sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
APT32 has used mshta.exe for code execution.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
APT32 used NTFS alternate data streams to hide their payloads.
MITRE ATT&CK technique: T1564.004: Hide Artifacts- NTFS File Attributes
APT32 performed network scanning on the network to search for open ports, services, OS finger-printing, and other vulnerabilities.
MITRE ATT&CK technique: T1046: Network Service Discovery
APT32 used the net view command to show all shares available, including the administrative shares such as C$ and ADMIN$.
MITRE ATT&CK technique: T1135: Network Share Discovery
An APT32 backdoor can use HTTP over a non-standard TCP port which is specified in the backdoor configuration.
MITRE ATT&CK technique: T1571: Non-Standard Port
APT32 used GetPassword_x64 to harvest credentials.
MITRE ATT&CK technique: T1003: OS Credential Dumping
APT32 have replaced Microsoft Outlook's VbaProject.OTM file to install a backdoor macro for persistence.
MITRE ATT&CK technique: T1137: Office Application Startup
APT32 has used pass the hash for lateral movement.
MITRE ATT&CK technique: T1550.002: Use Alternate Authentication Material- Pass the Hash
APT32 successfully gained remote access by using pass the ticket.
MITRE ATT&CK technique: T1550.003: Use Alternate Authentication Material- Pass the Ticket
APT32 has used PowerShell-based tools, PowerShell one-liners, and shellcode loaders for execution.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
APT32 malware has injected a Cobalt Strike beacon into Rundll32.exe.
MITRE ATT&CK technique: T1055: Process Injection
APT32 has used PubPrn.vbs within execution scripts to execute malware, possibly bypassing defenses.
MITRE ATT&CK technique: T1216.001: System Script Proxy Execution- PubPrn
APT32's backdoor can query the Windows Registry to gather system information.
MITRE ATT&CK technique: T1012: Query Registry
APT32 established persistence using Registry Run keys, both to execute PowerShell and VBS scripts as well as to execute their backdoor directly.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory. The group has also used regsvr32 to run their backdoor.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
APT32 has enumerated DC servers using the command net group "Domain Controllers" /domain. The group has also used the ping command.
MITRE ATT&CK technique: T1018: Remote System Discovery
APT32 has moved and renamed pubprn.vbs to a .txt file to avoid detection.
MITRE ATT&CK technique: T1036.003: Masquerading- Rename System Utilities
APT32 malware has used rundll32.exe to execute an initial infection process.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
APT32 used Net to use Windows' hidden network shares to copy their tools to remote machines for execution.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
APT32 has used scheduled tasks to persist on victim systems.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
APT32's backdoor has used Windows services as a way to execute its malicious payload.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
APT32 has set up Facebook pages in tandem with fake websites.
MITRE ATT&CK technique: T1585.001: Establish Accounts- Social Media Accounts
APT32 compromised McAfee ePO to move laterally by distributing malware as a software deployment task.
MITRE ATT&CK technique: T1072: Software Deployment Tools
APT32 has sent spearphishing emails with a malicious executable disguised as a document or spreadsheet.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
APT32 has sent spearphishing emails containing malicious links.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
APT32 has used malicious links to direct users to web pages designed to harvest credentials.
MITRE ATT&CK technique: T1598.003: Phishing for Information- Spearphishing Link
APT32 has collected the OS version and computer name from victims. One of the group's backdoors can also query the Windows Registry to gather system information, and another macOS backdoor performs a fingerprint of the machine on its first connection to the C&C server. APT32 executed shellcode to identify the name of the infected host.
MITRE ATT&CK technique: T1082: System Information Discovery
APT32 used the ipconfig /all command to gather the IP address from the system.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
APT32 used the netstat -anpo tcp command to display TCP connections on the victim's machine.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
APT32 collected the victim's username and executed the whoami command on the victim's machine. APT32 executed shellcode to collect the username on the victim's machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
APT32 has used scheduled task raw XML with a backdated timestamp of June 2, 2016. The group has also set the creation time of the files dropped by the second stage of the exploit to match the creation time of kernel32.dll. Additionally, APT32 has used a random value to modify the timestamp of the file storing the clientID.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
APT32 has obtained and used tools such as Mimikatz and Cobalt Strike, and a variety of other open-source tools from GitHub.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
APT32 has hosted malicious payloads in Dropbox, Amazon S3, and Google Drive for use during targeting.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
APT32 has used macros, COM scriptlets, and VBS scripts.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
APT32 has used JavaScript that communicates over HTTP or HTTPS to attacker controlled domains to download additional frameworks. The group has also used downloaded encrypted payloads over HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
APT32 has used Dropbox, Amazon S3, and Google Drive to host malicious downloads.
MITRE ATT&CK technique: T1102: Web Service
APT32 has set up Dropbox, Amazon S3, and Google Drive to host malicious downloads.
MITRE ATT&CK technique: T1583.006: Acquire Infrastructure- Web Services
APT32 has used Web shells to maintain access to victim websites.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
APT32 has used cmd.exe for execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
APT32 used WMI to deploy their tools on remote machines and to gather information about the Outlook process.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
APT32 modified Windows Services to ensure PowerShell scripts were loaded on the system. APT32 also creates a Windows service to establish persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
APT33 has used WinRAR to compress data prior to exfil.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
APT33 has used a variety of publicly available tools like LaZagne to gather credentials.
MITRE ATT&CK technique: T1003.005: OS Credential Dumping- Cached Domain Credentials
APT33 has used compromised Office 365 accounts in tandem with Ruler in an attempt to gain control of endpoints.
MITRE ATT&CK technique: T1078.004: Valid Accounts- Cloud Accounts
APT33 has used a variety of publicly available tools like LaZagne to gather credentials.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
APT33 has used a variety of publicly available tools like LaZagne to gather credentials.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
APT33 has used a variety of publicly available tools like LaZagne to gather credentials.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
APT33 has used base64 to encode payloads.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
APT33 has used FTP to exfiltrate files .
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
APT33 has attempted to exploit a known vulnerability in WinRAR , and attempted to gain remote code execution via a security bypass vulnerability .
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
APT33 has used a publicly available exploit for CVE-2017-0213 to escalate privileges on a local system.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
APT33 has used a variety of publicly available tools like Gpppassword to gather credentials.
MITRE ATT&CK technique: T1552.006: Unsecured Credentials- Group Policy Preferences
APT33 has downloaded additional files and programs from its C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
APT33 has used a variety of publicly available tools like LaZagne to gather credentials.
MITRE ATT&CK technique: T1003.004: OS Credential Dumping- LSA Secrets
APT33 has used a variety of publicly available tools like LaZagne, Mimikatz, and ProcDump to dump credentials.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
APT33 has used malicious e-mail attachments to lure victims into executing malware.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
APT33 has lured users to click links to malicious HTML applications delivered via spearphishing emails.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
APT33 has used SniffPass to collect credentials by sniffing network traffic.
MITRE ATT&CK technique: T1040: Network Sniffing
APT33 has used HTTP over TCP ports 808 and 880 for command and control.
MITRE ATT&CK technique: T1571: Non-Standard Port
APT33 has used password spraying to gain access to target systems.
MITRE ATT&CK technique: T1110.003: Brute Force- Password Spraying
APT33 has utilized PowerShell to download files from the C2 server and run various scripts.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
APT33 has deployed a tool known as DarkComet to the Startup folder of a victim, and used Registry run keys to gain persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
APT33 has created a scheduled task to execute a .vbe file multiple times a day.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
APT33 has sent spearphishing e-mails with archive attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
APT33 has sent spearphishing emails containing links to .hta files.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
APT33 has used base64 to encode command and control traffic.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
APT33 has used AES for encryption of command and control traffic.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
APT33 has obtained and leveraged publicly-available tools for early intrusion activities.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
APT33 has used valid accounts for initial access and privilege escalation.
MITRE ATT&CK technique: T1078: Valid Accounts
APT33 has used VBScript to initiate the delivery of payloads.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
APT33 has used HTTP for command and control.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
APT33 has attempted to use WMI event subscriptions to establish persistence on compromised hosts.
MITRE ATT&CK technique: T1546.003: Event Triggered Execution- Windows Management Instrumentation Event Subscription
APT37 has used an audio capturing utility known as SOUNDWAVE that captures microphone input.
MITRE ATT&CK technique: T1123: Audio Capture
APT37 leverages social networking sites and cloud platforms for C2.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
APT37 has a function in the initial dropper to bypass Windows UAC in order to execute the next payload with higher privileges.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
APT37 has used Ruby scripts to execute payloads.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
APT37 has used a credential stealer known as ZUMKONG that can harvest usernames and passwords stored in browsers.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
APT37 has collected data from victims' local systems.
MITRE ATT&CK technique: T1005: Data from Local System
APT37 has access to destructive malware that is capable of overwriting a machine's Master Boot Record .
MITRE ATT&CK technique: T1561.002: Disk Wipe- Disk Structure Wipe
APT37 has used strategic web compromises, particularly of South Korean websites, to distribute malware. The group has also used torrent file-sharing sites to more indiscriminately disseminate malware to victims. As part of their compromises, the group has used a Javascript based profiler called RICECURRY to profile a victim's web browser and deliver malicious code accordingly.
MITRE ATT&CK technique: T1189: Drive-by Compromise
APT37 has used Windows DDE for execution of commands and a malicious VBS.
MITRE ATT&CK technique: T1559.002: Inter-Process Communication- Dynamic Data Exchange
APT37 has used exploits for Flash Player , Word , Internet Explorer , and Microsoft Edge for execution.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
APT37 has downloaded second stage malware from compromised websites.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
APT37 has signed its malware with an invalid digital certificates listed as “Tencent Technology Company Limited.”
MITRE ATT&CK technique: T1036.001: Masquerading- Invalid Code Signature
APT37 has sent spearphishing attachments attempting to get a user to open them.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
APT37 leverages the Windows API calls: VirtualAlloc, WriteProcessMemory, and CreateRemoteThread for process injection.
MITRE ATT&CK technique: T1106: Native API
APT37 obfuscates strings and payloads.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
APT37's Freenki malware lists running processes using the Microsoft Windows API.
MITRE ATT&CK technique: T1057: Process Discovery
APT37 injects its malware variant, ROKRAT, into the cmd.exe process.
MITRE ATT&CK technique: T1055: Process Injection
APT37 has used Python scripts to execute payloads.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
APT37's has added persistence via the Registry key HKCU\Software\Microsoft\CurrentVersion\Run\.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
APT37 has created scheduled tasks to run malicious scripts on a compromised host.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
APT37 delivers malware using spearphishing emails with malicious HWP attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
APT37 uses steganography to send images to users that are embedded with shellcode.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
APT37 collects the computer name, the BIOS model, and execution path.
MITRE ATT&CK technique: T1082: System Information Discovery
APT37 identifies the victim username.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
APT37 has used malware that will issue the command shutdown /r /t 1 to reboot a system after wiping its MBR.
MITRE ATT&CK technique: T1529: System Shutdown/Reboot
APT37 executes shellcode and a VBA script to decode Base64 strings.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
APT37 uses HTTPS to conceal C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
APT37 has used the command-line interface.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
APT38 has collected browser bookmark information to learn more about compromised hosts, obtain personal information about users, and acquire details about internal network resources.
MITRE ATT&CK technique: T1217: Browser Information Discovery
APT38 has used brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable.
MITRE ATT&CK technique: T1110: Brute Force
APT38 clears Window Event logs and Sysmon logs from the system.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
APT38 used a Trojan called KEYLIME to collect data from the clipboard.
MITRE ATT&CK technique: T1115: Clipboard Data
APT38 has used CHM files to move concealed payloads.
MITRE ATT&CK technique: T1218.001: System Binary Proxy Execution- Compiled HTML File
APT38 has used cron to create pre-scheduled and periodic background jobs on a Linux system.
MITRE ATT&CK technique: T1053.003: Scheduled Task/Job- Cron
APT38 has used a custom secure delete function to make deleted files unrecoverable.
MITRE ATT&CK technique: T1485: Data Destruction
APT38 has used Hermes ransomware to encrypt files with AES256.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
APT38 has collected data from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
APT38 has used a custom MBR wiper named BOOTWRECK to render systems inoperable.
MITRE ATT&CK technique: T1561.002: Disk Wipe- Disk Structure Wipe
APT38 has conducted watering holes schemes to gain initial access to victims.
MITRE ATT&CK technique: T1189: Drive-by Compromise
APT38 has used a utility called CLOSESHAVE that can securely delete a file from the system. They have also removed malware, tools, or other non-native files used during the intrusion to reduce their footprint or as part of the post-intrusion cleanup process.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
APT38 have enumerated files and directories, or searched in specific locations within a compromised host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
APT38 has prepended a space to all of their terminal commands to operate without leaving traces in the HISTCONTROL environment.
MITRE ATT&CK technique: T1562.003: Impair Defenses- Impair Command History Logging
APT38 used a backdoor, NESTEGG, that has the capability to download and upload files to and from a victim’s machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
APT38 used a Trojan called KEYLIME to capture keystrokes from the victim’s machine.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
APT38 has attempted to lure victims into enabling malicious macros within email attachments.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
APT38 uses a tool called CLEANTOAD that has the capability to modify Registry keys.
MITRE ATT&CK technique: T1112: Modify Registry
APT38 has used the Windows API to execute code within a victim's system.
MITRE ATT&CK technique: T1106: Native API
APT38 has enumerated network shares on a compromised host.
MITRE ATT&CK technique: T1135: Network Share Discovery
APT38 has used PowerShell to execute commands and other operational tasks.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
APT38 leveraged Sysmon to understand the processes, services in the organization.
MITRE ATT&CK technique: T1057: Process Discovery
APT38 has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
APT38 has used DYEPACK.FOX to manipulate PDF data as it is accessed to remove traces of fraudulent SWIFT transactions from the data displayed to the end user.
MITRE ATT&CK technique: T1565.003: Data Manipulation- Runtime Data Manipulation
APT38 has used Task Scheduler to run programs at system startup or on a scheduled basis for persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
APT38 has identified security software, configurations, defensive tools, and sensors installed on a compromised system.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
APT38 has created new services or modified existing ones to run executables, commands, or scripts.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium, to pack their implants.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
APT38 has conducted spearphishing campaigns using malicious email attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
APT38 has used DYEPACK to create, delete, and alter records in databases used for SWIFT transactions.
MITRE ATT&CK technique: T1565.001: Data Manipulation- Stored Data Manipulation
APT38 has attempted to get detailed information about a compromised host, including the operating system, version, patches, hotfixes, and service packs.
MITRE ATT&CK technique: T1082: System Information Discovery
APT38 installed a port monitoring tool, MAPMAKER, to print the active TCP connections on the local system.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
APT38 has identified primary users, currently logged in users, sets of users that commonly use a system, or inactive users.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
APT38 has used a custom MBR wiper named BOOTWRECK, which will initiate a system reboot after wiping the victim's MBR.
MITRE ATT&CK technique: T1529: System Shutdown/Reboot
APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
APT38 has obtained and used open-source tools such as Mimikatz.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
APT38 has used DYEPACK to manipulate SWIFT messages en route to a printer.
MITRE ATT&CK technique: T1565.002: Data Manipulation- Transmitted Data Manipulation
APT38 has used VBScript to execute commands and other operational tasks.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
APT38 used a backdoor, QUICKRIDE, to communicate to the C2 server over HTTP and HTTPS.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
APT38 has used web shells for persistence or to ensure redundant access.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
APT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
APT38 has installed a new Windows service to establish persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
APT39 has used malware to set LoadAppInit_DLLs in the Registry key SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows in order to establish persistence.
MITRE ATT&CK technique: T1546.010: Event Triggered Execution- AppInit DLLs
APT39 has used WinRAR and 7-Zip to compress an archive stolen data.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
APT39 has utilized AutoIt malware scripts embedded in Microsoft Office documents or malicious links.
MITRE ATT&CK technique: T1059.010: Command and Scripting Interpreter- AutoHotKey & AutoIT
APT39 has used the BITS protocol to exfiltrate stolen data from a compromised host.
MITRE ATT&CK technique: T1197: BITS Jobs
APT39 has communicated with C2 through files uploaded to and downloaded from DropBox.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
APT39 has used Ncrack to reveal credentials.
MITRE ATT&CK technique: T1110: Brute Force
APT39 has used tools capable of stealing contents of the clipboard.
MITRE ATT&CK technique: T1115: Clipboard Data
APT39 has used malware to turn off the RequireSigned feature which ensures only signed DLLs can be run on Windows.
MITRE ATT&CK technique: T1553.006: Subvert Trust Controls- Code Signing Policy Modification
APT39 has utilized custom scripts to perform internal reconnaissance.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
APT39 has used the Smartftp Password Decryptor tool to decrypt FTP passwords.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
APT39 has used remote access tools that leverage DNS in communications with C2.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
APT39 has used various tools to steal files from the compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
APT39 has used malware to decrypt encrypted CAB files.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
APT39 has used malware to drop encrypted CAB files.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
APT39 has exfiltrated stolen victim data through C2 communications.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
APT39 has used SQL injection for initial compromise.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
APT39 has used various tools to proxy C2 communications.
MITRE ATT&CK technique: T1090.002: Proxy- External Proxy
APT39 has used malware to delete files after they are deployed on a compromised host.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
APT39 has used tools with the ability to search for files on a compromised host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
APT39 has downloaded tools to compromised hosts.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
APT39 has utilized tools to capture mouse movements.
MITRE ATT&CK technique: T1056: Input Capture
APT39 used custom tools to create SOCK5 and custom protocol proxies between infected hosts.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy
APT39 has used tools for capturing keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
APT39 has used Mimikatz, Windows Credential Editor and ProcDump to dump credentials.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
APT39 has created accounts on multiple compromised hosts to perform actions within the network.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
APT39 has utilized tools to aggregate data prior to exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious attachment.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious link.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
APT39 has used malware disguised as Mozilla Firefox and a tool named mfevtpse.exe to proxy C2 communications, closely mimicking a legitimate McAfee file mfevtps.exe.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
APT39 has used CrackMapExec and a custom port scanner known as BLUETORCH for network scanning.
MITRE ATT&CK technique: T1046: Network Service Discovery
APT39 has used the post exploitation tool CrackMapExec to enumerate network shares.
MITRE ATT&CK technique: T1135: Network Share Discovery
APT39 has used different versions of Mimikatz to obtain credentials.
MITRE ATT&CK technique: T1003: OS Credential Dumping
APT39 has used PowerShell to execute malicious code.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
APT39 has used a command line utility and a network scanner written in python.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
APT39 has used various strains of malware to query the Registry.
MITRE ATT&CK technique: T1012: Query Registry
APT39 has maintained persistence using the startup folder.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
APT39 has been seen using RDP for lateral movement and persistence, in some cases employing the rdpwinst tool for mangement of multiple sessions.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
APT39 has used NBTscan and custom tools to discover remote systems.
MITRE ATT&CK technique: T1018: Remote System Discovery
APT39 has used SMB for lateral movement.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
APT39 used secure shell to move laterally among their targets.
MITRE ATT&CK technique: T1021.004: Remote Services- SSH
APT39 has created scheduled tasks for persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
APT39 has used a screen capture utility to take screenshots on a compromised host.
MITRE ATT&CK technique: T1113: Screen Capture
APT39 has used post-exploitation tools including RemCom and the Non-sucking Service Manager to execute processes.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
APT39 has modified LNK shortcuts.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
APT39 has packed tools with UPX, and has repacked a modified version of Mimikatz to thwart anti-virus detection.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
APT39 leveraged spearphishing emails with malicious attachments to initially compromise victims.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
APT39 leveraged spearphishing emails with malicious links to initially compromise victims.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
APT39 used Remexi to collect usernames from the system.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
APT39 has modified and used customized versions of publicly-available tools like PLINK and Mimikatz.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
APT39 has used stolen credentials to compromise Outlook Web Access .
MITRE ATT&CK technique: T1078: Valid Accounts
APT39 has utilized malicious VBS scripts in malware.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
APT39 has used HTTP in communications with C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
APT39 has installed ANTAK and ASPXSPY web shells.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
APT41 leveraged sticky keys to establish persistence.
MITRE ATT&CK technique: T1546.008: Event Triggered Execution- Accessibility Features
APT41 has added user accounts to the User and Admin groups.
MITRE ATT&CK technique: T1098.007: Account Manipulation- Additional Local or Domain Groups
APT41 created a RAR archive of targeted files for exfiltration. Additionally, APT41 used the makecab.exe utility to both download tools, such as NATBypass, to the victim network and to archive a file for exfiltration.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
APT41 used BITSAdmin to download and install payloads.
MITRE ATT&CK technique: T1197: BITS Jobs
APT41 used a hidden shell script in `/etc/rc.d/init.d` to leverage the `ADORE.XSEC`backdoor and `Adore-NG` rootkit.
MITRE ATT&CK technique: T1037: Boot or Logon Initialization Scripts
APT41 deployed Master Boot Record bootkits on Windows systems to hide their malware and maintain persistence on victim systems.
MITRE ATT&CK technique: T1542.003: Pre-OS Boot- Bootkit
APT41 performed password brute-force attacks on the local admin account.
MITRE ATT&CK technique: T1110: Brute Force
APT41 attempted to remove evidence of some of its activity by deleting Bash histories.
MITRE ATT&CK technique: T1070.003: Indicator Removal- Clear Command History
APT41 attempted to remove evidence of some of its activity by clearing Windows security and system events.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
APT41 cloned victim user Git repositories during intrusions.
MITRE ATT&CK technique: T1213.003: Data from Information Repositories- Code Repositories
APT41 leveraged code-signing certificates to sign malware when targeting both gaming and non-gaming organizations.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
APT41 used compiled HTML files for targeting.
MITRE ATT&CK technique: T1218.001: System Binary Proxy Execution- Compiled HTML File
APT41 gained access to production environments where they could inject malicious code into legitimate, signed files and widely distribute them to end users.
MITRE ATT&CK technique: T1195.002: Supply Chain Compromise- Compromise Software Supply Chain
APT41 deployed a Monero cryptocurrency mining tool in a victim’s environment.
MITRE ATT&CK technique: T1496.001: Resource Hijacking- Compute Hijacking
APT41 has obtained information about accounts, lists of employees, and plaintext and hashed passwords from databases.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
APT41 has used search order hijacking to execute malicious payloads, such as Winnti for Windows.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
APT41 used legitimate executables to perform DLL side-loading of their malware.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
APT41 used DNS for C2 communications.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
APT41 used a ransomware called Encryptor RaaS to encrypt files on the targeted systems and provide a ransom note to the user. APT41 also used Microsoft Bitlocker to encrypt workstations and Jetico’s BestCrypt to encrypt servers.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
APT41 transfers post-exploitation files dividing the payload into fixed-size chunks to evade detection.
MITRE ATT&CK technique: T1030: Data Transfer Size Limits
APT41 has uploaded files and data from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
APT41 used legitimate websites for C2 through dead drop resolvers , including GitHub, Pastebin, and Microsoft TechNet.
MITRE ATT&CK technique: T1102.001: Web Service- Dead Drop Resolver
APT41 used built-in net commands to enumerate domain administrator users.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
APT41 has used DGAs to change their C2 servers monthly.
MITRE ATT&CK technique: T1568.002: Dynamic Resolution- Domain Generation Algorithms
APT41 has configured payloads to load via LD_PRELOAD.
MITRE ATT&CK technique: T1574.006: Hijack Execution Flow- Dynamic Linker Hijacking
APT41 has encrypted payloads using the Data Protection API , which relies on keys tied to specific user accounts on specific machines. APT41 has also environmentally keyed second stage malware with an RC5 key derived in part from the infected system's volume serial number.
MITRE ATT&CK technique: T1480.001: Execution Guardrails- Environmental Keying
APT41 exploited CVE-2020-10189 against Zoho ManageEngine Desktop Central through unsafe deserialization, and CVE-2019-19781 to compromise Citrix Application Delivery Controllers and gateway devices. APT41 leveraged vulnerabilities such as ProxyLogon exploitation or SQL injection for initial access. APT41 exploited CVE-2021-26855 against a vulnerable Microsoft Exchange Server to gain initial access to the victim network.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
APT41 compromised an online billing/payment service using VPN access between a third-party service provider and the targeted payment service.
MITRE ATT&CK technique: T1133: External Remote Services
APT41 used the Steam community page as a fallback mechanism for C2.
MITRE ATT&CK technique: T1008: Fallback Channels
APT41 deleted files from the system.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
APT41 used exploit payloads that initiate download via ftp.
MITRE ATT&CK technique: T1071.002: Application Layer Protocol- File Transfer Protocols
APT41 has executed file /bin/pwd on exploited victims, perhaps to return architecture related information.
MITRE ATT&CK technique: T1083: File and Directory Discovery
APT41 used scheduled tasks created via Group Policy Objects to deploy ransomware.
MITRE ATT&CK technique: T1484.001: Domain or Tenant Policy Modification- Group Policy Modification
APT41 impersonated an employee at a video game developer company to send phishing emails.
MITRE ATT&CK technique: T1656: Impersonation
APT41 developed a custom injector that enables an Event Tracing for Windows bypass, making malicious processes invisible to Windows logging.
MITRE ATT&CK technique: T1562.006: Impair Defenses- Indicator Blocking
APT41 used certutil to download additional files. APT41 downloaded post-exploitation tools such as Cobalt Strike via command shell following initial access. APT41 has uploaded Procdump and NATBypass to a staging directory and has used these tools in follow-on activities.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
APT41 used a keylogger called GEARSHIFT on a target system.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
APT41 has used hashdump, Mimikatz, Procdump, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
APT41 uses remote shares to move and remotely execute payloads during lateral movemement.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
APT41 used built-in net commands to enumerate local administrator groups.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
APT41 has created user accounts.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
APT41 has created services to appear as benign system tools.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
APT41 attempted to masquerade their files as popular anti-virus software.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.
MITRE ATT&CK technique: T1112: Modify Registry
APT41 used the storescyncsvc.dll BEACON backdoor to download a secondary backdoor.
MITRE ATT&CK technique: T1104: Multi-Stage Channels
APT41 used ntdsutil to obtain a copy of the victim environment ntds.dit file.
MITRE ATT&CK technique: T1003.003: OS Credential Dumping- NTDS
APT41 used `NATBypass` to bypass firewall restrictions and to access compromised systems via RDP.
MITRE ATT&CK technique: T1599: Network Boundary Bridging
APT41 used a malware variant called WIDETONE to conduct port scans on specified subnets.
MITRE ATT&CK technique: T1046: Network Service Discovery
APT41 used the net share command as part of network reconnaissance.
MITRE ATT&CK technique: T1135: Network Share Discovery
APT41 used VMProtected binaries in multiple intrusions.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
APT41 uses tools such as Mimikatz to enable lateral movement via captured password hashes.
MITRE ATT&CK technique: T1550.002: Use Alternate Authentication Material- Pass the Hash
APT41 used net group commands to enumerate various Windows user groups and permissions.
MITRE ATT&CK technique: T1069: Permission Groups Discovery
APT41 leveraged PowerShell to deploy malware families in victims’ environments.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
APT41 malware TIDYELF loaded the main WINTERLOVE component by injecting it into the iexplore.exe process.
MITRE ATT&CK technique: T1055: Process Injection
APT41 used a tool called CLASSFON to covertly proxy network communications.
MITRE ATT&CK technique: T1090: Proxy
APT41 queried registry values to determine items such as configured RDP ports and network configurations.
MITRE ATT&CK technique: T1012: Query Registry
APT41 created and modified startup files for persistence. APT41 added a registry key in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost to establish persistence for Cobalt Strike.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
APT41 used RDP for lateral movement. APT41 used NATBypass to expose local RDP ports on compromised systems to the Internet.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
APT41 has used MiPing to discover active systems in the victim network.
MITRE ATT&CK technique: T1018: Remote System Discovery
APT41 deployed rootkits on Linux systems.
MITRE ATT&CK technique: T1014: Rootkit
APT41 has used rundll32.exe to execute a loader.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
APT41 has transferred implant files using Windows Admin Shares and the Server Message Block protocol, then executes files through Windows Management Instrumentation .
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
APT41 uses the Chinese website fofa.su, similar to the Shodan scanning service, for passive scanning of victims.
MITRE ATT&CK technique: T1596.005: Search Open Technical Databases- Scan Databases
APT41 used a compromised account to create a scheduled task on a system.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
APT41 extracted user account data from the Security Account Managerr , making a copy of this database from the registry using the reg save command or by exploiting volume shadow copies.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
APT41 used svchost.exe and Net to execute a system service installed to launch a Cobalt Strike BEACON loader.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
APT41 uses packers such as Themida to obfuscate malicious files.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
APT41 sent spearphishing emails with attachments such as compiled HTML files to initially compromise their victims.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
APT41 uses multiple built-in commands such as systeminfo and `net config Workstation` to enumerate victim system basic configuration information.
MITRE ATT&CK technique: T1082: System Information Discovery
APT41 collected MAC addresses from victim machines.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
APT41 has enumerated IP addresses of network resources and used the netstat command as part of network reconnaissance. The group has also used a malware variant, HIGHNOON, to enumerate active RDP sessions.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
APT41 has executed whoami commands, including using the WMIEXEC utility to execute this on remote machines.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
APT41 has obtained and used tools such as Mimikatz, pwdump, PowerSploit, and Windows Credential Editor.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
APT41 used Linux shell commands for system survey and information gathering prior to exploitation of vulnerabilities such as CVE-2019-19871.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
APT41 used compromised credentials to log on to other systems.
MITRE ATT&CK technique: T1078: Valid Accounts
APT41 used the Acunetix SQL injection vulnerability scanner in target reconnaissance operations, as well as the JexBoss tool to identify vulnerabilities in Java applications.
MITRE ATT&CK technique: T1595.002: Active Scanning- Vulnerability Scanning
APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
APT41 used cmd.exe /c to execute commands on remote machines. APT41 used a batch file to install persistence for the Cobalt Strike BEACON loader.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit. APT41 has executed files through Windows Management Instrumentation .
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
APT41 modified legitimate Windows services to install malware backdoors. APT41 created the StorSyncSvc service to provide persistence for Cobalt Strike.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
APT41 leverages various tools and frameworks to brute-force directories on web servers.
MITRE ATT&CK technique: T1595.003: Active Scanning- Wordlist Scanning
APT5 has created their own accounts with Local Administrator privileges to maintain access to systems with short-cycle credential rotation.
MITRE ATT&CK technique: T1098.007: Account Manipulation- Additional Local or Domain Groups
APT5 has used the JAR/ZIP file format for exfiltrated files.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
APT5 has cleared the command history on targeted ESXi servers.
MITRE ATT&CK technique: T1070.003: Indicator Removal- Clear Command History
APT5 has accessed Microsoft M365 cloud environments using stolen credentials.
MITRE ATT&CK technique: T1078.004: Valid Accounts- Cloud Accounts
APT5 has modified legitimate binaries and scripts for Pulse Secure VPNs including the legitimate DSUpgrade.pm file to install the ATRIUM webshell for persistence.
MITRE ATT&CK technique: T1554: Compromise Host Software Binary
APT5 has made modifications to the crontab file including in `/var/cron/tabs/`.
MITRE ATT&CK technique: T1053.003: Scheduled Task/Job- Cron
APT5 has used legitimate account credentials to move laterally through compromised environments.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
APT5 has exploited vulnerabilities in externally facing software and devices including Pulse Secure VPNs and Citrix Application Delivery Controllers.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
APT5 has deleted scripts and web shells to evade detection.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
APT5 has used the BLOODMINE utility to discover files with .css, .jpg, .png, .gif, .ico, .js, and .jsp extensions in Pulse Secure Connect logs.
MITRE ATT&CK technique: T1083: File and Directory Discovery
APT5 has used the CLEANPULSE utility to insert command line strings into a targeted process to prevent certain log events from occurring.
MITRE ATT&CK technique: T1562.006: Impair Defenses- Indicator Blocking
APT5 has used the THINBLOOD utility to clear SSL VPN log files located at `/home/runtime/logs`.
MITRE ATT&CK technique: T1070: Indicator Removal
APT5 has used malware with keylogging capabilities to monitor the communications of targeted entities.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
APT5 has used the Task Manager process to target LSASS process memory in order to obtain NTLM password hashes. APT5 has also dumped clear text passwords and hashes from memory using Mimikatz hosted through an RDP mapped drive.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
APT5 has created Local Administrator accounts to maintain access to systems with short-cycle credential rotation.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account