sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
BlackCat can use Windows commands such as `fsutil behavior set SymLinkEvaluation R2L:1` to redirect file system access to a different location after gaining access into compromised networks.
MITRE ATT&CK technique: T1222.001: File and Directory Permissions Modification- Windows File and Directory Permissions Modification
BlackCat can use `wmic.exe` to delete shadow copies on compromised networks.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
BlackEnergy attempts to bypass default User Access Control settings by exploiting a backward-compatibility setting found in Windows 7 and later.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
The BlackEnergy component KillDisk is capable of deleting Windows Event Logs.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
BlackEnergy has enabled the TESTSIGNING boot configuration option to facilitate loading of a driver component.
MITRE ATT&CK technique: T1553.006: Subvert Trust Controls- Code Signing Policy Modification
BlackEnergy has used a plug-in to gather credentials stored in files on the host by various software programs, including The Bat! email client, Outlook, and Windows Credential Store.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
BlackEnergy has used a plug-in to gather credentials from web browsers including FireFox, Google Chrome, and Internet Explorer.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
BlackEnergy 2 contains a "Destroy" plug-in that destroys data stored on victim hard drives by overwriting file contents.
MITRE ATT&CK technique: T1485: Data Destruction
BlackEnergy injects its DLL component into svchost.exe.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
BlackEnergy has the capability to communicate over a backup channel via plus.google.com.
MITRE ATT&CK technique: T1008: Fallback Channels
BlackEnergy gathers a list of installed apps from the uninstall program Registry. It also gathers registered mail, browser, and instant messaging clients from the Registry. BlackEnergy has searched for given file types.
MITRE ATT&CK technique: T1083: File and Directory Discovery
BlackEnergy has removed the watermark associated with enabling the TESTSIGNING boot configuration option by removing the relevant strings in the user32.dll.mui of the system.
MITRE ATT&CK technique: T1070: Indicator Removal
BlackEnergy has run a keylogger plug-in on a victim.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
BlackEnergy has conducted port scans on a host.
MITRE ATT&CK technique: T1046: Network Service Discovery
BlackEnergy can gather very specific information about attached USB devices, to include device instance ID and drive geometry.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
BlackEnergy has gathered a process list by using Tasklist.exe.
MITRE ATT&CK technique: T1057: Process Discovery
The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
BlackEnergy has run a plug-in on a victim to spread through the local network by using PsExec and accessing admin shares.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
BlackEnergy is capable of taking screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
One variant of BlackEnergy locates existing driver services that have been disabled and drops its driver component into one of those service's paths, replacing the legitimate executable. The malware then sets the hijacked service to start automatically to establish persistence.
MITRE ATT&CK technique: T1574.010: Hijack Execution Flow- Services File Permissions Weakness
The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
BlackEnergy has used Systeminfo to gather the OS version, as well as information on the system configuration, BIOS, the motherboard, and the processor.
MITRE ATT&CK technique: T1082: System Information Discovery
BlackEnergy has gathered information about network IP configurations using ipconfig.exe and about routing tables using route.exe.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
BlackEnergy has gathered information about local network connections using netstat.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
BlackEnergy communicates with its C2 server over HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
A BlackEnergy 2 plug-in uses WMI to gather victim host details.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
One variant of BlackEnergy creates a new service using either a hard-coded or randomly generated name.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
BlackMould can copy files on a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
BlackMould has the ability to find files on the targeted system.
MITRE ATT&CK technique: T1083: File and Directory Discovery
BlackMould has the ability to download files to the victim's machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
BlackMould can enumerate local drives on a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
BlackMould can send commands to C2 in the body of HTTP POST requests.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
BlackMould can run cmd.exe with parameters.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
BloodHound can compress data collected by its SharpHound ingestor into a ZIP file to be written to disk.
MITRE ATT&CK technique: T1560: Archive Collected Data
BloodHound can collect information about domain users, including identification of domain admin accounts.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
BloodHound can collect information about domain groups and members.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
BloodHound has the ability to map domain trusts and identify misconfigurations for potential abuse.
MITRE ATT&CK technique: T1482: Domain Trust Discovery
BloodHound has the ability to collect local admin information via GPO.
MITRE ATT&CK technique: T1615: Group Policy Discovery
BloodHound can identify users with local administrator rights.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
BloodHound can collect information about local groups and members.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
BloodHound can use .NET API calls in the SharpHound ingestor component to pull Active Directory data.
MITRE ATT&CK technique: T1106: Native API
BloodHound can collect password policy information on the target environment.
MITRE ATT&CK technique: T1201: Password Policy Discovery
BloodHound can use PowerShell to pull Active Directory information from the target environment.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
BloodHound can enumerate and collect the properties of domain computers, including domain controllers.
MITRE ATT&CK technique: T1018: Remote System Discovery
BloodHound can collect information on user sessions.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Bonadan can create bind and reverse shells on the infected system.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
Bonadan has maliciously altered the OpenSSH binary on targeted systems to create a backdoor.
MITRE ATT&CK technique: T1554: Compromise Host Software Binary
Bonadan can download an additional module which has a cryptocurrency mining extension.
MITRE ATT&CK technique: T1496.001: Resource Hijacking- Compute Hijacking
Bonadan can download additional modules from the C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Bonadan can use the ps command to discover other cryptocurrency miners active on the system.
MITRE ATT&CK technique: T1057: Process Discovery
Bonadan can XOR-encrypt C2 communications.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Bonadan has discovered the OS version, CPU model, and RAM size of the system it has been installed on.
MITRE ATT&CK technique: T1082: System Information Discovery
Bonadan can find the external IP address of the infected host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Bonadan has discovered the username of the user running the backdoor.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
BoomBox can decrypt AES-encrypted files downloaded from C2.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
BoomBox has the ability to execute an LDAP query to enumerate the distinguished name, SAM account name, and display name for all domain users.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
BoomBox can execute an LDAP query to discover e-mail accounts for domain users.
MITRE ATT&CK technique: T1087.003: Account Discovery- Email Account
BoomBox can check its current working directory and for the presence of a specific file and terminate if specific values are not found.
MITRE ATT&CK technique: T1480: Execution Guardrails
BoomBox can upload data to dedicated per-victim folders in Dropbox.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
BoomBox can search for specific files and directories on a machine.
MITRE ATT&CK technique: T1083: File and Directory Discovery
BoomBox has the ability to download next stage malware components to a compromised system.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
BoomBox has gained execution through user interaction with a malicious file.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
BoomBox has the ability to mask malicious data strings as PDF files.
MITRE ATT&CK technique: T1036: Masquerading
BoomBox can encrypt data using AES prior to exfiltration.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
BoomBox can establish persistence by writing the Registry value MicroNativeCacheSvc to HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
BoomBox can use RunDLL32 for execution.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
BoomBox can enumerate the hostname, domain, and IP of a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
BoomBox can enumerate the username on a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
BoomBox has used HTTP POST requests for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
BoomBox can download files from Dropbox using a hardcoded access token.
MITRE ATT&CK technique: T1102: Web Service
BoxCaon has used DropBox for C2 communications.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
BoxCaon established persistence by setting the HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load registry key to point to its executable.
MITRE ATT&CK technique: T1547: Boot or Logon Autostart Execution
BoxCaon can upload files from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
BoxCaon uploads files and data from a compromised host over the existing C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
BoxCaon has the capability to download folders' contents on the system and upload the results back to its Dropbox drive.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
BoxCaon has searched for files on the system, such as documents located in the desktop folder.
MITRE ATT&CK technique: T1083: File and Directory Discovery
BoxCaon can download files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
BoxCaon has created a working folder for collected files that it sends to the C2 server.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
BoxCaon has used Windows API calls to obtain information about the compromised host.
MITRE ATT&CK technique: T1106: Native API
BoxCaon used the "StackStrings" obfuscation technique to hide malicious functionalities.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
BoxCaon can collect the victim's MAC address by using the GetAdaptersInfo API.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
BoxCaon can execute arbitrary commands and utilize the "ComSpec" environment variable.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Brave Prince terminates antimalware processes.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Some Brave Prince variants have used South Korea's Daum email service to exfiltrate information, and later variants have posted the data to a web server via an HTTP post command.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
Brave Prince gathers file and directory information from the victim’s machine.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Brave Prince lists the running processes.
MITRE ATT&CK technique: T1057: Process Discovery
Brave Prince gathers information about the Registry.
MITRE ATT&CK technique: T1012: Query Registry
Brave Prince collects hard drive content and system configuration information.
MITRE ATT&CK technique: T1082: System Information Discovery
Brave Prince gathers network configuration information as well as the ARP cache.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Briba downloads files onto infected hosts.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Briba creates run key Registry entries pointing to malicious DLLs dropped to disk.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Briba uses rundll32 within Registry Run Keys / Startup Folder entries to execute malicious DLLs.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Briba installs a service pointing to a malicious DLL dropped to disk.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Brute Ratel C4 has used search order hijacking to load a malicious payload DLL as a dependency to a benign application packaged in the same ISO.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
Brute Ratel C4 has loaded a malicious DLL by spoofing the name of the legitimate Version.DLL and placing it in the same folder as the digitally-signed Microsoft binary OneDriveUpdater.exe.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Brute Ratel C4 can use DNS over HTTPS for C2.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Brute Ratel C4 has the ability to upload files from a compromised system.
MITRE ATT&CK technique: T1005: Data from Local System
Brute Ratel C4 has the ability to deobfuscate its payload prior to execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Brute Ratel C4 can use LDAP queries, `net group "Domain Admins" /domain` and `net user /domain` for discovery.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
Brute Ratel C4 can use `net group` for discovery on targeted domains.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
Brute Ratel C4 can use LDAP queries and `nltest /domain_trusts` for domain trust discovery.
MITRE ATT&CK technique: T1482: Domain Trust Discovery
Brute Ratel C4 can call and dynamically resolve hashed APIs.
MITRE ATT&CK technique: T1027.007: Obfuscated Files or Information- Dynamic API Resolution
Brute Ratel C4 has the ability to hide memory artifacts and to patch Event Tracing for Windows and the Anti Malware Scan Interface .
MITRE ATT&CK technique: T1562.006: Impair Defenses- Indicator Blocking
Brute Ratel C4 can download files to compromised hosts.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Brute Ratel C4 can decode Kerberos 5 tickets and convert it to hashcat format for subsequent cracking.
MITRE ATT&CK technique: T1558.003: Steal or Forge Kerberos Tickets- Kerberoasting
Brute Ratel C4 has gained execution through users opening malicious documents.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Brute Ratel C4 has used Microsoft Word icons to hide malicious LNK files.
MITRE ATT&CK technique: T1036.008: Masquerading- Masquerade File Type
Brute Ratel C4 has used a payload file named OneDrive.update to appear benign.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Brute Ratel C4 can call multiple Windows APIs for execution, to share memory, and defense evasion.
MITRE ATT&CK technique: T1106: Native API
Brute Ratel C4 can conduct port scanning against targeted systems.
MITRE ATT&CK technique: T1046: Network Service Discovery
Brute Ratel C4 has the ability to use TCP for external C2.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Brute Ratel C4 has used encrypted payload files and maintains an encrypted configuration structure in memory.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Brute Ratel C4 has injected Latrodectus into the Explorer.exe process on comrpomised hosts.
MITRE ATT&CK technique: T1055.002: Process Injection- Portable Executable Injection
Brute Ratel C4 can enumerate all processes and locate specific process IDs .
MITRE ATT&CK technique: T1057: Process Discovery
Brute Ratel C4 can use DNS over HTTPS for C2.
MITRE ATT&CK technique: T1572: Protocol Tunneling
Brute Ratel C4 has used reflective loading to execute malicious DLLs.
MITRE ATT&CK technique: T1620: Reflective Code Loading
Brute Ratel C4 has the ability to use RPC for lateral movement.
MITRE ATT&CK technique: T1021: Remote Services
Brute Ratel C4 has the ability to use SMB to pivot in compromised networks.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Brute Ratel C4 can take screenshots on compromised hosts.
MITRE ATT&CK technique: T1113: Screen Capture
Brute Ratel C4 can detect EDR userland hooks.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Brute Ratel C4 can create Windows system services for execution.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Brute Ratel C4 can call `NtDelayExecution` to pause execution.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
Brute Ratel C4 can use HTTPS and HTTPS for C2 communication.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Brute Ratel C4 can use legitimate websites for external C2 channels including Slack, Discord, and MS Teams.
MITRE ATT&CK technique: T1102: Web Service
Brute Ratel C4 can use cmd.exe for execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Brute Ratel C4 can use WMI to move laterally.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Brute Ratel C4 can use WinRM for pivoting.
MITRE ATT&CK technique: T1021.006: Remote Services- Windows Remote Management
Bumblebee can compress data stolen from the Registry and volume shadow copies prior to exfiltration.
MITRE ATT&CK technique: T1560: Archive Collected Data
Bumblebee can use asynchronous procedure call injection to execute commands received from C2.
MITRE ATT&CK technique: T1055.004: Process Injection- Asynchronous Procedure Call
Bumblebee has the ability to bypass UAC to deploy post exploitation tools with elevated privileges.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
Bumblebee can use a COM object to execute queries to gather system information.
MITRE ATT&CK technique: T1559.001: Inter-Process Communication- Component Object Model
Bumblebee can capture and compress stolen credentials from the Registry and volume shadow copies.
MITRE ATT&CK technique: T1005: Data from Local System
Bumblebee can search for tools used in static analysis.
MITRE ATT&CK technique: T1622: Debugger Evasion
Bumblebee can deobfuscate C2 server responses and unpack its code on targeted hosts.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
The Bumblebee loader can support the `Dij` command which gives it the ability to inject DLLs into the memory of other processes.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Bumblebee can send collected data in JSON format to C2.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Bumblebee can use backup C2 servers if the primary server fails.
MITRE ATT&CK technique: T1008: Fallback Channels
Bumblebee can uninstall its loader through the use of a `Sdl` command.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Bumblebee can download and execute additional payloads including through the use of a `Dex` command.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Bumblebee has relied upon a user opening an ISO file to enable execution of malicious shortcut files and DLLs.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Bumblebee has relied upon a user downloading a file from a OneDrive link for execution.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Bumblebee has named component DLLs "RapportGP.dll" to match those used by the security company Trusteer.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Bumblebee can use multiple Native APIs.
MITRE ATT&CK technique: T1106: Native API
Bumblebee has been delivered as password-protected zipped ISO files and used control-flow-flattening to obfuscate the flow of functions.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Bumblebee can use `odbcconf.exe` to run DLLs on targeted hosts.
MITRE ATT&CK technique: T1218.008: System Binary Proxy Execution- Odbcconf
Bumblebee can use PowerShell for execution.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Bumblebee can identify processes associated with analytical tools.
MITRE ATT&CK technique: T1057: Process Discovery
Bumblebee can inject code into multiple processes on infected endpoints.
MITRE ATT&CK technique: T1055: Process Injection
Bumblebee can check the Registry for specific keys.
MITRE ATT&CK technique: T1012: Query Registry
Bumblebee has used `rundll32` for execution of the loader component.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Bumblebee can achieve persistence by copying its DLL to a subdirectory of %APPDATA% and creating a Visual Basic Script that will load the DLL via a scheduled task.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Bumblebee can identify specific analytical tools based on running processes.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Bumblebee can use `LoadLibrary` to attempt to execute GdiPlus.dll.
MITRE ATT&CK technique: T1129: Shared Modules
Bumblebee has gained execution through luring users into opening malicious attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Bumblebee has been spread through e-mail campaigns with malicious links.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Bumblebee has the ability to base64 encode C2 server responses.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Bumblebee can encrypt C2 requests and responses with RC4
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Bumblebee has the ability to search for designated file paths and Registry keys that indicate a virtualized environment from multiple products.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
Bumblebee can enumerate the OS version and domain on a targeted system.
MITRE ATT&CK technique: T1082: System Information Discovery
Bumblebee has the ability to identify the user name.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Bumblebee has the ability to set a hardcoded and randomized sleep interval.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
Bumblebee has the ability to perform anti-virtualization checks.
MITRE ATT&CK technique: T1497: Virtualization/Sandbox Evasion
Bumblebee can create a Visual Basic script to enable persistence.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Bumblebee has been downloaded to victim's machines from OneDrive.
MITRE ATT&CK technique: T1102: Web Service
Bumblebee can use `cmd.exe` to drop and run files.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Bumblebee can use WMI to gather system information and to spawn processes for code injection.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Bundlore can use AppleScript to inject malicious JavaScript into a browser.
MITRE ATT&CK technique: T1059.002: Command and Scripting Interpreter- AppleScript
Bundlore can install malicious browser extensions that are used to hijack user searches.
MITRE ATT&CK technique: T1176: Browser Extensions
Bundlore has used openssl to decrypt AES encrypted payload data. Bundlore has also used base64 and RC4 with a hardcoded key to deobfuscate data.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Bundlore can change browser security settings to enable extensions to be installed. Bundlore uses the pkill cfprefsd command to prevent users from inspecting processes.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Bundlore has been spread through malicious advertisements on websites.
MITRE ATT&CK technique: T1189: Drive-by Compromise
Bundlore uses the curl -s -L -o command to exfiltrate archived data to a URL.
MITRE ATT&CK technique: T1048: Exfiltration Over Alternative Protocol
Bundlore prompts the user for their credentials.
MITRE ATT&CK technique: T1056.002: Input Capture- GUI Input Capture
Bundlore uses the mktemp utility to make unique file and directory names for payloads, such as TMP_DIR=`mktemp -d -t x.
MITRE ATT&CK technique: T1564: Hide Artifacts
Bundlore can download and execute new versions of itself.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Bundlore can execute JavaScript by injecting it into the victim's browser.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Bundlore can persist via a LaunchAgent.
MITRE ATT&CK technique: T1543.001: Create or Modify System Process- Launch Agent
Bundlore can persist via a LaunchDaemon.
MITRE ATT&CK technique: T1543.004: Create or Modify System Process- Launch Daemon
Bundlore changes the permissions of a payload using the command chmod -R 755.
MITRE ATT&CK technique: T1222.002: File and Directory Permissions Modification- Linux and Mac File and Directory Permissions Modification
Bundlore has attempted to get users to execute a malicious .app file that looks like a Flash Player update.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Bundlore has disguised a malicious .app file as a Flash Player update.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Bundlore has obfuscated data with base64, AES, RC4, and bz2.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Bundlore has used the ps command to list processes.
MITRE ATT&CK technique: T1057: Process Discovery
Bundlore has used Python scripts to execute payloads.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
Bundlore creates a new key pair with ssh-keygen and drops the newly created user key in authorized_keys to enable remote login.
MITRE ATT&CK technique: T1098.004: Account Manipulation- SSH Authorized Keys
Bundlore has the ability to enumerate what browser is being used as well as version information for Safari.
MITRE ATT&CK technique: T1518: Software Discovery
Bundlore will enumerate the macOS version to determine which follow-on behaviors to execute using /usr/bin/sw_vers -productVersion.
MITRE ATT&CK technique: T1082: System Information Discovery
Bundlore has leveraged /bin/sh and /bin/bash to execute commands on the victim machine.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
Bundlore uses HTTP requests for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
The CALENDAR malware communicates through the use of events in Google Calendar.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
CALENDAR has a command to run cmd.exe to execute commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
CARROTBALL has the ability to use FTP in C2 communications.
MITRE ATT&CK technique: T1071.002: Application Layer Protocol- File Transfer Protocols
CARROTBALL has the ability to download and install a remote payload.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
CARROTBALL has been executed through users being lured into opening malicious e-mail attachments.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
CARROTBALL has used a custom base64 alphabet to decode files.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
CARROTBAT has the ability to execute obfuscated commands on the infected host.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
CARROTBAT has the ability to download a base64 encoded payload.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
CARROTBAT has the ability to delete downloaded files from a compromised host.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
CARROTBAT has the ability to download and execute a remote file via certutil.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
CARROTBAT has the ability to determine the operating system of the compromised host and whether Windows is being run with x86 or x64 architecture.
MITRE ATT&CK technique: T1082: System Information Discovery
CARROTBAT has the ability to execute command line arguments on a compromised host.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
CCBkdr was added to a legitimate, signed version 5.33 of the CCleaner software and distributed on CCleaner's distribution site.
MITRE ATT&CK technique: T1195.002: Supply Chain Compromise- Compromise Software Supply Chain
CCBkdr can use a DGA for Fallback Channels if communications with the primary command and control server are lost.
MITRE ATT&CK technique: T1568.002: Dynamic Resolution- Domain Generation Algorithms
The CHIMNEYSWEEP installer has been padded with null bytes to inflate its size.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
CHIMNEYSWEEP can make use of the Windows `SilentCleanup` scheduled task to execute its payload with elevated privileges.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
CHIMNEYSWEEP can use CMSTP.exe to install a malicious Microsoft Connection Manager Profile.
MITRE ATT&CK technique: T1218.003: System Binary Proxy Execution- CMSTP
CHIMNEYSWEEP can capture content from the clipboard.
MITRE ATT&CK technique: T1115: Clipboard Data
CHIMNEYSWEEP has been dropped by a self-extracting archive signed with a valid digital certificate.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
CHIMNEYSWEEP can collect files from compromised hosts.
MITRE ATT&CK technique: T1005: Data from Local System
CHIMNEYSWEEP can use an embedded RC4 key to decrypt Windows API function strings.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
CHIMNEYSWEEP can use `LoadLibrary` and `GetProcAddress` to resolve Windows API function strings at run time.
MITRE ATT&CK technique: T1027.007: Obfuscated Files or Information- Dynamic API Resolution
CHIMNEYSWEEP can extract RC4 encrypted embedded payloads for privilege escalation.
MITRE ATT&CK technique: T1027.009: Obfuscated Files or Information- Embedded Payloads
CHIMNEYSWEEP can execute a task which leads to execution if it finds a process name containing “creensaver.”
MITRE ATT&CK technique: T1480: Execution Guardrails
CHIMNEYSWEEP can upload collected files to the command-and-control server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
CHIMNEYSWEEP has the ability to enumerate directories for files that match a set list.
MITRE ATT&CK technique: T1083: File and Directory Discovery
CHIMNEYSWEEP can download additional files from C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
CHIMNEYSWEEP has the ability to support keylogging.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
CHIMNEYSWEEP can store captured screenshots to disk including to a covert store named `APPX.%x%x%x%x%x.tmp` where `%x` is a random value.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
CHIMNEYSWEEP can use the Windows Registry Environment key to change the `%windir%` variable to point to `c:\Windows` to enable payload execution.
MITRE ATT&CK technique: T1112: Modify Registry
CHIMNEYSWEEP can use Windows APIs including `LoadLibrary` and `GetProcAddress`.
MITRE ATT&CK technique: T1106: Native API
CHIMNEYSWEEP can use a custom Base64 alphabet for encoding C2.
MITRE ATT&CK technique: T1132.002: Data Encoding- Non-Standard Encoding
CHIMNEYSWEEP can use a custom Base64 alphabet to encode an API decryption key.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
CHIMNEYSWEEP can monitor for removable drives.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
CHIMNEYSWEEP can invoke the PowerShell command `Reflection.Assembly::LoadFile\n$i=\"\"\n$r=%s::%s\necho $r,$i\n` to execute secondary payloads.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
CHIMNEYSWEEP can check if a process name contains “creensaver.”
MITRE ATT&CK technique: T1057: Process Discovery
CHIMNEYSWEEP can use the Windows `SilentCleanup` scheduled task to enable payload execution.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
CHIMNEYSWEEP can capture screenshots on targeted systems using a timer and either upload them or store them to disk.
MITRE ATT&CK technique: T1113: Screen Capture
CHIMNEYSWEEP is capable of checking whether a compromised device is running DeepFreeze by Faronics.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
CHIMNEYSWEEP has included the victim's computer name and username in C2 messages sent to actor-owned infrastructure.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
CHIMNEYSWEEP can reboot or shutdown the targeted system or logoff the current user.
MITRE ATT&CK technique: T1529: System Shutdown/Reboot
CHIMNEYSWEEP can time stomp its executable, previously dating it between 2010 to 2021.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
CHIMNEYSWEEP has executed a script named cln.vbs on compromised hosts.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
CHIMNEYSWEEP can send `HTTP GET` requests to C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
CHIMNEYSWEEP has the ability to use use Telegram channels to return a list of commands to be executed, to download additional payloads, or to create a reverse shell.
MITRE ATT&CK technique: T1102: Web Service
CHOPSTICK encrypts C2 communications with TLS.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
CHOPSTICK is capable of performing remote command execution.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
Part of APT28's operation involved using CHOPSTICK modules to copy itself to air-gapped machines, using files written to USB sticks to transfer data and command traffic.
MITRE ATT&CK technique: T1092: Communication Through Removable Media
CHOPSTICK can use a DGA for Fallback Channels, domains are generated by concatenating words from lists.
MITRE ATT&CK technique: T1568.002: Dynamic Resolution- Domain Generation Algorithms
CHOPSTICK can switch to a new C2 channel if the current one is broken.
MITRE ATT&CK technique: T1008: Fallback Channels
An older version of CHOPSTICK has a module that monitors all mounted volumes for files with the extensions .doc, .docx, .pgp, .gpg, .m2f, or .m2o.
MITRE ATT&CK technique: T1083: File and Directory Discovery
CHOPSTICK may store RC4 encrypted configuration information in the Windows Registry.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
CHOPSTICK is capable of performing remote file transmission.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
CHOPSTICK used a proxy server between victims and the C2 server.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy
CHOPSTICK is capable of performing keylogging.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Various implementations of CHOPSTICK communicate with C2 over SMTP and POP3.
MITRE ATT&CK technique: T1071.003: Application Layer Protocol- Mail Protocols
CHOPSTICK may modify Registry keys to store RC4 encrypted configuration information.
MITRE ATT&CK technique: T1112: Modify Registry
CHOPSTICK provides access to the Windows Registry, which can be used to gather information.
MITRE ATT&CK technique: T1012: Query Registry
Part of APT28's operation involved using CHOPSTICK modules to copy itself to air-gapped machines and using files written to USB sticks to transfer data and command traffic.
MITRE ATT&CK technique: T1091: Replication Through Removable Media
CHOPSTICK has the capability to capture screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
CHOPSTICK checks for antivirus and forensics software.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
CHOPSTICK encrypts C2 communications with RC4.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
CHOPSTICK includes runtime checks to identify an analysis environment and prevent execution on it.
MITRE ATT&CK technique: T1497: Virtualization/Sandbox Evasion
Various implementations of CHOPSTICK communicate with C2 over HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
COATHANGER connects to command and control infrastructure using SSL.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
COATHANGER decodes configuration items from a bundled file for command and control activity.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
COATHANGER copies the malicious file /data2/.bd.key/preload.so to /lib/preload.so, then launches a child process that executes the malicious file /data2/.bd.key/authd as /bin/authd with the arguments /lib/preload.so reboot newreboot 1. This injects the malicious preload.so file into the process with PID 1, and replaces its reboot function with the malicious newreboot function for persistence.
MITRE ATT&CK technique: T1574.006: Hijack Execution Flow- Dynamic Linker Hijacking
COATHANGER is installed following exploitation of a vulnerable FortiGate device.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
COATHANGER removes files from victim environments following use in multiple instances.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
COATHANGER will survey the contents of system files during installation.
MITRE ATT&CK technique: T1083: File and Directory Discovery
COATHANGER creates and installs itself to a hidden installation directory.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
COATHANGER will remove and write malicious shared objects associated with legitimate system functions such as `read`.
MITRE ATT&CK technique: T1574: Hijack Execution Flow
COATHANGER will create a daemon for timed check-ins with command and control infrastructure.
MITRE ATT&CK technique: T1543.004: Create or Modify System Process- Launch Daemon
COATHANGER will set the GID of `httpsd` to 90 when infected.
MITRE ATT&CK technique: T1222.002: File and Directory Permissions Modification- Linux and Mac File and Directory Permissions Modification
COATHANGER uses ICMP for transmitting configuration information to and from its command and control server.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
COATHANGER can store obfuscated configuration information in the last 56 bytes of the file `/date/.bd.key/preload.so`.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
COATHANGER will query running process information to determine subsequent program execution flow.
MITRE ATT&CK technique: T1057: Process Discovery
COATHANGER includes a binary labeled `authd` that can inject a library into a running process and then hook an existing function within that process with a new function from that library.
MITRE ATT&CK technique: T1055: Process Injection
COATHANGER hooks or replaces multiple legitimate processes and other functions on victim devices.
MITRE ATT&CK technique: T1014: Rootkit
The first stage of COATHANGER is delivered as a packed file.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
COATHANGER provides a BusyBox reverse shell for command and control.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
COATHANGER uses an HTTP GET request to initialize a follow-on TLS tunnel for command and control.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
CORALDECK has created password-protected RAR, WinImage, and zip archives to be exfiltrated.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
CORALDECK has exfiltrated data in HTTP POST headers.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
CORALDECK searches for specified files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
CORESHELL contains unused machine instructions in a likely attempt to hinder analysis.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
CORESHELL downloads another dropper from its C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
CORESHELL can communicate over SMTP and POP3 for C2.
MITRE ATT&CK technique: T1071.003: Application Layer Protocol- Mail Protocols
CORESHELL obfuscates strings using a custom stream cipher.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
CORESHELL has established persistence by creating autostart extensibility point Registry entries in the Run key and other Registry keys, as well as by creating shortcuts in the Internet Explorer Quick Start folder.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
CORESHELL is installed via execution of rundll32 with an export named "init" or "InitW."
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
CORESHELL C2 messages are Base64-encoded.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
CORESHELL C2 messages are encrypted with custom stream ciphers using six-byte or eight-byte keys.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
CORESHELL collects hostname, volume serial number and OS version data from the victim and sends the information to its C2 server.
MITRE ATT&CK technique: T1082: System Information Discovery
CORESHELL can communicate over HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
CSPY Downloader can bypass UAC using the SilentCleanup task to execute the binary with elevated privileges.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
CSPY Downloader has come signed with revoked certificates.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
CSPY Downloader has the ability to self delete.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
CSPY Downloader has the ability to remove values it writes to the Registry.
MITRE ATT&CK technique: T1070: Indicator Removal
CSPY Downloader can download additional tools to a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
CSPY Downloader has been delivered via malicious documents with embedded macros.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
CSPY Downloader has attempted to appear as a legitimate Windows service with a fake description claiming it is used to support packed applications.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
CSPY Downloader can write to the Registry under the %windir% variable to execute tasks.
MITRE ATT&CK technique: T1112: Modify Registry
CSPY Downloader can use the schtasks utility to bypass UAC.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
CSPY Downloader has been packed with UPX.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
CSPY Downloader can search loaded modules, PEB structure, file paths, Registry keys, and memory to determine if it is being debugged or running in a virtual environment.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
CSPY Downloader can use GET requests to download additional payloads from C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Cachedump can extract cached password hashes from cache entry information.
MITRE ATT&CK technique: T1003.005: OS Credential Dumping- Cached Domain Credentials
CaddyWiper can work alphabetically through drives on a compromised system to take ownership of and overwrite all files.
MITRE ATT&CK technique: T1485: Data Destruction
CaddyWiper has the ability to destroy information about a physical drive's partitions including the MBR, GPT, and partition entries.
MITRE ATT&CK technique: T1561.002: Disk Wipe- Disk Structure Wipe
CaddyWiper can enumerate all files and directories on a compromised host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
CaddyWiper has the ability to dynamically resolve and use APIs, including `SeTakeOwnershipPrivilege`.
MITRE ATT&CK technique: T1106: Native API
CaddyWiper can obtain a list of current processes.
MITRE ATT&CK technique: T1057: Process Discovery
CaddyWiper can use `DsRoleGetPrimaryDomainInformation` to determine the role of the infected machine. CaddyWiper can also halt execution if the compromised host is identified as a domain controller.
MITRE ATT&CK technique: T1082: System Information Discovery
CaddyWiper can modify ACL entries to take ownership of files.
MITRE ATT&CK technique: T1222.001: File and Directory Permissions Modification- Windows File and Directory Permissions Modification
Cadelspy has the ability to identify open windows on the compromised host.
MITRE ATT&CK technique: T1010: Application Window Discovery
Cadelspy has the ability to compress stolen data into a .cab file.
MITRE ATT&CK technique: T1560: Archive Collected Data
Cadelspy has the ability to record audio from the compromised host.
MITRE ATT&CK technique: T1123: Audio Capture
Cadelspy has the ability to steal data from the clipboard.
MITRE ATT&CK technique: T1115: Clipboard Data
Cadelspy has the ability to log keystrokes on the compromised host.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Cadelspy has the ability to steal information about printers and the documents sent to printers.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
Cadelspy has the ability to capture screenshots and webcam photos.
MITRE ATT&CK technique: T1113: Screen Capture
Cadelspy has the ability to discover information about the compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
Calisto adds permissions and remote logins to all users.
MITRE ATT&CK technique: T1098: Account Manipulation
Calisto uses the zip -r command to compress the data collected on the local system.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
Calisto collects information on bookmarks from Google Chrome.
MITRE ATT&CK technique: T1217: Browser Information Discovery
Calisto can collect data from user directories.
MITRE ATT&CK technique: T1005: Data from Local System