sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Chimera has used the NtdsAudit utility to collect information related to accounts and passwords.
MITRE ATT&CK technique: T1201: Password Policy Discovery
Chimera has used multiple password spraying attacks against victim's remote services to obtain valid user and administrator accounts.
MITRE ATT&CK technique: T1110.003: Brute Force- Password Spraying
Chimera has used PowerShell scripts to execute malicious payloads and the DSInternals PowerShell module to make use of Active Directory features.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Chimera has used tasklist to enumerate processes.
MITRE ATT&CK technique: T1057: Process Discovery
Chimera has encapsulated Cobalt Strike's C2 protocol in DNS and HTTPS.
MITRE ATT&CK technique: T1572: Protocol Tunneling
Chimera has queried Registry keys using reg query \\\HKU\\SOFTWARE\Microsoft\Terminal Server Client\Servers and reg query \\\HKU\\Software\Microsoft\Windows\CurrentVersion\Internet Settings.
MITRE ATT&CK technique: T1012: Query Registry
Chimera has staged stolen data on designated servers in the target environment.
MITRE ATT&CK technique: T1074.002: Data Staged- Remote Data Staging
Chimera has used RDP to access targeted systems.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
Chimera has harvested data from remote mailboxes including through execution of \\\c$\Users\\AppData\Local\Microsoft\Outlook*.ost.
MITRE ATT&CK technique: T1114.002: Email Collection- Remote Email Collection
Chimera has utilized various scans and queries to find domain controllers and remote services in the target environment.
MITRE ATT&CK technique: T1018: Remote System Discovery
Chimera has used Windows admin shares to move laterally.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Chimera has used scheduled tasks to invoke Cobalt Strike including through batch script schtasks /create /ru "SYSTEM" /tn "update" /tr "cmd /c c:\windows\temp\update.bat" /sc once /f /st and to maintain persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Chimera has used PsExec to deploy beacons on compromised systems.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Chimera has collected documents from the victim's SharePoint.
MITRE ATT&CK technique: T1213.002: Data from Information Repositories- Sharepoint
Chimera has used `fsutil fsinfo drives`, `systeminfo`, and `vssadmin list shadows` for system information including shadow volumes and drive information.
MITRE ATT&CK technique: T1082: System Information Discovery
Chimera has used ipconfig, Ping, and tracert to enumerate the IP address and network environment and settings of the local host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Chimera has used netstat -ano | findstr EST to discover network connections.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Chimera has used the quser command to show currently logged on users.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Chimera has used net start and net use for system service discovery.
MITRE ATT&CK technique: T1007: System Service Discovery
Chimera has used time /t and net time \\ip/hostname for system time discovery.
MITRE ATT&CK technique: T1124: System Time Discovery
Chimera has used a Windows version of the Linux touch command to modify the date and time stamp on DLLs.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
Chimera has obtained and used tools such as BloodHound, Cobalt Strike, Mimikatz, and PsExec.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Chimera has used a valid account to maintain persistence via scheduled task.
MITRE ATT&CK technique: T1078: Valid Accounts
Chimera has used HTTPS for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Chimera has used the Windows Command Shell and batch scripts for execution on compromised hosts.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Chimera has used WMIC to execute remote commands.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Chimera has used WinRM for lateral movement.
MITRE ATT&CK technique: T1021.006: Remote Services- Windows Remote Management
Cinnamon Tempest has used search order hijacking to launch Cobalt Strike Beacons.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
Cinnamon Tempest has abused legitimate executables to side-load weaponized DLLs.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Cinnamon Tempest has used weaponized DLLs to load and decrypt payloads.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Cinnamon Tempest has obtained highly privileged credentials such as domain administrator in order to deploy malware.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
Cinnamon Tempest has uploaded captured keystroke logs to the Alibaba Cloud Object Storage Service, Aliyun OSS.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
Cinnamon Tempest has exploited multiple unpatched vulnerabilities for initial access including vulnerabilities in Microsoft Exchange, Manage Engine AdSelfService Plus, Confluence, and Log4j.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
Cinnamon Tempest has maintained leak sites for exfiltrated data in attempt to extort victims into paying a ransom.
MITRE ATT&CK technique: T1657: Financial Theft
Cinnamon Tempest has used Group Policy to deploy batch scripts for ransomware deployment.
MITRE ATT&CK technique: T1484.001: Domain or Tenant Policy Modification- Group Policy Modification
Cinnamon Tempest has downloaded files, including Cobalt Strike, to compromised hosts.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Cinnamon Tempest has used PowerShell to communicate with C2, download files, and execute reconnaissance commands.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Cinnamon Tempest has used the Iox and NPS proxy and tunneling tools in combination create multiple connections through a single tunnel.
MITRE ATT&CK technique: T1572: Protocol Tunneling
Cinnamon Tempest has used a customized version of the Iox port-forwarding and proxy tool.
MITRE ATT&CK technique: T1090: Proxy
Cinnamon Tempest has used a customized version of the Impacket wmiexec.py module to create renamed output files.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
Cinnamon Tempest has used SMBexec for lateral movement.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Cinnamon Tempest has deployed ransomware from a batch file in a network share.
MITRE ATT&CK technique: T1080: Taint Shared Content
Cinnamon Tempest has used open-source tools including customized versions of the Iox proxy tool, NPS tunneling tool, Meterpreter, and a keylogger that uploads data to Alibaba cloud storage.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Cinnamon Tempest has used compromised user accounts to deploy payloads and create system services.
MITRE ATT&CK technique: T1078: Valid Accounts
Cinnamon Tempest has executed ransomware using batch scripts deployed via GPO.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Cinnamon Tempest has used Impacket for lateral movement via WMI.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Cinnamon Tempest has created system services to establish persistence for deployed tooling.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Cleaver has used custom tools to facilitate ARP cache poisoning.
MITRE ATT&CK technique: T1557.002: Adversary-in-the-Middle- ARP Cache Poisoning
Cleaver has been known to dump credentials using Mimikatz and Windows Credential Editor.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Cleaver has created customized tools and payloads for functions including ARP poisoning, encryption, credential dumping, ASP.NET shells, web backdoors, process enumeration, WMI querying, HTTP and SMB communications, network interface sniffing, and keystroke logging.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
Cleaver has created fake LinkedIn profiles that included profile photos, details, and connections.
MITRE ATT&CK technique: T1585.001: Establish Accounts- Social Media Accounts
Cleaver has obtained and used open-source tools such as PsExec, Windows Credential Editor, and Mimikatz.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Cobalt Group has used the Plink utility to create SSH tunnels.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Cobalt Group has bypassed UAC.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
Cobalt Group has used the command cmstp.exe /s /ns C:\Users\ADMINI~W\AppData\Local\Temp\XKNqbpzl.txt to bypass AppLocker and launch a malicious script.
MITRE ATT&CK technique: T1218.003: System Binary Proxy Execution- CMSTP
Cobalt Group obfuscated several scriptlets and code used on the victim’s machine, including through use of XOR and RC4.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
Cobalt Group has compromised legitimate web browser updates to deliver a backdoor.
MITRE ATT&CK technique: T1195.002: Supply Chain Compromise- Compromise Software Supply Chain
Cobalt Group has used DNS tunneling for C2.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Cobalt Group has sent malicious Word OLE compound documents to victims.
MITRE ATT&CK technique: T1559.002: Inter-Process Communication- Dynamic Data Exchange
Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor , an Internet Explorer vulnerability , CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Cobalt Group has used exploits to increase their levels of rights and privileges.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
Cobalt Group deleted the DLL dropper from the victim’s machine to cover their tracks.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Cobalt Group has used public sites such as github.com and sendspace.com to upload files and then download them to victim computers. The group's JavaScript backdoor is also capable of downloading files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Cobalt Group has executed JavaScript scriptlets on the victim's machine.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Cobalt Group has added persistence by registering the file name for the next stage malware under HKCU\Environment\UserInitMprLogonScript.
MITRE ATT&CK technique: T1037.001: Boot or Logon Initialization Scripts- Logon Script (Windows)
Cobalt Group has sent emails containing malicious attachments that require users to execute a file or macro to infect the victim machine.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Cobalt Group has sent emails containing malicious links that require users to execute a file or macro to infect the victim machine.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Cobalt Group leveraged an open-source tool called SoftPerfect Network Scanner to perform network scanning.
MITRE ATT&CK technique: T1046: Network Service Discovery
Cobalt Group has used odbcconf to proxy the execution of malicious DLL files.
MITRE ATT&CK technique: T1218.008: System Binary Proxy Execution- Odbcconf
Cobalt Group has used powershell.exe to download and execute scripts.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Cobalt Group has injected code into trusted processes.
MITRE ATT&CK technique: T1055: Process Injection
Cobalt Group has used the Plink utility to create SSH tunnels.
MITRE ATT&CK technique: T1572: Protocol Tunneling
Cobalt Group has used Registry Run keys for persistence. The group has also set a Startup path to launch the PowerShell shell command and download Cobalt Strike.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Cobalt Group has used regsvr32.exe to execute scripts.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
Cobalt Group used the Ammyy Admin tool as well as TeamViewer for remote access, including to preserve remote access if a Cobalt Strike module was lost.
MITRE ATT&CK technique: T1219: Remote Access Software
Cobalt Group has used Remote Desktop Protocol to conduct lateral movement.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
Cobalt Group has created Windows tasks to establish persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Cobalt Group used a JavaScript backdoor that is capable of collecting a list of the security solutions installed on the victim's machine.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Cobalt Group has sent spearphishing emails with various attachment types to corporate and personal email accounts of victim organizations. Attachment types have included .rtf, .doc, .xls, archives containing LNK files, and password protected archives containing .exe and .scr executables.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Cobalt Group has sent emails with URLs pointing to malicious documents.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Cobalt Group has obtained and used a variety of tools including Mimikatz, PsExec, Cobalt Strike, and SDelete.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Cobalt Group has used HTTPS for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands. The group has used an exploit toolkit known as Threadkit that launches .bat files.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Cobalt Group has created new services to establish persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Cobalt Group used msxsl.exe to bypass AppLocker and to invoke Jscript code from an XSL file.
MITRE ATT&CK technique: T1220: XSL Script Processing
Confucius has used a file stealer to steal documents and images with the following extensions: txt, pdf, png, jpg, doc, xls, xlm, odp, ods, odt, rtf, ppt, xlsx, xlsm, docx, pptx, and jpeg.
MITRE ATT&CK technique: T1119: Automated Collection
Confucius has exfiltrated stolen files to its C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Confucius has exfiltrated victim data to cloud storage service accounts.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
Confucius has exploited Microsoft Office vulnerabilities, including CVE-2015-1641, CVE-2017-11882, and CVE-2018-0802.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Confucius has used a file stealer that checks the Document, Downloads, Desktop, and Picture folders for documents and images with specific extensions.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Confucius has downloaded additional files and payloads onto a compromised host following initial access.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Confucius has lured victims to execute malicious attachments included in crafted spearphishing emails related to current topics.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Confucius has lured victims into clicking on a malicious link sent through spearphishing.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Confucius has used mshta.exe to execute malicious VBScript.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
Confucius has used PowerShell to execute malicious files and payloads.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Confucius has dropped malicious files into the startup folder `%AppData%\Microsoft\Windows\Start Menu\Programs\Startup` on a compromised host in order to maintain persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Confucius has created scheduled tasks to maintain persistence on a compromised host.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Confucius has crafted and sent victims malicious attachments to gain initial access.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Confucius has sent malicious links to victims through email campaigns.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Confucius has used a file stealer that can examine system drives, including those other than the C drive.
MITRE ATT&CK technique: T1082: System Information Discovery
Confucius has used a weaponized Microsoft Word document with an embedded RTF exploit.
MITRE ATT&CK technique: T1221: Template Injection
Confucius has used VBScript to execute malicious code.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Confucius has used HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Confucius has obtained cloud storage service accounts to host stolen data.
MITRE ATT&CK technique: T1583.006: Acquire Infrastructure- Web Services
CopyKittens encrypts data with a substitute cipher prior to exfiltration.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
CopyKittens uses ZPP, a .NET console program, to compress files with ZIP.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
CopyKittens digitally signed an executable with a stolen certificate from legitimate company AI Squared.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
CopyKittens has used -w hidden and -windowstyle hidden to conceal PowerShell windows.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
CopyKittens has used PowerShell Empire.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
CopyKittens has used the AirVPN service for operational activity.
MITRE ATT&CK technique: T1090: Proxy
CopyKittens uses rundll32 to load various tools on victims, including a lateral movement tool named Vminst, Cobalt Strike, and shellcode.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
CopyKittens has used Metasploit, Empire, and AirVPN for post-exploitation activities.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Daggerfly has used signed, but not notarized, malicious files for execution in macOS environments.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Daggerfly created code signing certificates to sign malicious macOS files.
MITRE ATT&CK technique: T1587.002: Develop Capabilities- Code Signing Certificates
Daggerfly is associated with several supply chain compromises using malicious updates to compromise victims.
MITRE ATT&CK technique: T1195.002: Supply Chain Compromise- Compromise Software Supply Chain
Daggerfly has used legitimate software to side-load PlugX loaders onto victim systems. Daggerfly is also linked to multiple other instances of side-loading for initial loading activity.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Daggerfly has used strategic website compromise for initial access against victims.
MITRE ATT&CK technique: T1189: Drive-by Compromise
Daggerfly has used PowerShell and BITSAdmin to retrieve follow-on payloads from external locations for execution on victim machines.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Daggerfly created a local account on victim machines to maintain access.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
Daggerfly has used strategic website compromise to deliver a malicious link requiring user interaction.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Daggerfly used PowerShell to download and execute remote-hosted files on victim systems.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Daggerfly used Reg to dump the Security Account Manager , System, and Security Windows registry hives from victim machines.
MITRE ATT&CK technique: T1012: Query Registry
Daggerfly used a renamed version of rundll32.exe, such as "dbengin.exe" located in the `ProgramData\Microsoft\PlayReady` directory, to proxy malicious DLL execution.
MITRE ATT&CK technique: T1036.003: Masquerading- Rename System Utilities
Daggerfly proxied execution of malicious DLLs through a renamed rundll32.exe binary.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Daggerfly has attempted to use scheduled tasks for persistence in victim environments.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Daggerfly used Reg to dump the Security Account Manager hive from victim machines for follow-on credential extraction.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
Daggerfly compromised web servers hosting updates for software as part of a supply chain intrusion.
MITRE ATT&CK technique: T1584.004: Compromise Infrastructure- Server
Daggerfly utilizes victim machine operating system information to create custom User Agent strings for subsequent command and control communication.
MITRE ATT&CK technique: T1082: System Information Discovery
Daggerfly uses HTTP for command and control communication.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Dark Caracal leveraged a compiled HTML file that contained a command to download and run an executable.
MITRE ATT&CK technique: T1218.001: System Binary Proxy Execution- Compiled HTML File
Dark Caracal collected complete contents of the 'Pictures' folder from compromised Windows systems.
MITRE ATT&CK technique: T1005: Data from Local System
Dark Caracal leveraged a watering hole to serve up malicious code.
MITRE ATT&CK technique: T1189: Drive-by Compromise
Dark Caracal has obfuscated strings in Bandook by base64 encoding, and then encrypting them.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Dark Caracal collected file listings of all default Windows directories.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Dark Caracal makes their malware look like Flash Player, Office, or PDF documents in order to entice a user to click on it.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Dark Caracal's version of Bandook adds a registry key to HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Dark Caracal took screenshots using their Windows malware.
MITRE ATT&CK technique: T1113: Screen Capture
Dark Caracal has used UPX to pack Bandook.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Dark Caracal spearphished victims via Facebook and Whatsapp.
MITRE ATT&CK technique: T1566.003: Phishing- Spearphishing via Service
Dark Caracal's version of Bandook communicates with their server over a TCP port using HTTP payloads Base64 encoded and suffixed with the string “&&&”.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Dark Caracal has used macros in Word documents that would download a second stage if executed.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
DarkHydrus used Template Injection to launch an authentication window for users to enter their credentials.
MITRE ATT&CK technique: T1187: Forced Authentication
DarkHydrus has used -WindowStyle Hidden to conceal PowerShell windows.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
DarkHydrus has sent malware that required users to hit the enable button in Microsoft Excel to allow an .iqy file to be downloaded.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
DarkHydrus leveraged PowerShell to download and execute additional scripts for execution.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
DarkHydrus has sent spearphishing emails with password-protected RAR archives containing malicious Excel Web Query files . The group has also sent spearphishing emails that contained malicious Microsoft Office documents that use the “attachedTemplate” technique to load a template from a remote server.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
DarkHydrus used an open-source tool, Phishery, to inject malicious remote template URLs into Microsoft Word documents and then sent them to victims to enable Forced Authentication.
MITRE ATT&CK technique: T1221: Template Injection
DarkHydrus has obtained and used tools such as Mimikatz, Empire, and Cobalt Strike.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
DarkVishnya used brute-force attack to obtain login data.
MITRE ATT&CK technique: T1110: Brute Force
DarkVishnya used Bash Bunny, Raspberry Pi, netbooks or inexpensive laptops to connect to the company’s local network.
MITRE ATT&CK technique: T1200: Hardware Additions
DarkVishnya performed port scanning to obtain the list of active services.
MITRE ATT&CK technique: T1046: Network Service Discovery
DarkVishnya scanned the network for public shared folders.
MITRE ATT&CK technique: T1135: Network Share Discovery
DarkVishnya used network sniffing to obtain login data.
MITRE ATT&CK technique: T1040: Network Sniffing
DarkVishnya used ports 5190 and 7900 for shellcode listeners, and 4444, 4445, 31337 for shellcode C2.
MITRE ATT&CK technique: T1571: Non-Standard Port
DarkVishnya used PowerShell to create shellcode loaders.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
DarkVishnya used DameWare Mini Remote Control for lateral movement.
MITRE ATT&CK technique: T1219: Remote Access Software
DarkVishnya has obtained and used tools such as Impacket, Winexe, and PsExec.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
DarkVishnya created new services for shellcode loaders distribution.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Darkhotel has used code-signing certificates on its malware that are either forged due to weak keys or stolen. Darkhotel has also stolen certificates and signed backdoors and downloaders with them.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Darkhotel has decrypted strings and imports using RC4 during execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Darkhotel used embedded iframes on hotel login portals to redirect selected victims to download malware.
MITRE ATT&CK technique: T1189: Drive-by Compromise
Darkhotel has obfuscated code using RC4, XOR, and RSA.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Darkhotel has exploited Adobe Flash vulnerability CVE-2015-8651 for execution.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Darkhotel has used malware that searched for files with specific patterns.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Darkhotel has used first-stage payloads that download additional malware from C2 servers.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Darkhotel has used a keylogger.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Darkhotel has sent spearphishing emails in an attempt to lure users into clicking on a malicious attachments.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Darkhotel has used malware that is disguised as a Secure Shell tool.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Darkhotel malware can collect a list of running processes on a system.
MITRE ATT&CK technique: T1057: Process Discovery
Darkhotel has been known to establish persistence by adding programs to the Run Registry key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Darkhotel's selective infector modifies executables stored on removable media as a method of spreading across computers.
MITRE ATT&CK technique: T1091: Replication Through Removable Media
Darkhotel has searched for anti-malware strings and anti-virus processes running on the system.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Darkhotel has sent spearphishing emails with malicious RAR and .LNK attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Darkhotel has used AES-256 and 3DES for C2 communications.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Darkhotel malware has used a series of checks to determine if it's being analyzed; checks include the length of executable names, if a filename ends with .Md5.exe, and if the program is executed from the root of the C:\ drive, as well as checks for sandbox-related libraries.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
Darkhotel has collected the hostname, OS version, service pack version, and the processor architecture from the victim’s machine.
MITRE ATT&CK technique: T1082: System Information Discovery
Darkhotel has collected the IP address and network adapter information from the victim’s machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Darkhotel malware can obtain system time from a compromised host.
MITRE ATT&CK technique: T1124: System Time Discovery
Darkhotel used a virus that propagates by infecting executables stored on shared drives.
MITRE ATT&CK technique: T1080: Taint Shared Content
Darkhotel has used malware that repeatedly checks the mouse cursor position to determine if a real user is on the system.
MITRE ATT&CK technique: T1497.002: Virtualization/Sandbox Evasion- User Activity Based Checks
Darkhotel malware has employed just-in-time decryption of strings to evade sandbox detection.
MITRE ATT&CK technique: T1497: Virtualization/Sandbox Evasion
Darkhotel has dropped an mspaint.lnk shortcut to disk which launches a shell script that downloads and executes a file.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Deep Panda has used the sticky-keys technique to bypass the RDP login screen on remote systems during intrusions.
MITRE ATT&CK technique: T1546.008: Event Triggered Execution- Accessibility Features
Deep Panda has used -w hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
Deep Panda has updated and modified its malware, resulting in different hash values that evade detection.
MITRE ATT&CK technique: T1027.005: Obfuscated Files or Information- Indicator Removal from Tools
Deep Panda has used PowerShell scripts to download and execute programs in memory, without writing to disk.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Deep Panda uses the Microsoft Tasklist utility to list processes running on systems.
MITRE ATT&CK technique: T1057: Process Discovery
Deep Panda has used regsvr32.exe to execute a server variant of Derusbi in victim networks.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
Deep Panda has used ping to identify other machines of interest.
MITRE ATT&CK technique: T1018: Remote System Discovery
Deep Panda uses net.exe to connect to network shares using net use commands with compromised credentials.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Deep Panda uses Web shells on publicly accessible Web servers to access victim networks.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
The Deep Panda group is known to utilize WMI for lateral movement.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Dragonfly has added newly created accounts to the administrators group to maintain elevated access.
MITRE ATT&CK technique: T1098.007: Account Manipulation- Additional Local or Domain Groups
Dragonfly has compressed data into .zip files prior to exfiltration.
MITRE ATT&CK technique: T1560: Archive Collected Data
Dragonfly has attempted to brute force credentials to gain access.
MITRE ATT&CK technique: T1110: Brute Force
Dragonfly has collected open source information to identify relationships between organizations for targeting purposes.
MITRE ATT&CK technique: T1591.002: Gather Victim Org Information- Business Relationships
Dragonfly has cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
Dragonfly has used the command line for execution.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
Dragonfly has placed trojanized installers for control system software on legitimate vendor app stores.
MITRE ATT&CK technique: T1195.002: Supply Chain Compromise- Compromise Software Supply Chain
Dragonfly has collected data from local victim systems.
MITRE ATT&CK technique: T1005: Data from Local System
Dragonfly has disabled host-based firewalls. The group has also globally opened port 3389.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
Dragonfly has used batch scripts to enumerate users on a victim domain controller.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
Dragonfly has used batch scripts to enumerate administrators and users in the domain.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
Dragonfly has registered domains for targeting intended victims.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
Dragonfly has compromised targets via strategic web compromise utilizing a custom exploit kit.
MITRE ATT&CK technique: T1189: Drive-by Compromise
Dragonfly has compromised websites to redirect traffic and to host exploit kits.
MITRE ATT&CK technique: T1608.004: Stage Capabilities- Drive-by Target
Dragonfly has conducted SQL injection attacks, exploited vulnerabilities CVE-2019-19781 and CVE-2020-0688 for Citrix and MS Exchange, and CVE-2018-13379 for Fortinet VPNs.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
Dragonfly has exploited CVE-2011-0611 in Adobe Flash Player to gain execution on a targeted system.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Dragonfly has exploited a Windows Netlogon vulnerability to obtain access to Windows Active Directory servers.
MITRE ATT&CK technique: T1210: Exploitation of Remote Services
Dragonfly has used VPNs and Outlook Web Access to maintain access to victim networks.
MITRE ATT&CK technique: T1133: External Remote Services
Dragonfly has deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Dragonfly has used SMB for C2.
MITRE ATT&CK technique: T1071.002: Application Layer Protocol- File Transfer Protocols
Dragonfly has used a batch script to gather folder and file names from victim hosts.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Dragonfly has gathered hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems.
MITRE ATT&CK technique: T1187: Forced Authentication
Dragonfly has modified the Registry to hide created user accounts.
MITRE ATT&CK technique: T1564.002: Hide Artifacts- Hidden Users
Dragonfly has copied and installed tools for operations once in the victim environment.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Dragonfly has dropped and executed SecretsDump to dump password hashes.
MITRE ATT&CK technique: T1003.004: OS Credential Dumping- LSA Secrets
Dragonfly has created accounts on victims, including administrator accounts, some of which appeared to be tailored to each individual staging target.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
Dragonfly has created a directory named "out" in the user's %AppData% folder and copied files to it.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Dragonfly has used various forms of spearphishing in attempts to get users to open malicious attachments.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Dragonfly has created accounts disguised as legitimate backup and service accounts as well as an email administration account.
MITRE ATT&CK technique: T1036.010: Masquerading- Masquerade Account Name
Dragonfly has modified the Registry to perform multiple techniques through the use of Reg.
MITRE ATT&CK technique: T1112: Modify Registry
Dragonfly has dropped and executed SecretsDump to dump password hashes. They also obtained ntds.dit from domain controllers.
MITRE ATT&CK technique: T1003.003: OS Credential Dumping- NTDS
Dragonfly has identified and browsed file servers in the victim network, sometimes , viewing files pertaining to ICS or Supervisory Control and Data Acquisition systems.
MITRE ATT&CK technique: T1135: Network Share Discovery
Dragonfly has dropped and executed tools used for password cracking, including Hydra and CrackMapExec.
MITRE ATT&CK technique: T1110.002: Brute Force- Password Cracking
Dragonfly has used PowerShell scripts for execution.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Dragonfly has used various types of scripting to perform operations, including Python scripts. The group was observed installing Python 2.7 on a victim.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
Dragonfly has queried the Registry to identify victim information.
MITRE ATT&CK technique: T1012: Query Registry
Dragonfly has added the registry value ntdll to the Registry Run key to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Dragonfly has moved laterally via RDP.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
Dragonfly has accessed email accounts using Outlook Web Access.
MITRE ATT&CK technique: T1114.002: Email Collection- Remote Email Collection
Dragonfly has likely obtained a list of hosts in the victim environment.
MITRE ATT&CK technique: T1018: Remote System Discovery
Dragonfly has used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Dragonfly has performed screen captures of victims, including by using a tool, scr.exe .
MITRE ATT&CK technique: T1113: Screen Capture
Dragonfly has dropped and executed SecretsDump to dump password hashes.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
Dragonfly has compromised legitimate websites to host C2 and malware modules.
MITRE ATT&CK technique: T1584.004: Compromise Infrastructure- Server
Dragonfly has sent emails with malicious attachments to gain initial access.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Dragonfly has used spearphishing with Microsoft Office attachments to enable harvesting of user credentials.
MITRE ATT&CK technique: T1598.002: Phishing for Information- Spearphishing Attachment
Dragonfly has used spearphishing with PDF attachments containing malicious links that redirected to credential harvesting websites.
MITRE ATT&CK technique: T1598.003: Phishing for Information- Spearphishing Link
Dragonfly has used batch scripts to enumerate network information, including information about trusts, zones, and the domain.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Dragonfly used the command query user on victim hosts.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Dragonfly has injected SMB URLs into malicious Word spearphishing attachments to initiate Forced Authentication.
MITRE ATT&CK technique: T1221: Template Injection
Dragonfly has obtained and used tools such as Mimikatz, CrackMapExec, and PsExec.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Dragonfly has compromised user credentials and used valid accounts for operations.
MITRE ATT&CK technique: T1078: Valid Accounts
Dragonfly has acquired VPS infrastructure for use in malicious campaigns.
MITRE ATT&CK technique: T1583.003: Acquire Infrastructure- Virtual Private Server
Dragonfly has scanned targeted systems for vulnerable Citrix and Microsoft Exchange services.
MITRE ATT&CK technique: T1595.002: Active Scanning- Vulnerability Scanning
Dragonfly has commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
Dragonfly has used various types of scripting to perform operations, including batch scripts.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
EXOTIC LILY has registered domains to spoof targeted organizations by changing the top-level domain to “.us”, “.co” or “.biz”.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
EXOTIC LILY has created e-mail accounts to spoof targeted organizations.
MITRE ATT&CK technique: T1585.002: Establish Accounts- Email Accounts
EXOTIC LILY has gathered targeted individuals' e-mail addresses through open source research and website contact forms.
MITRE ATT&CK technique: T1589.002: Gather Victim Identity Information- Email Addresses
EXOTIC LILY has used malicious documents containing exploits for CVE-2021-40444 affecting Microsoft MSHTML.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
EXOTIC LILY has gained execution through victims clicking on malicious LNK files contained within ISO files, which can execute hidden DLLs within the ISO.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
EXOTIC LILY has used malicious links to lure users into executing malicious payloads.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
EXOTIC LILY has searched for information on targeted individuals on business databases including RocketReach and CrunchBase.
MITRE ATT&CK technique: T1597: Search Closed Sources
EXOTIC LILY has used contact forms on victim websites to generate phishing e-mails.
MITRE ATT&CK technique: T1594: Search Victim-Owned Websites
EXOTIC LILY has copied data from social media sites to impersonate targeted individuals.
MITRE ATT&CK technique: T1593.001: Search Open Websites/Domains- Social Media
EXOTIC LILY has established social media profiles to mimic employees of targeted companies.
MITRE ATT&CK technique: T1585.001: Establish Accounts- Social Media Accounts
EXOTIC LILY conducted an e-mail thread-hijacking campaign with malicious ISO attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
EXOTIC LILY has relied on victims to open malicious links in e-mails for execution.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
EXOTIC LILY has used the e-mail notification features of legitimate file sharing services for spearphishing.
MITRE ATT&CK technique: T1566.003: Phishing- Spearphishing via Service
EXOTIC LILY has uploaded malicious payloads to file-sharing services including TransferNow, TransferXL, WeTransfer, and OneDrive.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
EXOTIC LILY has used file-sharing services including WeTransfer, TransferNow, and OneDrive to deliver payloads.
MITRE ATT&CK technique: T1102: Web Service
Earth Lusca has used WinRAR to compress stolen files into an archive prior to exfiltration.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
Earth Lusca has used the Fodhelper UAC bypass technique to gain elevated privileges.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
Earth Lusca has used a DCSync command with Mimikatz to retrieve credentials from an exploited controller.
MITRE ATT&CK technique: T1003.006: OS Credential Dumping- DCSync
Earth Lusca has placed a malicious payload in `%WINDIR%\SYSTEM32\oci.dll` so it would be sideloaded by the MSDTC service.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Earth Lusca has used certutil to decode a string into a cabinet file.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Earth Lusca has used Nltest to obtain information about domain controllers.
MITRE ATT&CK technique: T1482: Domain Trust Discovery
Earth Lusca has registered domains, intended to look like legitimate target domains, that have been used in watering hole attacks.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
Earth Lusca has performed watering hole attacks.
MITRE ATT&CK technique: T1189: Drive-by Compromise
Earth Lusca has used the megacmd tool to upload stolen files from a victim network to MEGA.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
Earth Lusca has compromised victims by directly exploiting vulnerabilities of public-facing servers, including those associated with Microsoft Exchange and Oracle GlassFish.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
Earth Lusca has used Mimikatz to exploit a domain controller via the ZeroLogon exploit .
MITRE ATT&CK technique: T1210: Exploitation of Remote Services
Earth Lusca has manipulated legitimate websites to inject malicious JavaScript code as part of their watering hole operations.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Earth Lusca has used ProcDump to obtain the hashes of credentials by dumping the memory of the LSASS process.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Earth Lusca required users to click on a malicious file for the loader to activate.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Earth Lusca has sent spearphishing emails that required the user to click on a malicious link and subsequently open a decoy document with a malicious loader.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Earth Lusca has acquired and used a variety of malware, including Cobalt Strike.
MITRE ATT&CK technique: T1588.001: Obtain Capabilities- Malware
Earth Lusca used the command `move file path c:\windows\system32\spool\prtprocs\x64\spool.dll` to move and register a malicious DLL name as a Windows print processor, which eventually was loaded by the Print Spooler service.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Earth Lusca modified the registry using the command reg add “HKEY_CURRENT_USER\Environment” /v UserInitMprLogonScript /t REG_SZ /d “file path” for persistence.
MITRE ATT&CK technique: T1112: Modify Registry
Earth Lusca has used `mshta.exe` to load an HTA script within a malicious .LNK file.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
Earth Lusca used Base64 to encode strings.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Earth Lusca has used PowerShell to execute commands.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Earth Lusca has added the Registry key `HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Print Processors\UDPrint” /v Driver /d “spool.dll /f` to load malware as a Print Processor.
MITRE ATT&CK technique: T1547.012: Boot or Logon Autostart Execution- Print Processors
Earth Lusca has used Tasklist to obtain information from a compromised host.
MITRE ATT&CK technique: T1057: Process Discovery
Earth Lusca adopted Cloudflare as a proxy for compromised servers.
MITRE ATT&CK technique: T1090: Proxy