downloaded and installed web shells to following path C:\inetpub\wwwroot\aspnet_client\system_web\IISpool.aspx.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Moses Staff has collected the administrator username from a compromised host.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Moses Staff has built malware, such as DCSrv and PyDCrypt, for targeting victims' machines.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
Moses Staff has used batch scripts that can enable SMB on a compromised host.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Moses Staff collected information about the infected host, including the machine names and OS architecture.
MITRE ATT&CK technique: T1082: System Information Discovery
Moses Staff has collected the domain name of a compromised network.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Moses Staff has used the commercial tool DiskCryptor.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Moses Staff has dropped a web shell onto a compromised system.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
MoustachedBouncer has injected content into DNS, HTTP, and SMB replies to redirect specifically-targeted victims to a fake Windows Update page to download malware.
MITRE ATT&CK technique: T1659: Content Injection
MoustachedBouncer has exploited CVE-2021-1732 to execute malware components with elevated rights.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
MoustachedBouncer has used JavaScript to deliver malware hosted on HTML pages.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
MoustachedBouncer has used plugins to execute PowerShell scripts.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
MoustachedBouncer has used a reverse proxy tool similar to the GitHub repository revsocks.
MITRE ATT&CK technique: T1090: Proxy
MoustachedBouncer has used plugins to save captured screenshots to `.\AActdata\` on an SMB share.
MITRE ATT&CK technique: T1074.002: Data Staged- Remote Data Staging
MoustachedBouncer has used plugins to take screenshots on targeted systems.
MITRE ATT&CK technique: T1113: Screen Capture
MoustachedBouncer has used malware plugins packed with Themida.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
MuddyWater has used the native Windows cabinet creation tool, makecab.exe, likely to compress stolen data to be uploaded.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
MuddyWater has used web services including OneHub to distribute remote access tools.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
MuddyWater uses various techniques to bypass UAC.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
MuddyWater has used CMSTP.exe and a malicious INF to execute its POWERSTATS payload.
MITRE ATT&CK technique: T1218.003: System Binary Proxy Execution- CMSTP
MuddyWater has performed credential dumping with LaZagne.
MITRE ATT&CK technique: T1003.005: OS Credential Dumping- Cached Domain Credentials
MuddyWater has used Daniel Bohannon’s Invoke-Obfuscation framework and obfuscated PowerShell scripts. The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
MuddyWater has used the .NET csc.exe tool to compile executables from downloaded C# code.
MITRE ATT&CK technique: T1027.004: Obfuscated Files or Information- Compile After Delivery
MuddyWater has used malware that has the capability to execute malicious code via COM, DCOM, and Outlook.
MITRE ATT&CK technique: T1559.001: Inter-Process Communication- Component Object Model
MuddyWater has run a tool that steals passwords saved in victim email.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
MuddyWater has performed credential dumping with LaZagne and other tools, including by dumping passwords saved in victim email.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
MuddyWater has run tools including Browser64 to steal passwords saved in victim web browsers.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
MuddyWater maintains persistence on victim networks through side-loading dlls to trick legitimate programs into running malware.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
MuddyWater has decoded base64-encoded PowerShell, JavaScript, and VBScript.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
MuddyWater can disable the system's local proxy settings.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
MuddyWater has used cmd.exe net user /domain to enumerate domain users.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
MuddyWater has used malware that can execute PowerShell scripts via DDE.
MITRE ATT&CK technique: T1559.002: Inter-Process Communication- Dynamic Data Exchange
MuddyWater has used C2 infrastructure to receive exfiltrated data.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
MuddyWater has exploited the Microsoft Exchange memory corruption vulnerability .
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
MuddyWater has exploited the Office vulnerability CVE-2017-0199 for execution.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
MuddyWater has exploited the Microsoft Netlogon vulnerability .
MITRE ATT&CK technique: T1210: Exploitation of Remote Services
MuddyWater has controlled POWERSTATS from behind a proxy network to obfuscate the C2 location. MuddyWater has used a series of compromised websites that victims connected to randomly to relay information to command and control .
MITRE ATT&CK technique: T1090.002: Proxy- External Proxy
MuddyWater has used malware that checked if the ProgramData folder had folders or files with the keywords "Kasper," "Panda," or "ESET."
MITRE ATT&CK technique: T1083: File and Directory Discovery
MuddyWater has used malware that can upload additional files to the victim’s machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
MuddyWater has used JavaScript files to execute its POWERSTATS payload.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
MuddyWater has performed credential dumping with LaZagne.
MITRE ATT&CK technique: T1003.004: OS Credential Dumping- LSA Secrets
MuddyWater has performed credential dumping with Mimikatz and procdump64.exe.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
MuddyWater has stored a decoy PDF file within a victim's `%temp%` folder.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
MuddyWater has attempted to get users to open malicious PDF attachment and to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
MuddyWater has distributed URLs in phishing e-mails that link to lure documents.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
MuddyWater has disguised malicious executables and used filenames and Registry key names associated with Windows Defender.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
MuddyWater has used mshta.exe to execute its POWERSTATS payload and to pass a PowerShell one-liner for execution.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
MuddyWater has used one C2 to obtain enumeration scripts and monitor web logs, but a different C2 to send data back.
MITRE ATT&CK technique: T1104: Multi-Stage Channels
MuddyWater has used a Word Template, Normal.dotm, for persistence.
MITRE ATT&CK technique: T1137.001: Office Application Startup- Office Template Macros
MuddyWater has used PowerShell for execution.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
MuddyWater has used malware to obtain a list of running processes on the system.
MITRE ATT&CK technique: T1057: Process Discovery
MuddyWater has developed tools in Python including Out1.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
MuddyWater has added Registry Run key KCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemTextEncoding to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
MuddyWater has used legitimate applications ScreenConnect, AteraAgent and SimpleHelp to manage systems remotely and move laterally.
MITRE ATT&CK technique: T1219: Remote Access Software
MuddyWater has used malware that leveraged rundll32.exe in a Registry Run key to execute a .dll.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
MuddyWater has used scheduled tasks to establish persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
MuddyWater has used malware that can capture screenshots of the victim’s machine.
MITRE ATT&CK technique: T1113: Screen Capture
MuddyWater has used malware to check running processes against a hard-coded list of security tools often used by malware researchers.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
MuddyWater has used a PowerShell backdoor to check for Skype connectivity on the target machine.
MITRE ATT&CK technique: T1518: Software Discovery
MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
MuddyWater has sent targeted spearphishing e-mails with malicious links.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
MuddyWater has used tools to encode C2 communications including Base64 encoding.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
MuddyWater has stored obfuscated JavaScript code in an image file named temp.jpg.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
MuddyWater has used AES to encrypt C2 responses.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
MuddyWater has used malware that can collect the victim’s OS version and machine name.
MITRE ATT&CK technique: T1082: System Information Discovery
MuddyWater has used malware to collect the victim’s IP address and domain name.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
MuddyWater has used a PowerShell backdoor to check for Skype connections on the target machine.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
MuddyWater has used malware that can collect the victim’s username.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
MuddyWater has used legitimate tools ConnectWise, RemoteUtilities, and SimpleHelp to gain access to the target environment.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
MuddyWater has used VBScript files to execute its POWERSTATS payload, as well as macros.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
MuddyWater has used HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
MuddyWater has used file sharing services including OneHub, Sync, and TeraBox to distribute tools.
MITRE ATT&CK technique: T1583.006: Acquire Infrastructure- Web Services
MuddyWater has used a custom tool for creating reverse shells.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
MuddyWater has used malware that leveraged WMI for execution and querying host information.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Mustang Panda has encrypted documents with RC4 prior to exfiltration.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
Mustang Panda has used RAR to create password-protected archives of collected documents prior to exfiltration.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
Mustang Panda used custom batch scripts to collect files automatically from a targeted system.
MITRE ATT&CK technique: T1119: Automated Collection
Mustang Panda has used junk code within their DLL files to hinder analysis.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
Mustang Panda has used a legitimately signed executable to execute a malicious payload within a DLL file.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Mustang Panda have acquired C2 domains prior to operations.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
Mustang Panda has used an additional filename extension to hide the true file type.
MITRE ATT&CK technique: T1036.007: Masquerading- Double File Extension
Mustang Panda has leveraged the legitimate email marketing service SMTP2Go for phishing campaigns.
MITRE ATT&CK technique: T1585.002: Establish Accounts- Email Accounts
Mustang Panda has used a customized PlugX variant which could exfiltrate documents from air-gapped networks.
MITRE ATT&CK technique: T1052.001: Exfiltration Over Physical Medium- Exfiltration over USB
Mustang Panda has exploited CVE-2017-0199 in Microsoft Word to execute code.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Mustang Panda will delete their tools and files, and kill processes after their objectives are reached.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Mustang Panda has searched the entire target system for DOC, DOCX, PPT, PPTX, XLS, XLSX, and PDF files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Mustang Panda's PlugX variant has created a hidden folder on USB drives named RECYCLE.BIN to store malicious executables and collected data.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
Mustang Panda has downloaded additional executables following the initial infection stage.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Mustang Panda has used InstallUtil.exe to execute a malicious Beacon stager.
MITRE ATT&CK technique: T1218.004: System Binary Proxy Execution- InstallUtil
Mustang Panda has stored collected credential files in c:\windows\temp prior to exfiltration. Mustang Panda has also stored documents for exfiltration in a hidden folder on USB drives.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Mustang Panda has sent malicious files requiring direct victim interaction to execute.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Mustang Panda has sent malicious links including links directing victims to a Google Drive folder.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Mustang Panda has used names like `adobeupdate.dat` and `PotPlayerDB.dat` to disguise PlugX, and a file named `OneDrive.exe` to load a Cobalt Strike payload.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Mustang Panda has used mshta.exe to launch collection scripts.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
Mustang Panda has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file. Mustang Panda has also used reg save on the SYSTEM file Registry location to help extract the NTDS.dit file.
MITRE ATT&CK technique: T1003.003: OS Credential Dumping- NTDS
Mustang Panda has delivered initial payloads hidden using archives and encoding measures.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Mustang Panda has used malicious PowerShell scripts to enable execution.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Mustang Panda has used tasklist /v to determine active process information.
MITRE ATT&CK technique: T1057: Process Discovery
Mustang Panda has created the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobelmdyU to maintain persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Mustang Panda has installed TeamViewer on targeted systems.
MITRE ATT&CK technique: T1219: Remote Access Software
Mustang Panda has used a customized PlugX variant which could spread through USB connections.
MITRE ATT&CK technique: T1091: Replication Through Removable Media
Mustang Panda has created a scheduled task to execute additional malicious software, as well as maintain persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Mustang Panda has searched the victim system for the InstallUtil.exe program and its version.
MITRE ATT&CK technique: T1518: Software Discovery
Mustang Panda has used spearphishing attachments to deliver initial access payloads.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Mustang Panda has delivered malicious links to their intended targets.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Mustang Panda has delivered web bugs to profile their intended targets.
MITRE ATT&CK technique: T1598.003: Phishing for Information- Spearphishing Link
Mustang Panda has used servers under their control to validate tracking pixels sent to phishing victims.
MITRE ATT&CK technique: T1608: Stage Capabilities
Mustang Panda has encrypted C2 communications with RC4.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Mustang Panda has gathered system information using systeminfo.
MITRE ATT&CK technique: T1082: System Information Discovery
Mustang Panda has used ipconfig and arp to determine network configuration information.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Mustang Panda has used netstat -ano to determine network connection information.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Mustang Panda has hosted malicious payloads on DropBox including PlugX.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
Mustang Panda has embedded VBScript components in LNK files to download additional files and automate collection.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Mustang Panda has communicated with its C2 via HTTP POST requests.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Mustang Panda has used DropBox URLs to deliver variants of PlugX.
MITRE ATT&CK technique: T1102: Web Service
Mustang Panda has executed HTA files via cmd.exe, and used batch scripts for collection.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Mustang Panda has executed PowerShell scripts via WMI.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Mustang Panda's custom ORat tool uses a WMI event consumer to maintain persistence.
MITRE ATT&CK technique: T1546.003: Event Triggered Execution- Windows Management Instrumentation Event Subscription
Mustard Tempest operates a global network of compromised websites that redirect into a traffic distribution system to select victims for a fake browser update page.
MITRE ATT&CK technique: T1584.001: Compromise Infrastructure- Domains
Mustard Tempest has used drive-by downloads for initial infection, often using fake browser updates as a lure.
MITRE ATT&CK technique: T1189: Drive-by Compromise
Mustard Tempest has injected malicious JavaScript into compromised websites to infect victims via drive-by download.
MITRE ATT&CK technique: T1608.004: Stage Capabilities- Drive-by Target
Mustard Tempest has deployed secondary payloads and third stage implants to compromised hosts.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Mustard Tempest has lured users into downloading malware through malicious links in fake advertisements and spearphishing emails.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Mustard Tempest has posted false advertisements including for software packages and browser updates in order to distribute malware.
MITRE ATT&CK technique: T1583.008: Acquire Infrastructure- Malvertising
Mustard Tempest has used the filename `AutoUpdater.js` to mimic legitimate update files and has also used the Cyrillic homoglyph characters С `` and а ``, to produce the filename `Сhrome.Updаte.zip`.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Mustard Tempest has poisoned search engine results to return fake software updates in order to distribute malware.
MITRE ATT&CK technique: T1608.006: Stage Capabilities- SEO Poisoning
Mustard Tempest has acquired servers to host second-stage payloads that remain active for a period of either days, weeks, or months.
MITRE ATT&CK technique: T1583.004: Acquire Infrastructure- Server
Mustard Tempest has sent victims emails containing links to compromised websites.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Mustard Tempest has used implants to perform system reconnaissance on targeted systems.
MITRE ATT&CK technique: T1082: System Information Discovery
Mustard Tempest has hosted payloads on acquired second-stage servers for periods of either days, weeks, or months.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
Naikon has used the RoyalRoad exploit builder to drop a second stage loader, intel.wll, into the Word Startup folder on the compromised host.
MITRE ATT&CK technique: T1137.006: Office Application Startup- Add-ins
Naikon has used DLL side-loading to load malicious DLL's into legitimate executables.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Naikon has used administrator credentials for lateral movement in compromised networks.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
Naikon has convinced victims to open malicious attachments to execute malware.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Naikon renamed a malicious service taskmgr to appear to be a legitimate version of Task Manager.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Naikon has disguised malicious programs as Google Chrome, Adobe, and VMware executables.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Naikon has used the LadonGo scanner to scan target networks.
MITRE ATT&CK technique: T1046: Network Service Discovery
Naikon has modified a victim's Windows Run registry to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Naikon has used a netbios scanner for remote machine identification.
MITRE ATT&CK technique: T1018: Remote System Discovery
Naikon has used schtasks.exe for lateral movement in compromised networks.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Naikon uses commands such as netsh advfirewall firewall to discover local firewall settings.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Naikon has used malicious e-mail attachments to deliver malware.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Naikon uses commands such as netsh interface show to discover network interface settings.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Naikon has used WMIC.exe for lateral movement.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Nomadic Octopus executed PowerShell in a hidden window.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
Nomadic Octopus has used malicious macros to download additional files to the victim's machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Nomadic Octopus as attempted to lure victims into clicking on malicious attachments within spearphishing emails.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Nomadic Octopus attempted to make Octopus appear as a Telegram Messenger with a Russian interface.
MITRE ATT&CK technique: T1036: Masquerading
Nomadic Octopus has used PowerShell for execution.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Nomadic Octopus has targeted victims with spearphishing emails containing malicious attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Nomadic Octopus used cmd.exe /c within a malicious macro.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
OilRig used the Plink utility and other tools to create tunnels to C2 servers.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
OilRig has used automated collection.
MITRE ATT&CK technique: T1119: Automated Collection
OilRig has used brute force techniques to obtain credentials.
MITRE ATT&CK technique: T1110: Brute Force
OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.
MITRE ATT&CK technique: T1003.005: OS Credential Dumping- Cached Domain Credentials
OilRig has used various types of scripting for execution.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
OilRig has used a CHM payload to load and execute another malicious file once delivered to a victim.
MITRE ATT&CK technique: T1218.001: System Binary Proxy Execution- Compiled HTML File
OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access. OilRig has also used tool named PICKPOCKET to dump passwords from web browsers.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
OilRig has used DNS for C2 including the publicly available requestbin.net tunneling service.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
A OilRig macro has run a PowerShell command to decode file contents. OilRig has also used certutil to decode base64-encoded files on victims.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
OilRig has run net user, net user /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to get account listings on a victim.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
OilRig has used net group /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to find domain group permission settings.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
OilRig has encrypted and encoded data in its malware, including by using base64.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
OilRig has exfiltrated data over FTP separately from its primary C2 channel over DNS.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
OilRig uses remote services such as VPN, Citrix, or OWA to persist in an environment.
MITRE ATT&CK technique: T1133: External Remote Services
OilRig malware ISMAgent falls back to its DNS tunneling mechanism if it is unable to reach the C2 server over HTTP.
MITRE ATT&CK technique: T1008: Fallback Channels
OilRig has deleted files associated with their payload after execution.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
OilRig has tested malware samples to determine AV detection and subsequently modified the samples to ensure AV evasion.
MITRE ATT&CK technique: T1027.005: Obfuscated Files or Information- Indicator Removal from Tools
OilRig can download remote files onto victims.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
OilRig has used keylogging tools called KEYPUNCH and LONGWATCH.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.
MITRE ATT&CK technique: T1003.004: OS Credential Dumping- LSA Secrets
OilRig has used credential dumping tools such as Mimikatz to steal credentials to accounts logged into the compromised system and to Outlook Web Access.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
OilRig has run net user, net user /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to get account listings on a victim.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
OilRig has used net localgroup administrators to find local administrators on compromised systems.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
OilRig has delivered macro-enabled documents that required targets to click the "enable content" button to execute the payload on the system.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
OilRig has delivered malicious links to achieve execution on the target system.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
OilRig has used .doc file extensions to mask malicious executables.
MITRE ATT&CK technique: T1036: Masquerading
OilRig has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.
MITRE ATT&CK technique: T1046: Network Service Discovery
OilRig has abused the Outlook Home Page feature for persistence. OilRig has also used CVE-2017-11774 to roll back the initial patch designed to protect against Home Page abuse.
MITRE ATT&CK technique: T1137.004: Office Application Startup- Outlook Home Page
OilRig has used net.exe in a script with net accounts /domain to find the password policy of a domain.
MITRE ATT&CK technique: T1201: Password Policy Discovery
OilRig has used tools to identify if a mouse is connected to a targeted system.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
OilRig has used PowerShell scripts for execution, including use of a macro to run a PowerShell command to decode file contents.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
OilRig has run tasklist on a victim's machine.
MITRE ATT&CK technique: T1057: Process Discovery
OilRig has used the Plink utility and other tools to create tunnels to C2 servers.
MITRE ATT&CK technique: T1572: Protocol Tunneling
OilRig has used reg query “HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default” on a victim to query the Registry.
MITRE ATT&CK technique: T1012: Query Registry
OilRig has used Remote Desktop Protocol for lateral movement. The group has also used tunneling tools to tunnel RDP into the environment.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
OilRig has used Putty to access compromised systems.
MITRE ATT&CK technique: T1021.004: Remote Services- SSH
OilRig has created scheduled tasks that run a VBScript to execute a payload on victim machines.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
OilRig has a tool called CANDYKING to capture a screenshot of user's desktop.
MITRE ATT&CK technique: T1113: Screen Capture
OilRig has sent spearphising emails with malicious attachments to potential victims using compromised and/or spoofed email accounts.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
OilRig has sent spearphising emails with malicious links to potential victims.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
OilRig has used LinkedIn to send spearphishing links.
MITRE ATT&CK technique: T1566.003: Phishing- Spearphishing via Service
OilRig has used macros to verify if a mouse is connected to a compromised machine.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
OilRig has run hostname and systeminfo on a victim.
MITRE ATT&CK technique: T1082: System Information Discovery
OilRig has run ipconfig /all on a victim.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
OilRig has used netstat -an on a victim to get a listing of network connections.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
OilRig has run whoami on a victim.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
OilRig has used sc query on a victim to gather information about services.
MITRE ATT&CK technique: T1007: System Service Discovery
OilRig has used compromised credentials to access other systems on a victim network.
MITRE ATT&CK technique: T1078: Valid Accounts
OilRig has used VBScript macros for execution on compromised hosts.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
OilRig has used HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
OilRig has used web shells, often to maintain access to a victim network.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
OilRig has used macros to deliver malware such as QUADAGENT and OopsIE. OilRig has used batch scripts.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
OilRig has used credential dumping tool named VALUEVAULT to steal credentials from the Windows Credential Manager.
MITRE ATT&CK technique: T1555.004: Credentials from Password Stores- Windows Credential Manager
OilRig has used WMI for execution.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Orangeworm has copied its backdoor across open network shares, including ADMIN$, C$WINDOWS, D$WINDOWS, and E$WINDOWS.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Orangeworm has used HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
PLATINUM is capable of using Windows hook interfaces for information gathering such as credential access.
MITRE ATT&CK technique: T1056.004: Input Capture- Credential API Hooking
PLATINUM has sometimes used drive-by attacks against vulnerable browser plugins.
MITRE ATT&CK technique: T1189: Drive-by Compromise
PLATINUM has leveraged a zero-day vulnerability to escalate privileges.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
PLATINUM has transferred files using the Intel® Active Management Technology Serial-over-LAN channel.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
PLATINUM has used several different keyloggers.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
PLATINUM has used keyloggers that are also capable of dumping credentials.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
PLATINUM has attempted to get users to open malicious files by sending spearphishing emails with attachments to victims.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
PLATINUM has renamed rar.exe to avoid detection.
MITRE ATT&CK technique: T1036: Masquerading
PLATINUM has used the Intel® Active Management Technology Serial-over-LAN channel for command and control.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
PLATINUM has used various methods of process injection including hot patching.
MITRE ATT&CK technique: T1055: Process Injection
PLATINUM has sent spearphishing emails with attachments to victims as its primary initial access vector.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
POLONIUM has used OneDrive and DropBox for C2.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
POLONIUM has exfiltrated stolen data to POLONIUM-owned OneDrive and Dropbox accounts.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
POLONIUM has used the AirVPN service for operational activity.
MITRE ATT&CK technique: T1090: Proxy
POLONIUM has obtained and used tools such as AirVPN and plink in their operations.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
POLONIUM has used compromised credentials from an IT company to target downstream customers including a law firm and aviation company.
MITRE ATT&CK technique: T1199: Trusted Relationship
POLONIUM has used valid compromised credentials to gain access to victim environments.
MITRE ATT&CK technique: T1078: Valid Accounts
POLONIUM has created and used legitimate Microsoft OneDrive accounts for their operations.
MITRE ATT&CK technique: T1583.006: Acquire Infrastructure- Web Services
PROMETHIUM has signed code with self-signed certificates.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
PROMETHIUM has created self-signed certificates to sign malicious installers.
MITRE ATT&CK technique: T1587.002: Develop Capabilities- Code Signing Certificates
PROMETHIUM has created self-signed digital certificates for use in HTTPS C2 traffic.
MITRE ATT&CK technique: T1587.003: Develop Capabilities- Digital Certificates
PROMETHIUM has used watering hole attacks to deliver malicious versions of legitimate installers.
MITRE ATT&CK technique: T1189: Drive-by Compromise
PROMETHIUM has created admin accounts on a compromised host.
MITRE ATT&CK technique: T1078.003: Valid Accounts- Local Accounts
PROMETHIUM has attempted to get users to execute compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
PROMETHIUM has named services to appear legitimate.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
PROMETHIUM has disguised malicious installer files by bundling them with legitimate software installers.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
PROMETHIUM has used a script that configures the knockd service and firewall to only accept C2 connections from systems that use a specified sequence of knock ports.
MITRE ATT&CK technique: T1205.001: Traffic Signaling- Port Knocking
PROMETHIUM has used Registry run keys to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
PROMETHIUM has created new services and modified existing services for persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Patchwork encrypted the collected files' path with AES and then encoded them with base64.
MITRE ATT&CK technique: T1560: Archive Collected Data
Patchwork developed a file stealer to search C:\ and collect files with certain extensions. Patchwork also executed a script to enumerate all drives, store them as a list, and upload generated files to the C2 server.
MITRE ATT&CK technique: T1119: Automated Collection
Patchwork has used BITS jobs to download malicious payloads.
MITRE ATT&CK technique: T1197: BITS Jobs
Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
Patchwork bypassed User Access Control .
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control