sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
metaMain can execute an operator-provided Windows command by leveraging functions such as `WinExec`, `WriteFile`, and `ReadFile`.
MITRE ATT&CK technique: T1106: Native API
metaMain can establish an indirect and raw TCP socket-based connection to the C2 server.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
metaMain has authenticated itself to a different implant, Cryshell, through a port knocking and handshake procedure.
MITRE ATT&CK technique: T1205.001: Traffic Signaling- Port Knocking
metaMain can enumerate the processes that run on the platform.
MITRE ATT&CK technique: T1057: Process Discovery
metaMain can inject the loader file, Speech02.db, into a process.
MITRE ATT&CK technique: T1055: Process Injection
metaMain has reflectively loaded a DLL to read, decrypt, and load an orchestrator file.
MITRE ATT&CK technique: T1620: Reflective Code Loading
metaMain can take and save screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
metaMain can encrypt the data that it sends and receives from the C2 server using an RC4 encryption algorithm.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
metaMain can collect the computer name from a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
metaMain can collect the username from a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
metaMain has delayed execution for five to six minutes during its persistence establishment process.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
metaMain can change the `CreationTime`, `LastAccessTime`, and `LastWriteTime` file time attributes when executed with `SYSTEM` privileges.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
metaMain can use HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
metaMain registered a WMI event subscription consumer called "hard_disk_stat" to establish persistence.
MITRE ATT&CK technique: T1546.003: Event Triggered Execution- Windows Management Instrumentation Event Subscription
nbtstat can be used to discover local NetBIOS domain names.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
nbtstat can be used to discover current NetBIOS sessions.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
netsh can be used to disable local firewall settings.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
netsh can be used as a persistence proxy technique to execute a helper DLL when netsh.exe is executed.
MITRE ATT&CK technique: T1546.007: Event Triggered Execution- Netsh Helper DLL
netsh can be used to set up a proxy tunnel to allow remote host access to an infected host.
MITRE ATT&CK technique: T1090: Proxy
netsh can be used to discover system firewall settings.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
netstat can be used to enumerate local network connections, including active TCP connections and other network statistics.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
ngrok can provide DGA for C2 servers through the use of random URL strings that change every 12 hours.
MITRE ATT&CK technique: T1568.002: Dynamic Resolution- Domain Generation Algorithms
ngrok has been used by threat actors to configure servers for data exfiltration.
MITRE ATT&CK technique: T1567: Exfiltration Over Web Service
ngrok can tunnel RDP and other services securely over internet connections.
MITRE ATT&CK technique: T1572: Protocol Tunneling
ngrok can be used to proxy connections to machines located behind NAT or firewalls.
MITRE ATT&CK technique: T1090: Proxy
ngrok has been used by threat actors to proxy C2 connections to ngrok service subdomains.
MITRE ATT&CK technique: T1102: Web Service
njRAT gathers information about opened windows during the initial infection.
MITRE ATT&CK technique: T1010: Application Window Discovery
njRAT is capable of manipulating and deleting registry keys, including those used for persistence.
MITRE ATT&CK technique: T1070.009: Indicator Removal- Clear Persistence
njRAT has used AutoIt to compile the payload and main script into a single executable after delivery.
MITRE ATT&CK technique: T1027.004: Obfuscated Files or Information- Compile After Delivery
njRAT has a module that steals passwords saved in victim web browsers.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
njRAT can collect data from a local system.
MITRE ATT&CK technique: T1005: Data from Local System
njRAT has modified the Windows firewall to allow itself to communicate through the firewall.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
njRAT has included a base64 encoded executable.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
njRAT has used HTTP to receive stolen information from the infected machine.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
njRAT has used a fast flux DNS for C2 IP resolution.
MITRE ATT&CK technique: T1568.001: Dynamic Resolution- Fast Flux DNS
njRAT is capable of deleting files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
njRAT can browse file systems using a file manager module.
MITRE ATT&CK technique: T1083: File and Directory Discovery
njRAT can download files to the victim’s machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
njRAT is capable of logging keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
njRAT can create, delete, or modify a specified Registry key or value.
MITRE ATT&CK technique: T1112: Modify Registry
njRAT has used the ShellExecute function within a script.
MITRE ATT&CK technique: T1106: Native API
njRAT has used port 1177 for HTTP C2 communications.
MITRE ATT&CK technique: T1571: Non-Standard Port
njRAT will attempt to detect if the victim system has a camera during the initial infection. njRAT can also detect any removable drives connected to the system.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
njRAT has executed PowerShell commands via auto-run registry key persistence.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
njRAT can search a list of running processes for Tr.exe.
MITRE ATT&CK technique: T1057: Process Discovery
njRAT can read specific registry values.
MITRE ATT&CK technique: T1012: Query Registry
njRAT has added persistence via the Registry key HKCU\Software\Microsoft\CurrentVersion\Run\ and dropped a shortcut in %STARTUP%.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
njRAT has a module for performing remote desktop access.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
njRAT can identify remote hosts on connected networks.
MITRE ATT&CK technique: T1018: Remote System Discovery
njRAT can be configured to spread via removable drives.
MITRE ATT&CK technique: T1091: Replication Through Removable Media
njRAT can capture screenshots of the victim’s machines.
MITRE ATT&CK technique: T1113: Screen Capture
njRAT uses Base64 encoding for C2 traffic.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
njRAT enumerates the victim operating system and computer name during the initial infection.
MITRE ATT&CK technique: T1082: System Information Discovery
njRAT enumerates the current user during the initial infection.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
njRAT can access the victim's webcam.
MITRE ATT&CK technique: T1125: Video Capture
njRAT has used HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
njRAT can launch a command shell interface for executing commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
If an initial connectivity check fails, pngdowner attempts to extract proxy details and credentials from Windows Protected Storage and from the IE Credentials Store. This allows the adversary to use the proxy credentials for subsequent requests if they enable outbound HTTP access.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
pngdowner deletes content from C2 communications that was saved to the user's temporary directory.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
pngdowner uses HTTP for command and control.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
pwdump can be used to dump credentials from the SAM.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
route can be used to discover routing configuration information.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
schtasks is used to schedule tasks on a Windows system to run at a specific date and time.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
spwebmember is used to enumerate and dump information from Microsoft SharePoint.
MITRE ATT&CK technique: T1213.002: Data from Information Repositories- Sharepoint
sqlmap can be used to automate exploitation of SQL injection vulnerabilities.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
xCaon has added persistence via the Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load which causes the malware to run each time any user logs in.
MITRE ATT&CK technique: T1547: Boot or Logon Autostart Execution
xCaon has uploaded files from victims' machines.
MITRE ATT&CK technique: T1005: Data from Local System
xCaon has decoded strings from the C2 server before executing commands.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
xCaon has a command to download files to the victim's machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
xCaon has leveraged native OS function calls to retrieve victim's network adapter's information using GetAdapterInfo API.
MITRE ATT&CK technique: T1106: Native API
xCaon has checked for the existence of Kaspersky antivirus software on the system.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
xCaon has used Base64 to encode its C2 traffic.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
xCaon has encrypted data sent to the C2 server using a XOR key.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
xCaon has used the GetAdaptersInfo API call to get the victim's MAC address.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
xCaon has communicated with the C2 server by sending POST requests over HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
xCaon has a command to start an interactive shell.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
xCmd can be used to execute binaries on remote systems by creating and starting a service.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
yty communicates to the C2 server by retrieving a Google Doc.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
yty contains junk code in its binary, likely to confuse malware analysts.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
yty collects files with the following extensions: .ppt, .pptx, .pdf, .doc, .docx, .xls, .xlsx, .docm, .rtf, .inp, .xlsm, .csv, .odt, .pps, .vcf and sends them back to the C2 server.
MITRE ATT&CK technique: T1005: Data from Local System
yty gathers information on victim’s drives and has a plugin for document listing.
MITRE ATT&CK technique: T1083: File and Directory Discovery
yty uses a keylogger plugin to gather keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
yty gets an output of running processes using the tasklist command.
MITRE ATT&CK technique: T1057: Process Discovery
yty uses the net view command for discovery.
MITRE ATT&CK technique: T1018: Remote System Discovery
yty establishes persistence by creating a scheduled task with the command SchTasks /Create /SC DAILY /TN BigData /TR “ + path_file + “/ST 09:30“.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
yty collects screenshots of the victim machine.
MITRE ATT&CK technique: T1113: Screen Capture
yty packs a plugin with UPX.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
yty has some basic anti-sandbox detection that tries to detect Virtual PC, Sandboxie, and VMware.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
yty gathers the computer name, the serial number of the main disk volume, CPU information, Microsoft Windows version, and runs the command systeminfo.
MITRE ATT&CK technique: T1082: System Information Discovery
yty runs ipconfig /all and collects the domain name.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
yty collects the victim’s username.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
zwShell has deleted itself after creating a service as well as deleted a temporary file when the system reboots.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
zwShell can browse the file system.
MITRE ATT&CK technique: T1083: File and Directory Discovery
zwShell can modify the Registry.
MITRE ATT&CK technique: T1112: Modify Registry
zwShell has used RDP for lateral movement.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
zwShell has been copied over network shares to move laterally.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
zwShell has used SchTasks for execution.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
zwShell can obtain the victim PC name and OS version.
MITRE ATT&CK technique: T1082: System Information Discovery
zwShell can obtain the victim IP address.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
zwShell can obtain the name of the logged-in user on the victim.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
zwShell can launch command-line shells.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
zwShell has established persistence by adding itself as a new service.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service