sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Pikabot will retrieve the name of the user associated with the thread under which the malware is executing.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Pikabot uses native Windows APIs to determine if the process is being debugged and analyzed, such as `CheckRemoteDebuggerPresent`, `NtQueryInformationProcess`, `ProcessDebugPort`, and `ProcessDebugFlags`. Other Pikabot variants populate a global list of Windows API addresses from the `NTDLL` and `KERNEL32` libraries, and references these items instead of calling the API items to obfuscate execution.
MITRE ATT&CK technique: T1106: Native API
Pikabot uses non-standard ports, such as 2967, 2223, and others, for HTTPS command and control communication.
MITRE ATT&CK technique: T1571: Non-Standard Port
Pikabot, following payload decryption, creates a process hard-coded into the dropped and injects the decrypted core modules into it.
MITRE ATT&CK technique: T1055.002: Process Injection- Portable Executable Injection
Pikabot reflectively loads stored, previously encrypted components of the PE file into memory of the currently executing process to avoid writing content to disk on the executing machine.
MITRE ATT&CK technique: T1620: Reflective Code Loading
Pikabot maintains persistence following system checks through the Run key in the registry.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Pikabot uses base64 encoding in conjunction with symmetric encryption mechanisms to obfuscate command and control communications.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Pikabot loads a set of PNG images stored in the malware's resources section , each with an encrypted section containing portions of the core Pikabot core module. These sections are loaded and decrypted using a bitwise XOR operation with a hardcoded 32 bit key.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
Earlier Pikabot variants use a custom encryption procedure leveraging multiple mechanisms including AES with multiple rounds of Base64 encoding for its command and control communication. Later Pikabot variants eliminate the use of AES and instead use RC4 encryption for transmitted information.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Pikabot performs a variety of system checks to determine if it is running in an analysis environment or sandbox, such as checking the number of processors , and the amount of RAM .
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
Pikabot performs a variety of system checks and gathers system information, including commands such as whoami.
MITRE ATT&CK technique: T1082: System Information Discovery
Pikabot gathers victim network information through commands such as ipconfig and ipconfig /all.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Pikabot can create a suspended instance of a legitimate process , allocate memory within the suspended process corresponding to Pikabot's core module, then redirect execution flow via `SetContextThread` API so that when the thread resumes the Pikabot core module is executed.
MITRE ATT&CK technique: T1055.003: Process Injection- Thread Execution Hijacking
Pikabot can execute Windows shell commands via cmd.exe.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Pillowmint has used a malicious shim database to maintain persistence.
MITRE ATT&CK technique: T1546.011: Event Triggered Execution- Application Shimming
Pillowmint has encrypted stolen credit card information with AES and further encoded it with Base64.
MITRE ATT&CK technique: T1560: Archive Collected Data
Pillowmint has used the NtQueueApcThread syscall to inject code into svchost.exe.
MITRE ATT&CK technique: T1055.004: Process Injection- Asynchronous Procedure Call
Pillowmint can uninstall the malicious service from an infected machine.
MITRE ATT&CK technique: T1070.009: Indicator Removal- Clear Persistence
Pillowmint has collected credit card data using native API functions.
MITRE ATT&CK technique: T1005: Data from Local System
Pillowmint has been decompressed by included shellcode prior to being launched.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Pillowmint has deleted the filepath %APPDATA%\Intel\devmonsrv.exe.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Pillowmint has stored a compressed payload in the Registry key HKLM\SOFTWARE\Microsoft\DRM.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
Pillowmint has modified the Registry key HKLM\SOFTWARE\Microsoft\DRM to store a malicious payload.
MITRE ATT&CK technique: T1112: Modify Registry
Pillowmint has used multiple native Windows APIs to execute and conduct process injections.
MITRE ATT&CK technique: T1106: Native API
Pillowmint has been compressed and stored within a registry key. Pillowmint has also obfuscated the AES key used for encryption.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Pillowmint has used a PowerShell script to install a shim database.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Pillowmint can iterate through running processes every six seconds collecting a list of processes to capture from later.
MITRE ATT&CK technique: T1057: Process Discovery
Pillowmint has used shellcode which reads code stored in the registry keys \REGISTRY\SOFTWARE\Microsoft\DRM using the native Windows API as well as read HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces as part of its C2.
MITRE ATT&CK technique: T1012: Query Registry
PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware . Credentials targeted by PinchDuke include ones associated with many sources such as The Bat!, Yahoo!, Mail.ru, Passport.Net, Google Talk, and Microsoft Outlook.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware . Credentials targeted by PinchDuke include ones associated with many sources such as Netscape Navigator, Mozilla Firefox, Mozilla Thunderbird, and Internet Explorer.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
PinchDuke collects user files from the compromised host based on predefined file extensions.
MITRE ATT&CK technique: T1005: Data from Local System
PinchDuke searches for files created within a certain timeframe and whose file extension matches a predefined list.
MITRE ATT&CK technique: T1083: File and Directory Discovery
PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware . Credentials targeted by PinchDuke include ones associated many sources such as WinInet Credential Cache, and Lightweight Directory Access Protocol .
MITRE ATT&CK technique: T1003: OS Credential Dumping
PinchDuke gathers system configuration information.
MITRE ATT&CK technique: T1082: System Information Discovery
PinchDuke transfers files from the compromised host via HTTP or HTTPS to a C2 server.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Ping can be used to identify remote systems within a network.
MITRE ATT&CK technique: T1018: Remote System Discovery
PingPull can collect data from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
PingPull can decrypt received data from its C2 server by using AES.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
PingPull has the ability to exfiltrate stolen victim data through its C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
PingPull can enumerate storage volumes and folder contents of a compromised host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
PingPull can mimic the names and descriptions of legitimate services such as `iphlpsvc`, `IP Helper`, and `Onedrive` to evade detection.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
PingPull variants have the ability to communicate with C2 servers using ICMP or TCP.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
PingPull can use HTTPS over port 8080 for C2.
MITRE ATT&CK technique: T1571: Non-Standard Port
PingPull can encode C2 traffic with Base64.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
PingPull can use AES, in cipher block chaining mode padded with PKCS5, to encrypt C2 server communications.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
PingPull can retrieve the hostname of a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
PingPull can retrieve the IP address of a compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
PingPull has the ability to timestomp a file.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
A PingPull variant can communicate with its C2 servers by using HTTPS.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
PingPull can use `cmd.exe` to run various commands as a reverse shell.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
PingPull has the ability to install itself as a service.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
PipeMon installer can use UAC bypass techniques to install the payload.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
PipeMon, its installer, and tools are signed with stolen code-signing certificates.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
PipeMon can attempt to gain administrative privileges using token impersonation.
MITRE ATT&CK technique: T1134.002: Access Token Manipulation- Create Process with Token
PipeMon can decrypt password-protected executables.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
PipeMon can inject its modules into various processes using reflective DLL loading.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
PipeMon modules are stored encrypted on disk.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
PipeMon can switch to an alternate C2 domain when a particular date has been reached.
MITRE ATT&CK technique: T1008: Fallback Channels
PipeMon has stored its encrypted payload in the Registry under `HKLM\SOFTWARE\Microsoft\Print\Components\`.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
PipeMon can install additional modules via C2 commands.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
PipeMon modules are stored on disk with seemingly benign names including use of a file extension associated with a popular word processor.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
PipeMon has modified the Registry to store its encrypted payload.
MITRE ATT&CK technique: T1112: Modify Registry
PipeMon's first stage has been executed by a call to CreateProcess with the decryption password in an argument. PipeMon has used a call to LoadLibrary to load its installer.
MITRE ATT&CK technique: T1106: Native API
The PipeMon communication module can use a custom protocol based on TLS over TCP.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
PipeMon can use parent PID spoofing to elevate privileges.
MITRE ATT&CK technique: T1134.004: Access Token Manipulation- Parent PID Spoofing
The PipeMon installer has modified the Registry key HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors to install PipeMon as a Print Processor.
MITRE ATT&CK technique: T1547.012: Boot or Logon Autostart Execution- Print Processors
PipeMon can iterate over the running processes to find a suitable injection target.
MITRE ATT&CK technique: T1057: Process Discovery
PipeMon can check for the presence of ESET and Kaspersky security software.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
PipeMon has used call to LoadLibrary to load its installer. PipeMon loads its modules using reflective loading or custom shellcode.
MITRE ATT&CK technique: T1129: Shared Modules
PipeMon communications are RC4 encrypted.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
PipeMon can collect and send OS version and computer name as a part of its C2 beacon.
MITRE ATT&CK technique: T1082: System Information Discovery
PipeMon can collect and send the local IP address, RDP information, and the network adapter physical address as a part of its C2 beacon.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
PipeMon can send time zone information from a compromised host to C2.
MITRE ATT&CK technique: T1124: System Time Discovery
PipeMon can establish persistence by registering a malicious DLL as an alternative Print Processor which is loaded when the print spooler service starts.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Pisloader uses DNS as its C2 protocol.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Pisloader has commands to list drives on the victim machine and to list file information for a given directory.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Pisloader has a command to upload a file to the victim machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Pisloader obfuscates files by splitting strings into smaller sub-strings and including "garbage" strings that are never used. The malware also uses return-oriented programming technique and single-byte XOR to obfuscate data.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Pisloader establishes persistence via a Registry Run key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Responses from the Pisloader C2 server are base32-encoded.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Pisloader has a command to collect victim system information, including the system name and OS version.
MITRE ATT&CK technique: T1082: System Information Discovery
Pisloader has a command to collect the victim's IP address.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Pisloader uses cmd.exe to set the Registry Run key value. It also has a command to spawn a command shell.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Playcrypt encrypts files on targeted hosts with an AES-RSA hybrid encryption, encrypting every other file portion of 0x100000 bytes.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Playcrypt can avoid encrypting files with a .PLAY, .exe, .msi, .dll, .lnk, or .sys file extension.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Playcrypt can use AlphaVSS to delete shadow copies.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
PlugX has the ability to use DLL search order hijacking for installation on targeted systems.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
PlugX has used DLL side-loading to evade anti-virus.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
PlugX can be configured to use DNS for command and control.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
PlugX uses Pastebin to store C2 addresses.
MITRE ATT&CK technique: T1102.001: Web Service- Dead Drop Resolver
PlugX decompresses and decrypts itself using the Microsoft API call RtlDecompressBuffer.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
PlugX has a module to enumerate drives and find files recursively.
MITRE ATT&CK technique: T1083: File and Directory Discovery
PlugX can modify the characteristics of folders to hide them from the compromised user.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
PlugX has a module to download and execute files on the compromised machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
PlugX has a module for capturing keystrokes per process including window titles.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
A version of PlugX loads as shellcode within a .NET Framework project using msbuild.exe, presumably to bypass application control techniques.
MITRE ATT&CK technique: T1127.001: Trusted Developer Utilities Proxy Execution- MSBuild
In one instance, menuPass added PlugX as a service with a display name of "Corel Writing Tools Utility."
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
PlugX has been disguised as legitimate Adobe and PotPlayer files.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
PlugX has a module to create, delete, or modify Registry keys.
MITRE ATT&CK technique: T1112: Modify Registry
PlugX can use the Windows API functions `GetProcAddress`, `LoadLibrary`, and `CreateProcess` to execute another process.
MITRE ATT&CK technique: T1106: Native API
PlugX has a module to enumerate network shares.
MITRE ATT&CK technique: T1135: Network Share Discovery
PlugX can be configured to use raw TCP or UDP for command and control.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
PlugX can use API hashing and modify the names of strings to evade detection.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
PlugX has a module to list the processes running on a machine.
MITRE ATT&CK technique: T1057: Process Discovery
PlugX can enumerate and query for information contained within the Windows Registry.
MITRE ATT&CK technique: T1012: Query Registry
PlugX adds Run key entries in the Registry to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
PlugX allows the operator to capture screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
PlugX can use RC4 encryption in C2 communications.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
PlugX checks if VMware tools is running in the background by searching for any process named "vmtoolsd".
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
PlugX has a module for enumerating TCP and UDP network connections and associated processes using the netstat command.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
PlugX can be configured to use HTTP for command and control.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
PlugX allows actors to spawn a reverse shell on a victim.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
PlugX can be added as a service to establish persistence. PlugX also has a module to change service configurations as well as start, control, and delete services.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
PoetRAT has the ability to compress files with zip.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
PoetRAT used TLS to encrypt command and control communications.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
PoetRAT used file system monitoring to track modification and enable automatic exfiltration.
MITRE ATT&CK technique: T1119: Automated Collection
PoetRAT has `pyminifier` to obfuscate scripts.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
PoetRAT has used a Python tool named Browdec.exe to steal browser credentials.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
PoetRAT has used LZMA and base64 libraries to decode obfuscated scripts.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
PoetRAT was delivered with documents using DDE to execute malicious code.
MITRE ATT&CK technique: T1559.002: Inter-Process Communication- Dynamic Data Exchange
PoetRAT has used a .NET tool named dog.exe to exiltrate information over an e-mail account.
MITRE ATT&CK technique: T1048: Exfiltration Over Alternative Protocol
PoetRAT has exfiltrated data over the C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
PoetRAT has used ftp for exfiltration.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
PoetRAT has the ability to overwrite scripts and delete itself if a sandbox environment is detected.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
PoetRAT has used FTP for C2 communications.
MITRE ATT&CK technique: T1071.002: Application Layer Protocol- File Transfer Protocols
PoetRAT has the ability to list files upon receiving the ls command from C2.
MITRE ATT&CK technique: T1083: File and Directory Discovery
PoetRAT has the ability to hide and unhide files.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
PoetRAT has the ability to copy files and download/upload files into C2 channels using FTP and HTTPS.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
PoetRAT has used a Python tool named klog.exe for keylogging.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
PoetRAT used voStro.exe, a compiled pypykatz ), to steal credentials.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
PoetRAT has executed a Lua script through a Lua interpreter for Windows.
MITRE ATT&CK technique: T1059.011: Command and Scripting Interpreter- Lua
PoetRAT has used spearphishing attachments to infect victims.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
PoetRAT has made registry modifications to alter its behavior upon execution.
MITRE ATT&CK technique: T1112: Modify Registry
PoetRAT used TLS to encrypt communications over port 143
MITRE ATT&CK technique: T1571: Non-Standard Port
PoetRAT has used a custom encryption scheme for communication between scripts.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
PoetRAT has the ability to list all running processes.
MITRE ATT&CK technique: T1057: Process Discovery
PoetRAT was executed with a Python script and worked in conjunction with additional Python-based post-exploitation tools.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
PoetRAT has added a registry key in the hive for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
PoetRAT used Nmap for remote system discovery.
MITRE ATT&CK technique: T1018: Remote System Discovery
PoetRAT has the ability to take screen captures.
MITRE ATT&CK technique: T1113: Screen Capture
PoetRAT was distributed via malicious Word documents.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
PoetRAT checked the size of the hard drive to determine if it was being run in a sandbox environment. In the event of sandbox detection, it would delete itself by overwriting the malware scripts with the contents of "License.txt" and exiting.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
PoetRAT has the ability to gather information about the compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
PoetRAT sent username, computer name, and the previously generated UUID in reply to a "who" command from C2.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
PoetRAT has used a Python tool named Bewmac to record the webcam on compromised hosts.
MITRE ATT&CK technique: T1125: Video Capture
PoetRAT has used Word documents with VBScripts to execute malicious activities.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
PoetRAT has used HTTP and HTTPs for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
PoetRAT has called cmd through a Word document macro.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
PoisonIvy creates a Registry key in the Active Setup pointing to a malicious executable.
MITRE ATT&CK technique: T1547.014: Boot or Logon Autostart Execution- Active Setup
PoisonIvy captures window titles.
MITRE ATT&CK technique: T1010: Application Window Discovery
PoisonIvy creates a backdoor through which remote attackers can steal system information.
MITRE ATT&CK technique: T1005: Data from Local System
PoisonIvy can inject a malicious DLL into a process.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
PoisonIvy creates a backdoor through which remote attackers can upload files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
PoisonIvy contains a keylogger.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
PoisonIvy stages collected data in a text file.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
PoisonIvy creates a Registry subkey that registers a new system device.
MITRE ATT&CK technique: T1112: Modify Registry
PoisonIvy creates a mutex using either a custom or default value.
MITRE ATT&CK technique: T1480.002: Execution Guardrails- Mutual Exclusion
PoisonIvy hides any strings related to its own indicators of compromise.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
PoisonIvy creates run key Registry entries pointing to a malicious executable dropped to disk.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
PoisonIvy starts a rootkit from a malicious file dropped to disk.
MITRE ATT&CK technique: T1014: Rootkit
PoisonIvy uses the Camellia cipher to encrypt communications.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
PoisonIvy creates a backdoor through which remote attackers can open a command-line interface.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
PoisonIvy creates a Registry subkey that registers a new service. PoisonIvy also creates a Registry entry modifying the Logical Disk Manager service to point to a malicious DLL dropped to disk.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
PolyglotDuke can use Twitter, Reddit, Imgur and other websites to get a C2 URL.
MITRE ATT&CK technique: T1102.001: Web Service- Dead Drop Resolver
PolyglotDuke can use a custom algorithm to decrypt strings used by the malware.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
PolyglotDuke can store encrypted JSON configuration files in the Registry.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
PolyglotDuke can retrieve payloads from the C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
PolyglotDuke can write encrypted JSON configuration files to the Registry.
MITRE ATT&CK technique: T1112: Modify Registry
PolyglotDuke can use LoadLibraryW and CreateProcess to load and execute code.
MITRE ATT&CK technique: T1106: Native API
PolyglotDuke can custom encrypt strings.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
PolyglotDuke can be executed using rundll32.exe.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
PolyglotDuke can use steganography to hide C2 information in images.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
PolyglotDuke has has used HTTP GET requests in C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Pony has used scripts to delete itself after execution.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Pony can download additional files onto the infected system.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Pony has used the NetUserEnum function to enumerate local accounts.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Pony has attempted to lure targets into downloading an attached executable or document .
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Pony has attempted to lure targets into clicking links in spoofed emails from legitimate banks.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Pony has used the Adobe Reader icon for the downloaded file to look more trustworthy.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Pony has used several Windows functions for various purposes.
MITRE ATT&CK technique: T1106: Native API
Pony attachments have been delivered via compressed archive files. Pony also obfuscates the memory flow by adding junk instructions when executing to make analysis more difficult.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Pony has used a small dictionary of common passwords against a collected list of local accounts.
MITRE ATT&CK technique: T1110.001: Brute Force- Password Guessing
Pony has been delivered via spearphishing attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Pony has been delivered via spearphishing emails which contained malicious links.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Pony has collected the Service Pack, language, and region information to send to the C2.
MITRE ATT&CK technique: T1082: System Information Discovery
Pony has delayed execution using a built-in function to avoid detection and analysis.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
Pony has sent collected information to the C2 via HTTP POST request.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Pony has used batch scripts to delete itself after execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
PoshC2 can use Invoke-TokenManipulation for manipulating tokens.
MITRE ATT&CK technique: T1134: Access Token Manipulation
PoshC2 contains a module for compressing data using ZIP.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
PoshC2 contains a module for recursively parsing through files and directories to gather valid credit card numbers.
MITRE ATT&CK technique: T1119: Automated Collection
PoshC2 has modules for brute forcing local administrator and AD user accounts.
MITRE ATT&CK technique: T1110: Brute Force
PoshC2 can utilize multiple methods to bypass UAC.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
PoshC2 can use Invoke-RunAs to make tokens.
MITRE ATT&CK technique: T1134.002: Access Token Manipulation- Create Process with Token
PoshC2 contains modules for searching for passwords in local and remote files.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
PoshC2 can decrypt passwords stored in the RDCMan configuration file.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
PoshC2 can enumerate local and domain user account information.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
PoshC2 has modules for enumerating domain trusts.
MITRE ATT&CK technique: T1482: Domain Trust Discovery
PoshC2 contains modules for local privilege escalation exploits such as CVE-2016-9192 and CVE-2016-0099.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
PoshC2 contains a module for exploiting SMB via EternalBlue.
MITRE ATT&CK technique: T1210: Exploitation of Remote Services
PoshC2 can enumerate files on the local file system and includes a module for enumerating recently accessed files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
PoshC2 has modules for keystroke logging and capturing credentials from spoofed Outlook authentication messages.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
PoshC2 can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks.
MITRE ATT&CK technique: T1557.001: Adversary-in-the-Middle- LLMNR/NBT-NS Poisoning and SMB Relay
PoshC2 contains an implementation of Mimikatz to gather credentials from memory.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
PoshC2 can enumerate local and domain user account information.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
PoshC2 contains modules, such as Get-LocAdm for enumerating permission groups.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
PoshC2 can perform port scans from an infected host.
MITRE ATT&CK technique: T1046: Network Service Discovery
PoshC2 contains a module for taking packet captures on compromised hosts.
MITRE ATT&CK technique: T1040: Network Sniffing
PoshC2 has a number of modules that leverage pass the hash for lateral movement.
MITRE ATT&CK technique: T1550.002: Use Alternate Authentication Material- Pass the Hash
PoshC2 can use Get-PassPol to enumerate the domain password policy.
MITRE ATT&CK technique: T1201: Password Policy Discovery
PoshC2 contains multiple modules for injecting into processes, such as Invoke-PSInject.
MITRE ATT&CK technique: T1055: Process Injection
PoshC2 contains modules that allow for use of proxies in command and control.
MITRE ATT&CK technique: T1090: Proxy
PoshC2 contains an implementation of PsExec for remote execution.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
PoshC2 contains modules, such as Get-ComputerInfo, for enumerating common system information.
MITRE ATT&CK technique: T1082: System Information Discovery
PoshC2 can enumerate network adapter information.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
PoshC2 contains an implementation of netstat to enumerate TCP and UDP connections.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
PoshC2 can enumerate service and service permission information.
MITRE ATT&CK technique: T1007: System Service Discovery
PoshC2 can use protocols like HTTP/HTTPS for command and control traffic.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
PoshC2 has a number of modules that use WMI to execute tasks.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
PoshC2 has the ability to persist on a system using WMI events.
MITRE ATT&CK technique: T1546.003: Event Triggered Execution- Windows Management Instrumentation Event Subscription
PowGoop can side-load `Goopdate.dll` into `GoogleUpdate.exe`.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
PowGoop can decrypt PowerShell scripts for execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
PowGoop can receive encrypted commands from C2.
MITRE ATT&CK technique: T1573: Encrypted Channel
PowGoop has disguised a PowerShell script as a .dat file .
MITRE ATT&CK technique: T1036: Masquerading
PowGoop has used a DLL named Goopdate.dll to impersonate a legitimate Google update file.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
PowGoop can use a modified Base64 encoding mechanism to send data to and from the C2 server.
MITRE ATT&CK technique: T1132.002: Data Encoding- Non-Standard Encoding
PowGoop has the ability to use PowerShell scripts to execute commands.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
PowGoop can send HTTP GET requests to malicious servers.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Power Loader overwrites Explorer’s Shell_TrayWnd extra window memory to redirect execution to a NTDLL function that is abused to assemble and execute a return-oriented programming chain and create a malicious thread within Explorer.exe.
MITRE ATT&CK technique: T1055.011: Process Injection- Extra Window Memory Injection
PowerDuke has a command to get text of the current foreground window.
MITRE ATT&CK technique: T1010: Application Window Discovery
PowerDuke has a command to write random data across a file and delete it.
MITRE ATT&CK technique: T1485: Data Destruction
PowerDuke has a command to write random data across a file and delete it.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
PowerDuke has commands to get the current directory name as well as the size of a file. It also has commands to obtain information about logical drives, drive type, and free space.
MITRE ATT&CK technique: T1083: File and Directory Discovery
PowerDuke has a command to download a file.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
PowerDuke hides many of its backdoor payloads in an alternate data stream .
MITRE ATT&CK technique: T1564.004: Hide Artifacts- NTFS File Attributes
PowerDuke has a command to list the victim's processes.
MITRE ATT&CK technique: T1057: Process Discovery
PowerDuke achieves persistence by using various Registry Run keys.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
PowerDuke uses rundll32.exe to load.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
PowerDuke uses steganography to hide backdoors in PNG files, which are also encrypted using the Tiny Encryption Algorithm .
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
PowerDuke has commands to get information about the victim's name, build, version, serial number, and memory usage.
MITRE ATT&CK technique: T1082: System Information Discovery
PowerDuke has a command to get the victim's domain and NetBIOS name.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
PowerDuke has commands to get the current user's name and SID.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
PowerDuke has commands to get the time the machine was built, the time, and the time zone.
MITRE ATT&CK technique: T1124: System Time Discovery
PowerDuke runs cmd.exe /c and sends the output to its C2.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
PowerLess can encrypt browser database files prior to exfiltration.
MITRE ATT&CK technique: T1560: Archive Collected Data
PowerLess has a browser info stealer module that can read Chrome and Edge browser database files.
MITRE ATT&CK technique: T1217: Browser Information Discovery
PowerLess has the ability to exfiltrate data, including Chrome and Edge browser database files, from compromised machines.
MITRE ATT&CK technique: T1005: Data from Local System
PowerLess can use base64 and AES ECB decryption prior to execution of downloaded modules.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
PowerLess can use an encrypted channel for C2 communications.
MITRE ATT&CK technique: T1573: Encrypted Channel
PowerLess can download additional payloads to a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
PowerLess can use a module to log keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
PowerLess can stage stolen browser data in `C:\\Windows\\Temp\\cup.tmp` and keylogger data in `C:\\Windows\\Temp\\Report.06E17A5A-7325-4325-8E5D-E172EBA7FC5BK`.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
PowerLess is written in and executed via PowerShell without using powershell.exe.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
PowerPunch can use Base64-encoded scripts.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
PowerPunch can use the volume serial number from a target host to generate a unique XOR key for the next stage payload.
MITRE ATT&CK technique: T1480.001: Execution Guardrails- Environmental Keying
PowerPunch can download payloads from adversary infrastructure.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
PowerPunch has the ability to execute through PowerShell.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
PowerShower has used 7Zip to compress .txt, .pdf, .xls or .doc files prior to exfiltration.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
PowerShower has used a PowerShell document stealer module to pack and exfiltrate .txt, .pdf, .xls or .doc files smaller than 5MB that were modified during the past two days.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
PowerShower has the ability to remove all files created during the dropper process.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
PowerShower has added a registry key so future powershell.exe instances are spawned with coordinates for a window position off-screen by default.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
PowerShower has added a registry key so future powershell.exe instances are spawned off-screen by default, and has removed all registry entries that are left behind during the dropper process.
MITRE ATT&CK technique: T1112: Modify Registry
PowerShower is a backdoor written in PowerShell.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
PowerShower has the ability to deploy a reconnaissance module to retrieve a list of the active processes.
MITRE ATT&CK technique: T1057: Process Discovery
PowerShower sets up persistence with a Registry run key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
PowerShower has the ability to encode C2 communications with base64 encoding.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
PowerShower has collected system information on the infected host.
MITRE ATT&CK technique: T1082: System Information Discovery
PowerShower has the ability to identify the current Windows domain of the infected host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
PowerShower has the ability to identify the current user on the infected host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
PowerShower has the ability to save and execute VBScript.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
PowerShower has sent HTTP GET and POST requests to C2 servers to send information and receive instructions.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
PowerSploit's Invoke-TokenManipulation Exfiltration module can be used to manipulate tokens.
MITRE ATT&CK technique: T1134: Access Token Manipulation
PowerSploit's Get-MicrophoneAudio Exfiltration module can record system microphone audio.
MITRE ATT&CK technique: T1123: Audio Capture
PowerSploit contains a collection of ScriptModification modules that compress and encode scripts and payloads.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
PowerSploit has several modules that search the Windows Registry for stored credentials: Get-UnattendedInstallFile, Get-Webconfig, Get-ApplicationHost, Get-SiteListPassword, Get-CachedGPPPassword, and Get-RegistryAutoLogon.
MITRE ATT&CK technique: T1552.002: Unsecured Credentials- Credentials in Registry
PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit DLL hijacking opportunities in services and processes.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
PowerSploit contains a collection of Exfiltration modules that can access data from local files, volumes, and processes.
MITRE ATT&CK technique: T1005: Data from Local System
PowerSploit has modules such as Get-NetDomainTrust and Get-NetForestTrust to enumerate domain and forest trusts.
MITRE ATT&CK technique: T1482: Domain Trust Discovery
PowerSploit contains a collection of CodeExecution modules that inject code into a process.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
PowerSploit contains a collection of Exfiltration modules that can harvest credentials from Group Policy Preferences.
MITRE ATT&CK technique: T1552.006: Unsecured Credentials- Group Policy Preferences
PowerSploit's Find-AVSignature AntivirusBypass module can be used to locate single byte anti-virus signatures.
MITRE ATT&CK technique: T1027.005: Obfuscated Files or Information- Indicator Removal from Tools
PowerSploit's Invoke-Kerberoast module can request service tickets and return crackable ticket hashes.
MITRE ATT&CK technique: T1558.003: Steal or Forge Kerberos Tickets- Kerberoasting
PowerSploit's Get-Keystrokes Exfiltration module can log keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
PowerSploit contains a collection of Exfiltration modules that can harvest credentials using Mimikatz.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
PowerSploit's Get-ProcessTokenGroup Privesc-PowerUp module can enumerate all SIDs associated with its current token.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit path interception opportunities in the PATH environment variable.
MITRE ATT&CK technique: T1574.007: Hijack Execution Flow- Path Interception by PATH Environment Variable
PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit search order hijacking vulnerabilities.
MITRE ATT&CK technique: T1574.008: Hijack Execution Flow- Path Interception by Search Order Hijacking
PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit unquoted path vulnerabilities.
MITRE ATT&CK technique: T1574.009: Hijack Execution Flow- Path Interception by Unquoted Path
PowerSploit modules are written in and executed via PowerShell.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
PowerSploit's Get-ProcessTokenPrivilege Privesc-PowerUp module can enumerate privileges for a given process.
MITRE ATT&CK technique: T1057: Process Discovery
PowerSploit contains a collection of Privesc-PowerUp modules that can query Registry keys for potential opportunities.
MITRE ATT&CK technique: T1012: Query Registry
PowerSploit reflectively loads a Windows PE file into a process.
MITRE ATT&CK technique: T1620: Reflective Code Loading
PowerSploit's New-UserPersistenceOption Persistence argument can be used to establish via the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
PowerSploit's New-UserPersistenceOption Persistence argument can be used to establish via a Scheduled Task/Job.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
PowerSploit's Get-TimedScreenshot Exfiltration module can take screenshots at regular intervals.
MITRE ATT&CK technique: T1113: Screen Capture
PowerSploit's Install-SSP Persistence module can be used to establish by installing a SSP DLL.
MITRE ATT&CK technique: T1547.005: Boot or Logon Autostart Execution- Security Support Provider
PowerSploit contains a collection of Exfiltration modules that can harvest credentials from Windows vault credential objects.
MITRE ATT&CK technique: T1555.004: Credentials from Password Stores- Windows Credential Manager
PowerSploit's Invoke-WmiCommand CodeExecution module uses WMI to execute and retrieve the output from a PowerShell payload.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
PowerSploit contains a collection of Privesc-PowerUp modules that can discover and replace/modify service binaries, paths, and configs.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
PowerStallion uses Microsoft OneDrive as a C2 server via a network drive mapped with net use.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
PowerStallion uses a XOR cipher to encrypt command output written to its OneDrive C2 server.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
PowerStallion uses PowerShell loops to iteratively check for available commands in its OneDrive C2 server.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
PowerStallion has been used to monitor process lists.
MITRE ATT&CK technique: T1057: Process Discovery
PowerStallion modifies the MAC times of its local log files to match that of the victim's desktop.ini file.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp