sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Hancitor has added Registry Run keys to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Hancitor has been delivered via phishing emails with malicious attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Hancitor has been delivered via phishing emails which contained malicious links.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Hancitor has used verclsid.exe to download and execute a malicious script.
MITRE ATT&CK technique: T1218.012: System Binary Proxy Execution- Verclsid
Hancitor has used a macro to check that an ActiveDocument shape object in the lure message is present. If this object is not found, the macro will exit without downloading additional payloads.
MITRE ATT&CK technique: T1497: Virtualization/Sandbox Evasion
Havij is used to automate SQL injection.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
A Helminth VBScript receives a batch script to execute a set of commands in a command prompt.
MITRE ATT&CK technique: T1119: Automated Collection
The executable version of Helminth has a module to log clipboard contents.
MITRE ATT&CK technique: T1115: Clipboard Data
Helminth samples have been signed with legitimate, compromised code signing certificates owned by software company AI Squared.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Helminth can use DNS for C2.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Helminth splits data into chunks up to 23 bytes and sends the data in DNS queries to its C2 server.
MITRE ATT&CK technique: T1030: Data Transfer Size Limits
Helminth has checked for the domain admin group and Exchange Trusted Subsystem groups using the commands net group Exchange Trusted Subsystem /domain and net group domain admins /domain.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
The Helminth config file is encrypted with RC4.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Helminth can download additional files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
The executable version of Helminth has a module to log keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Helminth creates folders to store output from batch scripts prior to sending the information to its C2 server.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Helminth has checked the local administrators group.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
One version of Helminth uses a PowerShell script.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Helminth has used Tasklist to get information on processes.
MITRE ATT&CK technique: T1057: Process Discovery
Helminth establishes persistence by creating a shortcut in the Start Menu folder.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Helminth has used a scheduled task for persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Helminth establishes persistence by creating a shortcut.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
For C2 over HTTP, Helminth encodes data with base64 and sends it via the "Cookie" field of HTTP requests. For C2 over DNS, Helminth converts ASCII characters into their hexadecimal values and sends the data in cleartext.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Helminth encrypts data sent to its C2 server over HTTP with RC4.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
One version of Helminth consists of VBScript scripts.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Helminth can use HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Helminth can provide a remote shell. One version of Helminth uses batch scripting.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
HermeticWiper can use `AdjustTokenPrivileges` to grant itself privileges for debugging with `SeDebugPrivilege`, creating backups with `SeBackupPrivilege`, loading drivers with `SeLoadDriverPrivilege`, and shutting down a local system with `SeShutdownPrivilege`.
MITRE ATT&CK technique: T1134: Access Token Manipulation
HermeticWiper can overwrite the `C:\Windows\System32\winevt\Logs` file on a targeted system.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
The HermeticWiper executable has been signed with a legitimate certificate issued to Hermetica Digital Ltd.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
HermeticWiper can recursively wipe folders and files in `Windows`, `Program Files`, `Program Files`, `PerfLogs`, `Boot, System`, `Volume Information`, and `AppData` folders using `FSCTL_MOVE_FILE`. HermeticWiper can also overwrite symbolic links and big files in `My Documents` and on the Desktop with random bytes.
MITRE ATT&CK technique: T1485: Data Destruction
HermeticWiper can decompress and copy driver files using `LZCopy`.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
HermeticWiper has the ability to corrupt disk partitions and obtain raw disk access to destroy data.
MITRE ATT&CK technique: T1561.001: Disk Wipe- Disk Content Wipe
HermeticWiper has the ability to corrupt disk partitions, damage the Master Boot Record , and overwrite the Master File Table of all available physical drives.
MITRE ATT&CK technique: T1561.002: Disk Wipe- Disk Structure Wipe
HermeticWiper can compress 32-bit and 64-bit driver files with the Lempel-Ziv algorithm.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
HermeticWiper has the ability to overwrite its own file with random bites.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
HermeticWiper can enumerate common folders such as My Documents, Desktop, and AppData.
MITRE ATT&CK technique: T1083: File and Directory Discovery
HermeticWiper has the ability to deploy through an infected system's default domain policy.
MITRE ATT&CK technique: T1484.001: Domain or Tenant Policy Modification- Group Policy Modification
HermeticWiper has the ability to set the `HKLM:\SYSTEM\\CurrentControlSet\\Control\\CrashControl\CrashDumpEnabled` Registry key to `0` in order to disable crash dumps.
MITRE ATT&CK technique: T1562.006: Impair Defenses- Indicator Blocking
HermeticWiper can disable pop-up information about folders and desktop items and delete Registry keys to hide malicious services.
MITRE ATT&CK technique: T1070: Indicator Removal
HermeticWiper can disable the VSS service on a compromised host using the service control manager.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
HermeticWiper has used the name `postgressql.exe` to mask a malicious payload.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
HermeticWiper has the ability to modify Registry keys to disable crash dumps, colors for compressed files, and pop-up information about folders and desktop items.
MITRE ATT&CK technique: T1112: Modify Registry
HermeticWiper can call multiple Windows API functions used for privilege escalation, service execution, and to overwrite random bites of data.
MITRE ATT&CK technique: T1106: Native API
HermeticWiper has the ability to use scheduled tasks for execution.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
HermeticWiper can create system services to aid in executing the payload.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
HermeticWiper has the ability to stop the Volume Shadow Copy service.
MITRE ATT&CK technique: T1489: Service Stop
HermeticWiper can determine the OS version, bitness, and enumerate physical drives on a targeted host.
MITRE ATT&CK technique: T1082: System Information Discovery
HermeticWiper can initiate a system shutdown.
MITRE ATT&CK technique: T1529: System Shutdown/Reboot
HermeticWiper has the ability to receive a command parameter to sleep prior to carrying out destructive actions on a targeted host.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
HermeticWiper can use `cmd.exe /Q/c move CSIDL_SYSTEM_DRIVE\temp\sys.tmp1 CSIDL_WINDOWS\policydefinitions\postgresql.exe 1> \\127.0.0.1\ADMIN$\_1636727589.6007507 2>&1` to deploy on an infected system.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
HermeticWiper can load drivers by creating a new service using the `CreateServiceW` API.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
HermeticWizard has the ability to use `wevtutil cl system` to clear event logs.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
HermeticWizard has been signed by valid certificates assigned to Hermetica Digital.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
HermeticWizard can execute files on remote machines using DCOM.
MITRE ATT&CK technique: T1559.001: Inter-Process Communication- Component Object Model
HermeticWizard has the ability to encrypt PE files with a reverse XOR loop.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
HermeticWizard can copy files to other machines on a compromised network.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
HermeticWizard has been named `exec_32.dll` to mimic a legitimate MS Outlook .dll.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
HermeticWizard can connect to remote shares using `WNetAddConnection2W`.
MITRE ATT&CK technique: T1106: Native API
HermeticWizard has the ability to scan ports on a compromised network.
MITRE ATT&CK technique: T1046: Network Service Discovery
HermeticWizard can use a list of hardcoded credentials in attempt to authenticate to SMB shares.
MITRE ATT&CK technique: T1110.001: Brute Force- Password Guessing
HermeticWizard has used `regsvr32.exe /s /i` to execute malicious payloads.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
HermeticWizard can find machines on the local network by gathering known local IP addresses through `DNSGetCacheDataTable`, `GetIpNetTable`,`WNetOpenEnumW`,`NetServerEnum`,`GetTcpTable`, and `GetAdaptersAddresses.`
MITRE ATT&CK technique: T1018: Remote System Discovery
HermeticWizard has the ability to create a new process using `rundll32`.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
HermeticWizard can use a list of hardcoded credentials to to authenticate via NTLMSSP to the SMB shares on remote systems.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
HermeticWizard can use `OpenRemoteServiceManager` to create a service.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
HermeticWizard can use `cmd.exe` for execution on compromised hosts.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
HermeticWizard can use WMI to create a new process on a remote machine via `C:\windows\system32\cmd.exe /c start C:\windows\system32\\regsvr32.exe /s /iC:\windows\.dll`.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Heyoka Backdoor can use DNS tunneling for C2 communications.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Heyoka Backdoor can decrypt its payload prior to execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Heyoka Backdoor can inject a DLL into rundll32.exe for execution.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Heyoka Backdoor can encrypt its payload.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Heyoka Backdoor has the ability to delete folders and files from a targeted system.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Heyoka Backdoor has the ability to search the compromised host for files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Heyoka Backdoor has been spread through malicious document lures.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Heyoka Backdoor has been named `srvdll.dll` to appear as a legitimate service.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Heyoka Backdoor can identify removable media attached to victim's machines.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
Heyoka Backdoor can gather process information.
MITRE ATT&CK technique: T1057: Process Discovery
Heyoka Backdoor can use spoofed DNS requests to create a bidirectional tunnel between a compromised host and its C2 servers.
MITRE ATT&CK technique: T1572: Protocol Tunneling
Heyoka Backdoor can establish persistence with the auto start function including using the value `EverNoteTrayUService`.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Heyoka Backdoor can use rundll32.exe to gain execution.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Heyoka Backdoor can enumerate drives on a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
Heyoka Backdoor can check if it is running as a service on a compromised host.
MITRE ATT&CK technique: T1007: System Service Discovery
Hi-Zor encrypts C2 traffic with TLS.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Hi-Zor uses various XOR techniques to obfuscate its components.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Hi-Zor deletes its RAT installer file as it executes its DLL payload file.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Hi-Zor has the ability to upload and download files from its C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Hi-Zor creates a Registry Run key to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Hi-Zor executes using regsvr32.exe called from the Registry Run Keys / Startup Folder persistence mechanism.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
Hi-Zor encrypts C2 traffic with a double XOR using two distinct single-byte keys.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Hi-Zor communicates with its C2 server over HTTPS.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Hi-Zor has the ability to create a reverse shell.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
HiddenWasp uses a cipher to implement a decoding function.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
HiddenWasp adds itself as a shared object to the LD_PRELOAD environment variable.
MITRE ATT&CK technique: T1574.006: Hijack Execution Flow- Dynamic Linker Hijacking
HiddenWasp encrypts its configuration and payload.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
HiddenWasp downloads a tar compressed archive from a download server to the system.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
HiddenWasp creates a user account as a means to provide initial persistence to the compromised machine.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
HiddenWasp communicates with a simple network protocol over TCP.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
HiddenWasp installs reboot persistence by adding itself to /etc/rc.local.
MITRE ATT&CK technique: T1037.004: Boot or Logon Initialization Scripts- RC Scripts
HiddenWasp uses a rootkit to hook and implement functions on the system.
MITRE ATT&CK technique: T1014: Rootkit
HiddenWasp uses an RC4-like algorithm with an already computed PRGA generated key-stream for network communication.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
HiddenWasp uses a script to automate tasks on the victim's machine and to assist in execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Hikit has attempted to disable driver signing verification by tampering with several Registry keys prior to the loading of a rootkit driver component.
MITRE ATT&CK technique: T1553.006: Subvert Trust Controls- Code Signing Policy Modification
Hikit has used DLL Search Order Hijacking to load oci.dll as a persistence mechanism.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
Hikit can upload files from compromised machines.
MITRE ATT&CK technique: T1005: Data from Local System
Hikit has the ability to download files to a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Hikit installs a self-generated certificate to the local trust store as a root CA and Trusted Publisher.
MITRE ATT&CK technique: T1553.004: Subvert Trust Controls- Install Root Certificate
Hikit supports peer connections.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy
Hikit has been spread through spear phishing.
MITRE ATT&CK technique: T1566: Phishing
Hikit is a Rootkit that has been used by Axiom.
MITRE ATT&CK technique: T1014: Rootkit
Hikit performs XOR encryption.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Hikit has used HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Hikit has the ability to create a remote shell and run given commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Hildegard has used an IRC channel for C2 communications.
MITRE ATT&CK technique: T1071: Application Layer Protocol
Hildegard has used history -c to clear script shell logs.
MITRE ATT&CK technique: T1070.003: Indicator Removal- Clear Command History
Hildegard has queried the Cloud Instance Metadata API for cloud credentials.
MITRE ATT&CK technique: T1552.005: Unsecured Credentials- Cloud Instance Metadata API
Hildegard has used xmrig to mine cryptocurrency.
MITRE ATT&CK technique: T1496.001: Resource Hijacking- Compute Hijacking
Hildegard was executed through the kubelet API run command and by executing commands on running containers.
MITRE ATT&CK technique: T1609: Container Administration Command
Hildegard has used masscan to search for kubelets and the kubelet API for additional running containers.
MITRE ATT&CK technique: T1613: Container and Resource Discovery
Hildegard has searched for SSH keys, Docker credentials, and Kubernetes service tokens.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
Hildegard has decrypted ELF files with AES.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Hildegard has modified DNS resolvers to evade DNS monitoring tools.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Hildegard has modified /etc/ld.so.preload to intercept shared library import functions.
MITRE ATT&CK technique: T1574.006: Hijack Execution Flow- Dynamic Linker Hijacking
Hildegard has encrypted an ELF file.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Hildegard has used the BOtB tool that can break out of containers.
MITRE ATT&CK technique: T1611: Escape to Host
Hildegard has used the BOtB tool which exploits CVE-2019-5736.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
Hildegard was executed through an unsecure kubelet that allowed anonymous access to the victim environment.
MITRE ATT&CK technique: T1133: External Remote Services
Hildegard has deleted scripts after execution.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Hildegard has downloaded additional scripts that build and run Monero cryptocurrency miners.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Hildegard has created a user named “monerodaemon”.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
Hildegard has disguised itself as a known Linux process.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Hildegard has used masscan to look for kubelets in the internal Kubernetes network.
MITRE ATT&CK technique: T1046: Network Service Discovery
Hildegard has searched for private keys in .ssh.
MITRE ATT&CK technique: T1552.004: Unsecured Credentials- Private Keys
Hildegard has established tmate sessions for C2 communications.
MITRE ATT&CK technique: T1219: Remote Access Software
Hildegard has modified /etc/ld.so.preload to overwrite readdir and readdir64.
MITRE ATT&CK technique: T1014: Rootkit
Hildegard has packed ELF files into other binaries.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Hildegard has collected the host's OS, CPU, and memory information.
MITRE ATT&CK technique: T1082: System Information Discovery
Hildegard has started a monero service.
MITRE ATT&CK technique: T1543.002: Create or Modify System Process- Systemd Service
Hildegard has used shell scripts for execution.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
Hildegard has downloaded scripts from GitHub.
MITRE ATT&CK technique: T1102: Web Service
HotCroissant has the ability to list the names of all open windows on the infected host.
MITRE ATT&CK technique: T1010: Application Window Discovery
HotCroissant has encrypted strings with single-byte XOR and base64 encoded RC4.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
HotCroissant has the ability to download files from the infected host to the command and control server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
HotCroissant has the ability to clean up installed files, delete files, and delete itself from the victim’s machine.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
HotCroissant has the ability to retrieve a list of files in a given directory as well as drives and drive types.
MITRE ATT&CK technique: T1083: File and Directory Discovery
HotCroissant has the ability to hide the window for operations performed on a given file.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
HotCroissant has the ability to upload a file from the command and control server to the victim machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
HotCroissant can perform dynamic DLL importing and API lookups using LoadLibrary and GetProcAddress on obfuscated strings.
MITRE ATT&CK technique: T1106: Native API
HotCroissant has the ability to list running processes on the infected host.
MITRE ATT&CK technique: T1057: Process Discovery
HotCroissant has attempted to install a scheduled task named “Java Maintenance64” on startup to establish persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
HotCroissant has the ability to do real time screen viewing on an infected host.
MITRE ATT&CK technique: T1113: Screen Capture
HotCroissant has the ability to stop services on the infected host.
MITRE ATT&CK technique: T1489: Service Stop
HotCroissant can retrieve a list of applications from the SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths registry key.
MITRE ATT&CK technique: T1518: Software Discovery
HotCroissant has used the open source UPX executable packer.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
HotCroissant has compressed network communications and encrypted them with a custom stream cipher.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
HotCroissant has the ability to determine if the current user is an administrator, Windows product name, processor name, screen resolution, and physical RAM of the infected host.
MITRE ATT&CK technique: T1082: System Information Discovery
HotCroissant has the ability to identify the IP address of the compromised machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
HotCroissant has the ability to collect the username on the infected host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
HotCroissant has the ability to retrieve a list of services on the infected host.
MITRE ATT&CK technique: T1007: System Service Discovery
HotCroissant can remotely open applications on the infected host with the ShellExecuteA command.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Hydraq creates a backdoor through which remote attackers can adjust token privileges.
MITRE ATT&CK technique: T1134: Access Token Manipulation
Hydraq creates a backdoor through which remote attackers can clear all system event logs.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
Hydraq creates a backdoor through which remote attackers can read data from files.
MITRE ATT&CK technique: T1005: Data from Local System
Hydraq connects to a predefined domain on port 443 to exfil gathered information.
MITRE ATT&CK technique: T1048: Exfiltration Over Alternative Protocol
Hydraq creates a backdoor through which remote attackers can delete files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Hydraq creates a backdoor through which remote attackers can check for the existence of files, including its own components, as well as retrieve a list of logical drives.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Hydraq creates a backdoor through which remote attackers can download files and additional malware components.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Hydraq creates a Registry subkey to register its created service, and can also uninstall itself later by deleting this value. Hydraq's backdoor also enables remote attackers to modify and delete subkeys.
MITRE ATT&CK technique: T1112: Modify Registry
Hydraq uses basic obfuscation in the form of spaghetti code.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Hydraq creates a backdoor through which remote attackers can monitor processes.
MITRE ATT&CK technique: T1057: Process Discovery
Hydraq creates a backdoor through which remote attackers can retrieve system information, such as CPU speed, from Registry keys.
MITRE ATT&CK technique: T1012: Query Registry
Hydraq includes a component based on the code of VNC that can stream a live feed of the desktop of an infected host.
MITRE ATT&CK technique: T1113: Screen Capture
Hydraq uses svchost.exe to execute a malicious DLL included in a new service group.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Hydraq creates a backdoor through which remote attackers can load and call DLL functions.
MITRE ATT&CK technique: T1129: Shared Modules
Hydraq C2 traffic is encrypted using bitwise NOT and XOR operations.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Hydraq creates a backdoor through which remote attackers can retrieve information such as computer name, OS version, processor speed, memory size, and CPU speed.
MITRE ATT&CK technique: T1082: System Information Discovery
Hydraq creates a backdoor through which remote attackers can retrieve IP addresses of compromised machines.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Hydraq creates a backdoor through which remote attackers can monitor services.
MITRE ATT&CK technique: T1007: System Service Discovery
Hydraq creates new services to establish persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
HyperBro has used a legitimate application to sideload a DLL to decrypt, decompress, and run a payload.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
HyperBro can unpack and decrypt its payload prior to execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
HyperBro can be delivered encrypted to a compromised host.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
HyperBro has the ability to delete a specified file.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
HyperBro has the ability to download additional files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
HyperBro has the ability to run an application or script/file via API.
MITRE ATT&CK technique: T1106: Native API
HyperBro can run shellcode it injects into a newly created process.
MITRE ATT&CK technique: T1055: Process Injection
HyperBro has the ability to take screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
HyperBro has the ability to start and stop a specified service.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
HyperBro has the ability to pack its payload.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
HyperBro can list all services and their configurations.
MITRE ATT&CK technique: T1007: System Service Discovery
HyperBro has used HTTPS for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
HyperStack can use default credentials to connect to IPC$ shares on remote machines.
MITRE ATT&CK technique: T1078.001: Valid Accounts- Default Accounts
HyperStack can connect to the IPC$ share on remote machines.
MITRE ATT&CK technique: T1559: Inter-Process Communication
HyperStack can enumerate all account names on a remote share.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
HyperStack can add the name of its communication pipe to HKLM\SYSTEM\\CurrentControlSet\\Services\\lanmanserver\\parameters\NullSessionPipes.
MITRE ATT&CK technique: T1112: Modify Registry
HyperStack can use Windows API's ConnectNamedPipe and WNetAddConnection2 to detect incoming connections and connect to remote shares.
MITRE ATT&CK technique: T1106: Native API
HyperStack has used RSA encryption for C2 communications.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
IMAPLoader is executed via the AppDomainManager injection technique.
MITRE ATT&CK technique: T1574.014: Hijack Execution Flow- AppDomainManager
IMAPLoader modifies Windows tasks on the victim machine to reference a retrieved PE file through a path modification.
MITRE ATT&CK technique: T1543: Create or Modify System Process
IMAPLoader hides the Windows Console window created by its execution by directly importing the `kernel32.dll` and `user32.dll` libraries `GetConsoleWindow` and `ShowWindow` APIs.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
IMAPLoader is a loader used to retrieve follow-on payload encoded in email messages for execution on victim systems.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
IMAPLoader uses the IMAP email protocol for command and control purposes.
MITRE ATT&CK technique: T1071.003: Application Layer Protocol- Mail Protocols
IMAPLoader imports native Windows APIs such as `GetConsoleWindow` and `ShowWindow`.
MITRE ATT&CK technique: T1106: Native API
IMAPLoader creates scheduled tasks for persistence based on the operating system version of the victim machine.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
IMAPLoader uses WMI queries to gather information about the victim machine.
MITRE ATT&CK technique: T1082: System Information Discovery
IMAPLoader uses WMI queries to query system information on victim hosts.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
INC Ransomware can encrypt data on victim systems, including through the use of partial encryption and multi-threading to speed encryption.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
INC Ransomware can run `CryptStringToBinaryA` to decrypt base64 content containing its ransom note.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
INC Ransomware can verify the presence of specific drivers on compromised hosts including Microsoft Print to PDF and Microsoft XPS Document Writer.
MITRE ATT&CK technique: T1652: Device Driver Discovery
INC Ransomware can receive command line arguments to encrypt specific files and directories.
MITRE ATT&CK technique: T1083: File and Directory Discovery
INC Ransomware can delete volume shadow copy backups from victim machines.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
INC Ransomware has the ability to change the background wallpaper image to display the ransom note.
MITRE ATT&CK technique: T1491.001: Defacement- Internal Defacement
INC Ransomware can push its encryption executable to multiple endpoints within compromised infrastructure.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
INC Ransomware can use the API `DeviceIoControl` to resize the allocated space for and cause the deletion of volume shadow copy snapshots.
MITRE ATT&CK technique: T1106: Native API
INC Ransomware has the ability to check for shared network drives to encrypt.
MITRE ATT&CK technique: T1135: Network Share Discovery
INC Ransomware can identify external USB and hard drives for encryption and printers to print ransom notes.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
INC Ransomware campaigns have used spearphishing emails for initial access.
MITRE ATT&CK technique: T1566: Phishing
INC Ransomware can use the Microsoft Win32 Restart Manager to kill processes with a specific handle or that are accessing resources it wants to encrypt.
MITRE ATT&CK technique: T1057: Process Discovery
INC Ransomware can issue a command to kill a process on compromised hosts.
MITRE ATT&CK technique: T1489: Service Stop
INC Ransomware can discover and mount hidden drives to encrypt them.
MITRE ATT&CK technique: T1082: System Information Discovery
INC Ransomware has the ability to use wmic.exe to spread to multiple endpoints within a compromised environment.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
IPsec Helper can delete various service traces related to persistent execution when commanded.
MITRE ATT&CK technique: T1070.009: Indicator Removal- Clear Persistence
IPsec Helper can identify specific files and folders for follow-on exfiltration.
MITRE ATT&CK technique: T1005: Data from Local System
IPsec Helper contains an embedded XML configuration file with an encrypted list of command and control servers. These are written to an external configuration file during execution.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
IPsec Helper exfiltrates specific files through its command and control framework.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
IPsec Helper can delete itself when given the appropriate command.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
IPsec Helper can delete various registry keys related to its execution and use.
MITRE ATT&CK technique: T1070: Indicator Removal
IPsec Helper can download additional payloads from command and control nodes and execute them.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
IPsec Helper can make arbitrary changes to registry keys based on provided input.
MITRE ATT&CK technique: T1112: Modify Registry
IPsec Helper can run arbitrary PowerShell commands passed to it.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
IPsec Helper can identify the process it is currently running under and its number, and pass this back to a command and control node.
MITRE ATT&CK technique: T1057: Process Discovery
IPsec Helper is run as a Windows service in victim environments.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
IPsec Helper will sleep for a random number of seconds, iterating 200 times over sleeps between one to three seconds, before continuing execution flow.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
IPsec Helper can run arbitrary Visual Basic scripts and commands passed to it.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
IPsec Helper connects to command and control servers via HTTP POST requests based on parameters hard-coded into the malware.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
IPsec Helper can run arbitrary commands passed to it through cmd.exe.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
ISMInjector uses the certutil command to decode a payload file.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
ISMInjector is obfuscated with the off-the-shelf SmartAssembly .NET obfuscator created by red-gate.com.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
ISMInjector hollows out a newly created process RegASM.exe and injects its payload into the hollowed process.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
ISMInjector creates scheduled tasks to establish persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
IceApple can encrypt and compress files using Gzip prior to exfiltration.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
IceApple can use Base64 and "junk" JavaScript code to obfuscate information.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
IceApple can harvest credentials from local and remote host registries.
MITRE ATT&CK technique: T1552.002: Unsecured Credentials- Credentials in Registry
IceApple can collect files, passwords, and other data from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
IceApple can use a Base64-encoded AES key to decrypt tasking.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
The IceApple Active Directory Querier module can perform authenticated requests against an Active Directory server.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
IceApple's Multi File Exfiltrator module can exfiltrate multiple files from a compromised host as an HTTP response over C2.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
IceApple can delete files and directories from targeted systems.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
The IceApple Directory Lister module can list information about files and directories including creation time, last write time, name, and size.
MITRE ATT&CK technique: T1083: File and Directory Discovery
IceApple is an IIS post-exploitation framework, consisting of 18 modules that provide several functionalities.
MITRE ATT&CK technique: T1505.004: Server Software Component- IIS Components
IceApple's Credential Dumper module can dump LSA secrets from registry keys, including: `HKLM\SECURITY\Policy\PolEKList\default`, `HKLM\SECURITY\Policy\Secrets\*\CurrVal`, and `HKLM\SECURITY\Policy\Secrets\*\OldVal`.
MITRE ATT&CK technique: T1003.004: OS Credential Dumping- LSA Secrets
IceApple .NET assemblies have used `App_Web_` in their file names to appear legitimate.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
IceApple can use reflective code loading to load .NET assemblies into `MSExchangeOWAAppPool` on targeted Exchange servers.
MITRE ATT&CK technique: T1620: Reflective Code Loading
IceApple's Credential Dumper module can dump encrypted password hashes from SAM registry keys, including `HKLM\SAM\SAM\Domains\Account\F` and `HKLM\SAM\SAM\Domains\Account\Users\*\V`.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
The IceApple Result Retriever module can AES encrypt C2 responses.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
The IceApple Server Variable Dumper module iterates over all server variables present for the current request and returns them to the adversary.
MITRE ATT&CK technique: T1082: System Information Discovery
The IceApple ifconfig module can iterate over all network interfaces on the host and retrieve the name, description, MAC address, DNS suffix, DNS servers, gateways, IPv4 addresses, and subnet masks.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
The IceApple OWA credential logger can monitor for OWA authentication requests and log the credentials.
MITRE ATT&CK technique: T1056.003: Input Capture- Web Portal Capture
IceApple can use HTTP GET to request and pull information from C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
IcedID has used SSL and TLS in communications with C2.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
IcedID has used ZwQueueApcThread to inject itself into remote processes.
MITRE ATT&CK technique: T1055.004: Process Injection- Asynchronous Procedure Call
IcedID has used web injection attacks to redirect victims to spoofed sites designed to harvest banking and other credentials. IcedID can use a self signed TLS certificate in connection with the spoofed site and simultaneously maintains a live connection with the legitimate site to display the correct URL and certificates in the browser.
MITRE ATT&CK technique: T1185: Browser Session Hijacking
IcedID can query LDAP and can use built-in `net` commands to identify additional users on the network to infect.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
IcedID used Nltest during initial discovery.
MITRE ATT&CK technique: T1482: Domain Trust Discovery
IcedID has cloned legitimate websites/applications to distribute the malware.
MITRE ATT&CK technique: T1189: Drive-by Compromise
IcedID has embedded malicious functionality in a legitimate DLL file.
MITRE ATT&CK technique: T1027.009: Obfuscated Files or Information- Embedded Payloads
IcedID has utilzed encrypted binaries and base64 encoded strings.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
IcedID has exfiltrated collected data via HTTPS.
MITRE ATT&CK technique: T1048.002: Exfiltration Over Alternative Protocol- Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
IcedID has the ability to download additional modules and a configuration file from C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
IcedID has been executed through Word and Excel files with malicious embedded macros and through ISO and LNK files that execute the malicious DLL.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
IcedID has modified legitimate .dll files to include malicious code.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
IcedID can inject itself into a suspended msiexec.exe process to send beacons to C2 while appearing as a normal msi application. IcedID has also used msiexec.exe to deploy the IcedID loader.
MITRE ATT&CK technique: T1218.007: System Binary Proxy Execution- Msiexec
IcedID has called ZwWriteVirtualMemory, ZwProtectVirtualMemory, ZwQueueApcThread, and NtResumeThread to inject itself into a remote process.
MITRE ATT&CK technique: T1106: Native API
IcedID has used the `net view /all` command to show available shares.
MITRE ATT&CK technique: T1135: Network Share Discovery
IcedID has the ability to identify Workgroup membership.
MITRE ATT&CK technique: T1069: Permission Groups Discovery
IcedID can inject a Cobalt Strike beacon into cmd.exe via process hallowing.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
IcedID has established persistence by creating a Registry run key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
IcedID has used rundll32.exe to execute the IcedID loader.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
IcedID has created a scheduled task to establish persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
IcedID can identify AV products on an infected host using the following command: ` WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get * /Format:List`.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
IcedID has packed and encrypted its loader module.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
IcedID has been delivered via phishing e-mails with malicious attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
IcedID has embedded binaries within RC4 encrypted .png files.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
IcedID has the ability to identify the computer name and OS version on a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
IcedID used the following command to check the country/language of the active console: ` cmd.exe /c chcp >&2`.
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
IcedID used the `ipconfig /all` command and a batch script to gather network information.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
IcedID has manipulated Keitaro Traffic Direction System to filter researcher and sandbox traffic.
MITRE ATT&CK technique: T1497: Virtualization/Sandbox Evasion
IcedID has used obfuscated VBA string expressions.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
IcedID has used HTTPS in communications with C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
IcedID has used WMI to execute binaries.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Imminent Monitor has a remote microphone monitoring capability.
MITRE ATT&CK technique: T1123: Audio Capture
Imminent Monitor has a CommandPromptPacket and ScriptPacket module for creating a remote shell and executing scripts.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
Imminent Monitor has the capability to run a cryptocurrency miner on the victim machine.
MITRE ATT&CK technique: T1496.001: Resource Hijacking- Compute Hijacking
Imminent Monitor has a PasswordRecoveryPacket module for recovering browser passwords.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Imminent Monitor has decoded malware components that are then dropped to the system.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Imminent Monitor has a feature to disable Windows Task Manager.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Imminent Monitor has uploaded a file containing debugger logs, network information and system information to the C2.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Imminent Monitor has deleted files related to its dynamic debugger feature.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Imminent Monitor has a dynamic debugging feature to check whether it is located in the %TEMP% directory, otherwise it copies itself there.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Imminent Monitor has a dynamic debugging feature to set the file attribute to hidden.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
Imminent Monitor has a keylogging module.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Imminent Monitor has leveraged CreateProcessW call to execute the debugger.
MITRE ATT&CK technique: T1106: Native API
Imminent Monitor has encrypted the spearphish attachments to avoid detection from email gateways; the debugger also encrypts information before sending to the C2.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Imminent Monitor has a "Process Watcher" feature to monitor processes in case the client ever crashes or gets closed.
MITRE ATT&CK technique: T1057: Process Discovery
Imminent Monitor has a module for performing remote desktop access.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
Imminent Monitor has a remote webcam monitoring capability.
MITRE ATT&CK technique: T1125: Video Capture
Impacket tools – such as getST.py or ticketer.py – can be used to steal or forge Kerberos tickets using ccache files given a password, hash, aesKey, or TGT.
MITRE ATT&CK technique: T1558.005: Steal or Forge Kerberos Tickets- Ccache Files
Impacket modules like GetUserSPNs can be used to get Service Principal Names for user accounts. The output is formatted to be compatible with cracking tools like John the Ripper and Hashcat.
MITRE ATT&CK technique: T1558.003: Steal or Forge Kerberos Tickets- Kerberoasting