sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
TeamTNT has searched for unsecured SSH keys.
MITRE ATT&CK technique: T1552.004: Unsecured Credentials- Private Keys
TeamTNT has searched for rival malware and removes it if found. TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.
MITRE ATT&CK technique: T1057: Process Discovery
TeamTNT has added batch scripts to the startup folder.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
TeamTNT has established tmate sessions for C2 communications.
MITRE ATT&CK technique: T1219: Remote Access Software
TeamTNT has used rootkits such as the open-source Diamorphine rootkit and their custom bots to hide cryptocurrency mining activities on the machine.
MITRE ATT&CK technique: T1014: Rootkit
TeamTNT has used SSH to connect back to victim machines. TeamTNT has also used SSH to transfer tools and payloads onto victim hosts and execute them.
MITRE ATT&CK technique: T1021.004: Remote Services- SSH
TeamTNT has added RSA keys in authorized_keys.
MITRE ATT&CK technique: T1098.004: Account Manipulation- SSH Authorized Keys
TeamTNT has scanned specific lists of target IP addresses.
MITRE ATT&CK technique: T1595.001: Active Scanning- Scanning IP Blocks
TeamTNT has searched for security products on infected machines.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
TeamTNT has used UPX and Ezuri packer to pack its binaries.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
TeamTNT has searched for system version, architecture, disk partition, logical volume, and hostname information.
MITRE ATT&CK technique: T1082: System Information Discovery
TeamTNT has enumerated the host machine’s IP address.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
TeamTNT has run netstat -anp to search for rival malware connections. TeamTNT has also used `libprocesshider` to modify /etc/ld.so.preload.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
TeamTNT has searched for services such as Alibaba Cloud Security's aliyun service and BMC Helix Cloud Security's bmc-agent service in order to disable them.
MITRE ATT&CK technique: T1007: System Service Discovery
TeamTNT has created system services to execute cryptocurrency mining software.
MITRE ATT&CK technique: T1569: System Services
TeamTNT has established persistence through the creation of a cryptocurrency mining system service using systemctl.
MITRE ATT&CK technique: T1543.002: Create or Modify System Process- Systemd Service
TeamTNT has used shell scripts for execution.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
TeamTNT has uploaded backdoored Docker images to Docker Hub.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
TeamTNT has scanned for vulnerabilities in IoT devices and other related resources such as the Docker API.
MITRE ATT&CK technique: T1595.002: Active Scanning- Vulnerability Scanning
TeamTNT has the `curl` command to send credentials over HTTP and the `curl` and `wget` commands to download new software. TeamTNT has also used a custom user agent HTTP header in shell scripts.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
TeamTNT has leveraged iplogger.org to send collected data back to C2.
MITRE ATT&CK technique: T1102: Web Service
TeamTNT has used batch scripts to download tools and executing cryptocurrency miners.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
TeamTNT has used malware that adds cryptocurrency miners as a service.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
The White Company has taken advantage of a known vulnerability in Microsoft Word to execute code.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
The White Company has the ability to delete its malware entirely from the target system.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
The White Company has used phishing lure documents that trick users into opening them and infecting their computers.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
The White Company has checked for specific antivirus products on the target’s computer, including Kaspersky, Quick Heal, AVG, BitDefender, Avira, Sophos, Avast!, and ESET.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
The White Company has obfuscated their payloads through packing.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
The White Company has sent phishing emails with malicious Microsoft Word attachments to victims.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
The White Company has checked the current date on the victim system.
MITRE ATT&CK technique: T1124: System Time Discovery
Threat Group-1314 actors used compromised domain credentials for the victim's endpoint management platform, Altiris, to move laterally.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
Threat Group-1314 actors mapped network drives using net use.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Threat Group-1314 actors used a victim's endpoint management platform, Altiris, for lateral movement.
MITRE ATT&CK technique: T1072: Software Deployment Tools
Threat Group-1314 actors spawned shells on remote systems on a victim network to execute commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Threat Group-3390 has used RAR to compress, encrypt, and password-protect files prior to exfiltration.
MITRE ATT&CK technique: T1560.002: Archive Collected Data- Archive via Library
Threat Group-3390 actors use at to schedule tasks to run self-extracting RAR archives, which install HTTPBrowser or PlugX on other victims on a network.
MITRE ATT&CK technique: T1053.002: Scheduled Task/Job- At
Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.
MITRE ATT&CK technique: T1119: Automated Collection
A Threat Group-3390 tool can use a public UAC bypass method to elevate privileges.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
Threat Group-3390 has obtained stolen valid certificates, including from VMProtect and the Chinese instant messaging application Youdu, for their operations.
MITRE ATT&CK technique: T1588.003: Obtain Capabilities- Code Signing Certificates
Threat Group-3390 has compromised the Able Desktop installer to gain access to victim's environments.
MITRE ATT&CK technique: T1195.002: Supply Chain Compromise- Compromise Software Supply Chain
Threat Group-3390 has performed DLL search order hijacking to execute their payload.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
Threat Group-3390 has used DLL side-loading, including by using legitimate Kaspersky antivirus variants as well as `rc.exe`, a legitimate Microsoft Resource Compiler.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Threat Group-3390 actors have split RAR files for exfiltration into parts.
MITRE ATT&CK technique: T1030: Data Transfer Size Limits
Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.
MITRE ATT&CK technique: T1005: Data from Local System
During execution, Threat Group-3390 malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Threat Group-3390 has used appcmd.exe to disable logging on a victim server.
MITRE ATT&CK technique: T1562.002: Impair Defenses- Disable Windows Event Logging
Threat Group-3390 has registered domains for C2.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
Threat Group-3390 has extensively used strategic web compromises to target victims.
MITRE ATT&CK technique: T1189: Drive-by Compromise
Threat Group-3390 has embedded malicious code into websites to screen a potential victim's IP address and then exploit their browser if they are of interest.
MITRE ATT&CK technique: T1608.004: Stage Capabilities- Drive-by Target
A Threat Group-3390 tool can encrypt payloads using XOR. Threat Group-3390 malware is also obfuscated using Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Threat Group-3390 has exfiltrated stolen data to Dropbox.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
Threat Group-3390 has exploited CVE-2018-0798 in Equation Editor.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Threat Group-3390 has used CVE-2014-6324 and CVE-2017-0213 to escalate privileges.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
Threat Group-3390 has exploited MS17-010 to move laterally to other systems on the network.
MITRE ATT&CK technique: T1210: Exploitation of Remote Services
Threat Group-3390 actors look for and use VPN profiles during an operation to access the network using external VPN services. Threat Group-3390 has also obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network.
MITRE ATT&CK technique: T1133: External Remote Services
Threat Group-3390 has deleted existing logs and exfiltrated file archives from a victim.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Threat Group-3390 has downloaded additional malware and tools, including through the use of `certutil`, onto a compromised host .
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Threat Group-3390 actors installed a credential logger on Microsoft Exchange servers. Threat Group-3390 also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.
MITRE ATT&CK technique: T1003.004: OS Credential Dumping- LSA Secrets
Threat Group-3390 actors have used a modified version of Mimikatz called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Threat Group-3390 has used net user to conduct internal discovery of systems.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Threat Group-3390 has locally staged encrypted archives for later exfiltration efforts.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Threat Group-3390 has lured victims into opening malicious files containing malware.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
A Threat Group-3390 tool has created new Registry keys under `HKEY_CURRENT_USER\Software\Classes\` and `HKLM\SYSTEM\CurrentControlSet\services`.
MITRE ATT&CK technique: T1112: Modify Registry
Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.
MITRE ATT&CK technique: T1046: Network Service Discovery
Threat Group-3390 has detached network shares after exfiltrating files, likely to evade detection.
MITRE ATT&CK technique: T1070.005: Indicator Removal- Network Share Connection Removal
Threat Group-3390 obtained a KeePass database from a compromised host.
MITRE ATT&CK technique: T1555.005: Credentials from Password Stores- Password Managers
Threat Group-3390 has used PowerShell for execution.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
A Threat Group-3390 tool can spawn `svchost.exe` and inject the payload into that process.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
A Threat Group-3390 tool can read and decrypt stored Registry values.
MITRE ATT&CK technique: T1012: Query Registry
Threat Group-3390's malware can add a Registry key to `Software\Microsoft\Windows\CurrentVersion\Run` for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Threat Group-3390 has moved staged encrypted archives to Internet-facing servers that had previously been compromised with China Chopper prior to exfiltration.
MITRE ATT&CK technique: T1074.002: Data Staged- Remote Data Staging
Threat Group-3390 has used the net view command.
MITRE ATT&CK technique: T1018: Remote System Discovery
Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
Threat Group-3390 has packed malware and tools, including using VMProtect.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Threat Group-3390 has used e-mail to deliver malicious attachments to victims.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Threat Group-3390 actors use NBTscan to discover vulnerable systems.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Threat Group-3390 has used `net use` and `netstat` to conduct internal discovery of systems. The group has also used `quser.exe` to identify existing RDP sessions on a victim.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Threat Group-3390 has used `whoami` to collect system user information.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Threat Group-3390 has obtained and used tools such as Impacket, pwdump, Mimikatz, gsecdump, NBTscan, and Windows Credential Editor.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Threat Group-3390 has compromised third party service providers to gain access to victim's environments.
MITRE ATT&CK technique: T1199: Trusted Relationship
Threat Group-3390 has hosted malicious payloads on Dropbox.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
Threat Group-3390 has staged tools, including gsecdump and WCE, on previously compromised websites.
MITRE ATT&CK technique: T1608.002: Stage Capabilities- Upload Tool
Threat Group-3390 actors obtain legitimate credentials using a variety of methods and use them to further lateral movement on victim networks.
MITRE ATT&CK technique: T1078: Valid Accounts
Threat Group-3390 malware has used HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Threat Group-3390 has used a variety of Web shells.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
Threat Group-3390 has used command-line interfaces for execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
A Threat Group-3390 tool can use WMI to execute a binary.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Threat Group-3390 has used WinRM to enable remote execution.
MITRE ATT&CK technique: T1021.006: Remote Services- Windows Remote Management
Threat Group-3390's malware can create a new service, sometimes naming it after the config information, to gain persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Thrip has used WinSCP to exfiltrate data from a targeted organization over FTP.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
Thrip leveraged PowerShell to run commands to download payloads, traverse the compromised networks, and carry out reconnaissance.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Thrip used a cloud-based remote access software called LogMeIn for their attacks.
MITRE ATT&CK technique: T1219: Remote Access Software
Thrip has obtained and used tools such as Mimikatz and PsExec.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
ToddyCat has leveraged xcopy, 7zip, and RAR to stage and compress collected documents prior to exfiltration.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
ToddyCat has run scripts to collect documents from targeted hosts.
MITRE ATT&CK technique: T1005: Data from Local System
Prior to executing a backdoor ToddyCat has run `cmd /c start /b netsh advfirewall firewall add rule name="SGAccessInboundRule" dir=in protocol=udp action=allow localport=49683` to allow the targeted system to receive UDP packets on port 49683.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
ToddyCat has run `net user %USER% /dom` for account discovery.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
ToddyCat has used compromised domain admin credentials to mount local network shares.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
ToddyCat has executed `net group "domain admins" /dom` for discovery on compromised machines.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
ToddyCat has used a DropBox uploader to exfiltrate stolen files.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
ToddyCat has exploited the ProxyLogon vulnerability to compromise Exchange Servers at multiple organizations.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
ToddyCat has run scripts to enumerate recently modified documents having either a .pdf, .doc, .docx, .xls or .xlsx extension.
MITRE ATT&CK technique: T1083: File and Directory Discovery
ToddyCat has hidden malicious scripts using `powershell.exe -windowstyle hidden`.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
ToddyCat has used the name `debug.exe` for malware components.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
ToddyCat has used `WinExec` to execute commands received from C2 on compromised hosts.
MITRE ATT&CK technique: T1106: Native API
ToddyCat has used a passive backdoor that receives commands with UDP packets.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
ToddyCat has used Powershell scripts to perform post exploit collection.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
ToddyCat has run `cmd /c start /b tasklist` to enumerate processes.
MITRE ATT&CK technique: T1057: Process Discovery
ToddyCat manually transferred collected files to an exfiltration host using xcopy.
MITRE ATT&CK technique: T1074.002: Data Staged- Remote Data Staging
ToddyCat has used `ping %REMOTE_HOST%` for post exploit discovery.
MITRE ATT&CK technique: T1018: Remote System Discovery
ToddyCat has used locally mounted network shares for lateral movement through targated environments.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
ToddyCat has used scheduled tasks to execute discovery commands and scripts for collection.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
ToddyCat can determine is Kaspersky software is running on an endpoint by running `cmd /c wmic process where name="avp.exe"`.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
ToddyCat has sent loaders configured to run Ninja as zip archives via Telegram.
MITRE ATT&CK technique: T1566.003: Phishing- Spearphishing via Service
ToddyCat has collected information on bootable drives including model, vendor, and serial numbers.
MITRE ATT&CK technique: T1082: System Information Discovery
ToddyCat has used `netstat -anop tcp` to discover TCP connections to compromised hosts.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
ToddyCat has used .bat scripts and `cmd` for execution on compromised hosts.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
ToddyCat has used WMI to execute scripts for post exploit document collection.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Tonto Team abuses a legitimate and signed Microsoft executable to launch a malicious DLL.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Tonto Team has exploited CVE-2019-0803 and MS16-032 to escalate privileges.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
Tonto Team has used EternalBlue exploits for lateral movement.
MITRE ATT&CK technique: T1210: Exploitation of Remote Services
Tonto Team has routed their traffic through an external server in order to obfuscate their location.
MITRE ATT&CK technique: T1090.002: Proxy- External Proxy
Tonto Team has downloaded malicious DLLs which served as a ShadowPad loader.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Tonto Team has used keylogging tools in their operations.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Tonto Team has used the ShowLocalGroupDetails command to identify administrator, user, and guest accounts on a compromised host.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
Tonto Team has relied on user interaction to open their malicious RTF documents.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Tonto Team has used tools such as NBTscan to enumerate network shares.
MITRE ATT&CK technique: T1135: Network Share Discovery
Tonto Team has used a variety of credential dumping tools.
MITRE ATT&CK technique: T1003: OS Credential Dumping
Tonto Team has used PowerShell to download additional payloads.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Tonto Team has used Python-based tools for execution.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
Tonto Team has delivered payloads via spearphishing attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Tonto Team has used a first stage web shell after compromising a vulnerable Exchange server.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
Transparent Tribe has registered domains to mimic file sharing, government, defense, and research websites for use in targeted campaigns.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
Transparent Tribe has compromised domains for use in targeted malicious campaigns.
MITRE ATT&CK technique: T1584.001: Compromise Infrastructure- Domains
Transparent Tribe has used websites with malicious hyperlinks and iframes to infect targeted victims with Crimson, njRAT, and other malicious tools.
MITRE ATT&CK technique: T1189: Drive-by Compromise
Transparent Tribe has set up websites with malicious hyperlinks and iframes to infect targeted victims with Crimson, njRAT, and other malicious tools.
MITRE ATT&CK technique: T1608.004: Stage Capabilities- Drive-by Target
Transparent Tribe has used dynamic DNS services to set up C2.
MITRE ATT&CK technique: T1568: Dynamic Resolution
Transparent Tribe has dropped encoded executables on compromised hosts.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Transparent Tribe has crafted malicious files to exploit CVE-2012-0158 and CVE-2010-3333 for execution.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Transparent Tribe can hide legitimate directories and replace them with malicious copies of the same name.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
Transparent Tribe has used weaponized documents in e-mail to compromise targeted systems.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Transparent Tribe has directed users to open URLs hosting malicious content.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Transparent Tribe can mimic legitimate Windows directories by using the same icons and names.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Transparent Tribe has sent spearphishing e-mails with attachments to deliver malicious payloads.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Transparent Tribe has embedded links to malicious downloads in e-mails.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Transparent Tribe has crafted VBS-based malicious documents.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Tropic Trooper has used SSL to connect to C2 servers.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Tropic Trooper has collected information automatically using the adversary's USBferry attack.
MITRE ATT&CK technique: T1119: Automated Collection
Tropic Trooper has used a copy function to automatically exfiltrate sensitive data from air-gapped systems using USB storage.
MITRE ATT&CK technique: T1020: Automated Exfiltration
Tropic Trooper has been known to side-load DLLs using a valid version of a Windows Address Book and Windows Defender executable with one of their tools.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Tropic Trooper's backdoor has communicated to the C2 over the DNS protocol.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload. Tropic Trooper also decrypted image files which contained a payload.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Tropic Trooper has injected a DLL backdoor into dllhost.exe and svchost.exe.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Tropic Trooper has encrypted traffic with the C2 to prevent network detection.
MITRE ATT&CK technique: T1573: Encrypted Channel
Tropic Trooper has encrypted configuration files.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Tropic Trooper has exfiltrated data using USB storage devices.
MITRE ATT&CK technique: T1052.001: Exfiltration Over Physical Medium- Exfiltration over USB
Tropic Trooper has executed commands through Microsoft security vulnerabilities, including CVE-2017-11882, CVE-2018-0802, and CVE-2012-0158.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Tropic Trooper has deleted dropper files on an infected system using command scripts.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Tropic Trooper has monitored files' modified time.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Tropic Trooper has created a hidden directory under C:\ProgramData\Apple\Updates\ and C:\Users\Public\Documents\Flash\.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
Tropic Trooper has used a delivered trojan to download additional files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Tropic Trooper has used known administrator account credentials to execute the backdoor directly.
MITRE ATT&CK technique: T1078.003: Valid Accounts- Local Accounts
Tropic Trooper has lured victims into executing malware via malicious e-mail attachments.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Tropic Trooper has hidden payloads in Flash directories and fake installer files.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Tropic Trooper has used multiple Windows APIs including HttpInitialize, HttpCreateHttpHandle, and HttpAddUrl.
MITRE ATT&CK technique: T1106: Native API
Tropic Trooper used pr and an openly available tool to scan for open ports on target systems.
MITRE ATT&CK technique: T1046: Network Service Discovery
Tropic Trooper used netview to scan target systems for shared resources.
MITRE ATT&CK technique: T1135: Network Share Discovery
Tropic Trooper is capable of enumerating the running processes on the system using pslist.
MITRE ATT&CK technique: T1057: Process Discovery
Tropic Trooper has created shortcuts in the Startup folder to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Tropic Trooper has attempted to transfer USBferry from an infected USB device by copying an Autorun function to the target machine.
MITRE ATT&CK technique: T1091: Replication Through Removable Media
Tropic Trooper can search for anti-virus software running on the system.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Tropic Trooper's backdoor could list the infected system's installed software.
MITRE ATT&CK technique: T1518: Software Discovery
Tropic Trooper sent spearphishing emails that contained malicious Microsoft Office and fake installer file attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Tropic Trooper has used base64 encoding to hide command strings delivered from the C2.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Tropic Trooper has used JPG files with encrypted payloads to mask their backdoor routines and evade detection.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
Tropic Trooper has detected a target system’s OS version and system volume information.
MITRE ATT&CK technique: T1082: System Information Discovery
Tropic Trooper has used scripts to collect the host's network topology.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Tropic Trooper has tested if the localhost network is available and other connection capability on an infected system using command scripts.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Tropic Trooper used letmein to scan for saved usernames on the target system.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Tropic Trooper delivered malicious documents with the XLSX extension, typically used by OpenXML documents, but the file itself was actually an OLE document.
MITRE ATT&CK technique: T1221: Template Injection
Tropic Trooper has used HTTP in communication with the C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Tropic Trooper has started a web service in the target host and wait for the adversary to connect, acting as a web shell.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
Tropic Trooper has used Windows command scripts.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Tropic Trooper has installed a service pointing to a malicious DLL dropped to disk.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Tropic Trooper has created the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell and sets the value to establish persistence.
MITRE ATT&CK technique: T1547.004: Boot or Logon Autostart Execution- Winlogon Helper DLL
Turla has encrypted files stolen from connected USB drives into a RAR file before exfiltration.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
A Turla JavaScript backdoor has used Google Apps Script as its C2 server.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
Turla may attempt to connect to systems within a victim's network using net use commands and a predefined list or collection of passwords.
MITRE ATT&CK technique: T1110: Brute Force
Turla has modified variables in kernel memory to turn off Driver Signature Enforcement after exploiting vulnerabilities that obtained kernel mode privileges.
MITRE ATT&CK technique: T1553.006: Subvert Trust Controls- Code Signing Policy Modification
Turla has used encryption 's Out-EncryptedScript.ps1), random variable names, and base64 encoding to obfuscate PowerShell commands and payloads.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
Turla RPC backdoors can impersonate or steal process tokens before executing commands.
MITRE ATT&CK technique: T1134.002: Access Token Manipulation- Create Process with Token
Turla has used a custom .NET tool to collect documents from an organization's internal central database.
MITRE ATT&CK technique: T1213: Data from Information Repositories
Turla RPC backdoors can upload files from victim machines.
MITRE ATT&CK technique: T1005: Data from Local System
Turla RPC backdoors can collect files from USB thumb drives.
MITRE ATT&CK technique: T1025: Data from Removable Media
Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or PowerShell Profile, to decode encrypted PowerShell payloads.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Turla has used a AMSI bypass, which patches the in-memory amsi.dll, in PowerShell scripts to bypass Windows antimalware products.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Turla has used net user /domain to enumerate domain accounts.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
Turla has used net group "Domain Admins" /domain to identify domain administrators.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
Turla has infected victims using watering holes.
MITRE ATT&CK technique: T1189: Drive-by Compromise
Turla has used Metasploit to perform reflective DLL injection in order to escalate privileges.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Turla has used WebDAV to upload stolen USB files to a cloud drive. Turla has also exfiltrated stolen files to OneDrive and 4shared.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
Turla has exploited vulnerabilities in the VBoxDrv.sys driver to obtain kernel mode privileges.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
Turla surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, the Program Files directory, and Recent. Turla RPC backdoors have also searched for files matching the lPH*.dll pattern.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Turla has placed LunarWeb install files into directories that are excluded from scanning.
MITRE ATT&CK technique: T1564.012: Hide Artifacts- File/Path Exclusions
Turla has used the Registry to store encrypted and encoded payloads.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
Turla surveys a system upon check-in to discover Group Policy details using the gpresult command.
MITRE ATT&CK technique: T1615: Group Policy Discovery
Based on comparison of Gazer versions, Turla made an effort to obfuscate strings in the malware that could be used as IoCs, including the mutex name and named pipe.
MITRE ATT&CK technique: T1027.005: Obfuscated Files or Information- Indicator Removal from Tools
Turla has used shellcode to download Meterpreter after compromising a victim.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Turla has compromised internal network systems to act as a proxy to forward traffic to C2.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy
Turla has used tracert to check internet connectivity.
MITRE ATT&CK technique: T1016.001: System Network Configuration Discovery- Internet Connection Discovery
Turla has used various JavaScript-based backdoors.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Turla RPC backdoors can be used to transfer files to/from victim machines on the local network.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
Turla has used net user to enumerate local accounts on the system.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Turla has abused local accounts that have the same password across the victim’s network.
MITRE ATT&CK technique: T1078.003: Valid Accounts- Local Accounts
Turla has used net localgroup and net localgroup Administrators to enumerate group information, including members of the local administrators group.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
Turla has used multiple backdoors which communicate with a C2 server via email attachments.
MITRE ATT&CK technique: T1071.003: Application Layer Protocol- Mail Protocols
Turla has used spearphishing via a link to get users to download and run their malware.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Turla has developed its own unique malware for use in operations.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
Turla has used malware obtained after compromising other threat actors, such as OilRig.
MITRE ATT&CK technique: T1588.001: Obtain Capabilities- Malware
Turla has named components of LunarWeb to mimic Zabbix agent logs.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Turla has modified Registry values to store payloads.
MITRE ATT&CK technique: T1112: Modify Registry
Turla and its RPC backdoors have used APIs calls for various tasks related to subverting AMSI and accessing then executing commands through RPC and/or named pipes.
MITRE ATT&CK technique: T1106: Native API
Turla has used net accounts and net accounts /domain to acquire password policy information.
MITRE ATT&CK technique: T1201: Password Policy Discovery
Turla has used fsutil fsinfo drives to list connected drives.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
Turla has used PowerShell to execute commands/scripts, in some cases via a custom executable or code from Empire's PSInject. Turla has also used PowerShell scripts to load and execute malware in memory.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Turla has used PowerShell profiles to maintain persistence on an infected machine.
MITRE ATT&CK technique: T1546.013: Event Triggered Execution- PowerShell Profile
Turla surveys a system upon check-in to discover running processes using the tasklist /v command. Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.
MITRE ATT&CK technique: T1057: Process Discovery
Turla has also used PowerSploit's Invoke-ReflectivePEInjection.ps1 to reflectively load a PowerShell payload into a random process on the victim system.
MITRE ATT&CK technique: T1055: Process Injection
Turla RPC backdoors have included local UPnP RPC proxies.
MITRE ATT&CK technique: T1090: Proxy
Turla has used IronPython scripts as part of the IronNetInjector toolchain to drop payloads.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
Turla surveys a system upon check-in to discover information in the Windows Registry with the reg query command. Turla has also retrieved PowerShell payloads hidden in Registry keys as well as checking keys associated with null session named pipes .
MITRE ATT&CK technique: T1012: Query Registry
A Turla Javascript backdoor added a local_update_check value under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence. Additionally, a Turla custom executable containing Metasploit shellcode is saved to the Startup folder to gain persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Turla surveys a system upon check-in to discover remote systems on a local network using the net view and net view /DOMAIN commands. Turla has also used net group "Domain Computers" /domain, net group "Domain Controllers" /domain, and net group "Exchange Servers" /domain to enumerate domain computers, including the organization's DC and Exchange Server.
MITRE ATT&CK technique: T1018: Remote System Discovery
Turla used net use commands to connect to lateral systems within a network.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Turla has obtained information on security software, including security logging information that may indicate whether their malware has been detected.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Turla has used compromised servers as infrastructure.
MITRE ATT&CK technique: T1584.004: Compromise Infrastructure- Server
Turla attempted to trick targets into clicking on a link featuring a seemingly legitimate domain from Adobe.com to download their malware and gain initial access.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Turla surveys a system upon check-in to discover operating system configuration details using the systeminfo and set commands.
MITRE ATT&CK technique: T1082: System Information Discovery
Turla surveys a system upon check-in to discover network configuration details using the arp -a, nbtstat -n, net config, ipconfig /all, and route commands, as well as NBTscan. Turla RPC backdoors have also retrieved registered RPC interface information from process memory.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Turla surveys a system upon check-in to discover active local network connections using the netstat -an, net use, net file, and net session commands. Turla RPC backdoors have also enumerated the IPv4 TCP connection table via the GetTcpTable2 API call.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Turla surveys a system upon check-in to discover running services and associated processes using the tasklist /svc command.
MITRE ATT&CK technique: T1007: System Service Discovery
Turla surveys a system upon check-in to discover the system time by using the net time command.
MITRE ATT&CK technique: T1124: System Time Discovery
Turla has obtained and customized publicly-available tools like Mimikatz.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Turla has used the VPS infrastructure of compromised Iranian threat actors.
MITRE ATT&CK technique: T1584.003: Compromise Infrastructure- Virtual Private Server
Turla has used VBS scripts throughout its operations.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Turla has used HTTP and HTTPS for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Turla has used legitimate web services including Pastebin, Dropbox, and GitHub for C2 communications.
MITRE ATT&CK technique: T1102: Web Service
Turla has created web accounts including Dropbox and GitHub for C2 and document exfiltration.
MITRE ATT&CK technique: T1583.006: Acquire Infrastructure- Web Services
Turla has frequently used compromised WordPress sites for C2 infrastructure.
MITRE ATT&CK technique: T1584.006: Compromise Infrastructure- Web Services
Turla RPC backdoors have used cmd.exe to execute commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Turla has gathered credentials from the Windows Credential Manager tool.
MITRE ATT&CK technique: T1555.004: Credentials from Password Stores- Windows Credential Manager
Turla has used WMI event filters and consumers to establish persistence.
MITRE ATT&CK technique: T1546.003: Event Triggered Execution- Windows Management Instrumentation Event Subscription
Turla established persistence by adding a Shell value under the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.
MITRE ATT&CK technique: T1547.004: Boot or Logon Autostart Execution- Winlogon Helper DLL
Volatile Cedar has targeted publicly facing web servers, with both automatic and manual vulnerability discovery.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
Volatile Cedar can deploy additional tools.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Volatile Cedar has performed vulnerability scans of the target server.
MITRE ATT&CK technique: T1595.002: Active Scanning- Vulnerability Scanning
Volatile Cedar can inject web shell code into a server.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
Volatile Cedar has used DirBuster and GoBuster to brute force web directories and DNS subdomains.
MITRE ATT&CK technique: T1595.003: Active Scanning- Wordlist Scanning
Volt Typhoon has collected window title information from compromised systems.
MITRE ATT&CK technique: T1010: Application Window Discovery
Volt Typhoon has archived the ntds.dit database as a multi-volume password-protected archive with 7-Zip.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
Volt Typhoon Volt Typhoon has used compromised Cisco and NETGEAR end-of-life SOHO routers implanted with KV Botnet malware to support operations.
MITRE ATT&CK technique: T1584.005: Compromise Infrastructure- Botnet
Volt Typhoon has targeted the browsing history of network administrators.
MITRE ATT&CK technique: T1217: Browser Information Discovery
Volt Typhoon has inspected server logs to remove their IPs.
MITRE ATT&CK technique: T1070.007: Indicator Removal- Clear Network Connection History and Configurations
Volt Typhoon has selectively cleared Windows Event Logs, system logs, and other technical artifacts to remove evidence of intrusion activity.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
Volt Typhoon has attempted to obtain credentials from OpenSSH, realvnc, and PuTTY.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
Volt Typhoon has targeted network administrator browser data including browsing history and stored credentials.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Volt Typhoon has staged collected data in password-protected archives.
MITRE ATT&CK technique: T1074: Data Staged
Volt Typhoon has stolen files from a sensitive file server and the Active Directory database from targeted environments, and used Wevtutil to extract event log information.
MITRE ATT&CK technique: T1005: Data from Local System
Volt Typhoon has executed the Windows-native `vssadmin` command to create volume shadow copies.
MITRE ATT&CK technique: T1006: Direct Volume Access
Volt Typhoon has run `net group /dom` and `net group "Domain Admins" /dom` in compromised environments for account discovery.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
Volt Typhoon has used compromised domain accounts to authenticate to devices on compromised networks.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
Volt Typhoon has run `net group` in compromised environments to discover domain groups.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
Volt Typhoon has targeted the personal emails of key network and IT staff at victim organizations.
MITRE ATT&CK technique: T1589.002: Gather Victim Identity Information- Email Addresses
Volt Typhoon has gained initial access through exploitation of multiple vulnerabilities in internet-facing software and appliances such as Fortinet, Ivanti , NETGEAR, Citrix, and Cisco.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
Volt Typhoon has gained initial access by exploiting privilege escalation vulnerabilities in the operating system or network services.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
Volt Typhoon has exploited zero-day vulnerabilities for initial access.
MITRE ATT&CK technique: T1587.004: Develop Capabilities- Exploits
Volt Typhoon has used VPNs to connect to victim environments and enable post-exploitation actions.
MITRE ATT&CK technique: T1133: External Remote Services
Volt Typhoon has run `rd /S` to delete their working directories and deleted systeminfo.dat from `C:\Users\Public\Documentsfiles`.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Volt Typhoon has enumerated directories containing vulnerability testing and cyber related content and facilities data such as construction drawings.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Volt Typhoon has conducted pre-compromise reconnaissance for victim host information.
MITRE ATT&CK technique: T1592: Gather Victim Host Information
Volt Typhoon has gathered victim identify information during pre-compromise reconnaissance.
MITRE ATT&CK technique: T1589: Gather Victim Identity Information