sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
OopsIE performs several anti-VM and sandbox checks on the victim's machine. One technique the group has used was to perform a WMI query SELECT * FROM MSAcpi_ThermalZoneTemperature to check the temperature to see if it’s running in a virtual environment.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
OopsIE checks for information on the CPU fan, temperature, mouse, hard disk, and motherboard as part of its anti-VM checks.
MITRE ATT&CK technique: T1082: System Information Discovery
OopsIE checks to see if the system is configured with "Daylight" time and checks for a specific region to be set for the timezone.
MITRE ATT&CK technique: T1124: System Time Discovery
OopsIE creates and uses a VBScript as part of its persistent execution.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
OopsIE uses HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
OopsIE uses the command prompt to execute commands on the victim's machine.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
OopsIE uses WMI to perform discovery techniques.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Orz has used Technet and Pastebin web pages for command and control.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
Orz can gather victim drive information.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Orz can overwrite Registry settings to reduce its visibility on the victim.
MITRE ATT&CK technique: T1070: Indicator Removal
Orz can download files onto the victim.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Orz can perform Registry operations.
MITRE ATT&CK technique: T1112: Modify Registry
Some Orz strings are base64 encoded, such as the embedded DLL known as MockDll.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Orz can gather a process list from the victim.
MITRE ATT&CK technique: T1057: Process Discovery
Some Orz versions have an embedded DLL known as MockDll that uses process hollowing and Regsvr32 to execute another payload.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
Some Orz versions have an embedded DLL known as MockDll that uses Process Hollowing and regsvr32 to execute another payload.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
Orz can gather the victim's Internet Explorer version.
MITRE ATT&CK technique: T1518: Software Discovery
Orz can gather the victim OS version and whether it is 64 or 32 bit.
MITRE ATT&CK technique: T1082: System Information Discovery
Orz can gather victim proxy information.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Orz can execute shell commands. Orz can execute commands with JavaScript.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Out1 can copy files and Registry data from compromised hosts.
MITRE ATT&CK technique: T1005: Data from Local System
Out1 can parse e-mails on a target machine.
MITRE ATT&CK technique: T1114.001: Email Collection- Local Email Collection
Out1 has the ability to encode data.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Out1 can use HTTP and HTTPS in communications with remote hosts.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Out1 can use native command line for execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
OutSteel was developed using the AutoIT scripting language.
MITRE ATT&CK technique: T1059.010: Command and Scripting Interpreter- AutoHotKey & AutoIT
OutSteel can automatically scan for and collect files with specific extensions.
MITRE ATT&CK technique: T1119: Automated Collection
OutSteel can automatically upload collected files to its C2 server.
MITRE ATT&CK technique: T1020: Automated Exfiltration
OutSteel can collect information from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
OutSteel can upload files from a compromised host over its C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
OutSteel can delete itself following the successful execution of a follow-on payload.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
OutSteel can search for specific file extensions, including zipped files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
OutSteel can download files from its C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
OutSteel can download the Saint Bot malware for follow-on execution.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
OutSteel has relied on a user to execute a malicious attachment delivered via spearphishing.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
OutSteel has relied on a user to click a malicious link within a spearphishing email.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
OutSteel attempts to download and execute Saint Bot to a statically-defined location attempting to mimic svchost: %TEMP%\\svjhost.exe.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
OutSteel can identify running processes on a compromised host.
MITRE ATT&CK technique: T1057: Process Discovery
OutSteel has been distributed as a malicious attachment within a spearphishing email.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
OutSteel has been distributed through malicious links contained within spearphishing emails.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
OutSteel has used HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
OutSteel has used `cmd.exe` to scan a compromised host for specific file extensions.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
OwaAuth DES-encrypts captured credentials using the key 12345678 before writing the credentials to a log file.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
OwaAuth has a command to list its directory and logical drives.
MITRE ATT&CK technique: T1083: File and Directory Discovery
OwaAuth has been loaded onto Exchange servers and disguised as an ISAPI filter . The IIS w3wp.exe process then loads the malicious DLL.
MITRE ATT&CK technique: T1505.004: Server Software Component- IIS Components
OwaAuth captures and DES-encrypts credentials before writing the username and password to a log file, C:\log.txt.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
OwaAuth uses the filename owaauth.dll, which is a legitimate file that normally resides in %ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\Auth\; the malicious file by the same name is saved in %ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\bin\.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
OwaAuth has a command to timestop a file or directory.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
OwaAuth uses incoming HTTP requests with a username keyword and commands and handles them as instructions to perform actions.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
OwaAuth is a Web shell that appears to be exclusively used by Threat Group-3390. It is installed as an ISAPI filter on Exchange servers and shares characteristics with the China Chopper Web shell.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
P.A.S. Webshell has the ability to create reverse shells with Perl scripts.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
P.A.S. Webshell has the ability to list and extract data from SQL databases.
MITRE ATT&CK technique: T1213: Data from Information Repositories
P.A.S. Webshell has the ability to copy files on a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
P.A.S. Webshell can use a decryption mechanism to process a user supplied password and allow execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
P.A.S. Webshell can delete scripts from a subdirectory of /tmp after they are run.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
P.A.S. Webshell has the ability to list files and file characteristics including extension, size, ownership, and permissions.
MITRE ATT&CK technique: T1083: File and Directory Discovery
P.A.S. Webshell can upload and download files to and from compromised hosts.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
P.A.S. Webshell has the ability to modify file permissions.
MITRE ATT&CK technique: T1222.002: File and Directory Permissions Modification- Linux and Mac File and Directory Permissions Modification
P.A.S. Webshell can display the /etc/passwd file on a compromised host.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
P.A.S. Webshell can scan networks for open ports and listening services.
MITRE ATT&CK technique: T1046: Network Service Discovery
P.A.S. Webshell can use encryption and base64 encoding to hide strings and to enforce access control once deployed.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
P.A.S. Webshell can use predefined users and passwords to execute brute force attacks against SSH, FTP, POP3, MySQL, MSSQL, and PostgreSQL services.
MITRE ATT&CK technique: T1110.001: Brute Force- Password Guessing
P.A.S. Webshell can list PHP server configuration details.
MITRE ATT&CK technique: T1518: Software Discovery
P.A.S. Webshell can issue commands via HTTP POST.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
P.A.S. Webshell can gain remote access and execution on target web servers.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
P2P ZeuS added junk data to outgoing UDP packets to peer implants.
MITRE ATT&CK technique: T1001.001: Data Obfuscation- Junk Data
P8RAT can download additional payloads to a target system.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
P8RAT can send randomly-generated data as part of its C2 communication.
MITRE ATT&CK technique: T1001.001: Data Obfuscation- Junk Data
P8RAT can check for specific processes associated with virtual environments.
MITRE ATT&CK technique: T1057: Process Discovery
P8RAT can check the compromised host for processes associated with VMware or VirtualBox environments.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
P8RAT has the ability to "sleep" for a specified time to evade detection.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
PACEMAKER can enter a loop to read `/proc/` entries every 2 seconds in order to read a target application's memory.
MITRE ATT&CK technique: T1119: Automated Collection
PACEMAKER can parse `/proc/"process_name"/cmdline` to look for the string `dswsd` within the command line.
MITRE ATT&CK technique: T1083: File and Directory Discovery
PACEMAKER has written extracted data to `tmp/dsserver-check.statementcounters`.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
PACEMAKER has the ability to extract credentials from OS memory.
MITRE ATT&CK technique: T1003.007: OS Credential Dumping- Proc Filesystem
PACEMAKER can use PTRACE to attach to a targeted process to read process memory.
MITRE ATT&CK technique: T1055.008: Process Injection- Ptrace System Calls
PACEMAKER can use a simple bash script for execution.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
PHOREAL is capable of manipulating the Registry.
MITRE ATT&CK technique: T1112: Modify Registry
PHOREAL communicates via ICMP for C2.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
PHOREAL is capable of creating reverse shell.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
PITSTOP has the ability to communicate over TLS.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
PITSTOP can deobfuscate base64 encoded and AES encrypted commands.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
PITSTOP can listen over the Unix domain socket located at `/data/runtime/cockpit/wd.fd`.
MITRE ATT&CK technique: T1559: Inter-Process Communication
PITSTOP can listen and evaluate incoming commands on the domain socket, created by PITHOOK malware, located at `/data/runtime/cockpit/wd.fd` for a predefined magic byte sequence. PITSTOP can then duplicate the socket for further communication over TLS.
MITRE ATT&CK technique: T1205.002: Traffic Signaling- Socket Filters
PITSTOP has the ability to receive shell commands over a Unix domain socket.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
An older variant of PLAINTEE performs UAC bypass.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
PLAINTEE has downloaded and executed additional plugins.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
PLAINTEE uses reg add to add a Registry Run key for persistence.
MITRE ATT&CK technique: T1112: Modify Registry
PLAINTEE performs the tasklist command to list running processes.
MITRE ATT&CK technique: T1057: Process Discovery
PLAINTEE gains persistence by adding the Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
PLAINTEE encodes C2 beacons using XOR.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
PLAINTEE collects general system enumeration data about the infected machine and checks the OS version.
MITRE ATT&CK technique: T1082: System Information Discovery
PLAINTEE uses the ipconfig /all command to gather the victim’s IP address.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
PLAINTEE uses cmd.exe to execute commands on the victim’s machine.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
PLEAD has the ability to list open windows on the compromised host.
MITRE ATT&CK technique: T1010: Application Window Discovery
PLEAD has the ability to steal saved passwords from Microsoft Outlook.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
PLEAD can harvest saved credentials from browsers such as Google Chrome, Microsoft Internet Explorer, and Mozilla Firefox.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
PLEAD has the ability to delete files on the compromised host.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
PLEAD has the ability to list drives and files on the compromised host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
PLEAD has the ability to upload and download files to and from an infected host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
PLEAD samples were found to be highly obfuscated with junk code.
MITRE ATT&CK technique: T1001.001: Data Obfuscation- Junk Data
PLEAD has been executed via malicious e-mail attachments.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
PLEAD has been executed via malicious links in e-mails.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
PLEAD can use `ShellExecute` to execute applications.
MITRE ATT&CK technique: T1106: Native API
PLEAD has the ability to list processes on the compromised host.
MITRE ATT&CK technique: T1057: Process Discovery
PLEAD has the ability to proxy network communications.
MITRE ATT&CK technique: T1090: Proxy
PLEAD has used RC4 encryption to download modules.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
PLEAD has used HTTP for communications with command and control servers.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
PLEAD has the ability to execute shell commands on the compromised host.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
POORAIM has used AOL Instant Messenger for C2.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
POORAIM has been delivered through compromised sites acting as watering holes.
MITRE ATT&CK technique: T1189: Drive-by Compromise
POORAIM can conduct file browsing.
MITRE ATT&CK technique: T1083: File and Directory Discovery
POORAIM can enumerate processes.
MITRE ATT&CK technique: T1057: Process Discovery
POORAIM can perform screen capturing.
MITRE ATT&CK technique: T1113: Screen Capture
POORAIM can identify system information, including battery status.
MITRE ATT&CK technique: T1082: System Information Discovery
POSHSPY encrypts C2 traffic with AES and RSA.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
POSHSPY uploads data in 2048-byte chunks.
MITRE ATT&CK technique: T1030: Data Transfer Size Limits
POSHSPY uses a DGA to derive command and control URLs from a word list.
MITRE ATT&CK technique: T1568.002: Dynamic Resolution- Domain Generation Algorithms
POSHSPY downloads and executes additional PowerShell code and Windows binaries.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
POSHSPY appends a file signature header to encrypted data prior to upload or download.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
POSHSPY uses PowerShell to execute various commands, one to execute its payload.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
POSHSPY modifies timestamps of all downloaded executables to match a randomly selected file created prior to 2013.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
POSHSPY uses a WMI event subscription to establish persistence.
MITRE ATT&CK technique: T1546.003: Event Triggered Execution- Windows Management Instrumentation Event Subscription
POWERSOURCE uses DNS TXT records for C2.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
POWERSOURCE has been observed being used to download TEXTMATE and the Cobalt Strike Beacon payload onto victims.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
If the victim is using PowerShell 3.0 or later, POWERSOURCE writes its decoded payload to an alternate data stream named kernel32.dll that is saved in %PROGRAMDATA%\Windows\.
MITRE ATT&CK technique: T1564.004: Hide Artifacts- NTFS File Attributes
POWERSOURCE is a PowerShell backdoor.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
POWERSOURCE queries Registry keys in preparation for setting Run keys to achieve persistence.
MITRE ATT&CK technique: T1012: Query Registry
POWERSOURCE achieves persistence by setting a Registry Run key, with the path depending on whether the victim account has user or administrator access.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
POWERSTATS has encrypted C2 traffic with RSA.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
POWERSTATS has used useless code blocks to counter analysis.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
POWERSTATS uses character replacement, PowerShell environment variables, and XOR encoding to obfuscate code. POWERSTATS's backdoor code is a multi-layer obfuscated, encoded, and compressed blob. POWERSTATS has used PowerShell code with custom string obfuscation
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
POWERSTATS can use DCOM to execute additional payloads on compromised hosts.
MITRE ATT&CK technique: T1559.001: Inter-Process Communication- Component Object Model
POWERSTATS can upload files from compromised hosts.
MITRE ATT&CK technique: T1005: Data from Local System
POWERSTATS can deobfuscate the main backdoor code.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
POWERSTATS can disable Microsoft Office Protected View by changing Registry keys.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
POWERSTATS can use DDE to execute additional payloads on compromised hosts.
MITRE ATT&CK technique: T1559.002: Inter-Process Communication- Dynamic Data Exchange
POWERSTATS has connected to C2 servers through proxies.
MITRE ATT&CK technique: T1090.002: Proxy- External Proxy
POWERSTATS can delete all files on the C:\, D:\, E:\ and, F:\ drives using PowerShell Remove-Item commands.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
POWERSTATS can retrieve and execute additional PowerShell payloads from the C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
POWERSTATS can use JavaScript code for execution.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
POWERSTATS can retrieve usernames from compromised hosts.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
POWERSTATS has created a scheduled task named "MicrosoftEdge" to establish persistence.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
POWERSTATS can use Mshta.exe to execute additional payloads on compromised hosts.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
POWERSTATS uses PowerShell for obfuscation and execution.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
POWERSTATS has used get_tasklist to discover processes on the compromised host.
MITRE ATT&CK technique: T1057: Process Discovery
POWERSTATS has established persistence through a scheduled task using the command ”C:\Windows\system32\schtasks.exe” /Create /F /SC DAILY /ST 12:00 /TN MicrosoftEdge /TR “c:\Windows\system32\wscript.exe C:\Windows\temp\Windows.vbe”.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
POWERSTATS can sleep for a given number of seconds.
MITRE ATT&CK technique: T1029: Scheduled Transfer
POWERSTATS can retrieve screenshots from compromised hosts.
MITRE ATT&CK technique: T1113: Screen Capture
POWERSTATS has detected security tools.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
POWERSTATS encoded C2 traffic with base64.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
POWERSTATS can retrieve OS name/architecture and computer/domain name information from compromised hosts.
MITRE ATT&CK technique: T1082: System Information Discovery
POWERSTATS can retrieve IP, network adapter configuration information, and domain from compromised hosts.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
POWERSTATS has the ability to identify the username on the compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
POWERSTATS can use VBScript code for execution.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
POWERSTATS can use WMI queries to retrieve data from compromised hosts.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
POWERTON is written in PowerShell.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
POWERTON can install a Registry Run key for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
POWERTON has the ability to dump password hashes.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
POWERTON has used AES for encrypting C2 traffic.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
POWERTON has used HTTP/HTTPS for C2 traffic.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
POWERTON can use WMI for persistence.
MITRE ATT&CK technique: T1546.003: Event Triggered Execution- Windows Management Instrumentation Event Subscription
POWRUNER can use DNS for C2 communications.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
POWRUNER may collect user account information by running net user /domain or a series of other commands on a victim.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
POWRUNER may collect domain group information by running net group /domain or a series of other commands on a victim.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
POWRUNER may enumerate user directories on a victim.
MITRE ATT&CK technique: T1083: File and Directory Discovery
POWRUNER can download or upload files from its C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
POWRUNER may collect local group information by running net localgroup administrators or a series of other commands on a victim.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
POWRUNER is written in PowerShell.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
POWRUNER may collect process information by running tasklist on a victim.
MITRE ATT&CK technique: T1057: Process Discovery
POWRUNER may query the Registry by running reg query on a victim.
MITRE ATT&CK technique: T1012: Query Registry
POWRUNER persists through a scheduled task that executes it every minute.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
POWRUNER can capture a screenshot from a victim.
MITRE ATT&CK technique: T1113: Screen Capture
POWRUNER may collect information on the victim's anti-virus software.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
POWRUNER can use base64 encoded C2 communications.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
POWRUNER may collect information about the system by running hostname and systeminfo on a victim.
MITRE ATT&CK technique: T1082: System Information Discovery
POWRUNER may collect network configuration data by running ipconfig /all on a victim.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
POWRUNER may collect active network connections by running netstat -an on a victim.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
POWRUNER may collect information about the currently logged in user by running whoami on a victim.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
POWRUNER can use HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
POWRUNER can execute commands from its C2 server.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
POWRUNER may use WMI when collecting information about a victim.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
PS1 can use an XOR key to decrypt a PowerShell loader and payload binary.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
PS1 can inject its payload DLL Into memory.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
PS1 is distributed as a set of encrypted files and scripts.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
CostaBricks can download additional payloads onto a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
PS1 can utilize a PowerShell loader.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
PULSECHECK can base-64 encode encrypted data sent through C2.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
PULSECHECK can use Unix shell script for command execution.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
PULSECHECK can check HTTP request headers for a specific backdoor key and if found will output the result of the command in the variable `HTTP_X_CMD.`
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
PULSECHECK is a web shell that can enable command execution on compromised servers.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
PUNCHBUGGY can establish using a AppCertDLLs Registry key.
MITRE ATT&CK technique: T1546.009: Event Triggered Execution- AppCert DLLs
PUNCHBUGGY has Gzipped information and saved it to a random temp file before exfil.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
PUNCHBUGGY has used PowerShell to decode base64-encoded assembly.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
PUNCHBUGGY can delete files written to disk.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
PUNCHBUGGY can download additional files and payloads to compromised hosts.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
PUNCHBUGGY can gather user names.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
PUNCHBUGGY has saved information to a random temp file before exfil.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
PUNCHBUGGY mimics filenames from %SYSTEM%\System32 to hide DLLs in %WINDIR% and/or %TEMP%.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
PUNCHBUGGY has hashed most its code's functions and encrypted payloads with base64 and XOR.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
PUNCHBUGGY has used PowerShell scripts.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
PUNCHBUGGY has used python scripts.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
PUNCHBUGGY has been observed using a Registry Run key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
PUNCHBUGGY can load a DLL using Rundll32.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
PUNCHBUGGY can gather AVs registered in the system.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
PUNCHBUGGY can load a DLL using the LoadLibrary API.
MITRE ATT&CK technique: T1129: Shared Modules
PUNCHBUGGY can gather system information such as computer names.
MITRE ATT&CK technique: T1082: System Information Discovery
PUNCHBUGGY enables remote interaction and can obtain additional code over HTTPS GET and POST requests.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
PUNCHTRACK scrapes memory for properly formatted payment card data.
MITRE ATT&CK technique: T1005: Data from Local System
PUNCHTRACK aggregates collected data in a tmp file.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
PUNCHTRACK is loaded and executed by a highly obfuscated launcher.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Pacu can generate SSH and API keys for AWS infrastructure and additional API keys for other IAM users.
MITRE ATT&CK technique: T1098.001: Account Manipulation- Additional Cloud Credentials
Pacu can automatically collect data, such as CloudFormation templates, EC2 user data, AWS Inspector reports, and IAM credential reports.
MITRE ATT&CK technique: T1119: Automated Collection
Pacu leverages the AWS CLI for its operations.
MITRE ATT&CK technique: T1059.009: Command and Scripting Interpreter- Cloud API
Pacu can enumerate IAM users, roles, and groups.
MITRE ATT&CK technique: T1087.004: Account Discovery- Cloud Account
Pacu leverages valid cloud accounts to perform most of its operations.
MITRE ATT&CK technique: T1078.004: Valid Accounts- Cloud Accounts
Pacu can run commands on EC2 instances using AWS Systems Manager Run Command.
MITRE ATT&CK technique: T1651: Cloud Administration Command
Pacu can enumerate IAM permissions.
MITRE ATT&CK technique: T1069.003: Permission Groups Discovery- Cloud Groups
Pacu can enumerate AWS infrastructure, such as EC2 instances.
MITRE ATT&CK technique: T1580: Cloud Infrastructure Discovery
Pacu can retrieve secrets from the AWS Secrets Manager via the enum_secrets module.
MITRE ATT&CK technique: T1555.006: Credentials from Password Stores- Cloud Secrets Management Stores
Pacu can enumerate AWS services, such as CloudTrail and CloudWatch.
MITRE ATT&CK technique: T1526: Cloud Service Discovery
Pacu can enumerate AWS storage services, such as S3 buckets and Elastic Block Store volumes.
MITRE ATT&CK technique: T1619: Cloud Storage Object Discovery
Pacu can create snapshots of EBS volumes and RDS instances.
MITRE ATT&CK technique: T1578.001: Modify Cloud Compute Infrastructure- Create Snapshot
Pacu can enumerate and download files stored in AWS storage services, such as S3 buckets.
MITRE ATT&CK technique: T1530: Data from Cloud Storage
Pacu can allowlist IP addresses in AWS GuardDuty.
MITRE ATT&CK technique: T1562.007: Impair Defenses- Disable or Modify Cloud Firewall
Pacu can disable or otherwise restrict various AWS logging services, such as AWS CloudTrail and VPC flow logs.
MITRE ATT&CK technique: T1562.008: Impair Defenses- Disable or Modify Cloud Logs
Pacu can set up S3 bucket notifications to trigger a malicious Lambda function when a CloudFormation template is uploaded to the bucket. It can also create Lambda functions that trigger upon the creation of users, roles, and groups.
MITRE ATT&CK technique: T1546: Event Triggered Execution
Pacu can collect CloudTrail event histories and CloudWatch logs.
MITRE ATT&CK technique: T1654: Log Enumeration
Pacu can enumerate AWS security services, including WAF rules and GuardDuty detectors.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Pacu can create malicious Lambda functions.
MITRE ATT&CK technique: T1648: Serverless Execution
Once inside a Virtual Private Cloud, Pacu can attempt to identify DirectConnect, VPN, or VPC Peering.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Pacu can search for sensitive data: for example, in Code Build environment variables, EC2 user data, and Cloud Formation templates.
MITRE ATT&CK technique: T1552: Unsecured Credentials
Pandora can use CVE-2017-15303 to disable Windows Driver Signature Enforcement protection and load its driver.
MITRE ATT&CK technique: T1553.006: Subvert Trust Controls- Code Signing Policy Modification
Pandora can use DLL side-loading to execute malicious payloads.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Pandora can use CVE-2017-15303 to bypass Windows Driver Signature Enforcement protection and load its driver.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
Pandora can load additional drivers and files onto a victim machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Pandora can write an encrypted token to the Registry to enable processing of remote commands.
MITRE ATT&CK technique: T1112: Modify Registry
Pandora has the ability to compress stings with QuickLZ.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Pandora can monitor processes on a compromised host.
MITRE ATT&CK technique: T1057: Process Discovery
Pandora can start and inject code into a new `svchost` process.
MITRE ATT&CK technique: T1055: Process Injection
Pandora has the ability to install itself as a Windows service.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Pandora has the ability to encrypt communications with D3DES.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Pandora can identify if incoming HTTP traffic contains a token and if so it will intercept the traffic and process the received command.
MITRE ATT&CK technique: T1205: Traffic Signaling
Pandora can communicate over HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Pandora has the ability to gain system privileges through Windows services.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Pasam creates a backdoor through which remote attackers can retrieve files.
MITRE ATT&CK technique: T1005: Data from Local System
Pasam creates a backdoor through which remote attackers can delete files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Pasam creates a backdoor through which remote attackers can retrieve lists of files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Pasam creates a backdoor through which remote attackers can upload files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Pasam establishes by infecting the Security Accounts Manager DLL to load a malicious DLL dropped to disk.
MITRE ATT&CK technique: T1547.008: Boot or Logon Autostart Execution- LSASS Driver
Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.
MITRE ATT&CK technique: T1057: Process Discovery
Pasam creates a backdoor through which remote attackers can retrieve information such as hostname and free disk space.
MITRE ATT&CK technique: T1082: System Information Discovery
Pass-The-Hash Toolkit can perform pass the hash.
MITRE ATT&CK technique: T1550.002: Use Alternate Authentication Material- Pass the Hash
Pay2Key has used RSA encrypted communications with C2.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Pay2Key can encrypt data on victim's machines using RSA and AES algorithms in order to extort a ransom payment for decryption.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Pay2Key can remove its log file from disk.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Pay2Key has designated machines in the compromised network to serve as reverse proxy pivot points to channel communications with C2.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy
Pay2Key has sent its public key to the C2 server over TCP.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Pay2Key can stop the MS SQL service at the end of the encryption process to release files locked by the service.
MITRE ATT&CK technique: T1489: Service Stop
Pay2Key has the ability to gather the hostname of the victim machine.
MITRE ATT&CK technique: T1082: System Information Discovery
Pay2Key can identify the IP and MAC addresses of the compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
PcShare has created the `HKCU\\Software\\Classes\\CLSID\\{42aedc87-2188-41fd-b9a3-0c966feabec1}\\InprocServer32` Registry key for persistence.
MITRE ATT&CK technique: T1546.015: Event Triggered Execution- Component Object Model Hijacking
PcShare can collect files and information from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
PcShare has decrypted its strings by applying a XOR operation and a decompression using a custom implemented LZM algorithm.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
PcShare has been encrypted with XOR using different 32-long Base16 strings and compressed with LZW algorithm.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
PcShare can upload files and information from a compromised host to its C2 servers.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
PcShare has deleted its files and components from a compromised host.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
PcShare has used an invalid certificate in attempt to appear legitimate.
MITRE ATT&CK technique: T1036.001: Masquerading- Invalid Code Signature
PcShare has the ability to capture keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
PcShare has been named `wuauclt.exe` to appear as the legitimate Windows Update AutoUpdate Client.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
PcShare can delete its persistence mechanisms from the registry.
MITRE ATT&CK technique: T1112: Modify Registry
PcShare has used a variety of Windows API functions.
MITRE ATT&CK technique: T1106: Native API
PcShare can obtain a list of running processes on a compromised host.
MITRE ATT&CK technique: T1057: Process Discovery
The PcShare payload has been injected into the `logagent.exe` and `rdpclip.exe` processes.
MITRE ATT&CK technique: T1055: Process Injection
PcShare can search the registry files of a compromised host.
MITRE ATT&CK technique: T1012: Query Registry
PcShare has used `rundll32.exe` for execution.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
PcShare can take screen shots of a compromised machine.
MITRE ATT&CK technique: T1113: Screen Capture
PcShare can obtain the proxy settings of a compromised machine using `InternetQueryOptionA` and its IP address by running `nslookup myip.opendns.comresolver1.opendns.com\r\n`.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
PcShare can capture camera video as part of its collection process.
MITRE ATT&CK technique: T1125: Video Capture
PcShare has used HTTP for C2 communication.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
PcShare can execute `cmd` commands on a compromised host.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Pcexter has been distributed and executed as a DLL file named Vspmsg.dll via DLL side-loading.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Pcexter can upload files from targeted systems.
MITRE ATT&CK technique: T1005: Data from Local System
Pcexter can upload stolen files to OneDrive storage accounts via HTTP `POST`.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
Pcexter has the ability to search for files in specified directories.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Peirates can use stolen service account tokens to perform its operations. It also enables adversaries to switch between valid service accounts.
MITRE ATT&CK technique: T1550.001: Use Alternate Authentication Material- Application Access Token
Peirates can use stolen service account tokens to perform its operations.
MITRE ATT&CK technique: T1078.004: Valid Accounts- Cloud Accounts
Peirates can query the query AWS and GCP metadata APIs for secrets.
MITRE ATT&CK technique: T1552.005: Unsecured Credentials- Cloud Instance Metadata API
Peirates can list AWS S3 buckets.
MITRE ATT&CK technique: T1619: Cloud Storage Object Discovery
Peirates can query the Kubernetes API for secrets.
MITRE ATT&CK technique: T1552.007: Unsecured Credentials- Container API
Peirates can use `kubectl` or the Kubernetes API to run commands.
MITRE ATT&CK technique: T1609: Container Administration Command
Peirates can enumerate Kubernetes pods in a given namespace.
MITRE ATT&CK technique: T1613: Container and Resource Discovery
Peirates can dump the contents of AWS S3 buckets. It can also retrieve service account tokens from kOps buckets in Google Cloud Storage or S3.
MITRE ATT&CK technique: T1530: Data from Cloud Storage
Peirates can deploy a pod that mounts its node’s root file system, then execute a command to create a reverse shell on the node.
MITRE ATT&CK technique: T1610: Deploy Container
Peirates can gain a reverse shell on a host node by mounting the Kubernetes hostPath.
MITRE ATT&CK technique: T1611: Escape to Host
Peirates can initiate a port scan against a given IP address.
MITRE ATT&CK technique: T1046: Network Service Discovery
Peirates gathers Kubernetes service account tokens using a variety of techniques.
MITRE ATT&CK technique: T1528: Steal Application Access Token
Penquin can encrypt communications using the BlowFish algorithm and a symmetric key exchanged with Diffie Hellman.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Penquin can use Cron to create periodic and pre-scheduled background jobs.
MITRE ATT&CK technique: T1053.003: Scheduled Task/Job- Cron
Penquin has encrypted strings in the binary for obfuscation.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Penquin can execute the command code do_upload to send files to C2.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Penquin can delete downloaded executables after running them.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Penquin can use the command code do_vslist to send file names, size, and status to C2.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Penquin can remove strings from binaries.
MITRE ATT&CK technique: T1027.005: Obfuscated Files or Information- Indicator Removal from Tools
Penquin can execute the command code do_download to retrieve remote files from C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Penquin can add the executable flag to a downloaded file.
MITRE ATT&CK technique: T1222.002: File and Directory Permissions Modification- Linux and Mac File and Directory Permissions Modification
Penquin has mimicked the Cron binary to hide itself on compromised systems.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Penquin can sniff network traffic to look for packets matching specific conditions.
MITRE ATT&CK technique: T1040: Network Sniffing
The Penquin C2 mechanism is based on TCP and UDP packets.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Penquin installs a `TCP` and `UDP` filter on the `eth0` interface.
MITRE ATT&CK technique: T1205.002: Traffic Signaling- Socket Filters
Penquin can report the file system type and disk space of a compromised host to C2.
MITRE ATT&CK technique: T1082: System Information Discovery
Penquin can report the IP of the compromised host to attacker controlled infrastructure.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Penquin will connect to C2 only after sniffing a "magic packet" value in TCP or UDP packets matching specific conditions.
MITRE ATT&CK technique: T1205: Traffic Signaling
Penquin can execute remote commands using bash scripts.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
Peppy has the ability to automatically exfiltrate files and keylogs.
MITRE ATT&CK technique: T1020: Automated Exfiltration
Peppy can identify specific files for exfiltration.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Peppy can download and execute remote files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Peppy can log keystrokes on compromised hosts.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Peppy can take screenshots on targeted systems.
MITRE ATT&CK technique: T1113: Screen Capture
Peppy can use HTTP to communicate with C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Peppy has the ability to execute shell commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Pikabot features several methods to evade debugging by analysts, including checks for active debuggers, the use of breakpoints during execution, and checking various system information items such as system memory and the number of processors.
MITRE ATT&CK technique: T1622: Debugger Evasion
Pikabot decrypts command and control URIs using ADVobfuscator, and decrypts IP addresses and port numbers with a custom algorithm. Other versions of Pikabot decode chunks of stored stage 2 payload content in the initial payload .text section before consolidating them for further execution. Overall LunarMail is associated with multiple encoding and encryption mechanisms to obfuscate the malware's presence and avoid analysis or detection.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Pikabot will gather information concerning the Windows Domain the victim machine is a member of during execution.
MITRE ATT&CK technique: T1482: Domain Trust Discovery
Pikabot further decrypts information embedded via steganography using AES-CBC with the same 32 bit key as initial XOR operations combined with the first 16 bytes of the encrypted data as an initialization vector. Other Pikabot variants include encrypted, chunked sections of the stage 2 payload in the initial loader .text section before decrypting and assembling these during execution.
MITRE ATT&CK technique: T1027.009: Obfuscated Files or Information- Embedded Payloads
Pikabot stops execution if the infected system language matches one of several languages, with various versions referencing: Georgian, Kazakh, Uzbek, Tajik, Russian, Ukrainian, Belarussian, and Slovenian.
MITRE ATT&CK technique: T1480.001: Execution Guardrails- Environmental Keying
During the initial Pikabot command and control check-in, Pikabot will transmit collected system information encrypted using RC4.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Some versions of Pikabot build the final PE payload in memory to avoid writing contents to disk on the executing machine.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage