sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Volt Typhoon has conducted extensive pre-compromise reconnaissance to learn about the target organization’s network.
MITRE ATT&CK technique: T1590: Gather Victim Network Information
Volt Typhoon has conducted extensive reconnaissance pre-compromise to gain information about the targeted organization.
MITRE ATT&CK technique: T1591: Gather Victim Org Information
Volt Typhoon has identified key network and IT staff members pre-compromise at targeted organizations.
MITRE ATT&CK technique: T1591.004: Gather Victim Org Information- Identify Roles
Volt Typhoon has downloaded an outdated version of comsvcs.dll to a compromised domain controller in a non-standard folder.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Volt Typhoon has used the built-in netsh `port proxy` command to create proxies on compromised systems to facilitate access.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy
Volt Typhoon has employed Ping to check network connectivity.
MITRE ATT&CK technique: T1016.001: System Network Configuration Discovery- Internet Connection Discovery
Volt Typhoon has created and accessed a file named rult3uil.log on compromised domain controllers to capture keypresses and command execution.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Volt Typhoon has attempted to access hashed credentials from the LSASS process memory space.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Volt Typhoon has copied web shells between servers in targeted environments.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
Volt Typhoon has executed `net user` and `quser` to enumerate local account information.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Volt Typhoon has saved stolen files including the `ntds.dit` database and the `SYSTEM` and `SECURITY` Registry hives locally to the `C:\Windows\Temp\` directory.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Volt Typhoon has run `net localgroup administrators` in compromised environments to enumerate accounts.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
Volt Typhoon has used `wevtutil.exe` and the PowerShell command `Get-EventLog security` to enumerate Windows logs to search for successful logons.
MITRE ATT&CK technique: T1654: Log Enumeration
Volt Typhoon has appended copies of the ntds.dit database with a .gif file extension.
MITRE ATT&CK technique: T1036.008: Masquerading- Masquerade File Type
Volt Typhoon has used legitimate looking filenames for compressed copies of the ntds.dit database and used names including cisco_up.exe, cl64.exe, vm3dservice.exe, watchdogd.exe, Win.exe, WmiPreSV.exe, and WmiPrvSE.exe for the Earthworm and Fast Reverse Proxy tools.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Volt Typhoon has used `netsh` to create a PortProxy Registry modification on a compromised server running the Paessler Router Traffic Grapher .
MITRE ATT&CK technique: T1112: Modify Registry
Volt Typhoon has used multi-hop proxies for command-and-control infrastructure.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
Volt Typhoon has used ntds.util to create domain controller installation media containing usernames and password hashes.
MITRE ATT&CK technique: T1003.003: OS Credential Dumping- NTDS
Volt Typhoon has compromised small office and home office network edge devices, many of which were located in the same geographic area as the victim, to proxy network traffic.
MITRE ATT&CK technique: T1584.008: Compromise Infrastructure- Network Devices
Volt Typhoon has identified target network security measures as part of pre-compromise reconnaissance.
MITRE ATT&CK technique: T1590.006: Gather Victim Network Information- Network Security Appliances
Volt Typhoon has used commercial tools, LOTL utilities, and appliances already present on the system for network service discovery.
MITRE ATT&CK technique: T1046: Network Service Discovery
Volt Typhoon has conducted extensive reconnaissance of victim networks including identifying network topologies.
MITRE ATT&CK technique: T1590.004: Gather Victim Network Information- Network Topology
Volt Typhoon has obtained victim's screen dimension and display device information.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
Volt Typhoon has used commercial tools, LOTL utilities, and appliances already present on the system for group and user discovery.
MITRE ATT&CK technique: T1069: Permission Groups Discovery
Volt Typhoon has used PowerShell including for remote system discovery.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Volt Typhoon has accessed a Local State file that contains the AES key used to encrypt passwords stored in the Chrome browser.
MITRE ATT&CK technique: T1552.004: Unsecured Credentials- Private Keys
Volt Typhoon has enumerated running processes on targeted systems including through the use of Tasklist.
MITRE ATT&CK technique: T1057: Process Discovery
Volt Typhoon has used compromised devices and customized versions of open source tools such as FRP , Earthworm, and Impacket to proxy network traffic.
MITRE ATT&CK technique: T1090: Proxy
Volt Typhoon has queried the Registry on compromised systems, `reg query hklm\software\`, for information on installed software including PuTTY.
MITRE ATT&CK technique: T1012: Query Registry
Volt Typhoon has moved laterally to the Domain Controller via RDP using a compromised account with domain administrator privileges.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
Volt Typhoon has used multiple methods, including Ping, to enumerate systems on compromised networks.
MITRE ATT&CK technique: T1018: Remote System Discovery
Volt Typhoon has used FOFA, Shodan, and Censys to search for exposed victim infrastructure.
MITRE ATT&CK technique: T1596.005: Search Open Technical Databases- Scan Databases
Volt Typhoon has obtained a screenshot of the victim's system using the gdi32.dll and gdiplus.dll libraries.
MITRE ATT&CK technique: T1113: Screen Capture
Volt Typhoon has conducted pre-compromise web searches for victim information.
MITRE ATT&CK technique: T1593: Search Open Websites/Domains
Volt Typhoon has conducted pre-compromise reconnaissance on victim-owned sites.
MITRE ATT&CK technique: T1594: Search Victim-Owned Websites
Volt Typhoon has used compromised Paessler Router Traffic Grapher servers from other organizations for C2.
MITRE ATT&CK technique: T1584.004: Compromise Infrastructure- Server
Volt Typhoon has queried the Registry on compromised systems for information on installed software.
MITRE ATT&CK technique: T1518: Software Discovery
Volt Typhoon has used the Ultimate Packer for Executables to obfuscate the FRP client files BrightmetricAgent.exe and SMSvcService.ex) and the port scanning utility ScanLine.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Volt Typhoon has used a version of the Awen web shell that employed AES encryption and decryption for C2 communications.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Volt Typhoon has used native tools and processes including living off the land binaries or “LOLBins" to maintain and expand access to the victim networks.
MITRE ATT&CK technique: T1218: System Binary Proxy Execution
Volt Typhoon has run system checks to determine if they were operating in a virtualized environment.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
Volt Typhoon has discovered file system types, drive names, size, and free space on compromised systems.
MITRE ATT&CK technique: T1082: System Information Discovery
Volt Typhoon has obtained the victim's system current location.
MITRE ATT&CK technique: T1614: System Location Discovery
Volt Typhoon has executed multiple commands to enumerate network topology and settings including `ipconfig`, `netsh interface firewall show all`, and `netsh interface portproxy show all`.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Volt Typhoon has used `netstat -ano` on compromised hosts to enumerate network connections.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Volt Typhoon has used public tools and executed the PowerShell command `Get-EventLog security -instanceid 4624` to identify associated user and computer account names.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Volt Typhoon has used `net start` to list running services.
MITRE ATT&CK technique: T1007: System Service Discovery
Volt Typhoon has obtained the victim's system timezone.
MITRE ATT&CK technique: T1124: System Time Discovery
Volt Typhoon has used legitimate network and forensic tools and customized versions of open-source tools for C2.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Volt Typhoon has used Brightmetricagent.exe which contains a command- line interface library that can leverage command shells including Z Shell .
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
Volt Typhoon has obtained credentials insecurely stored on targeted network appliances.
MITRE ATT&CK technique: T1552: Unsecured Credentials
Volt Typhoon relies primarily on valid credentials for persistence.
MITRE ATT&CK technique: T1078: Valid Accounts
Volt Typhoon has compromised Virtual Private Servers to proxy C2 traffic.
MITRE ATT&CK technique: T1584.003: Compromise Infrastructure- Virtual Private Server
Volt Typhoon has used publicly available exploit code for initial access.
MITRE ATT&CK technique: T1588.006: Obtain Capabilities- Vulnerabilities
Volt Typhoon has used webshells, including ones named AuditReport.jspx and iisstart.aspx, in compromised environments.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
Volt Typhoon has used the Windows command line to perform hands-on-keyboard activities in targeted environments including for discovery.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Volt Typhoon has leveraged WMIC for execution, remote system discovery, and to create and use temporary directories.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
WIRTE has used Base64 to decode malicious VBS script.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
WIRTE has downloaded PowerShell code from the C2 server to be executed.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
WIRTE has attempted to lure users into opening malicious MS Word and Excel files to execute malicious payloads.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
WIRTE has named a first stage dropper `Kaspersky Update Agent` in order to appear legitimate.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
WIRTE has used HTTPS over ports 2083 and 2087 for C2.
MITRE ATT&CK technique: T1571: Non-Standard Port
WIRTE has used PowerShell for script execution.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
WIRTE has used `regsvr32.exe` to trigger the execution of a malicious script.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
WIRTE has sent emails to intended victims with malicious MS Word and Excel attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
WIRTE has obtained and used Empire for post-exploitation activities.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
WIRTE has used VBScript in its operations.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
WIRTE has used HTTP for network communication.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Whitefly has used a simple remote shell tool that will call back to the C2 server and wait for commands.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
Whitefly has used search order hijacking to run the loader Vcrodat.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
Whitefly has encrypted the payload used for C2.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Whitefly has used an open-source tool to exploit a known Windows privilege escalation vulnerability on unpatched computers.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
Whitefly has the ability to download additional tools from the C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Whitefly has used Mimikatz to obtain credentials.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Whitefly has used malicious .exe or .dll files disguised as documents or images.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Whitefly has named the malicious DLL the same name as DLLs belonging to legitimate software from various security vendors.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Whitefly has obtained and used tools such as Mimikatz.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Windigo has used a Perl script for information gathering.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
Windigo has used a script to gather credentials in files left on disk by OpenSSH backdoors.
MITRE ATT&CK technique: T1005: Data from Local System
Windigo has distributed Windows malware via drive-by downloads.
MITRE ATT&CK technique: T1189: Drive-by Compromise
Windigo has used a script to check for the presence of files created by OpenSSH backdoors.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Windigo has delivered a generic Windows proxy Win32/Glubteta.M. Windigo has also used multiple reverse proxy chains as part of their C2 infrastructure.
MITRE ATT&CK technique: T1090: Proxy
Windigo has used a script to detect installed software on targeted systems.
MITRE ATT&CK technique: T1518: Software Discovery
Windigo has used a script to detect which Linux distribution and version is currently installed on the system.
MITRE ATT&CK technique: T1082: System Information Discovery
Windshift has used compromised websites to register custom URL schemes on a remote system.
MITRE ATT&CK technique: T1189: Drive-by Compromise
Windshift has used tools to deploy additional payloads to compromised hosts.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Windshift has used revoked certificates to sign malware.
MITRE ATT&CK technique: T1036.001: Masquerading- Invalid Code Signature
Windshift has used e-mail attachments to lure victims into executing malicious code.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Windshift has used links embedded in e-mails to lure victims into executing malicious code.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Windshift has used icons mimicking MS Office files to mask malicious executables. Windshift has also attempted to hide executables by changing the file extension to ".scr" to mimic Windows screensavers.
MITRE ATT&CK technique: T1036: Masquerading
Windshift has used string encoding with floating point calculations.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Windshift has used malware to enumerate active processes.
MITRE ATT&CK technique: T1057: Process Discovery
Windshift has created LNK files in the Startup folder to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Windshift has used malware to identify installed AV and commonly used forensic and malware analysis tools.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Windshift has used malware to identify installed software.
MITRE ATT&CK technique: T1518: Software Discovery
Windshift has sent spearphishing emails with attachment to harvest credentials and deliver malware.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Windshift has sent spearphishing emails with links to harvest credentials and deliver malware.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Windshift has used fake personas on social media to engage and target victims.
MITRE ATT&CK technique: T1566.003: Phishing- Spearphishing via Service
Windshift has used malware to identify the computer name of a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
Windshift has used malware to identify the username on a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Windshift has used Visual Basic 6 payloads.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Windshift has used tools that communicate with C2 over HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Windshift has used WMI to collect information about target machines.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Winnti Group used stolen certificates to sign its malware.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Winnti Group has registered domains for C2 that mimicked sites of their intended targets.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
Winnti Group has used a program named ff.exe to search for specific documents on compromised hosts.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Winnti Group has downloaded an auxiliary program named ff.exe to infected machines.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Winnti Group looked for a specific process running on infected servers.
MITRE ATT&CK technique: T1057: Process Discovery
Winnti Group used a rootkit to modify typical server functionality.
MITRE ATT&CK technique: T1014: Rootkit
Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.
MITRE ATT&CK technique: T1119: Automated Collection
Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.
MITRE ATT&CK technique: T1020: Automated Exfiltration
Winter Vivern used XLM 4.0 macros for initial code execution for malicious document files.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
Winter Vivern delivered exploit payloads via base64-encoded payloads in malicious email messages.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Winter Vivern registered domains mimicking other entities throughout various campaigns.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
Winter Vivern created dedicated web pages mimicking legitimate government websites to deliver malicious fake anti-virus software.
MITRE ATT&CK technique: T1189: Drive-by Compromise
Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Winter Vivern has exploited known and zero-day vulnerabilities in software usch as Roundcube Webmail servers and the "Follina" vulnerability.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
Winter Vivern delivered malicious JavaScript payloads capable of listing folders and emails in exploited email servers.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Winter Vivern executed PowerShell scripts to create scheduled tasks to retrieve remotely-hosted payloads.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Winter Vivern delivered malicious JavaScript to exploit targets when exploiting Roundcube Webmail servers.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Winter Vivern delivered malicious JavaScript payloads capable of exfiltrating email messages from exploited email servers.
MITRE ATT&CK technique: T1114.001: Email Collection- Local Email Collection
Winter Vivern has mimicked legitimate government-related domains to deliver malicious webpages containing links to documents or other content for user execution.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Winter Vivern has distributed malicious scripts and executables mimicking virus scanners.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Winter Vivern created specially-crafted documents mimicking legitimate government or similar documents during phishing campaigns.
MITRE ATT&CK technique: T1036: Masquerading
Winter Vivern passed execution from document macros to PowerShell scripts during initial access operations. Winter Vivern used batch scripts that called PowerShell commands as part of initial access and installation operations.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Winter Vivern executed PowerShell scripts that would subsequently attempt to establish persistence by creating scheduled tasks objects to periodically retrieve and execute remotely-hosted payloads.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Winter Vivern delivered PowerShell scripts capable of taking screenshots of victim machines.
MITRE ATT&CK technique: T1113: Screen Capture
Winter Vivern leverages malicious attachments delivered via email for initial access activity.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Winter Vivern script execution includes basic victim information gathering steps which are then transmitted to command and control servers.
MITRE ATT&CK technique: T1082: System Information Discovery
Winter Vivern PowerShell scripts execute `whoami` to identify the executing user.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Winter Vivern used adversary-owned and -controlled servers to host web vulnerability scanning applications.
MITRE ATT&CK technique: T1583.003: Acquire Infrastructure- Virtual Private Server
Winter Vivern has used remotely-hosted instances of the Acunetix vulnerability scanner.
MITRE ATT&CK technique: T1595.002: Active Scanning- Vulnerability Scanning
Winter Vivern registered and hosted domains to allow for creation of web pages mimicking legitimate government email logon sites to collect logon information.
MITRE ATT&CK technique: T1056.003: Input Capture- Web Portal Capture
Winter Vivern uses HTTP and HTTPS protocols for exfiltration and command and control activity.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Winter Vivern has used compromised WordPress sites to host malicious payloads for download.
MITRE ATT&CK technique: T1584.006: Compromise Infrastructure- Web Services
Winter Vivern distributed Windows batch scripts disguised as virus scanners to prompt download of malicious payloads using built-in system tools.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Wizard Spider has archived data into ZIP files on compromised machines.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
Wizard Spider has used batch scripts that utilizes WMIC to execute a BITSAdmin transfer of a ransomware payload to each compromised machine.
MITRE ATT&CK technique: T1197: BITS Jobs
Wizard Spider has used Digicert code-signing certificates for some of its malware.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Wizard Spider has obtained code signing certificates signed by DigiCert, GlobalSign, and COMOOD for malware payloads.
MITRE ATT&CK technique: T1588.003: Obtain Capabilities- Code Signing Certificates
Wizard Spider used Base64 encoding to obfuscate an Empire service and PowerShell commands.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
Wizard Spider has collected and staged credentials and network enumeration information, using the networkdll and psfin TrickBot modules.
MITRE ATT&CK technique: T1074: Data Staged
Wizard Spider has collected data from a compromised host prior to exfiltration.
MITRE ATT&CK technique: T1005: Data from Local System
Wizard Spider has shut down or uninstalled security applications on victim systems that might prevent ransomware from executing.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Wizard Spider has identified domain admins through the use of `net group "Domain admins" /DOMAIN`. Wizard Spider has also leveraged the PowerShell cmdlet `Get-ADComputer` to collect account names from Active Directory data.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
Wizard Spider has created and used new accounts within a victim's Active Directory environment to maintain persistence.
MITRE ATT&CK technique: T1136.002: Create Account- Domain Account
Wizard Spider has used administrative accounts, including Domain Admin, to move laterally within a victim network.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
Wizard Spider has injected malicious DLLs into memory with read, write, and execute permissions.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Wizard Spider has leveraged ProtonMail email addresses in ransom notes when delivering Ryuk ransomware.
MITRE ATT&CK technique: T1585.002: Establish Accounts- Email Accounts
Wizard Spider has exfiltrated domain credentials and network enumeration information over command and control channels.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Wizard Spider has exfiltrated victim information using FTP.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
Wizard Spider has exfiltrated stolen victim data to various cloud storage providers.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
Wizard Spider has exploited or attempted to exploit Zerologon and EternalBlue vulnerabilities.
MITRE ATT&CK technique: T1210: Exploitation of Remote Services
Wizard Spider has accessed victim networks by using stolen credentials to access the corporate VPN infrastructure.
MITRE ATT&CK technique: T1133: External Remote Services
Wizard Spider has used file deletion to remove some modules and configurations from an infected host after use.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Wizard Spider has used PowerShell cmdlets `Get-GPPPassword` and `Find-GPOPassword` to find unsecured credentials in a compromised network group policy.
MITRE ATT&CK technique: T1552.006: Unsecured Credentials- Group Policy Preferences
Wizard Spider can transfer malicious payloads such as ransomware to compromised machines.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Wizard Spider has used WMIC and vssadmin to manually delete volume shadow copies. Wizard Spider has also used Conti ransomware to delete volume shadow copies automatically with the use of vssadmin.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
Wizard Spider has used Rubeus, MimiKatz Kerberos module, and the Invoke-Kerberoast cmdlet to steal AES hashes.
MITRE ATT&CK technique: T1558.003: Steal or Forge Kerberos Tickets- Kerberoasting
Wizard Spider has used the Invoke-Inveigh PowerShell cmdlets, likely for name service poisoning.
MITRE ATT&CK technique: T1557.001: Adversary-in-the-Middle- LLMNR/NBT-NS Poisoning and SMB Relay
Wizard Spider has dumped the lsass.exe memory to harvest credentials with the use of open-source tool LaZagne.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Wizard Spider has used stolen credentials to copy tools into the %TEMP% directory of domain controllers.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
Wizard Spider has created local administrator accounts to maintain persistence in compromised networks.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
Wizard Spider has staged ZIP files in local directories such as, `C:\PerfLogs\1\` and `C:\User\1\` prior to exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Wizard Spider has lured victims to execute malware with spearphishing attachments containing macros to download either Emotet, Bokbot, TrickBot, or Bazar.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Wizard Spider has lured victims into clicking a malicious link delivered through spearphishing.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Wizard Spider has used scheduled tasks to install TrickBot, using task names to appear legitimate such as WinDotNet, GoogleTask, or Sysnetsf. It has also used common document file names for other malware binaries.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Wizard Spider has modified the Registry key HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest by setting the UseLogonCredential registry value to 1 in order to force credentials to be stored in clear text in memory. Wizard Spider has also modified the WDigest registry key to allow plaintext credentials to be cached in memory.
MITRE ATT&CK technique: T1112: Modify Registry
Wizard Spider has gained access to credentials via exported copies of the ntds.dit Active Directory database. Wizard Spider has also created a volume shadow copy and used a batch script file to collect NTDS.dit with the use of the Windows utility, ntdsutil.
MITRE ATT&CK technique: T1003.003: OS Credential Dumping- NTDS
Wizard Spider has used the “net view” command to locate mapped network shares.
MITRE ATT&CK technique: T1135: Network Share Discovery
Wizard Spider has used the `Invoke-SMBExec` PowerShell cmdlet to execute the pass-the-hash technique and utilized stolen password hashes to move laterally.
MITRE ATT&CK technique: T1550.002: Use Alternate Authentication Material- Pass the Hash
Wizard Spider has used macros to execute PowerShell scripts to download malware on victim's machines. It has also used PowerShell to execute commands and move laterally through a victim network.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Wizard Spider has used process injection to execute payloads to escalate privileges.
MITRE ATT&CK technique: T1055: Process Injection
Wizard Spider has established persistence via the Registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and a shortcut within the startup folder.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Wizard Spider has used RDP for lateral movement and to deploy ransomware interactively.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
Wizard Spider has used the WebDAV protocol to execute Ryuk payloads hosted on network file shares.
MITRE ATT&CK technique: T1021: Remote Services
Wizard Spider has used networkdll for network discovery and psfin specifically for financial and point of sale indicators. Wizard Spider has also used AdFind, nltest/dclist, and PowerShell script Get-DataInfo.ps1 to enumerate domain computers, including the domain controller.
MITRE ATT&CK technique: T1018: Remote System Discovery
Wizard Spider has utilized `rundll32.exe` to deploy ransomware commands with the use of WebDAV.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Wizard Spider has used SMB to drop Cobalt Strike Beacon on a domain controller for lateral movement.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Wizard Spider has used scheduled tasks to establish persistence for TrickBot and other malware.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Wizard Spider has acquired credentials from the SAM/SECURITY registry hives.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
Wizard Spider has used WMI to identify anti-virus products installed on a victim's machine.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Wizard Spider has used `services.exe` to execute scripts and executables during lateral movement within a victim's network. Wizard Spider has also used batch scripts that leverage PsExec to execute a previously transferred ransomware payload on a victim's network.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Wizard Spider has used taskkill.exe and net.exe to stop backup, catalog, cloud, and other services prior to network encryption.
MITRE ATT&CK technique: T1489: Service Stop
Wizard Spider has utilized the PowerShell script `Get-DataInfo.ps1` to collect installed backup software information from a compromised machine.
MITRE ATT&CK technique: T1518: Software Discovery
Wizard Spider has used spearphishing attachments to deliver Microsoft documents containing macros or PDFs containing malicious links to download either Emotet, Bokbot, TrickBot, or Bazar.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Wizard Spider has sent phishing emails containing a link to an actor-controlled Google Drive document or other free online file hosting services.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Wizard Spider has used Systeminfo and similar commands to acquire detailed configuration information of a victim's machine. Wizard Spider has also utilized the PowerShell cmdlet `Get-ADComputer` to collect DNS hostnames, last logon dates, and operating system information from Active Directory.
MITRE ATT&CK technique: T1082: System Information Discovery
Wizard Spider has used ipconfig to identify the network configuration of a victim machine. Wizard Spider has also used the PowerShell cmdlet `Get-ADComputer` to collect IP address data from Active Directory.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Wizard Spider has used "whoami" to identify the local user and their privileges.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Wizard Spider has utilized tools such as Empire, Cobalt Strike, Cobalt Strike, Rubeus, AdFind, BloodHound, Metasploit, Advanced IP Scanner, Nirsoft PingInfoView, and SoftPerfect Network Scanner for targeting efforts.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Wizard Spider has used valid credentials for privileged accounts with the goal of accessing domain controllers.
MITRE ATT&CK technique: T1078: Valid Accounts
Wizard Spider has used HTTP for network communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Wizard Spider has used `cmd.exe` to execute commands on a victim's machine.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Wizard Spider has used PowerShell cmdlet `Invoke-WCMDump` to enumerate Windows credentials in the Credential Manager in a compromised network.
MITRE ATT&CK technique: T1555.004: Credentials from Password Stores- Windows Credential Manager
Wizard Spider has used the icacls command to modify access control to backup servers, providing them with full control of all the system folders.
MITRE ATT&CK technique: T1222.001: File and Directory Permissions Modification- Windows File and Directory Permissions Modification
Wizard Spider has used WMI and LDAP queries for network discovery and to move laterally. Wizard Spider has also used batch scripts to leverage WMIC to deploy ransomware.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Wizard Spider has used Window Remote Management to move laterally through a victim network.
MITRE ATT&CK technique: T1021.006: Remote Services- Windows Remote Management
Wizard Spider has installed TrickBot as a service named ControlServiceA in order to establish persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Wizard Spider has established persistence using Userinit by adding the Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.
MITRE ATT&CK technique: T1547.004: Boot or Logon Autostart Execution- Winlogon Helper DLL
ZIRCONIUM has used Dropbox for C2 allowing upload and download of files as well as execution of arbitrary commands.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
ZIRCONIUM has used a tool to steal credentials from installed web browsers including Microsoft Internet Explorer and Google Chrome.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
ZIRCONIUM has used the AES256 algorithm with a SHA1 derived key to decrypt exploit code.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
ZIRCONIUM has purchased domains for use in targeted campaigns.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
ZIRCONIUM has exfiltrated files via the Dropbox API C2.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
ZIRCONIUM has exfiltrated stolen data to Dropbox.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
ZIRCONIUM has exploited CVE-2017-0005 for local privilege escalation.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
ZIRCONIUM has used tools to download malicious files to compromised hosts.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
ZIRCONIUM has used malicious links in e-mails to lure victims into downloading malware.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
ZIRCONIUM has created a run key named Dropbox Update Setup to mask a persistence mechanism for a malicious binary.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
ZIRCONIUM has spoofed legitimate applications in phishing lures and changed file extensions to conceal installation of malware.
MITRE ATT&CK technique: T1036: Masquerading
ZIRCONIUM has used the msiexec.exe command-line utility to download and execute malicious MSI files.
MITRE ATT&CK technique: T1218.007: System Binary Proxy Execution- Msiexec
ZIRCONIUM has utilized an ORB network – consisting compromised devices such as small office and home office routers, IoT devices, and leased virtual private servers – to proxy traffic.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
ZIRCONIUM has compromised network devices such as small office and home office routers and IoT devices for ORB Proxy networks.
MITRE ATT&CK technique: T1584.008: Compromise Infrastructure- Network Devices
ZIRCONIUM targeted presidential campaign staffers with credential phishing e-mails.
MITRE ATT&CK technique: T1598: Phishing for Information
ZIRCONIUM has used Python-based implants to interact with compromised hosts.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
ZIRCONIUM has used a tool to query the Registry for proxy settings.
MITRE ATT&CK technique: T1012: Query Registry
ZIRCONIUM has created a Registry Run key named Dropbox Update Setup to establish persistence for a malicious Python binary.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
ZIRCONIUM has used multi-stage packers for exploit code.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
ZIRCONIUM has used malicious links in e-mails to deliver malware.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
ZIRCONIUM has used web beacons in e-mails to track hits to attacker-controlled URL's.
MITRE ATT&CK technique: T1598.003: Phishing for Information- Spearphishing Link
ZIRCONIUM has used AES encrypted communications in C2.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
ZIRCONIUM has used a tool to capture the processor architecture of a compromised host in order to register it with C2.
MITRE ATT&CK technique: T1082: System Information Discovery
ZIRCONIUM has used a tool to enumerate proxy settings in the target environment.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
ZIRCONIUM has used a tool to capture the username on a compromised host in order to register it with C2.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
ZIRCONIUM has used a tool to capture the time on a compromised host in order to register it with C2.
MITRE ATT&CK technique: T1124: System Time Discovery
ZIRCONIUM has used GitHub to host malware linked in spearphishing e-mails.
MITRE ATT&CK technique: T1583.006: Acquire Infrastructure- Web Services
ZIRCONIUM has used a tool to open a Windows Command Shell on a remote host.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
admin@338 has exploited client software vulnerabilities for execution, such as Microsoft Word CVE-2012-0158.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about files and directories: dir c:\ >> %temp%\download dir "c:\Documents and Settings" >> %temp%\download dir "c:\Program Files\" >> %temp%\download dir d:\ >> %temp%\download
MITRE ATT&CK technique: T1083: File and Directory Discovery
admin@338 actors used the following commands following exploitation of a machine with LOWBALL malware to enumerate user accounts: net user >> %temp%\download net user /domain >> %temp%\download
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: net localgroup administrator >> %temp%\download
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
admin@338 has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
admin@338 actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
admin@338 has sent emails with malicious Microsoft Office documents attached.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about the OS: ver >> %temp%\download systeminfo >> %temp%\download
MITRE ATT&CK technique: T1082: System Information Discovery
admin@338 actors used the following command after exploiting a machine with LOWBALL malware to acquire information about local networks: ipconfig /all >> %temp%\download
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to display network connections: netstat -ano >> %temp%\download
MITRE ATT&CK technique: T1049: System Network Connections Discovery
admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to obtain information about services: net start >> %temp%\download
MITRE ATT&CK technique: T1007: System Service Discovery
Following exploitation with LOWBALL malware, admin@338 actors created a file containing a list of commands to be executed on the compromised computer.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
menuPass has encrypted files and information before exfiltration.
MITRE ATT&CK technique: T1560: Archive Collected Data
menuPass has compressed files before exfiltration using TAR and RAR.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
menuPass has used the Csvde tool to collect Active Directory files and data.
MITRE ATT&CK technique: T1119: Automated Collection
menuPass has used Wevtutil to remove PowerShell execution logs.
MITRE ATT&CK technique: T1070.003: Indicator Removal- Clear Command History
menuPass has resized and added data to the certificate table to enable the signing of modified files with legitimate signatures.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
menuPass has used DLL search order hijacking.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
menuPass has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as UPPERCUT.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
menuPass has collected various files from the compromised computers.
MITRE ATT&CK technique: T1005: Data from Local System
menuPass has collected data from remote systems by mounting network shares with net use and using Robocopy to transfer data.
MITRE ATT&CK technique: T1039: Data from Network Shared Drive
menuPass has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has also used certutil -decode to decode files on the victim’s machine when dropping UPPERCUT.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
menuPass has used the Microsoft administration tool csvde.exe to export Active Directory data.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
menuPass has registered malicious domains for use in intrusion campaigns.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
menuPass has encoded strings in its malware with base64 as well as with a simple, single-byte XOR obfuscation using key 0x40.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
menuPass has leveraged vulnerabilities in Pulse Secure VPNs to hijack sessions.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
menuPass has used tools to exploit the ZeroLogon vulnerability .
MITRE ATT&CK technique: T1210: Exploitation of Remote Services
menuPass has used a global service provider's IP as a proxy for C2 traffic from a victim.
MITRE ATT&CK technique: T1090.002: Proxy- External Proxy
menuPass has used dynamic DNS service providers to host malicious domains.
MITRE ATT&CK technique: T1568.001: Dynamic Resolution- Fast Flux DNS
A menuPass macro deletes files after it has decoded and decompressed them.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
menuPass has searched compromised systems for folders of interest including those related to HR, audit and expense, and meeting memos.
MITRE ATT&CK technique: T1083: File and Directory Discovery
menuPass has installed updates and new malware on victims.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
menuPass has used InstallUtil.exe to execute malicious software.
MITRE ATT&CK technique: T1218.004: System Binary Proxy Execution- InstallUtil
menuPass has used key loggers to steal usernames and passwords.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.
MITRE ATT&CK technique: T1003.004: OS Credential Dumping- LSA Secrets
menuPass stages data prior to exfiltration in multi-part archives, often saved in the Recycle Bin.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
menuPass has attempted to get victims to open malicious files such as Windows Shortcuts and/or Microsoft Office documents, sent via email as part of spearphishing campaigns.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
menuPass has used esentutl to change file extensions to their true type that were masquerading as .txt files.
MITRE ATT&CK technique: T1036: Masquerading
menuPass has been seen changing malicious files to appear legitimate.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
menuPass has used Ntdsutil to dump credentials.
MITRE ATT&CK technique: T1003.003: OS Credential Dumping- NTDS
menuPass has used native APIs including GetModuleFileName, lstrcat, CreateFile, and ReadFile.
MITRE ATT&CK technique: T1106: Native API
menuPass has used tcping.exe, similar to Ping, to probe port status on systems of interest.
MITRE ATT&CK technique: T1046: Network Service Discovery
menuPass uses PowerSploit to inject shellcode into PowerShell.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
menuPass has used process hollowing in iexplore.exe to load the RedLeaves implant.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
menuPass has staged data on remote MSP systems or other victim networks prior to exfiltration.
MITRE ATT&CK technique: T1074.002: Data Staged- Remote Data Staging
menuPass has used RDP connections to move across the victim network.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol