sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Earth Lusca used Python scripts for port scanning or building reverse shells.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
Earth Lusca used the command powershell “Get-EventLog -LogName security -Newest 500 | where {$_.EventID -eq 4624} | format-list - property * | findstr “Address”” to find the network information of successfully logged-in accounts to discovery addresses of other machines. Earth Lusca has also used multiple scanning tools to discover other machines within the same compromised network.
MITRE ATT&CK technique: T1018: Remote System Discovery
Earth Lusca has dropped an SSH-authorized key in the `/root/.ssh` folder in order to access a compromised server with SSH.
MITRE ATT&CK technique: T1098.004: Account Manipulation- SSH Authorized Keys
Earth Lusca used the command schtasks /Create /SC ONLOgon /TN WindowsUpdateCheck /TR “file path” /ru system for persistence.
MITRE ATT&CK technique: T1053: Scheduled Task/Job
Earth Lusca has acquired multiple servers for some of their operations, using each server for a different role.
MITRE ATT&CK technique: T1583.004: Acquire Infrastructure- Server
Earth Lusca has used compromised web servers as part of their operational infrastructure.
MITRE ATT&CK technique: T1584.004: Compromise Infrastructure- Server
Earth Lusca has sent spearphishing emails to potential targets that contained a malicious link.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Earth Lusca has used steganography to hide shellcode in a BMP image file.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
Earth Lusca used the command ipconfig to obtain information about network configurations.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Earth Lusca employed a PowerShell script called RDPConnectionParser to read and filter the Windows event log “Microsoft-Windows-TerminalServices-RDPClient/Operational” to obtain network information from RDP connections. Earth Lusca has also used netstat from a compromised system to obtain network connection information.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Earth Lusca collected information on user accounts via the whoami command.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Earth Lusca has used Tasklist to obtain information from a compromised host.
MITRE ATT&CK technique: T1007: System Service Discovery
Earth Lusca has acquired and used a variety of open source tools.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Earth Lusca has staged malware and malicious files on compromised web servers, GitHub, and Google Drive.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
Earth Lusca used VBA scripts.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Earth Lusca has scanned for vulnerabilities in the public-facing servers of their targets.
MITRE ATT&CK technique: T1595.002: Active Scanning- Vulnerability Scanning
Earth Lusca has established GitHub accounts to host their malware.
MITRE ATT&CK technique: T1583.006: Acquire Infrastructure- Web Services
Earth Lusca has compromised Google Drive repositories.
MITRE ATT&CK technique: T1584.006: Compromise Infrastructure- Web Services
Earth Lusca used a VBA script to execute WMI.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Earth Lusca created a service using the command sc create “SysUpdate” binpath= “cmd /c start “file path””&&sc config “SysUpdate” start= auto&&net start SysUpdate for persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Elderwood has delivered zero-day exploits and malware to victims by injecting malicious code into specific public Web pages visited by targets within a particular sector.
MITRE ATT&CK technique: T1189: Drive-by Compromise
Elderwood has encrypted documents and malicious executables.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Elderwood has used exploitation of endpoint software, including Microsoft Internet Explorer Adobe Flash vulnerabilities, to gain execution. They have also used zero-day exploits.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
The Ritsol backdoor trojan used by Elderwood can download files onto a compromised host from a remote location.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open attachments.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open links.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Elderwood has packed malware payloads before delivery to victims.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing malicious attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing a link to malicious content hosted on an uncommon Web server.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Ember Bear uses services such as IVPN, SurfShark, and Tor to add anonymization to operations.
MITRE ATT&CK technique: T1583: Acquire Infrastructure
Ember Bear has compressed collected data prior to exfiltration.
MITRE ATT&CK technique: T1560: Archive Collected Data
Ember Bear engages in mass collection from compromised systems during intrusions.
MITRE ATT&CK technique: T1119: Automated Collection
Ember Bear used the `su-bruteforce` tool to brute force specific users using the `su` command.
MITRE ATT&CK technique: T1110: Brute Force
Ember Bear has dumped configuration settings in accessed IP cameras including plaintext credentials.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
Ember Bear has used DNS tunnelling tools, such as dnscat/2 and Iodine, for C2 purposes.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Ember Bear gathers victim system information such as enumerating the volume of a given device or extracting system and security event logs for analysis.
MITRE ATT&CK technique: T1005: Data from Local System
Ember Bear has abused default user names and passwords in externally-accessible IP cameras for initial access.
MITRE ATT&CK technique: T1078.001: Valid Accounts- Default Accounts
Ember Bear uses the NirSoft AdvancedRun utility to disable Microsoft Defender Antivirus through stopping the WinDefend service on victim machines. Ember Bear disables Windows Defender via registry key changes.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Ember Bear conducted destructive operations against victims, including disk structure wiping, via the WhisperGate malware in Ukraine.
MITRE ATT&CK technique: T1561.002: Disk Wipe- Disk Structure Wipe
Ember Bear attempts to collect mail from accessed systems and servers.
MITRE ATT&CK technique: T1114: Email Collection
Ember Bear has created accounts on dark web forums to obtain various tools and malware.
MITRE ATT&CK technique: T1585: Establish Accounts
Ember Bear has used tools such as Rclone to exfiltrate information from victim environments to cloud storage such as `mega.nz`.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
Ember Bear gains initial access to victim environments by exploiting external-facing services. Examples include exploitation of CVE-2021-26084 in Confluence servers; CVE-2022-41040, ProxyShell, and other vulnerabilities in Microsoft Exchange; and multiple vulnerabilities in open-source platforms such as content management systems.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
Ember Bear has used exploits to enable follow-on execution of frameworks such as Meterpreter.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Ember Bear has used exploits for vulnerabilities such as MS17-010, also known as `Eternal Blue`, during operations.
MITRE ATT&CK technique: T1210: Exploitation of Remote Services
Ember Bear has obtained exploitation scripts against publicly-disclosed vulnerabilities from public repositories.
MITRE ATT&CK technique: T1588.005: Obtain Capabilities- Exploits
Ember Bear is linked to the defacement of several Ukrainian organization websites.
MITRE ATT&CK technique: T1491.002: Defacement- External Defacement
Ember Bear have used VPNs both for initial access to victim environments and for persistence within them following compromise.
MITRE ATT&CK technique: T1133: External Remote Services
Ember Bear deletes files related to lateral movement to avoid detection.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Ember Bear has used frameworks such as Impacket to dump LSA secrets for credential capture.
MITRE ATT&CK technique: T1003.004: OS Credential Dumping- LSA Secrets
Ember Bear uses legitimate Sysinternals tools such as procdump to dump LSASS memory.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Ember Bear retrieves follow-on payloads direct from adversary-owned infrastructure for deployment on compromised hosts.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
Ember Bear has enumerated SECURITY and SYSTEM log files during intrusions.
MITRE ATT&CK technique: T1654: Log Enumeration
Ember Bear has acquired malware and related tools from dark web forums.
MITRE ATT&CK technique: T1588.001: Obtain Capabilities- Malware
Ember Bear has renamed the legitimate Sysinternals tool procdump to alternative names such as dump64.exe to evade detection.
MITRE ATT&CK technique: T1036: Masquerading
Ember Bear has renamed tools to match legitimate utilities, such as renaming GOST tunneling instances to `java` in victim environments.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Ember Bear modifies registry values for anti-forensics and defense evasion purposes.
MITRE ATT&CK technique: T1112: Modify Registry
Ember Bear has configured multi-hop proxies via ProxyChains within victim environments.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
Ember Bear has used tools such as NMAP for remote system discovery and enumeration in victim environments.
MITRE ATT&CK technique: T1046: Network Service Discovery
Ember Bear uses socket-based tunneling utilities for command and control purposes such as NetCat and Go Simple Tunnel . These tunnels are used to push interactive command prompts over the created sockets. Ember Bear has also used reverse TCP connections from Meterpreter installations to communicate back with C2 infrastructure.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Ember Bear has used various non-standard ports for C2 communication.
MITRE ATT&CK technique: T1571: Non-Standard Port
Ember Bear gathers credential material from target systems, such as SSH keys, to facilitate access to victim environments.
MITRE ATT&CK technique: T1003: OS Credential Dumping
Ember Bear has used pass-the-hash techniques for lateral movement in victim environments.
MITRE ATT&CK technique: T1550.002: Use Alternate Authentication Material- Pass the Hash
Ember Bear has conducted password spraying against Outlook Web Access infrastructure to identify valid user names and passwords.
MITRE ATT&CK technique: T1110.003: Brute Force- Password Spraying
Ember Bear has used PowerShell commands to gather information from compromised systems, such as email servers.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Ember Bear has used ProxyChains to tunnel protocols to internal networks.
MITRE ATT&CK technique: T1572: Protocol Tunneling
Ember Bear uses valid network credentials gathered through credential harvesting to move laterally within victim networks, often employing the Impacket framework to do so.
MITRE ATT&CK technique: T1021: Remote Services
Ember Bear has used tools such as Nmap and MASSCAN for remote service discovery.
MITRE ATT&CK technique: T1018: Remote System Discovery
Ember Bear has targeted IP ranges for vulnerability scanning related to government and critical infrastructure organizations.
MITRE ATT&CK technique: T1595.001: Active Scanning- Scanning IP Blocks
Ember Bear uses remotely scheduled tasks to facilitate remote command execution on victim machines.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Ember Bear acquires victim credentials by extracting registry hives such as the Security Account Manager through commands such as reg save.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
Ember Bear has compromised information technology providers and software developers providing services to targets of interest, building initial access to ultimate victims at least in part through compromise of service providers that work with the victim organizations.
MITRE ATT&CK technique: T1195: Supply Chain Compromise
Ember Bear has exfiltrated images from compromised IP cameras.
MITRE ATT&CK technique: T1125: Video Capture
Ember Bear has used virtual private servers to host tools, perform reconnaissance, exploit victim infrastructure, and as a destination for data exfiltration.
MITRE ATT&CK technique: T1583.003: Acquire Infrastructure- Virtual Private Server
Ember Bear has used publicly available tools such as MASSCAN and Acunetix for vulnerability scanning of public-facing infrastructure.
MITRE ATT&CK technique: T1595.002: Active Scanning- Vulnerability Scanning
Ember Bear deploys web shells following initial access for either follow-on command execution or protocol tunneling. Example web shells used by Ember Bear include P0wnyshell, reGeorg, P.A.S. Webshell, and custom variants of publicly-available web shell examples.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
Ember Bear has used WMI execution with password hashes for command execution and lateral movement.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Equation is known to have the capability to overwrite the firmware on hard drives from some manufacturers.
MITRE ATT&CK technique: T1542.002: Pre-OS Boot- Component Firmware
Equation has been observed utilizing environmental keying in payload delivery.
MITRE ATT&CK technique: T1480.001: Execution Guardrails- Environmental Keying
Equation has used an encrypted virtual file system stored in the Windows Registry.
MITRE ATT&CK technique: T1564.005: Hide Artifacts- Hidden File System
Equation has used tools with the functionality to search for specific information about the attached hard drive that could be used to identify and overwrite the firmware.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
Evilnum has used PowerShell to bypass UAC.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
Evilnum can collect email credentials from victims.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
Evilnum has used the malware variant, TerraTV, to load a malicious DLL placed in the TeamViewer directory, instead of the original Windows DLL located in a system folder.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
Evilnum has deleted files used during infection.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Evilnum can deploy additional components or tools as needed.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Evilnum has used malicious JavaScript files on the victim's machine.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Evilnum has sent spearphishing emails designed to trick the recipient into opening malicious shortcut links which downloads a .LNK file.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
EVILNUM has used the malware variant, TerraTV, to run a legitimate TeamViewer application to connect to compromrised machines.
MITRE ATT&CK technique: T1219: Remote Access Software
Evilnum has sent spearphishing emails containing a link to a zip file hosted on Google Drive.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Evilnum can steal cookies and session information from browsers.
MITRE ATT&CK technique: T1539: Steal Web Session Cookie
Evilnum has used a component called TerraLoader to check certain hardware and file information to detect sandboxed environments.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
FIN10 has used batch scripts and scheduled tasks to delete critical system files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
FIN10 has deployed Meterpreter stagers and SplinterRAT instances in the victim network after moving laterally.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
FIN10 has moved laterally using the Local Administrator account.
MITRE ATT&CK technique: T1078.003: Valid Accounts- Local Accounts
FIN10 uses PowerShell for execution as well as PowerShell Empire to establish persistence.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
FIN10 has established persistence by using the Registry option in PowerShell Empire to add a Run key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
FIN10 has used RDP to move laterally to systems in the victim environment.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
FIN10 has established persistence by using S4U tasks as well as the Scheduled Task option in PowerShell Empire.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
FIN10 has used Meterpreter to enumerate users on remote systems.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
FIN10 has relied on publicly-available software to gain footholds and establish persistence in victim environments.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
FIN10 has used stolen credentials to connect remotely to victim networks using VPNs protected with only a single factor.
MITRE ATT&CK technique: T1078: Valid Accounts
FIN10 has executed malicious .bat files containing PowerShell commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
FIN13 has enumerated all users and their roles from a victim's main treasury system.
MITRE ATT&CK technique: T1087: Account Discovery
FIN13 has assigned newly created accounts the sysadmin role to maintain persistence.
MITRE ATT&CK technique: T1098.007: Account Manipulation- Additional Local or Domain Groups
FIN13 has compressed the dump output of compromised credentials with a 7zip binary.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
FIN13 has obtained administrative credentials by browsing through local files on a compromised machine.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
FIN13 has used IISCrack.dll as a side-loading technique to load a malicious version of httpodbc.dll on old IIS Servers .
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
FIN13 has injected fraudulent transactions into compromised networks that mimic legitimate behavior to siphon off incremental amounts of money.
MITRE ATT&CK technique: T1565: Data Manipulation
FIN13 has gathered stolen credentials, sensitive data such as point-of-sale , and ATM data from a compromised network before exfiltration.
MITRE ATT&CK technique: T1005: Data from Local System
FIN13 has leveraged default credentials for authenticating myWebMethods and QLogic web management interface to gain initial access.
MITRE ATT&CK technique: T1078.001: Valid Accounts- Default Accounts
FIN13 has utilized `certutil` to decode base64 encoded versions of custom malware.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
FIN13 can identify user accounts associated with a Service Principal Name and query Service Principal Names within the domain by utilizing the following scripts: `GetUserSPNs.vbs` and `querySpn.vbs`.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
FIN13 has exploited known vulnerabilities such as CVE-2017-1000486 , CVE-2015-7450 , CVE-2010-5326 , and EDB-ID-24963 to gain initial access.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
FIN13 has gained access to compromised environments via remote access services such as the corporate virtual private network .
MITRE ATT&CK technique: T1133: External Remote Services
FIN13 has used the Windows `dir` command to enumerate files and directories in a victim's network.
MITRE ATT&CK technique: T1083: File and Directory Discovery
FIN13 has observed the victim's software and infrastructure over several months to understand the technical process of legitimate financial transactions, prior to attempting to conduct fraudulent transactions.
MITRE ATT&CK technique: T1657: Financial Theft
FIN13 has researched employees to target for social engineering attacks.
MITRE ATT&CK technique: T1589: Gather Victim Identity Information
FIN13 has created hidden files and folders within a compromised Linux system `/tmp` directory. FIN13 also has used `attrib.exe` to hide gathered local host information.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
FIN13 has downloaded additional tools and malware to compromised systems.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
FIN13 has utilized a proxy tool to communicate between compromised assets.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy
FIN13 has used `Ping` and `tracert` for network reconnaissance efforts.
MITRE ATT&CK technique: T1016.001: System Network Configuration Discovery- Internet Connection Discovery
FIN13 has logged the keystrokes of victims to escalate privileges.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
FIN13 has obtained memory dumps with ProcDump to parse and extract credentials from a victim's LSASS process memory with Mimikatz.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
FIN13 has created MS-SQL local accounts in a compromised network.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
FIN13 has utilized the following temporary folders on compromised Windows and Linux systems for their operations prior to exfiltration: `C:\Windows\Temp` and `/tmp`.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
FIN13 has utilized tools such as Incognito V2 for token manipulation and impersonation.
MITRE ATT&CK technique: T1134.003: Access Token Manipulation- Make and Impersonate Token
FIN13 has utilized custom malware to maintain persistence in a compromised environment.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
FIN13 has used scheduled tasks names such as `acrotyr` and `AppServicesr` to mimic the same names in a compromised network's `C:\Windows` directory.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
FIN13 has masqueraded staged data by using the Windows certutil utility to generate fake Base64 encoded certificates with the input file.
MITRE ATT&CK technique: T1036: Masquerading
FIN13 has masqueraded WAR files to look like legitimate packages such as, wsexample.war, wsexamples.com, examples.war, and exampl3s.war.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
FIN13 has replaced legitimate KeePass binaries with trojanized versions to collect passwords from numerous applications.
MITRE ATT&CK technique: T1556: Modify Authentication Process
FIN13 has harvested the NTDS.DIT file and leveraged the Impacket tool on the compromised domain controller to locally decrypt it.
MITRE ATT&CK technique: T1003.003: OS Credential Dumping- NTDS
FIN13 has utilized `nmap` for reconnaissance efforts. FIN13 has also scanned for internal MS-SQL servers in a compromised network.
MITRE ATT&CK technique: T1046: Network Service Discovery
FIN13 has executed net view commands for enumeration of open shares on compromised machines.
MITRE ATT&CK technique: T1135: Network Share Discovery
FIN13 has searched for infrastructure that can provide remote access to an environment for targeting efforts.
MITRE ATT&CK technique: T1590.004: Gather Victim Network Information- Network Topology
FIN13 has used the PowerShell utility `Invoke-SMBExec` to execute the pass the hash method for lateral movement within an compromised environment.
MITRE ATT&CK technique: T1550.002: Use Alternate Authentication Material- Pass the Hash
FIN13 has enumerated all users and roles from a victim's main treasury system.
MITRE ATT&CK technique: T1069: Permission Groups Discovery
FIN13 has used PowerShell commands to obtain DNS data from a compromised network.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
FIN13 has utilized web shells and Java tools for tunneling capabilities to and from compromised assets.
MITRE ATT&CK technique: T1572: Protocol Tunneling
FIN13 has used Windows Registry run keys such as, `HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hosts` to maintain persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
FIN13 has remotely accessed compromised environments via Remote Desktop Services for lateral movement.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
FIN13 has leveraged SMB to move laterally within a compromised network via application servers and SQL servers.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
FIN13 has remotely accessed compromised environments via secure shell for lateral movement.
MITRE ATT&CK technique: T1021.004: Remote Services- SSH
FIN13 has created scheduled tasks in the `C:\Windows` directory of the compromised network.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
FIN13 has extracted the SAM and SYSTEM registry hives using the `reg.exe` binary for obtaining password hashes from a compromised machine.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
FIN13 has collected local host information by utilizing Windows commands `systeminfo`, `fsutil`, and `fsinfo`. FIN13 has also utilized a compromised Symantex Altiris console and LanDesk account to retrieve host information.
MITRE ATT&CK technique: T1082: System Information Discovery
FIN13 has used `nslookup` and `ipconfig` for network reconnaissance efforts. FIN13 has also utilized a compromised Symantec Altiris console and LanDesk account to retrieve network information.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
FIN13 has used `netstat` and other net commands for network reconnaissance efforts.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
FIN13 has utilized publicly available tools such as Mimikatz, Impacket, PWdump7, ProcDump, Nmap, and Incognito V2 for targeting efforts.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
FIN13 has used VBS scripts for code execution on comrpomised machines.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
FIN13 has used HTTP requests to chain multiple web shells and to contact actor-controlled C2 servers prior to exfiltrating stolen data.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
FIN13 has utilized obfuscated and open-source web shells such as JspSpy, reGeorg, MiniWebCmdShell, and Vonloesch Jsp File Browser 1.2 to enable remote code execution and to execute commands on compromised web server.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
FIN13 has leveraged `xp_cmdshell` and Windows Command Shell to execute commands on a compromised machine. FIN13 has also attempted to leverage the ‘xp_cmdshell’ SQL procedure to execute remote commands on internal MS-SQL servers.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
FIN13 has utilized `WMI` to execute commands and move laterally on compromised Windows machines.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
FIN13 has leveraged `WMI` to move laterally within a compromised network via application servers and SQL servers.
MITRE ATT&CK technique: T1021.006: Remote Services- Windows Remote Management
FIN4 has created rules in victims' Microsoft Outlook accounts to automatically delete emails containing words such as “hacked," "phish," and “malware" in a likely attempt to prevent organizations from communicating about their activities.
MITRE ATT&CK technique: T1564.008: Hide Artifacts- Email Hiding Rules
FIN4 has presented victims with spoofed Windows Authentication prompts to collect their credentials.
MITRE ATT&CK technique: T1056.002: Input Capture- GUI Input Capture
FIN4 has captured credentials via fake Outlook Web App login pages and has also used a .NET based keylogger.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
FIN4 has lured victims to launch malicious attachments delivered via spearphishing emails .
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
FIN4 has lured victims to click malicious links delivered via spearphishing emails .
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
FIN4 has used Tor to log in to victims' email accounts.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
FIN4 has accessed and hijacked online email communications using stolen credentials.
MITRE ATT&CK technique: T1114.002: Email Collection- Remote Email Collection
FIN4 has used spearphishing emails containing attachments with embedded malicious macros.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
FIN4 has used spearphishing emails containing malicious links.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
FIN4 has used legitimate credentials to hijack email communications.
MITRE ATT&CK technique: T1078: Valid Accounts
FIN4 has used VBA macros to display a dialog box and collect victim credentials.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
FIN4 has used HTTP POST requests to transmit data.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.
MITRE ATT&CK technique: T1119: Automated Collection
FIN5 has has used the tool GET2 Penetrator to look for remote login and hard-coded credentials.
MITRE ATT&CK technique: T1110: Brute Force
FIN5 has cleared event logs from victims.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
FIN5 maintains access to victim environments by using FLIPSIDE to create a proxy for a backup RDP tunnel.
MITRE ATT&CK technique: T1090.002: Proxy- External Proxy
FIN5 has used legitimate VPN, Citrix, or VNC credentials to maintain access to a victim environment.
MITRE ATT&CK technique: T1133: External Remote Services
FIN5 uses SDelete to clean up the environment and attempt to prevent detection.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
FIN5 scripts save memory dump data into a specific directory on hosts in the victim environment.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
FIN5 has used the open source tool Essential NetTools to map the network and build a list of targets.
MITRE ATT&CK technique: T1018: Remote System Discovery
FIN5 has obtained and used a customized version of PsExec, as well as use other tools such as pwdump, SDelete, and Windows Credential Editor.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
FIN5 has used legitimate VPN, RDP, Citrix, or VNC credentials to maintain access to a victim environment.
MITRE ATT&CK technique: T1078: Valid Accounts
FIN6 has used has used Metasploit’s named-pipe impersonation technique to escalate privileges.
MITRE ATT&CK technique: T1134: Access Token Manipulation
Following data collection, FIN6 has compressed log files into a ZIP archive prior to staging and exfiltration.
MITRE ATT&CK technique: T1560: Archive Collected Data
FIN6 has encoded data gathered from the victim with a simple substitution cipher and single-byte XOR using the 0xAA key, and Base64 with character permutation.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
FIN6 has used a script to iterate through a list of compromised PoS systems, copy and remove data to a log file, and to bind to events from the submit payment button.
MITRE ATT&CK technique: T1119: Automated Collection
FIN6 has used Comodo code-signing certificates.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
FIN6 has used encoded PowerShell commands.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
FIN6 has used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
FIN6 has used the Stealer One credential stealer to target e-mail and file transfer utilities including FTP.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
FIN6 has used the Stealer One credential stealer to target web browsers.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
FIN6 has collected schemas and user accounts from systems running SQL Server.
MITRE ATT&CK technique: T1213: Data from Information Repositories
FIN6 has collected and exfiltrated payment card data from compromised systems.
MITRE ATT&CK technique: T1005: Data from Local System
FIN6 has deployed a utility script named kill.bat to disable anti-virus.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
FIN6 has sent stolen payment card data to remote servers via HTTP POSTs.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
FIN6 has used tools to exploit Windows vulnerabilities in order to escalate privileges. The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
FIN6 has removed files from victim machines.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
FIN6 has used malicious JavaScript to steal payment card data from e-commerce sites.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
FIN6 has used Windows Credential Editor for credential dumping.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
FIN6 has used malicious documents to lure victims into allowing execution of PowerShell scripts.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
FIN6 has renamed the "psexec" service name to "mstdc" to masquerade as a legitimate Windows service.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.
MITRE ATT&CK technique: T1003.003: OS Credential Dumping- NTDS
FIN6 used publicly available tools to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language servers, and NetBIOS.
MITRE ATT&CK technique: T1046: Network Service Discovery
FIN6 has used Metasploit Bind and Reverse TCP stagers.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
FIN6 has extracted password hashes from ntds.dit to crack offline.
MITRE ATT&CK technique: T1110.002: Brute Force- Password Cracking
FIN6 has used PowerShell to gain access to merchant's networks, and a Metasploit PowerShell module to download and execute shellcode and to set up a local listener.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.
MITRE ATT&CK technique: T1572: Protocol Tunneling
FIN6 has used Registry Run keys to establish persistence for its downloader tools known as HARDTACK and SHIPBREAD.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
FIN6 actors have compressed data from remote systems and moved it to another staging system before exfiltration.
MITRE ATT&CK technique: T1074.002: Data Staged- Remote Data Staging
FIN6 used RDP to move laterally in victim networks.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
FIN6 used publicly available tools to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language servers, and NetBIOS.
MITRE ATT&CK technique: T1018: Remote System Discovery
FIN6 has used scheduled tasks to establish persistence for various malware it uses, including downloaders known as HARDTACK and SHIPBREAD and FrameworkPOS.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
FIN6 has created Windows services to execute encoded PowerShell commands.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
FIN6 has targeted victims with e-mails containing malicious attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
FIN6 has used fake job advertisements sent via LinkedIn to spearphish targets.
MITRE ATT&CK technique: T1566.003: Phishing- Spearphishing via Service
FIN6 has obtained and used tools such as Mimikatz, Cobalt Strike, and AdFind.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
To move laterally on a victim network, FIN6 has used credentials stolen from various systems on which it gathered usernames and password hashes.
MITRE ATT&CK technique: T1078: Valid Accounts
FIN6 has used Pastebin and Google Storage to host content for their operations.
MITRE ATT&CK technique: T1102: Web Service
FIN6 has used kill.bat script to disable security tools.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
FIN6 has used WMI to automate the remote execution of PowerShell scripts.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
FIN7 has used application shim databases for persistence.
MITRE ATT&CK technique: T1546.011: Event Triggered Execution- Application Shimming
FIN7 used legitimate services like Google Docs, Google Scripts, and Pastebin for C2.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
FIN7 has used random junk code to obfuscate malware code.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
FIN7 has signed Carbanak payloads with legally purchased code signing certificates. FIN7 has also digitally signed their phishing documents, backdoors and other staging tools to bypass security controls.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
FIN7 has used fragmented strings, environment variables, standard input , and native character-replacement functionalities to obfuscate commands.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
FIN7 used SQL scripts to help perform tasks on the victim's machine.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
FIN7 has gained initial access by compromising a victim's software supply chain.
MITRE ATT&CK technique: T1195.002: Supply Chain Compromise- Compromise Software Supply Chain
FIN7 has performed C2 using DNS via A, OPT, and TXT records.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
FIN7 has encrypted virtual disk volumes on ESXi servers using a version of Darkside ransomware.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
FIN7 has collected files and other sensitive information from a compromised network.
MITRE ATT&CK technique: T1005: Data from Local System
FIN7 has used the command `net group "domain admins" /domain` to enumerate domain groups.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
FIN7 has registered look-alike domains for use in phishing campaigns.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
FIN7 has compromised a digital product website and modified multiple download links to point to trojanized versions of offered digital products.
MITRE ATT&CK technique: T1608.004: Stage Capabilities- Drive-by Target
FIN7 spear phishing campaigns have included malicious Word documents with DDE execution.
MITRE ATT&CK technique: T1559.002: Inter-Process Communication- Dynamic Data Exchange
FIN7 has exfiltrated stolen data to the MEGA file sharing site.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
FIN7 has compromised targeted organizations through exploitation of CVE-2021-31207 in Exchange.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
FIN7 has exploited ZeroLogon against vulnerable domain controllers.
MITRE ATT&CK technique: T1210: Exploitation of Remote Services
FIN7's Harpy backdoor malware can use DNS as a backup channel for C2 if HTTP fails.
MITRE ATT&CK technique: T1008: Fallback Channels
FIN7 has downloaded additional malware to execute on the victim's machine, including by using a PowerShell script to launch shellcode that retrieves an additional payload.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
FIN7 used JavaScript scripts to help perform tasks on the victim's machine.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
FIN7 has used Kerberoasting PowerShell commands such as, `Invoke-Kerberoast` for credential access and to enable lateral movement.
MITRE ATT&CK technique: T1558.003: Steal or Forge Kerberos Tickets- Kerberoasting
FIN7 has used compromised credentials for access as SYSTEM on Exchange servers.
MITRE ATT&CK technique: T1078.003: Valid Accounts- Local Accounts
FIN7 lured victims to double-click on images in the attachments they sent which would then execute the hidden LNK file.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
FIN7 has used malicious links to lure victims into downloading malware.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
FIN7 has developed malware for use in operations, including the creation of infected removable media.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
FIN7 has created a scheduled task named “AdobeFlashSync” to establish persistence.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
FIN7 has attempted to run Darkside ransomware with the filename sleep.exe.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
FIN7 has used port-protocol mismatches on ports such as 53, 80, 443, and 8080 during C2.
MITRE ATT&CK technique: T1571: Non-Standard Port
FIN7 used a PowerShell script to launch shellcode that retrieved an additional payload.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
FIN7 has utilized the remote management tool Atera to download malware to a compromised system.
MITRE ATT&CK technique: T1219: Remote Access Software
FIN7 has used RDP to move laterally in victim environments.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
FIN7 actors have mailed USB drives to potential victims containing malware that downloads and installs various backdoors, including in some cases for ransomware operations.
MITRE ATT&CK technique: T1091: Replication Through Removable Media
FIN7 has used `rundll32.exe` to execute malware on a compromised network.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
FIN7 has used SSH to move laterally through victim environments.
MITRE ATT&CK technique: T1021.004: Remote Services- SSH
FIN7 malware has created scheduled tasks to establish persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
FIN7 captured screenshots and desktop video recordings.
MITRE ATT&CK technique: T1113: Screen Capture
FIN7 sent spearphishing emails with either malicious Microsoft Documents or RTF files attached.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
FIN7 has conducted broad phishing campaigns using malicious links.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
FIN7 has used the command `cmd.exe /C quser` to collect user session information.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
FIN7 has utilized a variety of tools such as Cobalt Strike, PowerSploit, and the remote management tool, Atera for targeting efforts.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
FIN7 has staged legitimate software, that was trojanized to contain an Atera agent installer, on Amazon S3.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
FIN7 used images embedded into document lures that only activate the payload when a user double clicks to avoid sandboxes.
MITRE ATT&CK technique: T1497.002: Virtualization/Sandbox Evasion- User Activity Based Checks
FIN7 has used TightVNC to control compromised hosts.
MITRE ATT&CK technique: T1021.005: Remote Services- VNC
FIN7 has harvested valid administrative credentials for lateral movement.
MITRE ATT&CK technique: T1078: Valid Accounts
FIN7 created a custom video recording capability that could be used to monitor operations in the victim's environment.
MITRE ATT&CK technique: T1125: Video Capture
FIN7 used VBS scripts to help perform tasks on the victim's machine.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
FIN7 has set up Amazon S3 buckets to host trojanized digital products.
MITRE ATT&CK technique: T1583.006: Acquire Infrastructure- Web Services
FIN7 used the command prompt to launch commands on the victim’s machine.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
FIN7 has used WMI to install malware on targeted systems.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
FIN7 created new Windows services and added them to the startup directories for persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
FIN8 has used RAR to compress collected data before exfiltration.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
FIN8 has used the Plink utility to tunnel RDP back to C2 infrastructure.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
FIN8 has injected malicious code into a new svchost.exe process.
MITRE ATT&CK technique: T1055.004: Process Injection- Asynchronous Procedure Call
FIN8 has cleared logs during post compromise cleanup activities.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
FIN8 has used an expired open-source X.509 certificate for testing in the OpenSSL repository, to connect to actor-controlled C2 servers.
MITRE ATT&CK technique: T1588.003: Obtain Capabilities- Code Signing Certificates
FIN8 has used environment variables and standard input to obfuscate command-line arguments. FIN8 also obfuscates malicious macros delivered as payloads.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
FIN8 has deployed ransomware such as Ragnar Locker, White Rabbit, and attempted to execute Noberus on compromised networks.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
FIN8 has retrieved a list of trusted domains by using nltest.exe /domain_trusts.
MITRE ATT&CK technique: T1482: Domain Trust Discovery