sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
APT12 has used multiple variants of DNS Calculation including multiplying the first two octets of an IP address and adding the third octet to that value in order to get a resulting command and control port.
MITRE ATT&CK technique: T1568.003: Dynamic Resolution- DNS Calculation
APT12 has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities and vulnerabilities in Adobe Reader and Flash .
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
APT12 has attempted to get victims to open malicious Microsoft Word and PDF attachment sent via spearphishing.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
APT12 has sent emails with malicious Microsoft Office documents and PDFs attached.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
APT16 has compromised otherwise legitimate sites as staging servers for second-stage payloads.
MITRE ATT&CK technique: T1584.004: Compromise Infrastructure- Server
APT17 has created and cultivated profile pages in Microsoft TechNet. To make profile pages appear more legitimate, APT17 has created biographical sections and posted in forum threads.
MITRE ATT&CK technique: T1585: Establish Accounts
APT17 has created profile pages in Microsoft TechNet that were used as C2 infrastructure.
MITRE ATT&CK technique: T1583.006: Acquire Infrastructure- Web Services
APT18 actors used the native at Windows task scheduler tool to use scheduled tasks for execution on a victim network.
MITRE ATT&CK technique: T1053.002: Scheduled Task/Job- At
APT18 uses DNS for C2 communications.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
APT18 obfuscates strings in the payload.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
APT18 actors leverage legitimate credentials to log into external remote services.
MITRE ATT&CK technique: T1133: External Remote Services
APT18 actors deleted tools and batch files from victim systems.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
APT18 can list files information for specific directories.
MITRE ATT&CK technique: T1083: File and Directory Discovery
APT18 can upload a file to the victim’s machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
APT18 establishes persistence via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
APT18 can collect system information from the victim’s machine.
MITRE ATT&CK technique: T1082: System Information Discovery
APT18 actors leverage legitimate credentials to log into external remote services.
MITRE ATT&CK technique: T1078: Valid Accounts
APT18 uses HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
APT18 uses cmd.exe to execute commands on the victim’s machine.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
APT19 used Base64 to obfuscate executed commands.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
APT19 downloaded and launched code within a SCT file.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
APT19 launched an HTTP malware variant and a Port 22 malware variant using a legitimate executable that loaded the malicious DLL.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
An APT19 HTTP malware variant decrypts strings using single-byte XOR keys.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
APT19 performed a watering hole attack on forbes.com in 2014 to compromise targets.
MITRE ATT&CK technique: T1189: Drive-by Compromise
APT19 used Base64 to obfuscate payloads.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
APT19 attempted to get users to launch malicious attachments delivered via spearphishing emails.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
APT19 uses a Port 22 malware variant to modify several Registry keys.
MITRE ATT&CK technique: T1112: Modify Registry
APT19 used PowerShell commands to execute payloads.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
An APT19 HTTP malware variant establishes persistence by setting the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Debug Tools-%LOCALAPPDATA%\.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
APT19 used Regsvr32 to bypass application control techniques.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
APT19 configured its payload to inject into the rundll32.exe.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
APT19 sent spearphishing emails with malicious attachments in RTF and XLSM formats to deliver initial exploits.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
An APT19 HTTP malware variant used Base64 to encode communications to the C2 server.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
APT19 collected system architecture information. APT19 used an HTTP malware variant and a Port 22 malware variant to gather the hostname and CPU information from the victim’s machine.
MITRE ATT&CK technique: T1082: System Information Discovery
APT19 used an HTTP malware variant and a Port 22 malware variant to collect the MAC address and IP address from the victim’s machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
APT19 used an HTTP malware variant and a Port 22 malware variant to collect the victim’s username.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
APT19 has obtained and used publicly-available tools like Empire.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
APT19 used HTTP for C2 communications. APT19 also used an HTTP malware variant to communicate over HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
An APT19 Port 22 malware variant registers itself as a service.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
APT28 has used a Powershell cmdlet to grant the ApplicationImpersonation role to a compromised account.
MITRE ATT&CK technique: T1098.002: Account Manipulation- Additional Email Delegate Permissions
APT28 has used several malicious applications that abused OAuth access tokens to gain access to target email accounts, including Gmail and Yahoo Mail.
MITRE ATT&CK technique: T1550.001: Use Alternate Authentication Material- Application Access Token
APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.
MITRE ATT&CK technique: T1560: Archive Collected Data
APT28 has used a variety of utilities, including WinRAR, to archive collected data with password protection.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.
MITRE ATT&CK technique: T1119: Automated Collection
APT28 has used Google Drive for C2.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
APT28 has deployed a bootkit along with Downdelph to ensure its persistence on the victim. The bootkit shares code with some variants of BlackEnergy.
MITRE ATT&CK technique: T1542.003: Pre-OS Boot- Bootkit
APT28 can perform brute force attacks to obtain credentials.
MITRE ATT&CK technique: T1110: Brute Force
APT28 has cleared event logs, including by using the commands wevtutil cl System and wevtutil cl Security.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
APT28 has used compromised Office 365 service accounts with Global Administrator privileges to collect email from user inboxes.
MITRE ATT&CK technique: T1078.004: Valid Accounts- Cloud Accounts
APT28 uses a tool that captures information from air-gapped computers via an infected USB and transfers it to network-connected computer when the USB is inserted.
MITRE ATT&CK technique: T1092: Communication Through Removable Media
APT28 has used COM hijacking for persistence by replacing the legitimate MMDeviceEnumerator object with a payload.
MITRE ATT&CK technique: T1546.015: Event Triggered Execution- Component Object Model Hijacking
APT28 has harvested user's login credentials.
MITRE ATT&CK technique: T1589.001: Gather Victim Identity Information- Credentials
APT28 has split archived exfiltration files into chunks smaller than 1MB.
MITRE ATT&CK technique: T1030: Data Transfer Size Limits
APT28 has collected files from various information repositories.
MITRE ATT&CK technique: T1213: Data from Information Repositories
APT28 has retrieved internal documents from machines inside victim environments, including by using Forfiles to stage documents before exfiltration.
MITRE ATT&CK technique: T1005: Data from Local System
APT28 has collected files from network shared drives.
MITRE ATT&CK technique: T1039: Data from Network Shared Drive
An APT28 backdoor may collect the entire contents of an inserted USB device.
MITRE ATT&CK technique: T1025: Data from Removable Media
An APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
APT28 registered domains imitating NATO, OSCE security websites, Caucasus information resources, and other organizations.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
APT28 has compromised targets via strategic web compromise utilizing custom exploit kits. APT28 used reflected cross-site scripting against government websites to redirect users to phishing webpages.
MITRE ATT&CK technique: T1189: Drive-by Compromise
APT28 has delivered JHUHUGIT and Koadic by executing PowerShell commands through DDE in Word documents.
MITRE ATT&CK technique: T1559.002: Inter-Process Communication- Dynamic Data Exchange
APT28 has used compromised email accounts to send credential phishing emails.
MITRE ATT&CK technique: T1586.002: Compromise Accounts- Email Accounts
APT28 encrypted a .dll payload using RTL and a custom encryption algorithm. APT28 has also obfuscated payloads with base64, XOR, and RC4.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
APT28 has used a Wi-Fi Pineapple to set up Evil Twin Wi-Fi Poisoning for the purposes of capturing victim credentials or planting espionage-oriented malware.
MITRE ATT&CK technique: T1557.004: Adversary-in-the-Middle- Evil Twin
APT28 has exfiltrated archives of collected data previously staged on a target's OWA server via HTTPS.
MITRE ATT&CK technique: T1048.002: Exfiltration Over Alternative Protocol- Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
APT28 can exfiltrate data over Google Drive.
MITRE ATT&CK technique: T1567: Exfiltration Over Web Service
APT28 has used a variety of public exploits, including CVE 2020-0688 and CVE 2020-17144, to gain execution on vulnerable Microsoft Exchange; they have also conducted SQL injection attacks against external websites.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
APT28 has exploited Microsoft Office vulnerability CVE-2017-0262 for execution.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
APT28 has used CVE-2015-4902 to bypass security features.
MITRE ATT&CK technique: T1211: Exploitation for Defense Evasion
APT28 has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263 to escalate privileges.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
APT28 exploited a Windows SMB Remote Code Execution Vulnerability to conduct lateral movement.
MITRE ATT&CK technique: T1210: Exploitation of Remote Services
APT28 used other victims as proxies to relay command traffic, for instance using a compromised Georgian military email server as a hop point to NATO victims. The group has also used a tool that acts as a proxy to allow C2 even if the victim is behind a router. APT28 has also used a machine to relay and obscure communications between CHOPSTICK and their server.
MITRE ATT&CK technique: T1090.002: Proxy- External Proxy
APT28 has used Tor and a variety of commercial VPN services to route brute force authentication attempts.
MITRE ATT&CK technique: T1133: External Remote Services
APT28 has intentionally deleted computer files to cover their tracks, including with use of the program CCleaner.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection. The group also searched a compromised DCCC computer for specific terms.
MITRE ATT&CK technique: T1083: File and Directory Discovery
APT28 has saved files with hidden file attributes.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
APT28 has used the WindowStyle parameter to conceal PowerShell windows.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
APT28 has downloaded additional files, including by using a first-stage downloader to contact the C2 server to obtain the second-stage implant.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
APT28 added "junk data" to each encoded string, preventing trivial decoding without knowledge of the junk removal algorithm. Each implant was given a "junk length" value when created, tracked by the controller software to allow seamless communication but prevent analysis of the command protocol on the wire.
MITRE ATT&CK technique: T1001.001: Data Obfuscation- Junk Data
APT28 has used tools to perform keylogging.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
APT28 regularly deploys both publicly available ) and custom password retrieval tools on victims. They have also dumped the LSASS process memory using the MiniDump function.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
APT28 has stored captured credential information in a file named pi.log.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
An APT28 loader Trojan adds the Registry key HKCU\Environment\UserInitMprLogonScript to establish persistence.
MITRE ATT&CK technique: T1037.001: Boot or Logon Initialization Scripts- Logon Script (Windows)
APT28 has used IMAP, POP3, and SMTP for a communication channel in various implants, including using self-registered Google Mail accounts and later compromised email servers of its victims.
MITRE ATT&CK technique: T1071.003: Application Layer Protocol- Mail Protocols
APT28 attempted to get users to click on Microsoft Office attachments containing malicious macro scripts.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
APT28 has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
APT28 has renamed the WinRAR utility to avoid detection.
MITRE ATT&CK technique: T1036: Masquerading
APT28 has changed extensions on files containing exfiltrated data to make them appear benign, and renamed a web shell instance to appear as a legitimate OWA page.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
APT28 has routed traffic over Tor and VPN servers to obfuscate their activities.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
APT28 has used the ntdsutil.exe utility to export the Active Directory database for credential access.
MITRE ATT&CK technique: T1003.003: OS Credential Dumping- NTDS
In 2016, APT28 conducted a distributed denial of service attack against the World Anti-Doping Agency.
MITRE ATT&CK technique: T1498: Network Denial of Service
APT28 compromised Ubiquiti network devices to act as collection devices for credentials compromised via phishing webpages.
MITRE ATT&CK technique: T1584.008: Compromise Infrastructure- Network Devices
APT28 deployed the open source tool Responder to conduct NetBIOS Name Service poisoning, which captured usernames and hashed passwords that allowed access to legitimate credentials. APT28 close-access teams have used Wi-Fi pineapples to intercept Wi-Fi signals and user credentials.
MITRE ATT&CK technique: T1040: Network Sniffing
APT28 regularly deploys both publicly available ) and custom password retrieval tools on victims.
MITRE ATT&CK technique: T1003: OS Credential Dumping
APT28 has used the Office Test persistence mechanism within Microsoft Office by adding the Registry key HKCU\Software\Microsoft\Office test\Special\Perf to execute code.
MITRE ATT&CK technique: T1137.002: Office Application Startup- Office Test
APT28 has used pass the hash for lateral movement.
MITRE ATT&CK technique: T1550.002: Use Alternate Authentication Material- Pass the Hash
APT28 has used a brute-force/password-spray tooling that operated in two modes: in brute-force mode it typically sent over 300 authentication attempts per hour per targeted account over the course of several hours or days. APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password guessing attacks.
MITRE ATT&CK technique: T1110.001: Brute Force- Password Guessing
APT28 has used a brute-force/password-spray tooling that operated in two modes: in password-spraying mode it conducted approximately four authentication attempts per hour per targeted account over the course of several days or weeks. APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password spray attacks.
MITRE ATT&CK technique: T1110.003: Brute Force- Password Spraying
APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
APT28 has used spearphishing to compromise credentials.
MITRE ATT&CK technique: T1598: Phishing for Information
APT28 downloads and executes PowerShell scripts and performs PowerShell commands.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.
MITRE ATT&CK technique: T1057: Process Discovery
APT28 has deployed malware that has copied itself to the startup directory for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
APT28 has staged archives of collected data on a target's Outlook Web Access server.
MITRE ATT&CK technique: T1074.002: Data Staged- Remote Data Staging
APT28 has collected emails from victim Microsoft Exchange servers.
MITRE ATT&CK technique: T1114.002: Email Collection- Remote Email Collection
APT28 uses a tool to infect connected USB devices and transmit itself to air-gapped computers when the infected USB device is inserted.
MITRE ATT&CK technique: T1091: Replication Through Removable Media
APT28 has used a UEFI rootkit known as LoJax.
MITRE ATT&CK technique: T1014: Rootkit
APT28 executed CHOPSTICK by using rundll32 commands such as rundll32.exe “C:\Windows\twain_64.dll”. APT28 also executed a .dll for a first stage dropper using rundll32.exe. An APT28 loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
APT28 has mapped network drives using Net and administrator credentials.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
APT28 has used tools to take screenshots from victims.
MITRE ATT&CK technique: T1113: Screen Capture
APT28 has collected information from Microsoft SharePoint services within target networks.
MITRE ATT&CK technique: T1213.002: Data from Information Repositories- Sharepoint
APT28 sent spearphishing emails containing malicious Microsoft Office and RAR attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
APT28 has conducted credential phishing campaigns with links that redirect to credential harvesting sites.
MITRE ATT&CK technique: T1598.003: Phishing for Information- Spearphishing Link
APT28 has used several malicious applications to steal user OAuth access tokens including applications masquerading as "Google Defender" "Google Email Protection," and "Google Scanner" for Gmail users. They also targeted Yahoo users with applications masquerading as "Delivery Service" and "McAfee Email Protection".
MITRE ATT&CK technique: T1528: Steal Application Access Token
APT28 installed a Delphi backdoor that used a custom algorithm for C2 communications.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
APT28 used weaponized Microsoft Word documents abusing the remote template function to retrieve a malicious macro.
MITRE ATT&CK technique: T1221: Template Injection
APT28 has performed timestomping on victim files.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
APT28 has used CVE-2015-1701 to access the SYSTEM token and copy it into the current process as part of privilege escalation.
MITRE ATT&CK technique: T1134.001: Access Token Manipulation- Token Impersonation/Theft
APT28 has obtained and used open-source tools like Koadic, Mimikatz, and Responder.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Once APT28 gained access to the DCCC network, the group then proceeded to use that access to compromise the DNC network.
MITRE ATT&CK technique: T1199: Trusted Relationship
APT28 has used legitimate credentials to gain initial access, maintain access, and exfiltrate data from a victim network. The group has specifically used credentials stolen through a spearphishing email to login to the DCCC network. The group has also leveraged default manufacturer's passwords to gain initial access to corporate networks via IoT devices such as a VOIP phone, printer, and video decoder.
MITRE ATT&CK technique: T1078: Valid Accounts
APT28 hosted phishing domains on free services for brief periods of time during campaigns.
MITRE ATT&CK technique: T1583.003: Acquire Infrastructure- Virtual Private Server
APT28 has performed large-scale scans in an attempt to find vulnerable servers.
MITRE ATT&CK technique: T1595.002: Active Scanning- Vulnerability Scanning
Later implants used by APT28, such as CHOPSTICK, use a blend of HTTP, HTTPS, and other legitimate channels for C2, depending on module configuration.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
APT28 has used newly-created Blogspot pages for credential harvesting operations.
MITRE ATT&CK technique: T1583.006: Acquire Infrastructure- Web Services
APT28 has used a modified and obfuscated version of the reGeorg web shell to maintain persistence on a target's Outlook Web Access server.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
An APT28 loader Trojan uses a cmd.exe and batch script to run its payload. The group has also used macros to execute payloads.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
APT29 used sticky-keys to obtain unauthenticated, privileged console access.
MITRE ATT&CK technique: T1546.008: Event Triggered Execution- Accessibility Features
APT29 has used a compromised global administrator account in Azure AD to backdoor a service principal with `ApplicationImpersonation` rights to start collecting emails from targeted mailboxes; APT29 has also used compromised accounts holding `ApplicationImpersonation` rights in Exchange to collect emails.
MITRE ATT&CK technique: T1098.002: Account Manipulation- Additional Email Delegate Permissions
APT29 used large size files to avoid detection by security solutions with hardcoded size limits.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
APT29 has hijacked legitimate application-specific startup scripts to enable malware to execute on system startup.
MITRE ATT&CK technique: T1037: Boot or Logon Initialization Scripts
APT29 has bypassed UAC.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
APT29 has leveraged the Microsoft Graph API to perform various actions across Azure and M365 environments. They have also utilized AADInternals PowerShell Modules to access the API
MITRE ATT&CK technique: T1059.009: Command and Scripting Interpreter- Cloud API
APT29 has conducted enumeration of Azure AD accounts.
MITRE ATT&CK technique: T1087.004: Account Discovery- Cloud Account
APT29 can create new users through Azure AD.
MITRE ATT&CK technique: T1136.003: Create Account- Cloud Account
APT29 has used residential proxies, including Azure Virtual Machines, to obfuscate their access to victim environments.
MITRE ATT&CK technique: T1586.003: Compromise Accounts- Cloud Accounts
APT29 has gained access to a global administrator account in Azure AD and has used `Service Principal` credentials in Exchange.
MITRE ATT&CK technique: T1078.004: Valid Accounts- Cloud Accounts
APT29 has used Azure Run Command and Azure Admin-on-Behalf-of to execute code on virtual machines.
MITRE ATT&CK technique: T1651: Cloud Administration Command
APT29 has leveraged compromised high-privileged on-premises accounts synced to Office 365 to move laterally into a cloud environment, including through the use of Azure AD PowerShell.
MITRE ATT&CK technique: T1021.007: Remote Services- Cloud Services
APT29 has stolen data from compromised hosts.
MITRE ATT&CK technique: T1005: Data from Local System
APT29 has enrolled their own devices into compromised cloud tenants, including enrolling a device in MFA to an Azure AD environment following a successful password guessing attack against a dormant account.
MITRE ATT&CK technique: T1098.005: Account Manipulation- Device Registration
APT29 has created self-signed digital certificates to enable mutual TLS authentication for malware.
MITRE ATT&CK technique: T1587.003: Develop Capabilities- Digital Certificates
APT29 has disabled Purview Audit on targeted accounts prior to stealing emails from Microsoft 365 tenants.
MITRE ATT&CK technique: T1562.008: Impair Defenses- Disable or Modify Cloud Logs
APT29 has used the meek domain fronting plugin for Tor to hide the destination of C2 traffic.
MITRE ATT&CK technique: T1090.004: Proxy- Domain Fronting
APT29 has used Dynamic DNS providers for their malware C2 infrastructure.
MITRE ATT&CK technique: T1568: Dynamic Resolution
APT29 has compromised email accounts to further enable phishing campaigns and taken control of dormant accounts.
MITRE ATT&CK technique: T1586.002: Compromise Accounts- Email Accounts
APT29 has used multiple layers of encryption within malware to protect C2 communication.
MITRE ATT&CK technique: T1573: Encrypted Channel
APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
APT29 has used multiple software exploits for common client software, like Microsoft Word, Exchange, and Adobe Reader, to gain code execution.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
APT29 has exploited CVE-2021-36934 to escalate privileges on a compromised host.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
APT29 uses compromised residential endpoints as proxies for defense evasion and network access.
MITRE ATT&CK technique: T1090.002: Proxy- External Proxy
APT29 has used compromised identities to access networks via VPNs and Citrix.
MITRE ATT&CK technique: T1133: External Remote Services
APT29 has used SDelete to remove artifacts from victim networks.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
APT29 has embedded an ISO file within an HTML attachment that contained JavaScript code to initiate malware execution.
MITRE ATT&CK technique: T1027.006: Obfuscated Files or Information- HTML Smuggling
APT29 uses compromised residential endpoints, typically within the same ISP IP address range, as proxies to hide the true source of C2 traffic.
MITRE ATT&CK technique: T1665: Hide Infrastructure
APT29 has edited the `Microsoft.IdentityServer.Servicehost.exe.config` file to load a malicious DLL into the AD FS process, thereby enabling persistent access to any service federated with AD FS for a user with a specified User Principal Name.
MITRE ATT&CK technique: T1556.007: Modify Authentication Process- Hybrid Identity
APT29 has downloaded additional tools and malware onto compromised networks.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
APT29 has ensured web servers in a victim environment are Internet accessible before copying tools or malware to it.
MITRE ATT&CK technique: T1016.001: System Network Configuration Discovery- Internet Connection Discovery
APT29 has used the `reg save` command to extract LSA secrets offline.
MITRE ATT&CK technique: T1003.004: OS Credential Dumping- LSA Secrets
APT29 targets dormant or inactive user accounts, accounts belonging to individuals no longer at the organization but whose accounts remain on the system, for access and persistence.
MITRE ATT&CK technique: T1078.003: Valid Accounts- Local Accounts
APT29 has used various forms of spearphishing attempting to get a user to open attachments, including, but not limited to, malicious Microsoft Word documents, .pdf, and .lnk files.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
APT29 has used various forms of spearphishing attempting to get a user to click on a malicious link.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
APT29 has used unique malware in many of their operations.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
APT29 has embedded ISO images and VHDX files in HTML to evade Mark-of-the-Web.
MITRE ATT&CK technique: T1553.005: Subvert Trust Controls- Mark-of-the-Web Bypass
APT29 has renamed malicious DLLs with legitimate names to appear benign; they have also created an Azure AD certificate with a Common Name that matched the display name of the compromised service principal.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
APT29 has use `mshta` to execute malicious scripts on a compromised host.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
APT29 has used repeated MFA requests to gain access to victim accounts.
MITRE ATT&CK technique: T1621: Multi-Factor Authentication Request Generation
A backdoor used by APT29 created a Tor hidden service to forward traffic from the Tor client to local ports 3389 , 139 , and 445 enabling full remote access from outside the network and has also used TOR.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
APT29 used Kerberos ticket attacks for lateral movement.
MITRE ATT&CK technique: T1550.003: Use Alternate Authentication Material- Pass the Ticket
APT29 has successfully conducted password guessing attacks against a list of mailboxes.
MITRE ATT&CK technique: T1110.001: Brute Force- Password Guessing
APT29 has conducted brute force password spray attacks.
MITRE ATT&CK technique: T1110.003: Brute Force- Password Spraying
APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
APT29 has developed malware variants written in Python.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
APT29 has installed a run command on a compromised system to enable malware execution on system startup.
MITRE ATT&CK technique: T1037.004: Boot or Logon Initialization Scripts- RC Scripts
APT29 added Registry Run keys to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
APT29 has collected emails from targeted mailboxes within a compromised Azure AD tenant and compromised Exchange servers, including via Exchange Web Services API requests.
MITRE ATT&CK technique: T1114.002: Email Collection- Remote Email Collection
APT29 has used named and hijacked scheduled tasks to establish persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
APT29 has used the `reg save` command to save registry hives.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
APT29 used UPX to pack files.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
APT29 has used spearphishing emails with an attachment to deliver files with exploits to initial victims.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
APT29 has used spearphishing with a link to trick victims into clicking on a link to a zip file containing malicious files.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
APT29 has used the legitimate mailing service Constant Contact to send phishing e-mails.
MITRE ATT&CK technique: T1566.003: Phishing- Spearphishing via Service
APT29 uses stolen tokens to access victim accounts, without needing a password.
MITRE ATT&CK technique: T1528: Steal Application Access Token
APT29 has abused misconfigured AD CS certificate templates to impersonate admin users and create additional authentication certificates.
MITRE ATT&CK technique: T1649: Steal or Forge Authentication Certificates
APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
APT29 has obtained and used a variety of tools including Mimikatz, SDelete, Tor, meek, and Cobalt Strike.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
APT29 has compromised IT, cloud services, and managed services providers to gain broad access to multiple customers for subsequent operations.
MITRE ATT&CK technique: T1199: Trusted Relationship
APT29 has used a compromised account to access an organization's VPN infrastructure.
MITRE ATT&CK technique: T1078: Valid Accounts
APT29 has conducted widespread scanning of target environments to identify vulnerabilities for exploit.
MITRE ATT&CK technique: T1595.002: Active Scanning- Vulnerability Scanning
APT29 has registered algorithmically generated Twitter handles that are used for C2 by malware, such as HAMMERTOSS. APT29 has also used legitimate web services such as Dropbox and Constant Contact in their operations.
MITRE ATT&CK technique: T1583.006: Acquire Infrastructure- Web Services
APT29 has installed web shells on exploited Microsoft Exchange servers.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
APT29 used WMI to steal credentials and execute backdoors at a future time.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
APT29 has used WMI event subscriptions for persistence.
MITRE ATT&CK technique: T1546.003: Event Triggered Execution- Windows Management Instrumentation Event Subscription
APT3 replaces the Sticky Keys binary C:\Windows\System32\sethc.exe for persistence.
MITRE ATT&CK technique: T1546.008: Event Triggered Execution- Accessibility Features
APT3 has been known to add created accounts to local admin groups to maintain elevated access.
MITRE ATT&CK technique: T1098.007: Account Manipulation- Additional Local or Domain Groups
APT3 has used tools to compress data before exfilling it.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
APT3 has a tool that can locate credentials in files on the file system such as those from Firefox or Chrome.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
APT3 has used tools to dump passwords from browsers.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
APT3 has been known to side load DLLs with a valid version of Chrome with one of their tools.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
APT3 will identify Microsoft Office documents on the victim's computer.
MITRE ATT&CK technique: T1005: Data from Local System
APT3 leverages valid accounts after gaining credentials for use within the victim domain.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
APT3 has a tool that exfiltrates data over the C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
APT3 has exploited the Adobe Flash Player vulnerability CVE-2015-3113 and Internet Explorer vulnerability CVE-2014-1776.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
An APT3 downloader establishes SOCKS5 connections for its initial C2.
MITRE ATT&CK technique: T1090.002: Proxy- External Proxy
APT3 has a tool that can delete files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
APT3 has a tool that looks for files and directories on the local file system.
MITRE ATT&CK technique: T1083: File and Directory Discovery
APT3 has been known to use -WindowStyle Hidden to conceal PowerShell windows.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
APT3 has been known to remove indicators of compromise from tools.
MITRE ATT&CK technique: T1027.005: Obfuscated Files or Information- Indicator Removal from Tools
APT3 has a tool that can copy files to remote machines.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
APT3 has used a keylogging tool that records keystrokes in encrypted files.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
APT3 has used a tool to dump credentials by injecting itself into lsass.exe and triggering with the argument "dig."
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
APT3 has used a tool that can obtain info about local and global group users, power users, and administrators.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
APT3 has been known to create or enable accounts, such as support_388945a0.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
APT3 has been known to stage files for exfiltration in a single location.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
APT3 has lured victims into clicking malicious links delivered through spearphishing.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
APT3 has been known to create or enable accounts, such as support_388945a0.
MITRE ATT&CK technique: T1036.010: Masquerading- Masquerade Account Name
An APT3 downloader first establishes a SOCKS5 connection to 192.157.198.103 using TCP port 1913; once the server response is verified, it then requests a connection to 192.184.60.229 on TCP port 81.
MITRE ATT&CK technique: T1104: Multi-Stage Channels
An APT3 downloader establishes SOCKS5 connections for its initial C2.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
APT3 obfuscates files or information to help evade defensive measures.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
APT3 has been known to brute force password hashes to be able to leverage plain text credentials.
MITRE ATT&CK technique: T1110.002: Brute Force- Password Cracking
APT3 has a tool that can enumerate the permissions associated with Windows groups.
MITRE ATT&CK technique: T1069: Permission Groups Discovery
APT3 has used PowerShell on victim systems to download and run payloads after exploitation.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
APT3 has a tool that can list out currently running processes.
MITRE ATT&CK technique: T1057: Process Discovery
APT3 places scripts in the startup folder for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
APT3 enables the Remote Desktop Protocol for persistence. APT3 has also interacted with compromised systems to browse and copy files through RDP sessions.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
APT3 has a tool that can detect the existence of remote systems.
MITRE ATT&CK technique: T1018: Remote System Discovery
APT3 has a tool that can run DLLs.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
APT3 will copy files over to Windows Admin Shares as part of lateral movement.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
An APT3 downloader creates persistence by creating the following scheduled task: schtasks /create /tn "mysc" /tr C:\Users\Public\test.exe /sc ONLOGON /ru "System".
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
APT3 has been known to pack their tools.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
APT3 has sent spearphishing emails containing malicious links.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
APT3 has a tool that can obtain information about the local system.
MITRE ATT&CK technique: T1082: System Information Discovery
A keylogging tool used by APT3 gathers network information from the victim, including the MAC address, IP address, WINS, DHCP server, and gateway.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
APT3 has a tool that can enumerate current network connections.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
An APT3 downloader uses the Windows command "cmd.exe" /C whoami to verify that it is running with the elevated privileges of “System.”
MITRE ATT&CK technique: T1033: System Owner/User Discovery
An APT3 downloader uses the Windows command "cmd.exe" /C whoami. The group also uses a tool to execute commands on remote computers.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
APT3 has a tool that creates a new service for persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
APT30 has relied on users to execute malicious file attachments delivered via spearphishing emails.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
APT30 has used spearphishing emails with malicious DOC attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
APT32's backdoor has used LZMA compression and RC4 encryption before exfiltration.
MITRE ATT&CK technique: T1560: Archive Collected Data
APT32 includes garbage code to mislead anti-malware software and researchers.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
APT32 has cleared select event log entries.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
APT32 has used the `Invoke-Obfuscation` framework to obfuscate their PowerShell.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
APT32 has used COM scriptlets to download Cobalt Strike beacons.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
APT32 used Outlook Credential Dumper to harvest credentials stored in Windows registry.
MITRE ATT&CK technique: T1552.002: Unsecured Credentials- Credentials in Registry
APT32 ran legitimately-signed executables from Symantec and McAfee which load a malicious DLL. The group also side-loads its backdoor by dropping a library and a legitimate, signed executable .
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
APT32 has set up and operated websites to gather information and deliver malware.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
APT32 has infected victims by tricking them into visiting compromised watering hole websites.
MITRE ATT&CK technique: T1189: Drive-by Compromise
APT32 has stood up websites containing numerous articles and content scraped from the Internet to make them appear legitimate, but some of these pages include malicious JavaScript to profile the potential victim or infect them via a fake software update.
MITRE ATT&CK technique: T1608.004: Stage Capabilities- Drive-by Target
APT32 has collected e-mail addresses for activists and bloggers in order to target them with spyware.
MITRE ATT&CK technique: T1589.002: Gather Victim Identity Information- Email Addresses
APT32 has performed code obfuscation, including encoding payloads using Base64 and using a framework called "Dont-Kill-My-Cat . APT32 also encrypts the library used for network exfiltration with AES-256 in CBC mode in their macOS backdoor.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
APT32's backdoor has exfiltrated data using the already opened channel with its C&C server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
APT32's backdoor can exfiltrate data by encoding it in the subdomain field of DNS packets.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
APT32 has used RTF document that includes an exploit to execute malicious code.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
APT32 has used CVE-2016-7255 to escalate privileges.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
APT32's macOS backdoor can receive a “delete” command.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
APT32's backdoor possesses the capability to list files and directories on a machine.
MITRE ATT&CK technique: T1083: File and Directory Discovery
APT32's backdoor has stored its configuration in a registry key.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
APT32 has conducted targeted surveillance against activists and bloggers.
MITRE ATT&CK technique: T1589: Gather Victim Identity Information
APT32's macOS backdoor hides the clientID file via a chflags function.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
APT32 has used the WindowStyle parameter to conceal PowerShell windows.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
APT32 has added JavaScript to victim websites to download additional frameworks that profile and compromise website visitors.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
APT32 has used JavaScript for drive-by downloads and C2 communications.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
APT32 has abused the PasswordChangeNotify to monitor for and capture account password changes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
APT32 used Mimikatz and customized versions of Windows Credential Dumper to harvest credentials.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
APT32 has deployed tools after moving laterally using administrative accounts.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
APT32's macOS backdoor changes the permission of the file it wants to execute to 755.
MITRE ATT&CK technique: T1222.002: File and Directory Permissions Modification- Linux and Mac File and Directory Permissions Modification
APT32 enumerated administrative users using the commands net localgroup administrators.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
APT32 has used legitimate local admin account credentials.
MITRE ATT&CK technique: T1078.003: Valid Accounts- Local Accounts
APT32 has used email for C2 via an Office macro.
MITRE ATT&CK technique: T1071.003: Application Layer Protocol- Mail Protocols
APT32 has attempted to lure users to execute a malicious dropper delivered via a spearphishing attachment.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
APT32 has lured targets to download a Cobalt Strike beacon by including a malicious link within spearphishing emails.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
APT32 has used hidden or non-printing characters to help masquerade service names, such as appending a Unicode no-break space character to a legitimate service name. APT32 has also impersonated the legitimate Flash installer file name "install_flashplayer.exe".
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
APT32 has disguised a Cobalt Strike beacon as a Flash Installer.
MITRE ATT&CK technique: T1036: Masquerading
APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update. APT32 has also renamed a Cobalt Strike beacon payload to install_flashplayers.exe.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
APT32's backdoor has modified the Windows Registry to store the backdoor's configuration.
MITRE ATT&CK technique: T1112: Modify Registry