sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Scattered Spider has used self-signed and stolen certificates originally issued to NVIDIA and Global Software LLC.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Scattered Spider has added additional trusted locations to Azure AD conditional access policies.
MITRE ATT&CK technique: T1556.009: Modify Authentication Process- Conditional Access Policies
Scattered Spider creates new user identities within the compromised organization.
MITRE ATT&CK technique: T1136: Create Account
During C0027, Scattered Spider used access to the victim's Azure tenant to create Azure VMs. Scattered Spider has also created Amazon EC2 instances within the victim's environment.
MITRE ATT&CK technique: T1578.002: Modify Cloud Compute Infrastructure- Create Cloud Instance
Scattered Spider Spider searches for credential storage documentation on a compromised host.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
Scattered Spider has used BlackCat ransomware to encrypt files on VMWare ESXi servers.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Scattered Spider stages data in a centralized database prior to exfiltration.
MITRE ATT&CK technique: T1074: Data Staged
Scattered Spider enumerates data stored in cloud resources for collection and exfiltration purposes.
MITRE ATT&CK technique: T1530: Data from Cloud Storage
Scattered Spider has created volume shadow copies of virtual domain controller disks to extract the `NTDS.dit` file.
MITRE ATT&CK technique: T1006: Direct Volume Access
Scattered Spider leverages legitimate domain accounts to gain access to the target environment.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
Scattered Spider threat actors search the victim’s Microsoft Exchange for emails about the intrusion and incident response.
MITRE ATT&CK technique: T1114: Email Collection
Scattered Spider creates inbound rules on the compromised email accounts of security personnel to automatically delete emails from vendor security products.
MITRE ATT&CK technique: T1564.008: Hide Artifacts- Email Hiding Rules
Scattered Spider has exfiltrated victim data to the MEGA file sharing site.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
Scattered Spider has deployed a malicious kernel driver through exploitation of CVE-2015-2291 in the Intel Ethernet diagnostics driver for Windows .
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
Scattered Spider has leveraged legitimate remote management tools to maintain persistent access.
MITRE ATT&CK technique: T1133: External Remote Services
Scattered Spider Spider enumerates a target organization for files and directories of interest, including source code.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Scattered Spider has deployed ransomware on compromised hosts for financial gain.
MITRE ATT&CK technique: T1657: Financial Theft
During C0027, Scattered Spider impersonated legitimate IT personnel in phone calls and text messages either to direct victims to a credential harvesting site or getting victims to run commercial remote monitoring and management tools. Scattered Spider utilized social engineering to compel IT help desk personnel to reset passwords and MFA tokens.
MITRE ATT&CK technique: T1656: Impersonation
Scattered Spider threat actors search the victim’s Slack and Microsoft Teams for conversations about the intrusion and incident response.
MITRE ATT&CK technique: T1213.005: Data from Information Repositories- Messaging Applications
After compromising user accounts, Scattered Spider registers their own MFA tokens.
MITRE ATT&CK technique: T1556.006: Modify Authentication Process- Multi-Factor Authentication
Scattered Spider has used multifactor authentication fatigue by sending repeated MFA authentication requests to targets.
MITRE ATT&CK technique: T1621: Multi-Factor Authentication Request Generation
Scattered Spider has extracted the `NTDS.dit` file by creating volume shadow copies of virtual domain controller disks.
MITRE ATT&CK technique: T1003.003: OS Credential Dumping- NTDS
Scattered Spider has used a combination of credential phishing and social engineering to capture one-time-password codes.
MITRE ATT&CK technique: T1598: Phishing for Information
Scattered Spider enumerate and exfiltrate code-signing certificates from a compromised host.
MITRE ATT&CK technique: T1552.004: Unsecured Credentials- Private Keys
During C0027, Scattered Spider directed victims to run remote monitoring and management tools. In addition to directing victims to run remote software, Scattered Spider members themselves also deploy RMM software including AnyDesk, LogMeIn, and ConnectWise Control to establish persistence on the compromised network.
MITRE ATT&CK technique: T1219: Remote Access Software
Scattered Spider can enumerate remote systems, such as VMware vCenter infrastructure.
MITRE ATT&CK technique: T1018: Remote System Discovery
During C0027, Scattered Spider used phone calls to instruct victims to navigate to credential-harvesting websites. Scattered Spider has also called employees at target organizations and compelled them to navigate to fake login portals using adversary-in-the-middle toolkits.
MITRE ATT&CK technique: T1598.004: Phishing for Information- Spearphishing Voice
Scattered Spider retrieves browser cookies via Raccoon Stealer.
MITRE ATT&CK technique: T1539: Steal Web Session Cookie
Scattered Spider adds a federated identity provider to the victim’s SSO tenant and activates automatic account linking.
MITRE ATT&CK technique: T1484.002: Domain or Tenant Policy Modification- Trust Modification
Scattered Spider has impersonated organization IT and helpdesk staff to instruct victims to execute commercial remote access tools to gain initial access.
MITRE ATT&CK technique: T1204: User Execution
SideCopy has used a malicious loader DLL file to execute the `credwiz.exe` process and side-load the malicious payload `Duser.dll`.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
SideCopy has compromised domains for some of their infrastructure, including for C2 and staging malware.
MITRE ATT&CK technique: T1584.001: Compromise Infrastructure- Domains
SideCopy has delivered trojanized executables via spearphishing emails that contacts actor-controlled servers to download malicious payloads.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
SideCopy has attempted to lure victims into clicking on malicious embedded archive files sent via spearphishing campaigns.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
SideCopy has used a legitimate DLL file name, `Duser.dll` to disguise a malicious remote access tool.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
SideCopy has utilized `mshta.exe` to execute a malicious hta file.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
SideCopy has executed malware by calling the API function `CreateProcessW`.
MITRE ATT&CK technique: T1106: Native API
SideCopy uses a loader DLL file to collect AV product names from an infected host.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
SideCopy has collected browser information from a compromised host.
MITRE ATT&CK technique: T1518: Software Discovery
SideCopy has sent spearphishing emails with malicious hta file attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
SideCopy has crafted generic lures for spam campaigns to collect emails and credentials for targeting efforts.
MITRE ATT&CK technique: T1598.002: Phishing for Information- Spearphishing Attachment
SideCopy has identified the OS version of a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
SideCopy has identified the country location of a compromised host.
MITRE ATT&CK technique: T1614: System Location Discovery
SideCopy has identified the IP address of a compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
SideCopy has used compromised domains to host its malicious payloads.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
SideCopy has sent Microsoft Office Publisher documents to victims that have embedded malicious macros that execute an hta file via calling `mshta.exe`.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Sidewinder has used tools to automatically collect system and network configuration information.
MITRE ATT&CK technique: T1119: Automated Collection
Sidewinder has configured tools to automatically send collected files to attacker controlled servers.
MITRE ATT&CK technique: T1020: Automated Exfiltration
Sidewinder has used base64 encoding for scripts.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
Sidewinder has used DLL side-loading to drop and execute malicious payloads including the hijacking of the legitimate Windows application file rekeywiz.exe.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Sidewinder has used the ActiveXObject utility to create OLE objects to obtain execution through Internet Explorer.
MITRE ATT&CK technique: T1559.002: Inter-Process Communication- Dynamic Data Exchange
Sidewinder has used base64 encoding and ECDH-P256 encryption for payloads.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Sidewinder has exploited vulnerabilities to gain execution including CVE-2017-11882 and CVE-2020-0674.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Sidewinder has used malware to collect information on files and directories.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Sidewinder has used LNK files to download remote files to the victim's network.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Sidewinder has used JavaScript to drop and execute malware loaders.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Sidewinder has collected stolen files in a temporary folder in preparation for exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Sidewinder has lured targets to click on malicious files to gain execution in the target environment.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Sidewinder has lured targets to click on malicious links to gain execution in the target environment.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Sidewinder has named malicious files rekeywiz.exe to match the name of a legitimate Windows executable.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Sidewinder has used mshta.exe to execute malicious payloads.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
Sidewinder has used PowerShell to drop and execute malware loaders.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Sidewinder has used tools to identify running processes on the victim's machine.
MITRE ATT&CK technique: T1057: Process Discovery
Sidewinder has added paths to executables in the Registry to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Sidewinder has used the Windows service winmgmts:\\.\root\SecurityCenter2 to check installed antivirus products.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Sidewinder has used tools to enumerate software installed on an infected host.
MITRE ATT&CK technique: T1518: Software Discovery
Sidewinder has sent e-mails with malicious attachments often crafted for specific targets.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Sidewinder has sent e-mails with malicious attachments that lead victims to credential harvesting websites.
MITRE ATT&CK technique: T1598.002: Phishing for Information- Spearphishing Attachment
Sidewinder has sent e-mails with malicious links often crafted for specific targets.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Sidewinder has sent e-mails with malicious links to credential harvesting websites.
MITRE ATT&CK technique: T1598.003: Phishing for Information- Spearphishing Link
Sidewinder has used tools to collect the computer name, OS version, installed hotfixes, as well as information regarding the memory and processor on a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
Sidewinder has used malware to collect information on network interfaces, including the MAC address.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Sidewinder has used tools to identify the user of a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Sidewinder has used tools to obtain the current system time.
MITRE ATT&CK technique: T1124: System Time Discovery
Sidewinder has used VBScript to drop and execute malware loaders.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Sidewinder has used HTTP in C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Silence has used a valid certificate to sign their primary loader Silence.Downloader .
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Silence has used environment variable string substitution for obfuscation.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
Silence has weaponized CHM files in their phishing campaigns.
MITRE ATT&CK technique: T1218.001: System Binary Proxy Execution- Compiled HTML File
Silence has used ProxyBot, which allows the attacker to redirect traffic from the current node to the backconnect server via Sock4\Socks5.
MITRE ATT&CK technique: T1090.002: Proxy- External Proxy
Silence has deleted artifacts, including scheduled tasks, communicates files from the C2 and other logs.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Silence has downloaded additional modules and malware to victim’s machines.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Silence has used JS scripts.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Silence has used the Farse6.1 utility ) to extract credentials from lsass.exe.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Silence attempts to get users to launch malicious attachments delivered via spearphishing emails.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Silence has named its backdoor "WINWORD.exe".
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Silence can create, delete, or modify a specified Registry key or value.
MITRE ATT&CK technique: T1112: Modify Registry
Silence has leveraged the Windows API, including using CreateProcess or ShellExecute, to perform a variety of tasks.
MITRE ATT&CK technique: T1106: Native API
Silence has used port 444 when sending data about the system from the client to the server.
MITRE ATT&CK technique: T1571: Non-Standard Port
Silence has used PowerShell to download and execute payloads.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Silence has injected a DLL library containing a Trojan into the fwmain32.exe process.
MITRE ATT&CK technique: T1055: Process Injection
Silence has used HKCU\Software\Microsoft\Windows\CurrentVersion\Run, HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and the Startup folder to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Silence has used RDP for lateral movement.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
Silence has used Nmap to scan the corporate network, build a network topology, and identify vulnerable hosts.
MITRE ATT&CK technique: T1018: Remote System Discovery
Silence has used scheduled tasks to stage its operation.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Silence can capture victim screen activity.
MITRE ATT&CK technique: T1113: Screen Capture
Silence has used Winexe to install a service on the remote system.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Silence has used RAdmin, a remote software tool used to remotely control workstations and ATMs.
MITRE ATT&CK technique: T1072: Software Deployment Tools
Silence has sent emails with malicious DOCX, CHM, LNK and ZIP attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Silence has obtained and modified versions of publicly-available tools like Empire and PsExec.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Silence has used compromised credentials to log on to other systems and escalate privileges.
MITRE ATT&CK technique: T1078: Valid Accounts
Silence has been observed making videos of victims to observe bank employees day to day activities.
MITRE ATT&CK technique: T1125: Video Capture
Silence has used VBS scripts.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Silence has used Windows command-line to run commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Silent Librarian has obtained free Let's Encrypt SSL certificates for use on their phishing pages.
MITRE ATT&CK technique: T1588.004: Obtain Capabilities- Digital Certificates
Silent Librarian has acquired domains to establish credential harvesting pages, often spoofing the target organization and using free top level domains .TK, .ML, .GA, .CF, and .GQ.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
Silent Librarian has established e-mail accounts to receive e-mails forwarded from compromised accounts.
MITRE ATT&CK technique: T1585.002: Establish Accounts- Email Accounts
Silent Librarian has collected e-mail addresses from targeted organizations from open Internet searches.
MITRE ATT&CK technique: T1589.002: Gather Victim Identity Information- Email Addresses
Silent Librarian has exfiltrated entire mailboxes from compromised accounts.
MITRE ATT&CK technique: T1114: Email Collection
Silent Librarian has set up auto forwarding rules on compromised e-mail accounts.
MITRE ATT&CK technique: T1114.003: Email Collection- Email Forwarding Rule
Silent Librarian has collected lists of names for individuals from targeted organizations.
MITRE ATT&CK technique: T1589.003: Gather Victim Identity Information- Employee Names
Silent Librarian has cloned victim organization login pages and staged them for later use in credential harvesting campaigns. Silent Librarian has also made use of a variety of URL shorteners for these staged websites.
MITRE ATT&CK technique: T1608.005: Stage Capabilities- Link Target
Silent Librarian has used collected lists of names and e-mail accounts to use in password spraying attacks against private sector targets.
MITRE ATT&CK technique: T1110.003: Brute Force- Password Spraying
Silent Librarian has searched victim's websites to identify the interests and academic areas of targeted individuals and to scrape source code, branding, and organizational contact information for phishing pages.
MITRE ATT&CK technique: T1594: Search Victim-Owned Websites
Silent Librarian has used links in e-mails to direct victims to credential harvesting websites designed to appear like the targeted organization's login page.
MITRE ATT&CK technique: T1598.003: Phishing for Information- Spearphishing Link
Silent Librarian has obtained free and publicly available tools including SingleFile and HTTrack to copy login pages of targeted organizations.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Silent Librarian has used compromised credentials to obtain unauthorized access to online accounts.
MITRE ATT&CK technique: T1078: Valid Accounts
SilverTerrier uses FTP for C2 communications.
MITRE ATT&CK technique: T1071.002: Application Layer Protocol- File Transfer Protocols
SilverTerrier targets organizations in high technology, higher education, and manufacturing for business email compromise campaigns with the goal of financial theft.
MITRE ATT&CK technique: T1657: Financial Theft
SilverTerrier uses SMTP for C2 communications.
MITRE ATT&CK technique: T1071.003: Application Layer Protocol- Mail Protocols
SilverTerrier uses HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Sowbug extracted documents and bundled them into a RAR archive.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
Sowbug extracted Word documents from a file server on a victim network.
MITRE ATT&CK technique: T1039: Data from Network Shared Drive
Sowbug identified and extracted all Word documents on a server by using a command containing * .doc and *.docx. The actors also searched for documents based on a specific date range and attempted to identify all installed software on a victim.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Sowbug has used keylogging tools.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Sowbug named its tools to masquerade as Windows or Adobe Reader software, such as by using the file name adobecms.exe and the directory CSIDL_APPDATA\microsoft\security.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Sowbug listed remote shared drives that were accessible from a victim.
MITRE ATT&CK technique: T1135: Network Share Discovery
Sowbug has used credential dumping tools.
MITRE ATT&CK technique: T1003: OS Credential Dumping
Sowbug obtained OS version and hardware configuration from a victim.
MITRE ATT&CK technique: T1082: System Information Discovery
Sowbug has used command line during its intrusions.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Star Blizzard has used HubSpot and MailerLite marketing platform services to hide the true sender of phishing emails.
MITRE ATT&CK technique: T1583: Acquire Infrastructure
Star Blizzard has registered domains using randomized words and with names resembling legitimate organizations.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
Star Blizzard has used compromised email accounts to conduct spearphishing against contacts of the original victim.
MITRE ATT&CK technique: T1586.002: Compromise Accounts- Email Accounts
Star Blizzard has registered impersonation email accounts to spoof experts in a particular field or individuals and organizations affiliated with the intended target.
MITRE ATT&CK technique: T1585.002: Establish Accounts- Email Accounts
Star Blizzard has abused email forwarding rules to monitor the activities of a victim, steal information, and maintain persistent access after compromised credentials are reset.
MITRE ATT&CK technique: T1114.003: Email Collection- Email Forwarding Rule
Star Blizzard has identified ways to engage targets by researching potential victims' interests and social or professional contacts.
MITRE ATT&CK technique: T1589: Gather Victim Identity Information
Star Blizzard has used JavaScript to redirect victim traffic from an adversary controlled server to a server hosting the Evilginx phishing framework.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Star Blizzard has lured targets into opening malicious .pdf files to deliver malware.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Star Blizzard has remotely accessed victims' email accounts to steal messages and attachments.
MITRE ATT&CK technique: T1114.002: Email Collection- Remote Email Collection
Star Blizzard has used open-source research to identify information about victims to use in targeting.
MITRE ATT&CK technique: T1593: Search Open Websites/Domains
Star Blizzard has established fraudulent profiles on professional networking sites to conduct reconnaissance.
MITRE ATT&CK technique: T1585.001: Establish Accounts- Social Media Accounts
Star Blizzard has sent emails with malicious .pdf files to spread malware.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Star Blizzard has sent emails to establish rapport with targets eventually sending messages with attachments containing links to credential-stealing sites.
MITRE ATT&CK technique: T1598.002: Phishing for Information- Spearphishing Attachment
Star Blizzard has sent emails to establish rapport with targets eventually sending messages with links to credential-stealing sites.
MITRE ATT&CK technique: T1598.003: Phishing for Information- Spearphishing Link
Star Blizzard has used EvilGinx to steal the session cookies of victims directed to phishing domains.
MITRE ATT&CK technique: T1539: Steal Web Session Cookie
Star Blizzard has incorporated the open-source EvilGinx framework into their spearphishing activity.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Star Blizzard has uploaded malicious payloads to cloud storage sites.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
Star Blizzard has used stolen credentials to sign into victim email accounts.
MITRE ATT&CK technique: T1078: Valid Accounts
Star Blizzard has bypassed multi-factor authentication on victim email accounts by using session cookies stolen using EvilGinx.
MITRE ATT&CK technique: T1550.004: Use Alternate Authentication Material- Web Session Cookie
Stealth Falcon malware uses WMI to script data collection and command execution on the victim.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
Stealth Falcon malware gathers passwords from multiple sources, including Windows Credential Vault and Outlook.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
Stealth Falcon malware gathers passwords from multiple sources, including Internet Explorer, Firefox, and Chrome.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Stealth Falcon malware gathers data from the local victim system.
MITRE ATT&CK technique: T1005: Data from Local System
After data is collected by Stealth Falcon malware, it is exfiltrated over the existing C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Stealth Falcon malware uses PowerShell commands to perform various functions, including gathering system information via WMI and executing commands from its C2 server.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Stealth Falcon malware gathers a list of running processes.
MITRE ATT&CK technique: T1057: Process Discovery
Stealth Falcon malware attempts to determine the installed version of .NET by querying the Registry.
MITRE ATT&CK technique: T1012: Query Registry
Stealth Falcon malware creates a scheduled task entitled “IE Web Cache” to execute a malicious file hourly.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Stealth Falcon malware encrypts C2 traffic using RC4 with a hard-coded key.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Stealth Falcon malware gathers system information via WMI, including the system directory, build number, serial number, version, manufacturer, model, and total physical memory.
MITRE ATT&CK technique: T1082: System Information Discovery
Stealth Falcon malware gathers the Address Resolution Protocol table from the victim.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Stealth Falcon malware gathers the registered user and primary owner name via WMI.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Stealth Falcon malware communicates with its C2 server via HTTPS.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Stealth Falcon malware gathers passwords from the Windows Credential Vault.
MITRE ATT&CK technique: T1555.004: Credentials from Password Stores- Windows Credential Manager
Stealth Falcon malware gathers system information via Windows Management Instrumentation .
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Strider has used a hidden file system that is stored as a file on disk.
MITRE ATT&CK technique: T1564.005: Hide Artifacts- Hidden File System
Strider has used local servers with both local network and Internet access to act as internal proxy nodes to exfiltrate data from other parts of the network without direct Internet access.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy
Strider has registered its persistence module on domain controllers as a Windows LSA password filter to acquire credentials any time a domain, local user, or administrator logs in or changes a password.
MITRE ATT&CK technique: T1556.002: Modify Authentication Process- Password Filter DLL
Suckfly has used stolen certificates to sign its malware.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Suckfly the victim's internal network for hosts with ports 8080, 5900, and 40 open.
MITRE ATT&CK technique: T1046: Network Service Discovery
Suckfly used a signed credential-dumping tool to obtain victim account credentials.
MITRE ATT&CK technique: T1003: OS Credential Dumping
Suckfly used legitimate account credentials that they dumped to navigate the internal victim network as though they were the legitimate account owner.
MITRE ATT&CK technique: T1078: Valid Accounts
Several tools used by Suckfly have been command-line driven.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
TA2541 has used TLS encrypted C2 communications including for campaigns using AsyncRAT.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
TA2541 has attempted to disable built-in security protections such as Windows AMSI.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
TA2541 has registered domains often containing the keywords “kimjoy,” “h0pe,” and “grace,” using domain registrars including Netdorm and No-IP DDNS, and hosting providers including xTom GmbH and Danilenko, Artyom.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
TA2541 has used dynamic DNS services for C2 infrastructure.
MITRE ATT&CK technique: T1568: Dynamic Resolution
TA2541 has used compressed and char-encoded scripts in operations.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
TA2541 has used malicious scripts and macros with the ability to download additional payloads.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
TA2541 has run scripts to check internet connectivity from compromised hosts.
MITRE ATT&CK technique: T1016.001: System Network Configuration Discovery- Internet Connection Discovery
TA2541 has used macro-enabled MS Word documents to lure victims into executing malicious payloads.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
TA2541 has used malicious links to cloud and web services to gain execution on victim machines.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
TA2541 has used multiple strains of malware available for purchase on criminal forums or in open-source repositories.
MITRE ATT&CK technique: T1588.001: Obtain Capabilities- Malware
TA2541 has used file names to mimic legitimate Windows files or system functionality.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
TA2541 has used `mshta` to execute scripts including VBS.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
TA2541 has used PowerShell to download files and to inject into various Windows processes.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
TA2541 has used process hollowing to execute CyberGate malware.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
TA2541 has injected malicious code into legitimate .NET related processes including regsvcs.exe, msbuild.exe, and installutil.exe.
MITRE ATT&CK technique: T1055: Process Injection
TA2541 has placed VBS files in the Startup folder and used Registry run keys to establish persistence for malicious payloads.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
TA2541 has used scheduled tasks to establish persistence for installed tools.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
TA2541 has used tools to search victim systems for security products such as antivirus and firewall software.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
TA2541 has used a .NET packer to obfuscate malicious files.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
TA2541 has sent phishing emails with malicious attachments for initial access including MS Word documents.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
TA2541 has used spearphishing e-mails with malicious links to deliver malware.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
TA2541 has collected system information prior to downloading malware on the targeted host.
MITRE ATT&CK technique: T1082: System Information Discovery
TA2541 has used commodity remote access tools.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
TA2541 has uploaded malware to various platforms including Google Drive, Pastetext, Sharetext, and GitHub.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
TA2541 has used VBS files to execute or establish persistence for additional payloads, often using file names consistent with email themes or mimicking system functionality.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
TA2541 has hosted malicious files on various platforms including Google Drive, OneDrive, Discord, PasteText, ShareText, and GitHub.
MITRE ATT&CK technique: T1583.006: Acquire Infrastructure- Web Services
TA2541 has used WMI to query targeted systems for security products.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
TA459 has exploited Microsoft Word vulnerability CVE-2017-0199 for execution.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
TA459 has attempted to get victims to open malicious Microsoft Word attachment sent via spearphishing.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
TA459 has used PowerShell for execution of a payload.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
TA459 has targeted victims using spearphishing emails with malicious Microsoft Word attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
TA459 has a VBScript for execution.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
TA505 has signed payloads with code signing certificates from Thawte and Sectigo.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
TA505 has used base64 encoded PowerShell commands.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
TA505 has used malware to gather credentials from FTP clients and Outlook.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
TA505 has used malware to gather credentials from Internet Explorer.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
TA505 has used a wide variety of ransomware, such as Clop, Locky, Jaff, Bart, Philadelphia, and GlobeImposter, to encrypt victim files and demand a ransom payment.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
TA505 has decrypted packed DLLs with an XOR key.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
TA505 has used malware to disable Windows Defender.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
TA505 has used stolen domain admin accounts to compromise additional hosts.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
TA505 has registered domains to impersonate services such as Dropbox to distribute malware.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
TA505 has leveraged malicious Word documents that abused DDE.
MITRE ATT&CK technique: T1559.002: Inter-Process Communication- Dynamic Data Exchange
TA505 has been seen injecting a DLL into winword.exe.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
TA505 has used the tool EmailStealer to steal and send lists of e-mail addresses to a remote server.
MITRE ATT&CK technique: T1087.003: Account Discovery- Email Account
TA505 has password-protected malicious Word documents.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
TA505 has used fast flux to mask botnets by distributing payloads across multiple IPs.
MITRE ATT&CK technique: T1568.001: Dynamic Resolution- Fast Flux DNS
TA505 has downloaded additional malware to execute on victim systems.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
TA505 has used JavaScript for code execution.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
TA505 has used lures to get users to enable content in malicious attachments and execute malicious files contained in archives. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
TA505 has used lures to get users to click links in emails and attachments. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
TA505 has used malware such as Azorult and Cobalt Strike in their operations.
MITRE ATT&CK technique: T1588.001: Obtain Capabilities- Malware
TA505 has used .iso files to deploy malicious .lnk files.
MITRE ATT&CK technique: T1553.005: Subvert Trust Controls- Mark-of-the-Web Bypass
TA505 has used malware to disable Windows Defender through modification of the Registry.
MITRE ATT&CK technique: T1112: Modify Registry
TA505 has used msiexec to download and execute malicious Windows Installer files.
MITRE ATT&CK technique: T1218.007: System Binary Proxy Execution- Msiexec
TA505 has deployed payloads that use Windows API calls on a compromised host.
MITRE ATT&CK technique: T1106: Native API
TA505 has used TinyMet to enumerate members of privileged groups. TA505 has also run net group /domain.
MITRE ATT&CK technique: T1069: Permission Groups Discovery
TA505 has used PowerShell to download and execute malware and reconnaissance scripts.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
TA505 has leveraged rundll32.exe to execute malicious DLLs.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
TA505 has used UPX to obscure malicious code.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
TA505 has used spearphishing emails with malicious attachments to initially compromise victims.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
TA505 has sent spearphishing emails containing malicious links.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
TA505 has used a variety of tools in their operations, including AdFind, BloodHound, Mimikatz, and PowerSploit.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
TA505 has staged malware on actor-controlled domains.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
TA505 has used VBS for code execution.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
TA505 has used HTTP to communicate with C2 nodes.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
TA505 has executed commands using cmd.exe.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
TA551 has used obfuscated variable names in a JavaScript configuration file.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
TA551 has used a DGA to generate URLs from executed macros.
MITRE ATT&CK technique: T1568.002: Dynamic Resolution- Domain Generation Algorithms
TA551 has used spoofed company emails that were acquired from email clients on previously infected hosts to target other individuals.
MITRE ATT&CK technique: T1589.002: Gather Victim Identity Information- Email Addresses
TA551 has retrieved DLLs and installer binaries for malware execution from C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
TA551 has prompted users to enable macros within spearphishing attachments to install malware.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
TA551 has masked malware DLLs as dat and jpg files.
MITRE ATT&CK technique: T1036: Masquerading
TA551 has used mshta.exe to execute malicious payloads.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
TA551 has used regsvr32.exe to load malicious DLLs.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
TA551 has used rundll32.exe to load malicious DLLs.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
TA551 has sent spearphishing attachments with password protected ZIP files.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
TA551 has used encoded ASCII text for initial C2 communications.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
TA551 has hidden encoded data for malware DLLs in a PNG.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
TA551 has used HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
TA551 has used cmd.exe to execute commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
TA577 has sent thread hijacked messages from compromised emails.
MITRE ATT&CK technique: T1586.002: Compromise Accounts- Email Accounts
TA577 has used LNK files to execute embedded DLLs.
MITRE ATT&CK technique: T1027.009: Obfuscated Files or Information- Embedded Payloads
TA577 has used JavaScript to execute additional malicious payloads.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
TA577 has lured users into executing malicious JavaScript files by sending malicious links via email.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
TA577 has sent emails containing links to malicious JavaScript files.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
TA577 has used BAT files in malware execution chains.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
TA578 has used JavaScript files in malware execution chains.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
TA578 has placed malicious links in contact forms on victim sites, often spoofing a copyright complaint, to redirect users to malicious file downloads.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
TA578 has filled out contact forms on victims' websites to direct them to adversary-controlled URLs.
MITRE ATT&CK technique: T1594: Search Victim-Owned Websites
TA578 has used Google Firebase to host malicious scripts.
MITRE ATT&CK technique: T1583.006: Acquire Infrastructure- Web Services
TeamTNT has used an IRC bot for C2 communications.
MITRE ATT&CK technique: T1071: Application Layer Protocol
TeamTNT has cleared command history with history -c.
MITRE ATT&CK technique: T1070.003: Indicator Removal- Clear Command History
TeamTNT has removed system logs from /var/log/syslog.
MITRE ATT&CK technique: T1070.002: Indicator Removal- Clear Linux or Mac System Logs
TeamTNT has leveraged AWS CLI to enumerate cloud environments with compromised credentials.
MITRE ATT&CK technique: T1059.009: Command and Scripting Interpreter- Cloud API
TeamTNT has queried the AWS instance metadata service for credentials.
MITRE ATT&CK technique: T1552.005: Unsecured Credentials- Cloud Instance Metadata API
TeamTNT has deployed XMRig Docker images to mine cryptocurrency. TeamTNT has also infected Docker containers and Kubernetes clusters with XMRig, and used RainbowMiner and lolMiner for mining cryptocurrency.
MITRE ATT&CK technique: T1496.001: Resource Hijacking- Compute Hijacking
TeamTNT executed Hildegard through the kubelet API run command and by executing commands on running containers.
MITRE ATT&CK technique: T1609: Container Administration Command
TeamTNT has checked for running containers with docker ps and for specific container names with docker inspect. TeamTNT has also searched for Kubernetes pods running in a local network.
MITRE ATT&CK technique: T1613: Container and Resource Discovery
TeamTNT has searched for unsecured AWS credentials and Docker API credentials.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
TeamTNT has used a script that decodes a Base64-encoded version of WeaveWorks Scope.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
TeamTNT has deployed different types of containers into victim environments to facilitate execution. TeamTNT has also transferred cryptocurrency mining software to Kubernetes clusters discovered within local IP address ranges.
MITRE ATT&CK technique: T1610: Deploy Container
TeamTNT has disabled iptables.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
TeamTNT has disabled and uninstalled security tools such as Alibaba, Tencent, and BMC cloud monitoring agents on cloud-based infrastructure.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
TeamTNT has obtained domains to host their payloads.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
TeamTNT has encrypted its binaries via AES and encoded files using Base64.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
TeamTNT has deployed privileged containers that mount the filesystem of victim machine.
MITRE ATT&CK technique: T1611: Escape to Host
TeamTNT has sent locally staged files with collected credentials to C2 servers using cURL.
MITRE ATT&CK technique: T1048: Exfiltration Over Alternative Protocol
TeamTNT has used open-source tools such as Weave Scope to target exposed Docker API ports and gain initial access to victim environments. TeamTNT has also targeted exposed kubelets for Kubernetes environments.
MITRE ATT&CK technique: T1133: External Remote Services
TeamTNT has used a payload that removes itself after running. TeamTNT also has deleted locally staged files for collecting credentials or scan results for local IP addresses after exfiltrating them.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
TeamTNT has used a script that checks `/proc/*/environ` for environment variables related to AWS.
MITRE ATT&CK technique: T1083: File and Directory Discovery
TeamTNT has the curl and wget commands as well as batch scripts to download new tools.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
TeamTNT has modified the permissions on binaries with chattr.
MITRE ATT&CK technique: T1222.002: File and Directory Permissions Modification- Linux and Mac File and Directory Permissions Modification
TeamTNT has created local privileged users on victim machines.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
TeamTNT has aggregated collected credentials in text files before exfiltrating.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
TeamTNT has relied on users to download and execute malicious Docker images.
MITRE ATT&CK technique: T1204.003: User Execution- Malicious Image
TeamTNT has developed custom malware such as Hildegard.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
TeamTNT has disguised their scripts with docker-related file names.
MITRE ATT&CK technique: T1036: Masquerading
TeamTNT has replaced .dockerd and .dockerenv with their own scripts and cryptocurrency mining software.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
TeamTNT has used masscan to search for open Docker API ports and Kubernetes clusters. TeamTNT has also used malware that utilizes zmap and zgrab to search for vulnerable services in cloud environments.
MITRE ATT&CK technique: T1046: Network Service Discovery
TeamTNT has searched for attached VGA devices using lspci.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
TeamTNT has executed PowerShell commands in batch scripts.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell