sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Neoichor can clear the browser history on a compromised host by changing the `ClearBrowsingHistoryOnExit` value to 1 in the `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy` Registry key.
MITRE ATT&CK technique: T1070: Indicator Removal
Neoichor can download additional files onto a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Neoichor can check for Internet connectivity by contacting bing.com with the request format `bing.com?id=`.
MITRE ATT&CK technique: T1016.001: System Network Configuration Discovery- Internet Connection Discovery
Neoichor has the ability to configure browser settings by modifying Registry entries under `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer`.
MITRE ATT&CK technique: T1112: Modify Registry
Neoichor can collect the OS version and computer name from a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
Neoichor can identify the system language on a compromised host.
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
Neoichor can gather the IP address from an infected host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Neoichor can collect the user name from a victim's machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Neoichor can use HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Nerex drops a signed Microsoft DLL to disk.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Nerex creates a backdoor through which remote attackers can download files onto a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Nerex creates a Registry subkey that registers a new service.
MITRE ATT&CK technique: T1112: Modify Registry
Nerex creates a Registry subkey that registers a new service.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
The `net localgroup` and `net group` commands in Net can be used to add existing users to local and domain groups.
MITRE ATT&CK technique: T1098.007: Account Manipulation- Additional Local or Domain Groups
Net commands used with the /domain flag can be used to gather information about and manipulate user accounts on the current domain.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
The net user username \password \domain commands in Net can be used to create a domain account.
MITRE ATT&CK technique: T1136.002: Create Account- Domain Account
Commands such as net group /domain can be used in Net to gather information about and manipulate groups.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
Commands under net user can be used in Net to gather information about and manipulate user accounts.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
The net user username \password commands in Net can be used to create a local account.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
Commands such as net group and net localgroup can be used in Net to gather information about and manipulate groups.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
The net use \\system\share /delete command can be used in Net to remove an established connection to a network share.
MITRE ATT&CK technique: T1070.005: Indicator Removal- Network Share Connection Removal
The net view \\remotesystem and net share commands in Net can be used to find shared drives and directories on remote and local systems respectively.
MITRE ATT&CK technique: T1135: Network Share Discovery
The net accounts and net accounts /domain commands with Net can be used to obtain password policy information.
MITRE ATT&CK technique: T1201: Password Policy Discovery
Commands such as net view can be used in Net to gather information about available remote systems.
MITRE ATT&CK technique: T1018: Remote System Discovery
Lateral movement can be done with Net through net use commands to connect to the on remote systems.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
The net start and net stop commands can be used in Net to execute or stop Windows services.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Commands such as net use and net session can be used in Net to gather information about network connections from a particular host.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
The net start command can be used in Net to find information about Windows services.
MITRE ATT&CK technique: T1007: System Service Discovery
The net time command can be used in Net to determine the local or remote system time.
MITRE ATT&CK technique: T1124: System Time Discovery
Net Crawler uses credential dumpers such as Mimikatz and Windows Credential Editor to extract cached credentials from Windows systems.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Net Crawler uses a list of known credentials gathered through credential dumping to guess passwords to accounts as it spreads throughout a network.
MITRE ATT&CK technique: T1110.002: Brute Force- Password Cracking
Net Crawler uses Windows admin shares to establish authenticated sessions to remote systems over SMB as part of lateral movement.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Net Crawler uses PsExec to perform remote service manipulation to execute a copy of itself as part of lateral movement.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
NetTraveler reports window names along with keylogger information to provide application context.
MITRE ATT&CK technique: T1010: Application Window Discovery
NetTraveler contains a keylogger.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Netwalker's PowerShell script has been obfuscated with multiple layers including base64 and hexadecimal encoding and XOR-encryption, as well as obfuscated PowerShell functions and variables.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
Netwalker can encrypt files on infected machines to extort victims.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Netwalker's PowerShell script can decode and decrypt multiple layers of obfuscation, leading to the Netwalker DLL being loaded into memory.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Netwalker can detect and terminate active security software-related processes on infected systems.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
The Netwalker DLL has been injected reflectively into the memory of a legitimate running process.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Netwalker's DLL has been embedded within the PowerShell script in hex format.
MITRE ATT&CK technique: T1027.009: Obfuscated Files or Information- Embedded Payloads
Operators deploying Netwalker have used psexec and certutil to retrieve the Netwalker payload.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Netwalker can delete the infected system's Shadow Volumes to prevent recovery.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
Operators deploying Netwalker have used psexec to copy the Netwalker payload across accessible systems.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
Netwalker can add the following registry entry: HKEY_CURRENT_USER\SOFTWARE\{8 random characters}.
MITRE ATT&CK technique: T1112: Modify Registry
Netwalker can use Windows API functions to inject the ransomware DLL.
MITRE ATT&CK technique: T1106: Native API
Netwalker has been written in PowerShell and executed directly in memory, avoiding detection.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Netwalker can detect and terminate active security software-related processes on infected systems.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Operators deploying Netwalker have used psexec and certutil to retrieve the Netwalker payload.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Netwalker can terminate system processes and services, some of which relate to backup software.
MITRE ATT&CK technique: T1489: Service Stop
Netwalker can determine the system architecture it is running on to choose which version of the DLL to use.
MITRE ATT&CK technique: T1082: System Information Discovery
Operators deploying Netwalker have used batch scripts to retrieve the Netwalker payload.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Netwalker can use WMI to delete Shadow Volumes.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Nidiran can download and execute files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Nidiran can create a new service named msamger , which mimics the legitimate Microsoft database by the same name.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Nidiran can create a new service named msamger .
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
NightClub can use `GetForegroundWindow` to enumerate the active window.
MITRE ATT&CK technique: T1010: Application Window Discovery
NightClub can load a module to leverage the LAME encoder and `mciSendStringW` to control and capture audio.
MITRE ATT&CK technique: T1123: Audio Capture
NightClub can use a DNS tunneling plugin to exfiltrate data by adding it to the subdomain portion of a DNS request.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
NightClub can use a file monitor to steal specific files from targeted systems.
MITRE ATT&CK technique: T1005: Data from Local System
NightClub can use SMTP and DNS for file exfiltration and C2.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
NightClub can use a file monitor to identify .lnk, .doc, .docx, .xls, .xslx, and .pdf files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
NightClub can load multiple additional plugins on an infected host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
NightClub can use a plugin for keylogging.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
NightClub has copied captured files and keystrokes to the `%TEMP%` directory of compromised hosts.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
NightClub can use emails for C2 communications.
MITRE ATT&CK technique: T1071.003: Application Layer Protocol- Mail Protocols
NightClub has created a service named `WmdmPmSp` to spoof a Windows Media service.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
NightClub has chosen file names to appear legitimate including EsetUpdate-0117583943.exe for its dropper.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
NightClub can modify the Registry to set the ServiceDLL for a service created by the malware for persistence.
MITRE ATT&CK technique: T1112: Modify Registry
NightClub can use multiple native APIs including `GetKeyState`, `GetForegroundWindow`, `GetWindowThreadProcessId`, and `GetKeyboardLayout`.
MITRE ATT&CK technique: T1106: Native API
NightClub has used a non-standard encoding in DNS tunneling removing any `=` from the result of base64 encoding, and replacing `/` characters with `-s` and `+` characters with `-p`.
MITRE ATT&CK technique: T1132.002: Data Encoding- Non-Standard Encoding
NightClub can obfuscate strings using the congruential generator `: staten+1 = mod 232`.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
NightClub has the ability to monitor removable drives.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
NightClub has the ability to use `GetWindowThreadProcessId` to identify the process behind a specified window.
MITRE ATT&CK technique: T1057: Process Discovery
NightClub can load a module to call `CreateCompatibleDC` and `GdipSaveImageToStream` for screen capture.
MITRE ATT&CK technique: T1113: Screen Capture
NightClub can modify the Creation, Access, and Write timestamps for malicious DLLs to match those of the genuine Windows DLL user32.dll.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
NightClub has created a Windows service named `WmdmPmSp` to establish persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Nightdoor uses TCP and UDP communication for command and control traffic.
MITRE ATT&CK technique: T1071: Application Layer Protocol
Nightdoor stores network configuration data in a file XOR encoded with the key value of `0x7A`.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Nightdoor can self-delete.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Nightdoor uses a legitimate executable to load a malicious DLL file for installation.
MITRE ATT&CK technique: T1574: Hijack Execution Flow
Nightdoor can collect information on installed applications via Windows registry keys, as well as collecting information on running processes.
MITRE ATT&CK technique: T1057: Process Discovery
Nightdoor uses scheduled tasks for persistence to load the final malware payload into memory.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Nightdoor embeds code from the public `al-khaser` project, a repository that works to detect virtual machines, sandboxes, and malware analysis environments.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
Nightdoor gathers information on the victim system such as CPU and Computer name as well as device drivers. Nightdoor can also collect information about disk drives, their total and free space, and file system type.
MITRE ATT&CK technique: T1082: System Information Discovery
Nightdoor gathers information on victim system network configuration such as MAC addresses.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Nightdoor gathers information on victim system users and usernames.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Nightdoor can identify the system local time information.
MITRE ATT&CK technique: T1124: System Time Discovery
Nightdoor can utilize Microsoft OneDrive or Google Drive for command and control purposes.
MITRE ATT&CK technique: T1102: Web Service
Nightdoor creates a cmd.exe shell to send and receive commands from the command and control server via open pipes.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Ninja loaders can be side-loaded with legitimate and signed executables including the VLC.exe media player.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Ninja has the ability to modify headers and URL paths to hide malicious traffic in HTTP requests.
MITRE ATT&CK technique: T1001: Data Obfuscation
The Ninja loader component can decrypt and decompress the payload.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
The Ninja payload is XOR encrypted and compressed. Ninja has also XORed its configuration data with a constant value of `0xAA` and compressed it with the LZSS algorithm.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Ninja can store its final payload in the Registry under `$HKLM\SOFTWARE\Classes\Interface\` encrypted with a dynamically generated key based on the drive’s serial number.
MITRE ATT&CK technique: T1480.001: Execution Guardrails- Environmental Keying
Ninja has the ability to enumerate directory content.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Ninja can use pipes to redirect the standard input and the standard output.
MITRE ATT&CK technique: T1559: Inter-Process Communication
Ninja can proxy C2 communications including to and from internal agents without internet connectivity.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy
Ninja has gained execution through victims opening malicious executable files embedded in zip archives.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Ninja has used legitimate looking filenames for its loader including update.dll and x64.dll.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Ninja has the ability to use a proxy chain with up to 255 hops when using TCP.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
The Ninja loader can call Windows APIs for discovery, process injection, and payload decryption.
MITRE ATT&CK technique: T1106: Native API
Ninja can forward TCP packets between the C2 and a remote host.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Ninja can encode C2 communications with a base64 algorithm using a custom alphabet.
MITRE ATT&CK technique: T1132.002: Data Encoding- Non-Standard Encoding
Ninja can enumerate processes on a targeted host.
MITRE ATT&CK technique: T1057: Process Discovery
Ninja has the ability to inject an agent module into a new process and arbitrary shellcode into running processes.
MITRE ATT&CK technique: T1055: Process Injection
Ninja has the ability to mimic legitimate services with customized HTTP URL paths and headers to hide malicious traffic.
MITRE ATT&CK technique: T1001.003: Data Obfuscation- Protocol or Service Impersonation
Ninja loader components can be executed through rundll32.exe.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Ninja can configure its agent to work only in specific time frames.
MITRE ATT&CK technique: T1029: Scheduled Transfer
Ninja has been distributed to victims via the messaging app Telegram.
MITRE ATT&CK technique: T1566.003: Phishing- Spearphishing via Service
Ninja can XOR and AES encrypt C2 messages.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Ninja can obtain the computer name and information on the OS and physical drives from targeted hosts.
MITRE ATT&CK technique: T1082: System Information Discovery
Ninja can enumerate the IP address on compromised systems.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Ninja can change or create the last access or write times.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
Ninja can use HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Ninja can create the services `httpsvc` and `w3esvc` for persistence .
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Nltest may be used to enumerate trusted domains by using commands such as nltest /domain_trusts.
MITRE ATT&CK technique: T1482: Domain Trust Discovery
Nltest may be used to enumerate remote domain controllers using options such as /dclist and /dsgetdc.
MITRE ATT&CK technique: T1018: Remote System Discovery
Nltest may be used to enumerate the parent domain of a local machine using /parentdomain.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
NotPetya uses wevtutil to clear the Windows event logs.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
NotPetya encrypts user files and disk structures like the MBR with 2048-bit RSA.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
NotPetya can use two exploits in SMBv1, EternalBlue and EternalRomance, to spread itself to other remote systems on the network.
MITRE ATT&CK technique: T1210: Exploitation of Remote Services
NotPetya searches for files ending with dozens of different file extensions prior to encryption.
MITRE ATT&CK technique: T1083: File and Directory Discovery
NotPetya contains a modified version of Mimikatz to help gather credentials that are later used for lateral movement.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
NotPetya can use valid credentials with PsExec or wmic to spread itself to remote systems.
MITRE ATT&CK technique: T1078.003: Valid Accounts- Local Accounts
NotPetya drops PsExec with the filename dllhost.dat.
MITRE ATT&CK technique: T1036: Masquerading
NotPetya uses rundll32.exe to install itself on remote systems when accessed via PsExec or wmic.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
NotPetya can use PsExec, which interacts with the ADMIN$ network share to execute commands on remote systems.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
NotPetya creates a task to reboot the system one hour after infection.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
NotPetya determines if specific antivirus programs are running on an infected host machine.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
NotPetya can use PsExec to help propagate itself across a network.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
NotPetya will reboot the system one hour after infection.
MITRE ATT&CK technique: T1529: System Shutdown/Reboot
NotPetya can use wmic to help propagate itself across a network.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
OLDBAIT collects credentials from several email clients.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
OLDBAIT collects credentials from Internet Explorer, Mozilla Firefox, and Eudora.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
OLDBAIT can use SMTP for C2.
MITRE ATT&CK technique: T1071.003: Application Layer Protocol- Mail Protocols
OLDBAIT installs itself in %ALLUSERPROFILE%\\Application Data\Microsoft\MediaPlayer\updatewindws.exe; the directory name is missing a space and the file name is missing the letter "o."
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
OLDBAIT obfuscates internal strings and unpacks them at startup.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
OLDBAIT can use HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
OSInfo enumerates local and domain users
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
OSInfo specifically looks for Domain Admins and power users within the domain.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
OSInfo enumerates local and domain users
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
OSInfo has enumerated the local administrators group.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
OSInfo discovers shares on the network
MITRE ATT&CK technique: T1135: Network Share Discovery
OSInfo queries the registry to look for information about Terminal Services.
MITRE ATT&CK technique: T1012: Query Registry
OSInfo performs a connection test to discover remote systems in the network
MITRE ATT&CK technique: T1018: Remote System Discovery
OSInfo discovers information about the infected machine.
MITRE ATT&CK technique: T1082: System Information Discovery
OSInfo discovers the current domain information.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
OSInfo enumerates the current network connections similar to net use .
MITRE ATT&CK technique: T1049: System Network Connections Discovery
OSX/Shlayer can install malicious Safari browser extensions to serve ads.
MITRE ATT&CK technique: T1176: Browser Extensions
OSX/Shlayer can base64-decode and AES-decrypt downloaded payloads. Versions of OSX/Shlayer pass encrypted and password-protected code to openssl and then write the payload to the /tmp folder.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
OSX/Shlayer can escalate privileges to root by asking the user for credentials.
MITRE ATT&CK technique: T1548.004: Abuse Elevation Control Mechanism- Elevated Execution with Prompt
OSX/Shlayer has used the command appDir="$)" and $") to construct installation paths.
MITRE ATT&CK technique: T1083: File and Directory Discovery
If running with elevated privileges, OSX/Shlayer has used the spctl command to disable Gatekeeper protection for a downloaded file. OSX/Shlayer can also leverage system links pointing to bash scripts in the downloaded DMG file to bypass Gatekeeper, a flaw patched in macOS 11.3 and later versions. OSX/Shlayer has been Notarized by Apple, resulting in successful passing of additional Gatekeeper checks.
MITRE ATT&CK technique: T1553.001: Subvert Trust Controls- Gatekeeper Bypass
OSX/Shlayer has executed a .command script from a hidden directory in a mounted DMG.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
OSX/Shlayer has used the mktemp utility to make random and unique filenames for payloads, such as export tmpDir="$" or mktemp -t Installer.
MITRE ATT&CK technique: T1564: Hide Artifacts
OSX/Shlayer has used the `nohup` command to instruct executed payloads to ignore hangup signals.
MITRE ATT&CK technique: T1564.011: Hide Artifacts- Ignore Process Interrupts
OSX/Shlayer can download payloads, and extract bytes from files. OSX/Shlayer uses the curl -fsL "$url" >$tmp_path command to download malicious payloads into a temporary directory.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
OSX/Shlayer can use the chmod utility to set a file as executable, such as chmod 777 or chmod +x.
MITRE ATT&CK technique: T1222.002: File and Directory Permissions Modification- Linux and Mac File and Directory Permissions Modification
OSX/Shlayer has relied on users mounting and executing a malicious DMG file.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
OSX/Shlayer can masquerade as a Flash Player update.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
OSX/Shlayer has used a resource fork to hide a compressed binary file of itself from the terminal, Finder, and potentially evade traditional scanners.
MITRE ATT&CK technique: T1564.009: Hide Artifacts- Resource Forking
OSX/Shlayer has collected the IOPlatformUUID, session UID, and the OS version using the command sw_vers -productVersion.
MITRE ATT&CK technique: T1082: System Information Discovery
OSX/Shlayer can use bash scripts to check the macOS version, download payloads, and extract bytes from files. OSX/Shlayer uses the command sh -c tail -c +1381... to extract bytes at an offset from a specified file. OSX/Shlayer uses the curl -fsL "$url" >$tmp_path command to download malicious payloads into a temporary directory.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
OSX_OCEANLOTUS.D has used AES in CBC mode to encrypt collected data when saving that data to disk.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
OSX_OCEANLOTUS.D scrambles and encrypts data using AES256 before sending it to the C2 server.
MITRE ATT&CK technique: T1560.002: Archive Collected Data- Archive via Library
OSX_OCEANLOTUS.D has the ability to upload files from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
OSX_OCEANLOTUS.D uses a decode routine combining bit shifting and XOR operations with a variable key that depends on the length of the string that was encoded. If the computation for the variable XOR key turns out to be 0, the default XOR key of 0x1B is used. This routine is also referenced as the `rotate` function in reporting.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
OSX_OCEANLOTUS.D encrypts its strings in RSA256 and encodes them in a custom base64 scheme and XOR.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
OSX_OCEANLOTUS.D has a command to delete a file from the system. OSX_OCEANLOTUS.D deletes the app bundle and dropper after execution.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
OSX_OCEANLOTUS.D uses the command xattr -d com.apple.quarantine to remove the quarantine file attribute used by Gatekeeper.
MITRE ATT&CK technique: T1553.001: Subvert Trust Controls- Gatekeeper Bypass
OSX_OCEANLOTUS.D sets the main loader file’s attributes to hidden.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
OSX_OCEANLOTUS.D has a command to download and execute a file on the victim’s machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
OSX_OCEANLOTUS.D can create a persistence file in the folder /Library/LaunchAgents.
MITRE ATT&CK technique: T1543.001: Create or Modify System Process- Launch Agent
If running with root permissions, OSX_OCEANLOTUS.D can create a persistence file in the folder /Library/LaunchDaemons.
MITRE ATT&CK technique: T1543.004: Create or Modify System Process- Launch Daemon
OSX_OCEANLOTUS.D has changed permissions of a second-stage payload to an executable via chmod.
MITRE ATT&CK technique: T1222.002: File and Directory Permissions Modification- Linux and Mac File and Directory Permissions Modification
OSX_OCEANLOTUS.D has disguised it's true file structure as an application bundle by adding special characters to the filename and using the icon for legitimate Word documents.
MITRE ATT&CK technique: T1036.008: Masquerading- Masquerade File Type
OSX_OCEANLOTUS.D uses file naming conventions with associated executable locations to blend in with the macOS TimeMachine and OpenSSL services. Such as, naming a LaunchAgent plist file `com.apple.openssl.plist` which executes OSX_OCEANLOTUS.D from the user's `~/Library/OpenSSL/` folder upon user login.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
OSX_OCEANLOTUS.D has used a custom binary protocol over port 443 for C2 traffic.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
OSX_OCEANLOTUS.D has used a custom binary protocol over TCP port 443 for C2.
MITRE ATT&CK technique: T1571: Non-Standard Port
OSX_OCEANLOTUS.D uses PowerShell scripts.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
For network communications, OSX_OCEANLOTUS.D loads a dynamic library using `dlopen` and obtains a function pointer to execute within that shared library using `dlsym`.
MITRE ATT&CK technique: T1129: Shared Modules
OSX_OCEANLOTUS.D has a variant that is packed with UPX.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
OSX_OCEANLOTUS.D has used `zlib` to compress all data after 0x52 for the custom TCP C2 protocol.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
OSX_OCEANLOTUS.D encrypts data sent back to the C2 using AES in CBC mode with a null initialization vector and a key sent from the server that is padded to 32 bytes.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
OSX_OCEANLOTUS.D checks a number of system parameters to see if it is being run on real hardware or in a virtual machine environment, such as `sysctl hw.model` and the kernel boot time.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
OSX_OCEANLOTUS.D collects processor information, memory information, computer name, hardware UUID, serial number, and operating system version. OSX_OCEANLOTUS.D has used the ioreg command to gather some of this information.
MITRE ATT&CK technique: T1082: System Information Discovery
OSX_OCEANLOTUS.D can collect the network interface MAC address on the infected host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
OSX_OCEANLOTUS.D can use the touch -t command to change timestamps.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
OSX_OCEANLOTUS.D uses a shell script as the main executable inside an app bundle and drops an embedded base64-encoded payload to the /tmp folder.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
OSX_OCEANLOTUS.D uses Word macros for execution.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
OSX_OCEANLOTUS.D can also use use HTTP POST and GET requests to send and receive C2 information.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
ObliqueRAT can break large files of interest into smaller chunks to prepare them for exfiltration.
MITRE ATT&CK technique: T1030: Data Transfer Size Limits
ObliqueRAT has the ability to extract data from removable devices connected to the endpoint.
MITRE ATT&CK technique: T1025: Data from Removable Media
ObliqueRAT has the ability to recursively enumerate files on an infected endpoint.
MITRE ATT&CK technique: T1083: File and Directory Discovery
ObliqueRAT can copy specific files, webcam captures, and screenshots to local directories.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
ObliqueRAT has gained execution on targeted systems through luring users to click on links to malicious URLs.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
ObliqueRAT can discover pluggable/removable drives to extract files from.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
ObliqueRAT can check for blocklisted process names on a compromised host.
MITRE ATT&CK technique: T1057: Process Discovery
ObliqueRAT can gain persistence by a creating a shortcut in the infected user's Startup directory.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
ObliqueRAT can capture a screenshot of the current screen.
MITRE ATT&CK technique: T1113: Screen Capture
ObliqueRAT can hide its payload in BMP images hosted on compromised websites.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
ObliqueRAT can halt execution if it identifies processes belonging to virtual machine software or analysis tools.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
ObliqueRAT has the ability to check for blocklisted computer names on infected endpoints.
MITRE ATT&CK technique: T1082: System Information Discovery
ObliqueRAT can check for blocklisted usernames on infected endpoints.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
ObliqueRAT can capture images from webcams on compromised hosts.
MITRE ATT&CK technique: T1125: Video Capture
OceanSalt can delete files from the system.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
OceanSalt can extract drive information from the endpoint and search files on the system.
MITRE ATT&CK technique: T1083: File and Directory Discovery
OceanSalt can encode data with a NOT operation before sending the data to the control server.
MITRE ATT&CK technique: T1132.002: Data Encoding- Non-Standard Encoding
OceanSalt can collect the name and ID for every process running on the system.
MITRE ATT&CK technique: T1057: Process Discovery
OceanSalt has been delivered via spearphishing emails with Microsoft Office attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
OceanSalt can collect the computer name from the system.
MITRE ATT&CK technique: T1082: System Information Discovery
OceanSalt can collect the victim’s IP address.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
OceanSalt can create a reverse shell on the infected endpoint using cmd.exe. OceanSalt has been executed via malicious macros.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Octopus has compressed data before exfiltrating it using a tool called Abbrevia.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
Octopus can exfiltrate files from the system using a documents collector tool.
MITRE ATT&CK technique: T1005: Data from Local System
Octopus has uploaded stolen files and data from a victim's machine over its C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Octopus has exfiltrated data to file sharing sites.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
Octopus can collect information on the Windows directory and searches for compressed RAR files on the host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Octopus can download additional files and tools onto the victim’s machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Octopus has stored collected information in the Application Data directory on a compromised host.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Octopus has relied upon users clicking on a malicious attachment delivered through spearphishing.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Octopus has been disguised as legitimate programs, such as Java and Telegram Messenger.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Octopus achieved persistence by placing a malicious executable in the startup directory and has added the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key to the Registry.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Octopus can capture screenshots of the victims’ machine.
MITRE ATT&CK technique: T1113: Screen Capture
Octopus has been delivered via spearsphishing emails.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Octopus has encoded C2 communications in Base64.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Octopus can collect system drive information, the computer name, the size of the disk, OS version, and OS architecture information.
MITRE ATT&CK technique: T1082: System Information Discovery
Octopus can collect the host IP address from the victim’s machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Octopus can collect the username from the victim’s machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Octopus has used HTTP GET and POST requests for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Octopus has used wmic.exe for local discovery information.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Okrum has used a custom implementation of AES encryption to encrypt collected data.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
Okrum was seen using a RAR archiver tool to compress/decompress data.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
Okrum was seen using modified Quarks PwDump to perform credential dumping.
MITRE ATT&CK technique: T1003.005: OS Credential Dumping- Cached Domain Credentials
Okrum leverages the HTTP protocol for C2 communication, while hiding the actual messages in the Cookie and Set-Cookie headers of the HTTP requests.
MITRE ATT&CK technique: T1001: Data Obfuscation
Okrum's loader can decrypt the backdoor code, embedded within the loader or within a legitimate PNG file. A custom XOR cipher or RC4 is used for decryption.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Data exfiltration is done by Okrum using the already opened channel with the C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Okrum can identify proxy servers configured and used by the victim, and use it to make HTTP requests to C2 its server.
MITRE ATT&CK technique: T1090.002: Proxy- External Proxy
Okrum's backdoor deletes files after they have been successfully uploaded to C2 servers.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Okrum has used DriveLetterView to enumerate drive information.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Before exfiltration, Okrum's backdoor has used hidden files to store logs and outputs from backdoor commands.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
Okrum has built-in commands for uploading, downloading, and executing files to the system.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Okrum was seen using a keylogger tool to capture keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Okrum was seen using MimikatzLite to perform credential dumping.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Okrum can establish persistence by adding a new service NtmsSvc with the display name Removable Storage to masquerade as a legitimate Removable Storage Manager.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Okrum leverages the HTTP protocol for C2 communication, while hiding the actual messages in the Cookie and Set-Cookie headers of the HTTP requests.
MITRE ATT&CK technique: T1001.003: Data Obfuscation- Protocol or Service Impersonation
Okrum establishes persistence by creating a .lnk shortcut to itself in the Startup folder.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Okrum's installer can attempt to achieve persistence by creating a scheduled task.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Okrum's loader can create a new service named NtmsSvc to execute the payload.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Okrum can establish persistence by creating a .lnk shortcut to itself in the Startup folder.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
Okrum has used base64 to encode C2 communication.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Okrum's payload is encrypted and embedded within its loader, or within a legitimate PNG file.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
Okrum uses AES to encrypt network traffic. The key can be hardcoded or negotiated with the C2 server in the registration phase.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Okrum's loader can check the amount of physical memory and terminates itself if the host has less than 1.5 Gigabytes of physical memory in total.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
Okrum can collect computer name, locale information, and information about the OS and architecture.
MITRE ATT&CK technique: T1082: System Information Discovery
Okrum can collect network information, including the host IP address, DNS, and proxy information.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Okrum was seen using NetSess to discover NetBIOS sessions.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Okrum can collect the victim username.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Okrum can obtain the date and time of the compromised system.
MITRE ATT&CK technique: T1124: System Time Discovery
Okrum's loader can detect presence of an emulator by using two calls to GetTickCount API, and checking whether the time has been accelerated.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
Okrum can impersonate a logged-on user's security context using a call to the ImpersonateLoggedOnUser API.
MITRE ATT&CK technique: T1134.001: Access Token Manipulation- Token Impersonation/Theft
Okrum loader only executes the payload after the left mouse button has been pressed at least three times, in order to avoid being executed within virtualized or emulated environments.
MITRE ATT&CK technique: T1497.002: Virtualization/Sandbox Evasion- User Activity Based Checks
Okrum uses HTTP for communication with its C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Okrum's backdoor has used cmd.exe to execute arbitrary commands as well as batch scripts to update itself to a newer version.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
To establish persistence, Okrum can install itself as a new service named NtmSsvc.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Olympic Destroyer will attempt to clear the System and Security event logs using wevtutil.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
Olympic Destroyer contains a module that tries to obtain stored credentials from web browsers.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Olympic Destroyer overwrites files locally and on remote shares.
MITRE ATT&CK technique: T1485: Data Destruction
Olympic Destroyer uses the native Windows utilities vssadmin, wbadmin, and bcdedit to delete and disable operating system recovery features such as the Windows backup catalog and Windows Automatic Repair.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
Olympic Destroyer contains a module that tries to obtain credentials from LSASS, similar to Mimikatz. These credentials are used with PsExec and Windows Management Instrumentation to help the malware propagate itself across a network.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Olympic Destroyer attempts to copy itself to remote machines on the network.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
Olympic Destroyer will attempt to enumerate mapped network shares to later attempt to wipe all files on those shares.
MITRE ATT&CK technique: T1135: Network Share Discovery
Olympic Destroyer uses Windows Management Instrumentation to enumerate all systems in the network.
MITRE ATT&CK technique: T1018: Remote System Discovery
Olympic Destroyer uses PsExec to interact with the ADMIN$ network share to execute commands on remote systems.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Olympic Destroyer utilizes PsExec to help propagate itself across a network.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Olympic Destroyer uses the API call ChangeServiceConfigW to disable all services on the affected system.
MITRE ATT&CK technique: T1489: Service Stop
Olympic Destroyer uses API calls to enumerate the infected system's ARP table.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Olympic Destroyer will shut down the compromised system after it is done modifying system configuration settings.
MITRE ATT&CK technique: T1529: System Shutdown/Reboot
Olympic Destroyer uses WMI to help propagate itself across a network.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
OnionDuke can use a custom decryption algorithm to decrypt strings.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
OnionDuke has the capability to use a Denial of Service module.
MITRE ATT&CK technique: T1499: Endpoint Denial of Service
OnionDuke steals credentials from its victims.
MITRE ATT&CK technique: T1003: OS Credential Dumping
OnionDuke uses Twitter as a backup C2.
MITRE ATT&CK technique: T1102.003: Web Service- One-Way Communication
OnionDuke uses HTTP and HTTPS for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
OopsIE compresses collected files with a simple character replacement scheme before sending them to its C2 server.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
OopsIE compresses collected files with GZipStream before sending them to its C2 server.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
OopsIE exfiltrates command output and collected files to its C2 server in 1500-byte blocks.
MITRE ATT&CK technique: T1030: Data Transfer Size Limits
OopsIE concatenates then decompresses multiple resources to load an embedded .Net Framework assembly.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
OopsIE can upload files from the victim's machine to its C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
OopsIE has the capability to delete files and scripts from the victim's machine.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
OopsIE can download files from its C2 server to the victim's machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
OopsIE stages the output from command execution and collected files in specific folders before exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
OopsIE uses the Confuser protector to obfuscate an embedded .Net Framework assembly used for C2. OopsIE also encodes collected data in hexadecimal format before writing to files on disk and obfuscates strings.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
OopsIE creates a scheduled task to run itself every three minutes.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
OopsIE uses the SmartAssembly obfuscator to pack an embedded .Net Framework assembly used for C2.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
OopsIE encodes data in hexadecimal format over the C2 channel.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding