sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Cobalt Strike can use spoof arguments in spawned processes that execute beacon commands.
MITRE ATT&CK technique: T1564.010: Hide Artifacts- Process Argument Spoofing
Cobalt Strike's Beacon payload can collect information on process details.
MITRE ATT&CK technique: T1057: Process Discovery
Cobalt Strike can use process hollowing for execution.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
Cobalt Strike can inject a variety of payloads into processes dynamically chosen by the adversary.
MITRE ATT&CK technique: T1055: Process Injection
Cobalt Strike uses a custom command and control protocol that is encapsulated in HTTP, HTTPS, or DNS. In addition, it conducts peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.
MITRE ATT&CK technique: T1572: Protocol Tunneling
Cobalt Strike can leverage the HTTP protocol for C2 communication, while hiding the actual data in either an HTTP header, URI parameter, the transaction body, or appending it to the URI.
MITRE ATT&CK technique: T1001.003: Data Obfuscation- Protocol or Service Impersonation
Cobalt Strike can use Python to perform execution.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
Cobalt Strike can query HKEY_CURRENT_USER\Software\Microsoft\Office\\Excel\Security\AccessVBOM\ to determine if the security setting for restricting default programmatic access is enabled.
MITRE ATT&CK technique: T1012: Query Registry
Cobalt Strike's execute-assembly command can run a .NET executable within the memory of a sacrificial process by loading the CLR.
MITRE ATT&CK technique: T1620: Reflective Code Loading
Cobalt Strike can start a VNC-based remote desktop server and tunnel the connection through the already established C2 channel.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
Cobalt Strike uses the native Windows Network Enumeration APIs to interrogate and discover targets in a Windows Active Directory network.
MITRE ATT&CK technique: T1018: Remote System Discovery
Cobalt Strike can use `rundll32.exe` to load DLL from the command line.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Cobalt Strike can use Window admin shares for lateral movement.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Cobalt Strike can SSH to a remote service.
MITRE ATT&CK technique: T1021.004: Remote Services- SSH
Cobalt Strike can set its Beacon payload to reach out to the C2 server on an arbitrary and random interval.
MITRE ATT&CK technique: T1029: Scheduled Transfer
Cobalt Strike's Beacon payload is capable of capturing screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
Cobalt Strike can recover hashed passwords.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
Cobalt Strike can use PsExec to execute a payload on a remote host. It can also use Service Control Manager to start new services.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
The Cobalt Strike System Profiler can discover applications through the browser and identify the version of Java the target has.
MITRE ATT&CK technique: T1518: Software Discovery
Cobalt Strike can use Base64, URL-safe Base64, or NetBIOS encoding in its C2 traffic.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Cobalt Strike can use sudo to run a command.
MITRE ATT&CK technique: T1548.003: Abuse Elevation Control Mechanism- Sudo and Sudo Caching
Cobalt Strike has the ability to use AES-256 symmetric encryption in CBC mode with HMAC-SHA-256 to encrypt task commands and XOR to encrypt shell code and configuration data.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Cobalt Strike can determine the NetBios name and the IP addresses of targets machines including domain controllers.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Cobalt Strike can produce a sessions report from compromised hosts.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Cobalt Strike can enumerate services on compromised hosts.
MITRE ATT&CK technique: T1007: System Service Discovery
Cobalt Strike can timestomp any files or payloads placed on a target machine to help them blend in.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
Cobalt Strike can steal access tokens from exiting processes.
MITRE ATT&CK technique: T1134.001: Access Token Manipulation- Token Impersonation/Theft
Cobalt Strike can use VBA to perform execution.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Cobalt Strike can use a custom command and control protocol that can be encapsulated in HTTP or HTTPS. All protocols use their standard assigned ports.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Cobalt Strike uses a command-line interface to interact with systems.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Cobalt Strike can use WMI to deliver a payload to a remote host.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Cobalt Strike can use WinRM to execute a payload on a remote host.
MITRE ATT&CK technique: T1021.006: Remote Services- Windows Remote Management
Cobalt Strike can install a new service.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Cobian RAT has a feature to perform voice recording on the victim’s machine.
MITRE ATT&CK technique: T1123: Audio Capture
Cobian RAT uses DNS for C2.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Cobian RAT has a feature to perform keylogging on the victim’s machine.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Cobian RAT creates an autostart Registry key to ensure persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Cobian RAT has a feature to perform screen capture.
MITRE ATT&CK technique: T1113: Screen Capture
Cobian RAT obfuscates communications with the C2 server using Base64 encoding.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Cobian RAT has a feature to access the webcam on the victim’s machine.
MITRE ATT&CK technique: T1125: Video Capture
Cobian RAT can launch a remote command shell interface for executing commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
CoinTicker decodes the initially-downloaded hidden encoded file using OpenSSL.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
CoinTicker downloads the EggShell mach-o binary using curl, which does not set the quarantine flag.
MITRE ATT&CK technique: T1553.001: Subvert Trust Controls- Gatekeeper Bypass
CoinTicker downloads the following hidden files to evade detection and maintain persistence: /private/tmp/.info.enc, /private/tmp/.info.py, /private/tmp/.server.sh, ~/Library/LaunchAgents/.espl.plist, ~/Library/Containers/.random string/random string.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
CoinTicker executes a Python script to download its second stage.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
CoinTicker creates user launch agents named .espl.plist and com.apple.random string.plist to establish persistence.
MITRE ATT&CK technique: T1543.001: Create or Modify System Process- Launch Agent
CoinTicker initially downloads a hidden encoded file.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
CoinTicker executes a Python script to download its second stage.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
CoinTicker executes a bash script to establish a reverse shell.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
CoinTicker executes a bash script to establish a reverse shell.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
ComRAT can use SSL/TLS encryption for its HTTP-based C2 channel. ComRAT has used public key cryptography with RSA and AES encrypted email attachments for its Gmail C2 channel.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
ComRAT has the ability to use the Gmail web UI to receive commands and exfiltrate information.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
ComRAT has used encryption and base64 to obfuscate its orchestrator code in the Registry. ComRAT has also used encoded PowerShell scripts.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
ComRAT samples have been seen which hijack COM objects for persistence by replacing the path to shell32.dll in registry location HKCU\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32.
MITRE ATT&CK technique: T1546.015: Event Triggered Execution- Component Object Model Hijacking
ComRAT has used unique per machine passwords to decrypt the orchestrator payload and a hardcoded XOR key to decrypt its communications module. ComRAT has also used a unique password to decrypt the file used for its hidden file system.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
ComRAT has injected its orchestrator DLL into explorer.exe. ComRAT has also injected its communications module into the victim's default browser to make C2 connections appear less suspicious as all network connections will be initiated by the browser process.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
ComRAT has embedded a XOR encrypted communications module inside the orchestrator module.
MITRE ATT&CK technique: T1027.009: Obfuscated Files or Information- Embedded Payloads
ComRAT has stored encrypted orchestrator code and payloads in the Registry.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
ComRAT has used a portable FAT16 partition image placed in %TEMP% as a hidden file system.
MITRE ATT&CK technique: T1564.005: Hide Artifacts- Hidden File System
ComRAT can use email attachments for command and control.
MITRE ATT&CK technique: T1071.003: Application Layer Protocol- Mail Protocols
ComRAT has used a task name associated with Windows SQM Consolidator.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
ComRAT has modified Registry values to store encrypted orchestrator code and payloads.
MITRE ATT&CK technique: T1112: Modify Registry
ComRAT can load a PE file from memory or the file system and execute it with CreateProcessW.
MITRE ATT&CK technique: T1106: Native API
ComRAT has encrypted its virtual file system using AES-256 in XTS mode.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
ComRAT has used PowerShell to load itself every time a user logs in to the system. ComRAT can execute PowerShell scripts loaded into memory or from the file system.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
ComRAT can check the default browser by querying HKCR\http\shell\open\command.
MITRE ATT&CK technique: T1012: Query Registry
ComRAT has used a scheduled task to launch its PowerShell loader.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
ComRAT has been programmed to sleep outside local business hours .
MITRE ATT&CK technique: T1029: Scheduled Transfer
ComRAT can check the victim's default browser to determine which process to inject its communications module into.
MITRE ATT&CK technique: T1518: Software Discovery
ComRAT has checked the victim system's date and time to perform tasks during business hours .
MITRE ATT&CK technique: T1124: System Time Discovery
ComRAT has used HTTP requests for command and control.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
ComRAT has used cmd.exe to execute commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Comnie executes a batch script to store discovery information in %TEMP%\info.dat and then uploads the temporarily file to the remote C2 server.
MITRE ATT&CK technique: T1119: Automated Collection
Comnie uses blogs and third-party sites to avoid DNS-based blocking of their communication to the command and control server.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
Comnie appends a total of 64MB of garbage data to a file to deter any security products in place that may be scanning files on disk.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
Comnie uses the net user command.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Comnie uses RC4 and Base64 to obfuscate strings.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Comnie uses the tasklist to view running processes on the victim’s machine.
MITRE ATT&CK technique: T1057: Process Discovery
Comnie achieves persistence by adding a shortcut of itself to the startup path in the Registry.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Comnie runs the net view command
MITRE ATT&CK technique: T1018: Remote System Discovery
Comnie uses Rundll32 to load a malicious DLL.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Comnie attempts to detect several anti-virus products.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Comnie establishes persistence via a .lnk file in the victim’s startup path.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
Comnie encrypts command and control communications with RC4.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Comnie collects the hostname of the victim machine.
MITRE ATT&CK technique: T1082: System Information Discovery
Comnie uses ipconfig /all and route PRINT to identify network adapter and interface information.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Comnie executes the netstat -ano command.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Comnie runs the command: net start >> %TEMP%\info.dat on a victim.
MITRE ATT&CK technique: T1007: System Service Discovery
Comnie executes VBS scripts.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Comnie uses HTTP for C2 communication.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Comnie executes BAT scripts.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Conficker terminates various services related to system security and Windows.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Conficker has used a DGA that seeds with the current UTC victim system date to generate domains.
MITRE ATT&CK technique: T1568.002: Dynamic Resolution- Domain Generation Algorithms
Conficker exploited the MS08-067 Windows vulnerability for remote code execution through a crafted RPC request.
MITRE ATT&CK technique: T1210: Exploitation of Remote Services
Conficker downloads an HTTP server to the infected machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Conficker resets system restore points and deletes backup files.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
Conficker adds keys to the Registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services and various other Registry locations.
MITRE ATT&CK technique: T1112: Modify Registry
Conficker scans for other machines to infect.
MITRE ATT&CK technique: T1046: Network Service Discovery
Conficker has obfuscated its code to prevent its removal from host machines.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Conficker adds Registry Run keys to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Conficker variants used the Windows AUTORUN feature to spread through USB propagation.
MITRE ATT&CK technique: T1091: Replication Through Removable Media
Conficker variants spread through NetBIOS share propagation.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Conficker uses the current UTC victim system date for domain generation and connects to time servers to determine the current date.
MITRE ATT&CK technique: T1124: System Time Discovery
Conficker copies itself into the %systemroot%\system32 directory and registers as a service.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
ConnectWise can be used to execute PowerShell commands on target machines.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
ConnectWise can take screenshots on remote hosts.
MITRE ATT&CK technique: T1113: Screen Capture
ConnectWise can record video on remote hosts.
MITRE ATT&CK technique: T1125: Video Capture
Conti can use CreateIoCompletionPort, PostQueuedCompletionStatus, and GetQueuedCompletionPort to rapidly encrypt files, excluding those with the extensions of .exe, .dll, and .lnk. It has used a different AES-256 encryption key per file with a bundled RAS-4096 public encryption key that is unique for each victim. Conti can use “Windows Restart Manager” to ensure files are unlocked and open for encryption.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Conti has decrypted its payload using a hardcoded AES-256 key.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Conti has loaded an encrypted DLL into memory and then executes it.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Conti can discover files on a local system.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Conti can delete Windows Volume Shadow Copies using vssadmin.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
Conti has used API calls during execution.
MITRE ATT&CK technique: T1106: Native API
Conti can enumerate remote open SMB network shares using NetShareEnum.
MITRE ATT&CK technique: T1135: Network Share Discovery
Conti can use compiler-based obfuscation for its code, encrypt DLLs, and hide Windows API calls.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Conti can enumerate through all open processes to search for any that have the string “sql” in their process name.
MITRE ATT&CK technique: T1057: Process Discovery
Conti has the ability to discover hosts on a target network.
MITRE ATT&CK technique: T1018: Remote System Discovery
Conti can spread via SMB and encrypts files on different hosts, potentially compromising an entire network.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Conti can stop up to 146 Windows services related to security, backup, database, and email solutions through the use of net stop.
MITRE ATT&CK technique: T1489: Service Stop
Conti can retrieve the ARP cache from the local system by using the GetIpNetTable API call and check to ensure IP addresses it connects to are for local, non-Internet, systems.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Conti can enumerate routine network connections from a compromised host.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Conti can spread itself by infecting other remote machines via network shared drives.
MITRE ATT&CK technique: T1080: Taint Shared Content
Conti can utilize command line options to allow an attacker control over how it scans and encrypts files.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
CookieMiner has used base64 encoding to obfuscate scripts on the system.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
CookieMiner has loaded coinmining software onto systems to mine for Koto cryptocurrency.
MITRE ATT&CK technique: T1496.001: Resource Hijacking- Compute Hijacking
CookieMiner can steal saved usernames and passwords in Chrome as well as credit card credentials.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
CookieMiner has retrieved iPhone text messages from iTunes phone backup files.
MITRE ATT&CK technique: T1005: Data from Local System
CookieMiner has used Google Chrome's decryption and extraction operations.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
CookieMiner has checked for the presence of "Little Snitch", macOS network monitoring and application firewall software, stopping and exiting if it is found.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
CookieMiner has used the curl --upload-file command to exfiltrate data over HTTP.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
CookieMiner has looked for files in the user's home directory with "wallet" in their name using find.
MITRE ATT&CK technique: T1083: File and Directory Discovery
CookieMiner can download additional scripts from a web server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
CookieMiner has installed multiple new Launch Agents in order to maintain persistence for cryptocurrency mining software.
MITRE ATT&CK technique: T1543.001: Create or Modify System Process- Launch Agent
CookieMiner has used python scripts on the user’s system, as well as the Python variant of the Empire agent, EmPyre.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
CookieMiner has checked for the presence of "Little Snitch", macOS network monitoring and application firewall software, stopping and exiting if it is found.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
CookieMiner can steal Google Chrome and Apple Safari browser cookies from the victim’s machine.
MITRE ATT&CK technique: T1539: Steal Web Session Cookie
CookieMiner has used a Unix shell script to run a series of commands targeting macOS.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
CosmicDuke exfiltrates collected files automatically over FTP to remote servers.
MITRE ATT&CK technique: T1020: Automated Exfiltration
CosmicDuke copies and exfiltrates the clipboard contents every 30 seconds.
MITRE ATT&CK technique: T1115: Clipboard Data
CosmicDuke collects user credentials, including passwords, for various programs including popular instant messaging applications and email clients as well as WLAN keys.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
CosmicDuke collects user credentials, including passwords, for various programs including Web browsers.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
CosmicDuke steals user files from local hard drives with file extensions that match a predefined list.
MITRE ATT&CK technique: T1005: Data from Local System
CosmicDuke steals user files from network shared drives with file extensions and keywords that match a predefined list.
MITRE ATT&CK technique: T1039: Data from Network Shared Drive
CosmicDuke steals user files from removable media with file extensions and keywords that match a predefined list.
MITRE ATT&CK technique: T1025: Data from Removable Media
CosmicDuke exfiltrates collected files over FTP or WebDAV. Exfiltration servers can be separately configured from C2 servers.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
CosmicDuke attempts to exploit privilege escalation vulnerabilities CVE-2010-0232 or CVE-2010-4398.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
CosmicDuke searches attached and mounted drives for file extensions and keywords that match a predefined list.
MITRE ATT&CK technique: T1083: File and Directory Discovery
CosmicDuke uses a keylogger.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
CosmicDuke collects LSA secrets.
MITRE ATT&CK technique: T1003.004: OS Credential Dumping- LSA Secrets
CosmicDuke searches for Microsoft Outlook data files with extensions .pst and .ost for collection and exfiltration.
MITRE ATT&CK technique: T1114.001: Email Collection- Local Email Collection
CosmicDuke uses scheduled tasks typically named "Watchmon Service" for persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
CosmicDuke takes periodic screenshots and exfiltrates them.
MITRE ATT&CK technique: T1113: Screen Capture
CosmicDuke collects Windows account hashes.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
CosmicDuke contains a custom version of the RC4 algorithm that includes a programming error.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
CosmicDuke can use HTTP or HTTPS for command and control to hard-coded C2 servers.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
CosmicDuke uses Windows services typically named "javamtsup" for persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
CostaBricks has added the entire unobfuscated code of the legitimate open source application Blink to its code.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
CostaBricks has the ability to use bytecode to decrypt embedded payloads.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
CostaBricks has been used to load SombRAT onto a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
CostaBricks has used a number of API calls, including `VirtualAlloc`, `VirtualFree`, `LoadLibraryA`, `GetProcAddress`, and `ExitProcess`.
MITRE ATT&CK technique: T1106: Native API
CostaBricks can inject a payload into the memory of a compromised host.
MITRE ATT&CK technique: T1055: Process Injection
CostaBricks can implement a custom-built virtual machine mechanism to obfuscate its code.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Covenant can utilize SSL to encrypt command and control traffic.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Covenant can create launchers via an InstallUtil XML file to install new Grunt listeners.
MITRE ATT&CK technique: T1218.004: System Binary Proxy Execution- InstallUtil
Covenant can create HTA files to install Grunt listeners.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
Covenant listeners and controllers can be configured to use non-standard ports.
MITRE ATT&CK technique: T1571: Non-Standard Port
Covenant can create PowerShell-based launchers for Grunt installation.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Covenant can create SCT files for installation via `Regsvr32` to deploy new Grunt listeners.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
Covenant implants can gather basic information on infected systems.
MITRE ATT&CK technique: T1082: System Information Discovery
Covenant can establish command and control via HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Covenant provides access to a Command Shell in Windows environments for follow-on command execution and tasking.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Covenant can utilize WMI to install new Grunt listeners through XSL files or command one-liners.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
CozyCar uses Twitter as a backup C2 channel to Twitter accounts specified in its configuration file.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
The payload of CozyCar is encrypted with simple XOR with a rotating key. The CozyCar configuration file has been encrypted with RC4 keys.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
CozyCar has executed Mimikatz to harvest stored credentials from the victim and further victim penetration.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
One persistence mechanism used by CozyCar is to set itself to be executed at system startup by adding a Registry value under one of the following Registry keys:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
The CozyCar dropper has masqueraded a copy of the infected system's rundll32.exe executable that was moved to the malware's install directory and renamed according to a predefined configuration file.
MITRE ATT&CK technique: T1036.003: Masquerading- Rename System Utilities
The CozyCar dropper copies the system file rundll32.exe to the install location for the malware, then uses the copy of rundll32.exe to load and execute the main CozyCar component.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
One persistence mechanism used by CozyCar is to register itself as a scheduled task.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Password stealer and NTLM stealer modules in CozyCar harvest stored credentials from the victim, including credentials used as part of Windows NTLM user authentication.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
The main CozyCar dropper checks whether the victim has an anti-virus product installed. If the installed product is on a predetermined list, the dropper will exit.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
A system info module in CozyCar gathers information on the victim host’s configuration.
MITRE ATT&CK technique: T1082: System Information Discovery
Some versions of CozyCar will check to ensure it is not being executed inside a virtual machine or a known malware analysis sandbox environment. If it detects that it is, it will exit.
MITRE ATT&CK technique: T1497: Virtualization/Sandbox Evasion
CozyCar's main method of communicating with its C2 servers is using HTTP or HTTPS.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
A module in CozyCar allows arbitrary commands to be executed by invoking C:\Windows\System32\cmd.exe.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
One persistence mechanism used by CozyCar is to register itself as a Windows service.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
CrackMapExec can set a scheduled task on the target system to execute commands remotely using at.
MITRE ATT&CK technique: T1053.002: Scheduled Task/Job- At
CrackMapExec can brute force supplied user credentials across a network range.
MITRE ATT&CK technique: T1110: Brute Force
CrackMapExec can enumerate the domain user accounts on a targeted system.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
CrackMapExec can gather the user accounts within domain groups.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
CrackMapExec can discover specified filetypes and log files on a targeted system.
MITRE ATT&CK technique: T1083: File and Directory Discovery
CrackMapExec can dump hashed passwords from LSA secrets for the targeted system.
MITRE ATT&CK technique: T1003.004: OS Credential Dumping- LSA Secrets
CrackMapExec can create a registry key using wdigest.
MITRE ATT&CK technique: T1112: Modify Registry
CrackMapExec can dump hashed passwords associated with Active Directory using Windows' Directory Replication Services API , or Volume Shadow Copy.
MITRE ATT&CK technique: T1003.003: OS Credential Dumping- NTDS
CrackMapExec can enumerate the shared folders and associated permissions for a targeted network.
MITRE ATT&CK technique: T1135: Network Share Discovery
CrackMapExec can pass the hash to authenticate via SMB.
MITRE ATT&CK technique: T1550.002: Use Alternate Authentication Material- Pass the Hash
CrackMapExec can brute force passwords for a specified user on a single target system or across an entire network.
MITRE ATT&CK technique: T1110.001: Brute Force- Password Guessing
CrackMapExec can discover the password policies applied to the target system.
MITRE ATT&CK technique: T1201: Password Policy Discovery
CrackMapExec can brute force credential authentication by using a supplied list of usernames and a single password.
MITRE ATT&CK technique: T1110.003: Brute Force- Password Spraying
CrackMapExec can execute PowerShell commands via WMI.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
CrackMapExec can discover active IP addresses, along with the machine name, within a targeted network.
MITRE ATT&CK technique: T1018: Remote System Discovery
CrackMapExec can dump usernames and hashed passwords from the SAM.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
CrackMapExec can enumerate the system drives and associated system name.
MITRE ATT&CK technique: T1082: System Information Discovery
CrackMapExec can collect DNS information from the targeted system.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
CrackMapExec can discover active sessions for a targeted system.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
CrackMapExec can execute remote commands using Windows Management Instrumentation.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
CreepyDrive can use legitimate OAuth refresh tokens to authenticate with OneDrive.
MITRE ATT&CK technique: T1550.001: Use Alternate Authentication Material- Application Access Token
CreepyDrive can use OneDrive for C2.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
CreepyDrive can upload files to C2 from victim machines.
MITRE ATT&CK technique: T1005: Data from Local System
CreepyDrive can use cloud services including OneDrive for data exfiltration.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
CreepyDrive can specify the local file path to upload files from.
MITRE ATT&CK technique: T1083: File and Directory Discovery
CreepyDrive can download files to the compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
CreepyDrive can use Powershell for execution, including the cmdlets `Invoke-WebRequest` and `Invoke-Expression`.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
CreepyDrive can use HTTPS for C2 using the Microsoft Graph API.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
CreepySnail can use stolen credentials to authenticate on target networks.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
CreepySnail can connect to C2 for data exfiltration.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
CreepySnail can use PowerShell for execution, including the cmdlets `Invoke-WebRequst` and `Invoke-Expression`.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
CreepySnail can use Base64 to encode its C2 traffic.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
CreepySnail can use `getmac` and `Get-NetIPAddress` to enumerate network settings.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
CreepySnail can execute `getUsername` on compromised systems.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
CreepySnail can use HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Crimson can perform audio surveillance using microphones.
MITRE ATT&CK technique: T1123: Audio Capture
Crimson contains a module to steal credentials from Web browsers on the victim machine.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Crimson can collect information from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
Crimson contains a module to collect data from removable drives.
MITRE ATT&CK technique: T1025: Data from Removable Media
Crimson can decode its encoded PE file prior to execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Crimson can exfiltrate stolen information over its C2.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Crimson has the ability to delete files from a compromised host.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Crimson contains commands to list files and directories, as well as search for files matching certain extensions from a defined list.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Crimson contains a command to retrieve files from its C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Crimson can use a module to perform keylogging on compromised hosts.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Crimson contains a command to collect and exfiltrate emails from Outlook.
MITRE ATT&CK technique: T1114.001: Email Collection- Local Email Collection
Crimson can set a Registry key to determine how long it has been installed and possibly to indicate the version number.
MITRE ATT&CK technique: T1112: Modify Registry
Crimson uses a custom TCP protocol for C2.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Crimson has the ability to discover pluggable/removable drives to extract files from.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
Crimson contains a command to list processes.
MITRE ATT&CK technique: T1057: Process Discovery
Crimson can check the Registry for the presence of HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\last_edate to determine how long it has been installed on a host.
MITRE ATT&CK technique: T1012: Query Registry
Crimson can add Registry run keys for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Crimson can spread across systems by infecting removable media.
MITRE ATT&CK technique: T1091: Replication Through Removable Media
Crimson contains a command to perform screen captures.
MITRE ATT&CK technique: T1113: Screen Capture
Crimson contains a command to collect information about anti-virus software on the victim.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Crimson contains a command to collect the victim PC name, disk drive information, and operating system.
MITRE ATT&CK technique: T1082: System Information Discovery
Crimson can identify the geographical location of a victim host.
MITRE ATT&CK technique: T1614: System Location Discovery
Crimson contains a command to collect the victim MAC address and LAN IP.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Crimson can identify the user on a targeted system.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Crimson has the ability to determine the date and time on a compromised host.
MITRE ATT&CK technique: T1124: System Time Discovery
Crimson can determine when it has been installed on a host for at least 15 days before downloading the final payload.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
Crimson can capture webcam video on targeted systems.
MITRE ATT&CK technique: T1125: Video Capture
Crimson can use a HTTP GET request to download its final payload.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Crimson has the ability to execute commands with the COMSPEC environment variable.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
CrossRAT can list all files on a system.
MITRE ATT&CK technique: T1083: File and Directory Discovery
CrossRAT creates a Launch Agent on macOS.
MITRE ATT&CK technique: T1543.001: Create or Modify System Process- Launch Agent
CrossRAT uses run keys for persistence on Windows.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
CrossRAT is capable of taking screen captures.
MITRE ATT&CK technique: T1113: Screen Capture
CrossRAT can use an XDG Autostart to establish persistence.
MITRE ATT&CK technique: T1547.013: Boot or Logon Autostart Execution- XDG Autostart Entries
Crutch has used the WinRAR utility to compress and encrypt stolen files.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
Crutch can automatically monitor removable drives in a loop and copy interesting files.
MITRE ATT&CK technique: T1119: Automated Collection
Crutch has automatically exfiltrated stolen files to Dropbox.
MITRE ATT&CK technique: T1020: Automated Exfiltration
Crutch can use Dropbox to receive commands and upload stolen data.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
Crutch can persist via DLL search order hijacking on Google Chrome, Mozilla Firefox, or Microsoft OneDrive.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
Crutch can exfiltrate files from compromised systems.
MITRE ATT&CK technique: T1005: Data from Local System
Crutch can monitor removable drives and exfiltrate files matching a given extension list.
MITRE ATT&CK technique: T1025: Data from Removable Media
Crutch can exfiltrate data over the primary C2 channel .
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Crutch has exfiltrated stolen data to Dropbox.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
Crutch has used a hardcoded GitHub repository as a fallback channel.
MITRE ATT&CK technique: T1008: Fallback Channels
Crutch has staged stolen files in the C:\AMD\Temp directory.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Crutch has established persistence with a scheduled task impersonating the Outlook item finder.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Crutch can monitor for removable drives being plugged into the compromised machine.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
Crutch has the ability to persist using scheduled tasks.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Crutch has conducted C2 communications with a Dropbox account using the HTTP API.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Cryptoistic can retrieve files from the local file system.
MITRE ATT&CK technique: T1005: Data from Local System
Cryptoistic can engage in encrypted communications with C2.
MITRE ATT&CK technique: T1573: Encrypted Channel
Cryptoistic has the ability delete files from a compromised host.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Cryptoistic can scan a directory to identify files for deletion.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Cryptoistic has the ability to send and receive files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Cryptoistic can use TCP in communications with C2.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Cryptoistic can gather data on the user of a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Cuba has used SeDebugPrivilege and AdjustTokenPrivileges to elevate privileges.
MITRE ATT&CK technique: T1134: Access Token Manipulation
Cuba has the ability to encrypt system data and add the ".cuba" extension to encrypted files.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Cuba can use the command cmd.exe /c del to delete its artifacts from the system.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Cuba can enumerate files by using a variety of functions.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Cuba has executed hidden PowerShell windows.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
Cuba can download files from its C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Cuba logs keystrokes via polling by using GetKeyState and VkKeyScan functions.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Cuba has been disguised as legitimate 360 Total Security Antivirus and OpenVPN programs.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Cuba has used several built-in API functions for discovery like GetIpNetTable and NetShareEnum.
MITRE ATT&CK technique: T1106: Native API
Cuba can discover shared resources using the NetShareEnum API call.
MITRE ATT&CK technique: T1135: Network Share Discovery
Cuba has used multiple layers of obfuscation to avoid analysis, including its Base64 encoded payload.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Cuba has been dropped onto systems and used for lateral movement via obfuscated PowerShell scripts.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Cuba can enumerate processes running on a victim's machine.
MITRE ATT&CK technique: T1057: Process Discovery
Cuba loaded the payload into memory using PowerShell.
MITRE ATT&CK technique: T1620: Reflective Code Loading
Cuba has a hardcoded list of services and processes to terminate.
MITRE ATT&CK technique: T1489: Service Stop
Cuba has a packed payload when delivered.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Cuba can enumerate local drives, disk type, and disk free space.
MITRE ATT&CK technique: T1082: System Information Discovery
Cuba can check if Russian language is installed on the infected machine by using the function GetKeyboardLayoutList.
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
Cuba can retrieve the ARP cache from the local system by using GetIpNetTable.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Cuba can use the function GetIpNetTable to recover the last connections to the victim's machine.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Cuba can query service status using QueryServiceStatusEx function.
MITRE ATT&CK technique: T1007: System Service Discovery
Cuba has used cmd.exe /c and batch files for execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Cuba can modify services by using the OpenService and ChangeServiceConfig functions.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Cuckoo Stealer can use osascript to generate a password-stealing prompt, duplicate files and folders, and set environmental variables.
MITRE ATT&CK technique: T1059.002: Command and Scripting Interpreter- AppleScript
Cuckoo Stealer can collect bookmarks, cookies, and history from Safari.
MITRE ATT&CK technique: T1217: Browser Information Discovery
Cuckoo Stealer strings are deobfuscated prior to execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Cuckoo Stealer strings are XOR-encrypted.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Cuckoo Stealer can send information about the targeted system to C2 including captured passwords, OS build, hostname, and username.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Cuckoo Stealer can search for files associated with specific applications.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Cuckoo Stealer has captured passwords by prompting victims with a “macOS needs to access System Settings” GUI window.
MITRE ATT&CK technique: T1056.002: Input Capture- GUI Input Capture
Cuckoo Stealer can use `xattr -d com.apple.quarantine` to remove the quarantine flag attribute.
MITRE ATT&CK technique: T1553.001: Subvert Trust Controls- Gatekeeper Bypass
Cuckoo Stealer has copied its binary and the victim's scraped password into a hidden folder in the `/Users` directory.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
Cuckoo Stealer can capture files from a targeted user's keychain directory.
MITRE ATT&CK technique: T1555.001: Credentials from Password Stores- Keychain
Cuckoo Stealer can achieve persistence by creating launch agents to repeatedly execute malicious payloads.
MITRE ATT&CK technique: T1543.001: Create or Modify System Process- Launch Agent
Cuckoo Stealer can use `launchctl` to load a LaunchAgent for persistence.
MITRE ATT&CK technique: T1569.001: System Services- Launchctl
Cuckoo Stealer has staged collected application data from Safari, Notes, and Keychain to `/var/folder`.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging