sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
APT5 has staged data on compromised systems prior to exfiltration often in `C:\Users\Public`.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
APT5 has used the BLOODMINE utility to parse and extract information from Pulse Secure Connect logs.
MITRE ATT&CK technique: T1654: Log Enumeration
APT5 has named exfiltration archives to mimic Windows Updates at times using filenames with a `KB.zip` pattern.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
APT5 has used PowerShell to accomplish tasks within targeted environments.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
APT5 has used Windows-based utilities to carry out tasks including tasklist.exe.
MITRE ATT&CK technique: T1057: Process Discovery
APT5 has used the CLEANPULSE utility to insert command line strings into a targeted process to alter its functionality.
MITRE ATT&CK technique: T1055: Process Injection
APT5 has moved laterally throughout victim environments using RDP.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
APT5 has used SSH for lateral movement in compromised environments including for enabling access to ESXi host servers.
MITRE ATT&CK technique: T1021.004: Remote Services- SSH
APT5 has copied and exfiltrated the SAM Registry hive from targeted systems.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
APT5 has used the BLOODMINE utility to collect data on web requests from Pulse Secure Connect logs.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
APT5 has modified file timestamps.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
APT5 has installed multiple web shells on compromised servers including on Pulse Secure VPN appliances.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
APT5 has used cmd.exe for execution on compromised systems.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Agrius typically uses commercial VPN services for anonymizing last-hop traffic to victim networks, such as ProtonVPN.
MITRE ATT&CK technique: T1583: Acquire Infrastructure
Agrius used 7zip to archive extracted data in preparation for exfiltration.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
Agrius used a custom tool, sql.net4.exe, to query SQL databases and then identify and extract personally identifiable information.
MITRE ATT&CK technique: T1119: Automated Collection
Agrius engaged in various brute forcing activities via SMB in victim environments.
MITRE ATT&CK technique: T1110: Brute Force
Agrius gathered data from database and other critical servers in victim environments, then used wiping mechanisms as an anti-analysis and anti-forensics mechanism.
MITRE ATT&CK technique: T1005: Data from Local System
Agrius has deployed base64-encoded variants of ASPXSpy to evade detection.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Agrius used several mechanisms to try to disable security tools. Agrius attempted to modify EDR-related services to disable auto-start on system reboot. Agrius used a publicly available driver, GMER64.sys typically used for anti-rootkit functionality, to selectively stop and remove security software processes.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Agrius attempted to acquire valid credentials for victim environments through various means to enable follow-on lateral movement.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Agrius exploits public-facing applications for initial access to victim environments. Examples include widespread attempts to exploit CVE-2018-13379 in FortiOS devices and SQL injection activity.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
Agrius used tools such as Mimikatz to dump LSASS memory to capture credentials in victim environments.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Agrius downloaded some payloads for follow-on execution from legitimate filesharing services such as ufile.io and easyupload.io.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
Agrius has used the folder, C:\\windows\\temp\\s\\, to stage data for exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Agrius used the Plink tool for tunneling and connections to remote machines, renaming it systems.exe in some instances.
MITRE ATT&CK technique: T1036: Masquerading
Agrius used the open-source port scanner WinEggDrop to perform detailed scans of hosts of interest in victim networks.
MITRE ATT&CK technique: T1046: Network Service Discovery
Agrius engaged in password spraying via SMB in victim environments.
MITRE ATT&CK technique: T1110.003: Brute Force- Password Spraying
Agrius tunnels RDP traffic through deployed web shells to access victim environments via compromised accounts. Agrius used the Plink tool to tunnel RDP connections for remote access and lateral movement in victim environments.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
Agrius used the tool NBTscan to scan for remote, accessible hosts in victim environments.
MITRE ATT&CK technique: T1018: Remote System Discovery
Agrius dumped the SAM file on victim machines to capture credentials.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
Agrius typically deploys a variant of the ASPXSpy web shell following initial access via exploitation.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
Agrius uses ASPXSpy web shells to enable follow-on command execution via cmd.exe.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Agrius has deployed IPsec Helper malware post-exploitation and registered it as a service for persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Ajax Security Team has used FireMalv custom-developed malware, which collected passwords from the Firefox browser storage.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Ajax Security Team has used Wrapper/Gholee, custom-developed malware, which downloaded additional malware to the infected system.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Ajax Security Team has used CWoolger and MPK, custom-developed malware, which recorded all keystrokes on an infected system.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Ajax Security Team has lured victims into executing malicious files.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Ajax Security Team has used personalized spearphishing attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Ajax Security Team has used various social media channels to spearphish victims.
MITRE ATT&CK technique: T1566.003: Phishing- Spearphishing via Service
Akira deletes administrator accounts in victim networks prior to encryption.
MITRE ATT&CK technique: T1531: Account Access Removal
Akira uses utilities such as WinRAR to archive data prior to exfiltration.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
Akira encrypts files in victim environments as part of ransomware operations.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Akira uses the built-in Nltest utility or tools such as AdFind to enumerate Active Directory trusts in victim environments.
MITRE ATT&CK technique: T1482: Domain Trust Discovery
Akira will exfiltrate victim data using applications such as Rclone.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
Akira uses compromised VPN accounts for initial access to victim networks.
MITRE ATT&CK technique: T1133: External Remote Services
Akira engages in double-extortion ransomware, exfiltrating files then encrypting them, in order to prompt victims to pay a ransom.
MITRE ATT&CK technique: T1657: Financial Theft
Akira uses legitimate utilities such as AnyDesk and PuTTy for maintaining remote access to victim environments.
MITRE ATT&CK technique: T1219: Remote Access Software
Akira uses software such as Advanced IP Scanner and MASSCAN to identify remote hosts within victim networks.
MITRE ATT&CK technique: T1018: Remote System Discovery
Akira has accessed and downloaded information stored in SharePoint instances as part of data gathering and exfiltration activity.
MITRE ATT&CK technique: T1213.002: Data from Information Repositories- Sharepoint
Akira uses valid account information to remotely access victim networks, such as VPN credentials.
MITRE ATT&CK technique: T1078: Valid Accounts
Andariel has collected large numbers of files from compromised network systems for later extraction.
MITRE ATT&CK technique: T1005: Data from Local System
Andariel has used watering hole attacks, often with zero-day exploits, to gain initial access to victims within a specific IP range.
MITRE ATT&CK technique: T1189: Drive-by Compromise
Andariel has exploited numerous ActiveX vulnerabilities, including zero-days.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Andariel has limited its watering hole attacks to specific IP address ranges.
MITRE ATT&CK technique: T1590.005: Gather Victim Network Information- IP Addresses
Andariel has downloaded additional tools and malware onto compromised hosts.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Andariel has attempted to lure victims into enabling malicious macros within email attachments.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Andariel has used a variety of publicly-available remote access Trojans for its operations.
MITRE ATT&CK technique: T1588.001: Obtain Capabilities- Malware
Andariel has used tasklist to enumerate processes and find a specific string.
MITRE ATT&CK technique: T1057: Process Discovery
Andariel has inserted a malicious script within compromised websites to collect potential victim information such as browser type, system language, Flash Player version, and other data.
MITRE ATT&CK technique: T1592.002: Gather Victim Host Information- Software
Andariel has conducted spearphishing campaigns that included malicious Word or Excel attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Andariel has hidden malicious executables within PNG files.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
Andariel has used the netstat -naop tcp command to display TCP connections on a victim's machine.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Aoqin Dragon has exploited CVE-2012-0158 and CVE-2010-3333 for execution against targeted systems.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Aoqin Dragon has run scripts to identify file formats including Microsoft Word.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Aoqin Dragon has spread malware in target networks by copying modules to folders masquerading as removable devices.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
Aoqin Dragon has lured victims into opening weaponized documents, fake external drives, and fake antivirus to execute malicious payloads.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Aoqin Dragon has used custom malware, including Mongall and Heyoka Backdoor, in their operations.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
Aoqin Dragon has used fake icons including antivirus and external drives to disguise malicious payloads.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Aoqin Dragon has used a dropper that employs a worm infection strategy using a removable device to breach a secure network environment.
MITRE ATT&CK technique: T1091: Replication Through Removable Media
Aoqin Dragon has used the Themida packer to obfuscate malicious payloads.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Aoqin Dragon obtained the Heyoka open source exfiltration tool and subsequently modified it for their operations.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Aquatic Panda used the last command in Linux environments to identify recently logged-in users on victim machines.
MITRE ATT&CK technique: T1087: Account Discovery
Aquatic Panda has used several publicly available tools, including WinRAR and 7zip, to compress collected files and memory dumps prior to exfiltration.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
Aquatic Panda cleared command history in Linux environments to remove traces of activity after operations.
MITRE ATT&CK technique: T1070.003: Indicator Removal- Clear Command History
Aquatic Panda clears Windows Event Logs following activity to evade defenses.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
Aquatic Panda has encoded PowerShell commands in Base64.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
Aquatic Panda has used DLL search-order hijacking to load `exe`, `dll`, and `dat` files into memory. Aquatic Panda loaded a malicious DLL into the legitimate Windows Security Health Service executable to execute malicious code on victim systems.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
Aquatic Panda captured local Windows security event log data from victim machines using the wevtutil utility to extract contents to an evtx output file.
MITRE ATT&CK technique: T1005: Data from Local System
Aquatic Panda has attempted to stop endpoint detection and response tools on compromised systems.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Aquatic Panda used multiple mechanisms to capture valid user accounts for victim domains to enable lateral movement and access to additional hosts in victim environments.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
Aquatic Panda modified the ld.so preload file in Linux environments to enable persistence for Winnti malware.
MITRE ATT&CK technique: T1574.006: Hijack Execution Flow- Dynamic Linker Hijacking
Aquatic Panda has deleted malicious executables from compromised machines.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Aquatic Panda has downloaded additional malware onto compromised hosts.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Aquatic Panda has attempted to harvest credentials through LSASS memory dumping.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Aquatic Panda enumerated logs related to authentication in Linux environments prior to deleting selective entries for defense evasion purposes.
MITRE ATT&CK technique: T1654: Log Enumeration
Aquatic Panda has acquired and used njRAT in its operations.
MITRE ATT&CK technique: T1588.001: Obtain Capabilities- Malware
Aquatic Panda created new, malicious services using names such as Windows User Service to attempt to blend in with legitimate items on victim systems.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Aquatic Panda renamed or moved malicious binaries to legitimate locations to evade defenses and blend into victim environments.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Aquatic Panda modified the victim registry to enable the `RestrictedAdmin` mode feature, allowing for pass the hash behaviors to function via RDP.
MITRE ATT&CK technique: T1112: Modify Registry
Aquatic Panda used a registry edit to enable a Windows feature called RestrictedAdmin in victim environments. This change allowed Aquatic Panda to leverage "pass the hash" mechanisms as the alteration allows for RDP connections with a valid account name and hash only, without possessing a cleartext password value.
MITRE ATT&CK technique: T1550.002: Use Alternate Authentication Material- Pass the Hash
Aquatic Panda has downloaded additional scripts and executed Base64 encoded commands in PowerShell.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Aquatic Panda leveraged stolen credentials to move laterally via RDP in victim environments.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
Aquatic Panda used remote scheduled tasks to install malicious software on victim systems during lateral movement actions.
MITRE ATT&CK technique: T1021: Remote Services
Aquatic Panda used rundll32.exe to proxy execution of a malicious DLL file identified as a keylogging binary.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Aquatic Panda used remote shares to enable lateral movement in victim environments.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Aquatic Panda used SSH with captured user credentials to move laterally in victim environments.
MITRE ATT&CK technique: T1021.004: Remote Services- SSH
Aquatic Panda has attempted to discover third party endpoint detection and response tools on compromised systems.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Aquatic Panda has used native OS commands to understand privilege levels and system details.
MITRE ATT&CK technique: T1082: System Information Discovery
Aquatic Panda gathers information on recently logged-in users on victim devices.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Aquatic Panda has attempted to discover services for third party EDR products.
MITRE ATT&CK technique: T1007: System Service Discovery
Aquatic Panda has acquired and used Cobalt Strike in its operations.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Aquatic Panda used malicious shell scripts in Linux environments following access via SSH to install Linux versions of Winnti malware.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
Aquatic Panda has used publicly accessible DNS logging services to identify servers vulnerable to Log4j .
MITRE ATT&CK technique: T1595.002: Active Scanning- Vulnerability Scanning
Aquatic Panda has attempted and failed to run Bash commands on a Windows host by passing them to cmd /C.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Aquatic Panda used WMI for lateral movement in victim environments.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Aquatic Panda created new Windows services for persistence that masqueraded as legitimate Windows services via name change.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Axiom actors have been known to use the Sticky Keys replacement within RDP sessions to obtain persistence.
MITRE ATT&CK technique: T1546.008: Event Triggered Execution- Accessibility Features
Axiom has compressed and encrypted data prior to exfiltration.
MITRE ATT&CK technique: T1560: Archive Collected Data
Axiom has used large groups of compromised machines for use as proxy nodes.
MITRE ATT&CK technique: T1584.005: Compromise Infrastructure- Botnet
Axiom has acquired dynamic DNS services for use in the targeting of intended victims.
MITRE ATT&CK technique: T1583.002: Acquire Infrastructure- DNS Server
Axiom has collected data from a compromised network.
MITRE ATT&CK technique: T1005: Data from Local System
Axiom has used watering hole attacks to gain access.
MITRE ATT&CK technique: T1189: Drive-by Compromise
Axiom has been observed using SQL injection to gain access to systems.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
Axiom has used exploits for multiple vulnerabilities including CVE-2014-0322, CVE-2012-4792, CVE-2012-1889, and CVE-2013-3893.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Axiom has been known to dump credentials.
MITRE ATT&CK technique: T1003: OS Credential Dumping
Axiom has used spear phishing to initially compromise victims.
MITRE ATT&CK technique: T1566: Phishing
Axiom has targeted victims with remote administration tools including RDP.
MITRE ATT&CK technique: T1563.002: Remote Service Session Hijacking- RDP Hijacking
Axiom has used RDP during operations.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
Axiom has used steganography to hide its C2 communications.
MITRE ATT&CK technique: T1001.002: Data Obfuscation- Steganography
Axiom has used digital certificates to deliver malware.
MITRE ATT&CK technique: T1553: Subvert Trust Controls
Axiom has used previously compromised administrative accounts to escalate privileges.
MITRE ATT&CK technique: T1078: Valid Accounts
Axiom has used VPS hosting providers in targeting of intended victims.
MITRE ATT&CK technique: T1583.003: Acquire Infrastructure- Virtual Private Server
BITTER has registered a variety of domains to host malicious payloads and for C2.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
BITTER has executed OLE objects using Microsoft Equation Editor to download and run malicious payloads.
MITRE ATT&CK technique: T1559.002: Inter-Process Communication- Dynamic Data Exchange
BITTER has used DDNS for C2 communications.
MITRE ATT&CK technique: T1568: Dynamic Resolution
BITTER has encrypted their C2 communications.
MITRE ATT&CK technique: T1573: Encrypted Channel
BITTER has used a RAR SFX dropper to deliver malware.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
BITTER has exploited Microsoft Office vulnerabilities CVE-2012-0158, CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
BITTER has exploited CVE-2021-1732 for privilege escalation.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
BITTER has downloaded additional malware and tools onto a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
BITTER has attempted to lure victims into opening malicious attachments delivered via spearphishing.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
BITTER has disguised malware as a Windows Security update service.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
BITTER has used TCP for C2 communications.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
BITTER has used scheduled tasks for persistence and execution.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
BITTER has sent spearphishing emails with a malicious RTF document or Excel spreadsheet.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
BITTER has obtained tools such as PuTTY for use in their operations.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
BITTER has registered domains to stage payloads.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
BITTER has used HTTP POST requests for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
BRONZE BUTLER has compressed data into password-protected RAR archives prior to exfiltration.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
BRONZE BUTLER has used at to register a scheduled task to execute malware during lateral movement.
MITRE ATT&CK technique: T1053.002: Scheduled Task/Job- At
BRONZE BUTLER downloader code has included "0" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
BRONZE BUTLER has used a Windows 10 specific tool and xxmm to bypass UAC for privilege escalation.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
BRONZE BUTLER has used legitimate applications to side-load malicious DLLs.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
BRONZE BUTLER has exfiltrated files stolen from local systems.
MITRE ATT&CK technique: T1005: Data from Local System
BRONZE BUTLER has exfiltrated files stolen from file shares.
MITRE ATT&CK technique: T1039: Data from Network Shared Drive
BRONZE BUTLER's MSGET downloader uses a dead drop resolver to access malicious payloads.
MITRE ATT&CK technique: T1102.001: Web Service- Dead Drop Resolver
BRONZE BUTLER downloads encoded payloads and decodes them on the victim.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
BRONZE BUTLER has incorporated code into several tools that attempts to terminate anti-virus processes.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
BRONZE BUTLER has used net user /domain to identify account information.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
BRONZE BUTLER compromised three Japanese websites using a Flash exploit to perform watering hole attacks.
MITRE ATT&CK technique: T1189: Drive-by Compromise
BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
The BRONZE BUTLER uploader or malware the uploader uses command to delete the RAR archives after they have been exfiltrated.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
BRONZE BUTLER has collected a list of files from the victim and uploaded it to its C2 server, and then created a new list of specific files to steal.
MITRE ATT&CK technique: T1083: File and Directory Discovery
BRONZE BUTLER has used various tools to download files, including DGet .
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
BRONZE BUTLER has used various tools to perform credential dumping.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
BRONZE BUTLER has attempted to get users to launch malicious Microsoft Word attachments delivered via spearphishing emails.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
BRONZE BUTLER has masked executables with document file icons including Word and Adobe PDF.
MITRE ATT&CK technique: T1036: Masquerading
BRONZE BUTLER has given malware the same name as an existing file on the file share server to cause users to unwittingly launch and install the malware on additional systems.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
BRONZE BUTLER has created forged Kerberos Ticket Granting Ticket and Ticket Granting Service tickets to maintain administrative access.
MITRE ATT&CK technique: T1550.003: Use Alternate Authentication Material- Pass the Ticket
BRONZE BUTLER has used PowerShell for execution.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
BRONZE BUTLER has made use of Python-based remote access tools.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
BRONZE BUTLER has used a batch script that adds a Registry Run key to establish malware persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
BRONZE BUTLER typically use ping and Net to enumerate systems.
MITRE ATT&CK technique: T1018: Remote System Discovery
BRONZE BUTLER has used Right-to-Left Override to deceive victims into executing several strains of malware.
MITRE ATT&CK technique: T1036.002: Masquerading- Right-to-Left Override
BRONZE BUTLER has used schtasks to register a scheduled task to execute malware during lateral movement.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
BRONZE BUTLER has used a tool to capture screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
BRONZE BUTLER has used tools to enumerate software installed on an infected host.
MITRE ATT&CK technique: T1518: Software Discovery
BRONZE BUTLER used spearphishing emails with malicious Microsoft Word attachments to infect victims.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Several BRONZE BUTLER tools encode data with base64 when posting it to a C2 server.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
BRONZE BUTLER has used steganography in multiple operations to conceal malicious payloads.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
BRONZE BUTLER has used RC4 encryption and AES to obfuscate HTTP traffic. BRONZE BUTLER has also used a tool called RarStar that encodes data with a custom XOR algorithm when posting it to a C2 server.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
BRONZE BUTLER has used TROJ_GETVERSION to discover system services.
MITRE ATT&CK technique: T1007: System Service Discovery
BRONZE BUTLER has used net time to check the local time on a target system.
MITRE ATT&CK technique: T1124: System Time Discovery
BRONZE BUTLER has placed malware on file shares and given it the same name as legitimate documents on the share.
MITRE ATT&CK technique: T1080: Taint Shared Content
BRONZE BUTLER has obtained and used open-source tools such as Mimikatz, gsecdump, and Windows Credential Editor.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
BRONZE BUTLER has used VBS and VBE scripts for execution.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
BRONZE BUTLER malware has used HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
BRONZE BUTLER has used batch scripts and the command-line interface for execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
BackdoorDiplomacy has executed DLL search order hijacking.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
BackdoorDiplomacy has dropped legitimate software onto a compromised host and used it to execute malicious DLLs.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
BackdoorDiplomacy has exploited CVE-2020-5902, an F5 BIP-IP vulnerability, to drop a Linux backdoor. BackdoorDiplomacy has also exploited mis-configured Plesk servers.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
BackdoorDiplomacy has downloaded additional files and tools onto a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
BackdoorDiplomacy has copied files of interest to the main drive's recycle bin.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
BackdoorDiplomacy has obtained and used leaked malware, including DoublePulsar, EternalBlue, EternalRocks, and EternalSynergy, in its operations.
MITRE ATT&CK technique: T1588.001: Obtain Capabilities- Malware
BackdoorDiplomacy has disguised their backdoor droppers with naming conventions designed to blend into normal operations.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
BackdoorDiplomacy has dropped implants in folders named for legitimate software.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
BackdoorDiplomacy has used SMBTouch, a vulnerability scanner, to determine whether a target is vulnerable to EternalBlue malware.
MITRE ATT&CK technique: T1046: Network Service Discovery
BackdoorDiplomacy has used EarthWorm for network tunneling with a SOCKS5 server and port transfer functionalities.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
BackdoorDiplomacy has obfuscated tools and malware it uses with VMProtect.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
BackdoorDiplomacy has used an executable to detect removable media, such as USB flash drives.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
BackdoorDiplomacy has used NetCat and PortQry to enumerate network connections and display the status of related TCP and UDP ports.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
BackdoorDiplomacy has obtained a variety of open-source reconnaissance and red team tools for discovery and lateral movement.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
BackdoorDiplomacy has used web shells to establish an initial foothold and for lateral movement within a victim's system.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
BlackOasis's first stage shellcode contains a NOP sled with alternative instructions that was likely designed to bypass antivirus tools.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
BlackTech has used stolen code-signing certificates for its malicious payloads.
MITRE ATT&CK technique: T1588.003: Obtain Capabilities- Code Signing Certificates
BlackTech has used DLL side loading by giving DLLs hardcoded names and placing them in searched directories.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
BlackTech has used valid, stolen digital certificates for some of their malware and tools.
MITRE ATT&CK technique: T1588.004: Obtain Capabilities- Digital Certificates
BlackTech has exploited a buffer overflow vulnerability in Microsoft Internet Information Services 6.0, CVE-2017-7269, in order to establish a new HTTP or command and control server.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
BlackTech has used e-mails with malicious documents to lure victims into installing malware.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
BlackTech has used e-mails with malicious links to lure victims into installing malware.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
BlackTech has used built-in API functions.
MITRE ATT&CK technique: T1106: Native API
BlackTech has used the SNScan tool to find other potential targets on victim networks.
MITRE ATT&CK technique: T1046: Network Service Discovery
BlackTech has used right-to-left-override to obfuscate the filenames of malicious e-mail attachments.
MITRE ATT&CK technique: T1036.002: Masquerading- Right-to-Left Override
BlackTech has used Putty for remote access.
MITRE ATT&CK technique: T1021.004: Remote Services- SSH
BlackTech has used spearphishing e-mails with malicious password-protected archived files to deliver malware.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
BlackTech has used spearphishing e-mails with links to cloud services to deliver malware.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
BlackTech has obtained and used tools such as Putty, SNScan, and PsExec for its operations.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Blue Mockingbird has used JuicyPotato to abuse the SeImpersonate token privilege to escalate from web application pool accounts to NT Authority\SYSTEM.
MITRE ATT&CK technique: T1134: Access Token Manipulation
Blue Mockingbird has used wmic.exe and Windows Registry modifications to set the COR_PROFILER environment variable to execute a malicious DLL whenever a process loads the .NET CLR.
MITRE ATT&CK technique: T1574.012: Hijack Execution Flow- COR_PROFILER
Blue Mockingbird has used XMRIG to mine cryptocurrency on victim systems.
MITRE ATT&CK technique: T1496.001: Resource Hijacking- Compute Hijacking
Blue Mockingbird has obfuscated the wallet address in the payload binary.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Blue Mockingbird has gained initial access by exploiting CVE-2019-18935, a vulnerability within Telerik UI for ASP.NET AJAX.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
Blue Mockingbird has used Mimikatz to retrieve credentials from LSASS memory.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Blue Mockingbird has masqueraded their XMRIG payload name by naming it wercplsupporte.dll after the legitimate wercplsupport.dll file.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Blue Mockingbird has used Windows Registry modifications to specify a DLL payload.
MITRE ATT&CK technique: T1112: Modify Registry
Blue Mockingbird has used PowerShell reverse TCP shells to issue interactive commands over a network connection.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Blue Mockingbird has used FRP, ssf, and Venom to establish SOCKS proxy connections.
MITRE ATT&CK technique: T1090: Proxy
Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using regsvr32.exe.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
Blue Mockingbird has used Remote Desktop to log on to servers interactively and manually copy files to remote hosts.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using rundll32.exe.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Blue Mockingbird has used Windows Explorer to manually copy malicious files to remote hosts over SMB.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Blue Mockingbird has used Windows Scheduled Tasks to establish persistence on local and remote hosts.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Blue Mockingbird has executed custom-compiled XMRIG miner DLLs by configuring them to execute via the "wercplsupport" service.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Blue Mockingbird has collected hardware details for the victim's system, including CPU and memory information.
MITRE ATT&CK technique: T1082: System Information Discovery
Blue Mockingbird has obtained and used tools such as Mimikatz.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Blue Mockingbird has used batch script files to automate execution and deployment of payloads.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Blue Mockingbird has used wmic.exe to set environment variables.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Blue Mockingbird has used mofcomp.exe to establish WMI Event Subscription persistence mechanisms configured from a *.mof file.
MITRE ATT&CK technique: T1546.003: Event Triggered Execution- Windows Management Instrumentation Event Subscription
Blue Mockingbird has made their XMRIG payloads persistent as a Windows Service.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
CURIUM has exfiltrated data from a compromised machine.
MITRE ATT&CK technique: T1005: Data from Local System
CURIUM created domains to facilitate strategic website compromise and credential capture activities.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
CURIUM has used strategic website compromise to infect victims with malware such as IMAPLoader.
MITRE ATT&CK technique: T1189: Drive-by Compromise
CURIUM used strategic website compromise to fingerprint then target victims.
MITRE ATT&CK technique: T1608.004: Stage Capabilities- Drive-by Target
CURIUM has created dedicated email accounts for use with tools such as IMAPLoader.
MITRE ATT&CK technique: T1585.002: Establish Accounts- Email Accounts
CURIUM has used SMTPS to exfiltrate collected data from victims.
MITRE ATT&CK technique: T1048.002: Exfiltration Over Alternative Protocol- Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
CURIUM has used IMAP and SMTPS for exfiltration via tools such as IMAPLoader.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
CURIUM has lured users into opening malicious files delivered via social media.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
CURIUM has leveraged PowerShell scripts for initial process execution and data gathering in victim environments.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
CURIUM has created dedicated servers for command and control and exfiltration purposes.
MITRE ATT&CK technique: T1583.004: Acquire Infrastructure- Server
CURIUM has established a network of fictitious social media accounts, including on Facebook and LinkedIn, to establish relationships with victims, often posing as an attractive woman.
MITRE ATT&CK technique: T1585.001: Establish Accounts- Social Media Accounts
CURIUM has used phishing with malicious attachments for initial access to victim environments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
CURIUM used malicious links to adversary-controlled resources for credential harvesting.
MITRE ATT&CK technique: T1598.003: Phishing for Information- Spearphishing Link
CURIUM has used social media to deliver malicious files to victims.
MITRE ATT&CK technique: T1566.003: Phishing- Spearphishing via Service
CURIUM deploys information gathering tools focused on capturing IP configuration, running application, system information, and network connectivity information.
MITRE ATT&CK technique: T1082: System Information Discovery
CURIUM deployed mechanisms to check system time information following strategic website compromise attacks.
MITRE ATT&CK technique: T1124: System Time Discovery
CURIUM created virtual private server instances to facilitate use of malicious domains and other items.
MITRE ATT&CK technique: T1583.003: Acquire Infrastructure- Virtual Private Server
CURIUM has compromised legitimate websites to enable strategic website compromise attacks.
MITRE ATT&CK technique: T1584.006: Compromise Infrastructure- Web Services
CURIUM has been linked to web shells following likely server compromise as an initial access vector into victim networks.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
Carbanak has used a VBScript named "ggldr" that uses Google Apps Script, Sheets, and Forms services for C2.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
Carbanak may use netsh to add local firewall rule exceptions.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
Carbanak has copied legitimate service names to use for malicious services.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Carbanak has named malware "svchost.exe," which is the name of the Windows shared service host program.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Carbanak used legitimate programs such as AmmyyAdmin and Team Viewer for remote interactive C2 to target systems.
MITRE ATT&CK technique: T1219: Remote Access Software
Carbanak installs VNC server software that executes through rundll32.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Carbanak has obtained and used open-source tools such as PsExec and Mimikatz.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Carbanak actors used legitimate credentials of banking employees to perform operations that sent them millions of dollars.
MITRE ATT&CK technique: T1078: Valid Accounts
Carbanak malware installs itself as a service to provide persistence and SYSTEM privileges.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Chimera has used gzip for Linux OS and a modified RAR software to archive data on Windows hosts.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
Chimera has used custom DLLs for continuous retrieval of data from memory.
MITRE ATT&CK technique: T1119: Automated Collection
Chimera has used type \\\c$\Users\\Favorites\Links\Bookmarks bar\Imported From IE\*citrix* for bookmark discovery.
MITRE ATT&CK technique: T1217: Browser Information Discovery
Chimera has cleared event logs on compromised hosts.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
Chimera has encoded PowerShell commands.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
Chimera has used credential stuffing against victim's remote services to obtain valid accounts.
MITRE ATT&CK technique: T1110.004: Brute Force- Credential Stuffing
Chimera has collected credentials for the target organization from previous breaches for use in brute force attacks.
MITRE ATT&CK technique: T1589.001: Gather Victim Identity Information- Credentials
Chimera has used side loading to place malicious DLLs in memory.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Chimera has used Cobalt Strike to encapsulate C2 in DNS traffic.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Chimera has collected data of interest from network shares.
MITRE ATT&CK technique: T1039: Data from Network Shared Drive
Chimera has has used net user /dom and net user Administrator to enumerate domain accounts including administrator accounts.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
Chimera has used compromised domain accounts to gain access to the target environment.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
Chimera's malware has altered the NTLM authentication program on domain controllers to allow Chimera to login without a valid credential.
MITRE ATT&CK technique: T1556.001: Modify Authentication Process- Domain Controller Authentication
Chimera has nltest /domain_trusts to identify domain trust relationships.
MITRE ATT&CK technique: T1482: Domain Trust Discovery
Chimera has used Cobalt Strike C2 beacons for data exfiltration.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Chimera has exfiltrated stolen data to OneDrive accounts.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
Chimera has used legitimate credentials to login to an external VPN, Citrix, SSH, and other remote services.
MITRE ATT&CK technique: T1133: External Remote Services
Chimera has performed file deletion to evade detection.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Chimera has utilized multiple commands to identify data of interest in file and directory listings.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Chimera has remotely copied tools and malware onto targeted systems.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Chimera has copied tools between compromised hosts using SMB.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
Chimera has used net user for account discovery.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Chimera has staged stolen data locally on compromised hosts.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Chimera has harvested data from victim's e-mail including through execution of wmic /node: process call create "cmd /c copy c:\Users\\\backup.pst c:\windows\temp\backup.pst" copy "i:\\\My Documents\.pst" copy.
MITRE ATT&CK technique: T1114.001: Email Collection- Local Email Collection
Chimera has used net localgroup administrators to identify accounts with local administrative rights.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
Chimera has renamed malware to GoogleUpdate.exe and WinRAR to jucheck.exe, RecordedTV.ms, teredo.tmp, update.exe, and msadcs1.exe.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Chimera has registered alternate phone numbers for compromised users to intercept 2FA codes sent via SMS.
MITRE ATT&CK technique: T1111: Multi-Factor Authentication Interception
Chimera has gathered the SYSTEM registry and ntds.dit files from target systems. Chimera specifically has used the NtdsAudit tool to dump the password hashes of domain users via msadcs.exe "NTDS.dit" -s "SYSTEM" -p RecordedTV_pdmp.txt --users-csv RecordedTV_users.csv and used ntdsutil to copy the Active Directory database.
MITRE ATT&CK technique: T1003.003: OS Credential Dumping- NTDS
Chimera has used direct Windows system calls by leveraging Dumpert.
MITRE ATT&CK technique: T1106: Native API
Chimera has used the get -b -e -p command for network scanning as well as a custom Python tool packed into a Windows executable named Get.exe to scan IP ranges for HTTP.
MITRE ATT&CK technique: T1046: Network Service Discovery
Chimera has used net share and net view to identify network shares of interest.
MITRE ATT&CK technique: T1135: Network Share Discovery
Chimera has dumped password hashes for use in pass the hash authentication attacks.
MITRE ATT&CK technique: T1550.002: Use Alternate Authentication Material- Pass the Hash