sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
SideTwist has used HTTP GET and POST requests over port 443 for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
SideTwist can execute shell commands on a compromised host.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Siloscape connects to an IRC server for C2.
MITRE ATT&CK technique: T1071: Application Layer Protocol
Siloscape can send kubectl commands to victim clusters through an IRC channel and can run kubectl locally to spread once within a victim cluster.
MITRE ATT&CK technique: T1609: Container Administration Command
Siloscape has decrypted the password of the C2 server with a simple byte by byte XOR. Siloscape also writes both an archive of Tor and the unzip binary to disk from data embedded within the payload using Visual Studio’s Resource Manager.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Siloscape maps the host’s C drive to the container by creating a global symbolic link to the host through the calling of NtSetInformationSymbolicLink.
MITRE ATT&CK technique: T1611: Escape to Host
Siloscape is executed after the attacker gains initial access to a Windows container using a known vulnerability.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
Siloscape has leveraged a vulnerability in Windows containers to perform an Escape to Host.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
Siloscape searches for the Kubernetes config file and other related files using a regular expression.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Siloscape uses Tor to communicate with C2.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
Siloscape makes various native API calls.
MITRE ATT&CK technique: T1106: Native API
Siloscape itself is obfuscated and uses obfuscated API calls.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Siloscape checks for Kubernetes node permissions.
MITRE ATT&CK technique: T1069: Permission Groups Discovery
Siloscape searches for the kubectl binary.
MITRE ATT&CK technique: T1518: Software Discovery
Siloscape impersonates the main thread of CExecSvc.exe by calling NtImpersonateThread.
MITRE ATT&CK technique: T1134.001: Access Token Manipulation- Token Impersonation/Theft
Siloscape can run cmd through an IRC channel.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Skeleton Key is used to patch an enterprise domain controller authentication process with a backdoor password. It allows adversaries to bypass the standard authentication system to use a defined password for all accounts authenticating to that domain controller.
MITRE ATT&CK technique: T1556.001: Modify Authentication Process- Domain Controller Authentication
Skidmap is a kernel-mode rootkit used for cryptocurrency mining.
MITRE ATT&CK technique: T1496.001: Resource Hijacking- Compute Hijacking
Skidmap has installed itself via crontab.
MITRE ATT&CK technique: T1053.003: Scheduled Task/Job- Cron
Skidmap has the ability to download, unpack, and decrypt tar.gz files .
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Skidmap has the ability to set SELinux to permissive mode.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Skidmap has encrypted it's main payload using 3DES.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Skidmap has checked for the existence of specific files including /usr/sbin/setenforce and /etc/selinux/config. It also has the ability to monitor the cryptocurrency miner file and process.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Skidmap has the ability to download files on an infected host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Skidmap has the ability to install several loadable kernel modules on infected machines.
MITRE ATT&CK technique: T1547.006: Boot or Logon Autostart Execution- Kernel Modules and Extensions
Skidmap has created a fake rm binary to replace the legitimate Linux binary.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Skidmap has the ability to replace the pam_unix.so file on an infected machine with its own malicious version that accepts a specific backdoor password for all users.
MITRE ATT&CK technique: T1556.003: Modify Authentication Process- Pluggable Authentication Modules
Skidmap has monitored critical processes to ensure resiliency.
MITRE ATT&CK technique: T1057: Process Discovery
Skidmap is a kernel-mode rootkit that has the ability to hook system calls to hide specific files and fake network and CPU-related statistics to make the CPU load of the infected machine always appear low.
MITRE ATT&CK technique: T1014: Rootkit
Skidmap has the ability to add the public key of its handlers to the authorized_keys file to maintain persistence on an infected host.
MITRE ATT&CK technique: T1098.004: Account Manipulation- SSH Authorized Keys
Skidmap has the ability to check if /usr/sbin/setenforce exists. This file controls what mode SELinux is in.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Skidmap has the ability to check whether the infected system’s OS is Debian or RHEL/CentOS to determine which cryptocurrency miner it should use.
MITRE ATT&CK technique: T1082: System Information Discovery
Skidmap has used pm.sh to download and install its main payload.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
Sliver has the ability to manipulate user tokens on targeted Windows systems.
MITRE ATT&CK technique: T1134: Access Token Manipulation
Sliver can use mutual TLS and RSA cryptography to exchange a session key.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Sliver can support C2 communications over DNS.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Sliver can encrypt strings at compile time.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Sliver can exfiltrate files from the victim using the download command.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Sliver can enumerate files on a target system.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Sliver can upload files from the C2 server to the victim machine using the upload command.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Sliver can inject code into local and remote processes.
MITRE ATT&CK technique: T1055: Process Injection
Sliver can take screenshots of the victim’s active display.
MITRE ATT&CK technique: T1113: Screen Capture
Sliver can use standard encoding techniques like gzip and hex to ASCII to encode the C2 communication payload.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Sliver can encode binary data into a .PNG file for C2 communication.
MITRE ATT&CK technique: T1001.002: Data Obfuscation- Steganography
Sliver can use AES-GCM-256 to encrypt a session key for C2 message exchange.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Sliver has the ability to gather network configuration information.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Sliver can collect network connection information.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Sliver has the ability to support C2 communications over HTTP/S.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Small Sieve can use SSL/TLS for its HTTPS Telegram Bot API-based C2 channel.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Small Sieve has the ability to use the Telegram Bot API from Telegram Messenger to send and receive messages.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
Small Sieve can only execute correctly if the word `Platypus` is passed to it on the command line.
MITRE ATT&CK technique: T1480: Execution Guardrails
Small Sieve has the ability to download files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Small Sieve can use variations of Microsoft and Outlook spellings, such as "Microsift", in its file names to avoid detection.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Small Sieve can use a custom hex byte swapping encoding scheme to obfuscate tasking traffic.
MITRE ATT&CK technique: T1132.002: Data Encoding- Non-Standard Encoding
Small Sieve has the ability to use a custom hex byte swapping encoding scheme combined with an obfuscated Base64 function to protect program strings and Telegram credentials.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Small Sieve can use Python scripts to execute commands.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
Small Sieve has the ability to add itself to `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\OutlookMicrosift` for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Small Sieve can obtain the IP address of a victim host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Small Sieve can obtain the id of a logged in user.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Small Sieve can contact actor-controlled C2 servers by using the Telegram API over HTTPS.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Small Sieve can use `cmd.exe` to execute commands on a victim's system.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Smoke Loader searches for files named logins.json to parse for credentials.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
Smoke Loader searches for credentials stored from web browsers.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Smoke Loader deobfuscates its code.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Smoke Loader uses a simple one-byte XOR method to obfuscate values in the malware.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Smoke Loader recursively searches through directories for files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Smoke Loader downloads a new version of itself once it has installed. It also downloads additional plugins.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Smoke Loader searches through Outlook files and directories .
MITRE ATT&CK technique: T1114.001: Email Collection- Local Email Collection
Smoke Loader spawns a new copy of c:\windows\syswow64\explorer.exe and then replaces the executable code in memory with malware.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
Smoke Loader injects into the Internet Explorer process.
MITRE ATT&CK technique: T1055: Process Injection
Smoke Loader adds a Registry Run key for persistence and adds a script in the Startup folder to deploy the payload.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Smoke Loader launches a scheduled task.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Smoke Loader scans processes to perform anti-VM checks.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
Smoke Loader adds a Visual Basic script in the Startup folder to deploy the payload.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Smoke Loader uses HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Snip3 can obfuscate strings using junk Chinese characters.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
Snip3 can decode its second-stage PowerShell script prior to execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Snip3 has been delivered to targets via downloads from malicious domains.
MITRE ATT&CK technique: T1189: Drive-by Compromise
Snip3 can execute PowerShell scripts in a hidden window.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
Snip3 can download additional payloads to compromised systems.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Snip3 can gain execution through the download of visual basic files.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Snip3 has been executed through luring victims into clicking malicious links.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Snip3 can download and execute additional payloads and modules over separate communication channels.
MITRE ATT&CK technique: T1104: Multi-Stage Channels
Snip3 has the ability to obfuscate strings using XOR encryption.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Snip3 can use a PowerShell script for second-stage execution.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Snip3 can use RunPE to execute malicious payloads within a hollowed Windows process.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
Snip3 can create a VBS file in startup to persist after system restarts.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Snip3 has been delivered to victims through malicious e-mail attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Snip3 has been delivered to victims through e-mail links to malicious files.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Snip3 has the ability to detect Windows Sandbox, VMWare, or VirtualBox by querying `Win32_ComputerSystem` to extract the `Manufacturer` string.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
Snip3 has the ability to query `Win32_ComputerSystem` for system information.
MITRE ATT&CK technique: T1082: System Information Discovery
Snip3 can execute `WScript.Sleep` to delay execution of its second stage.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
Snip3 can use visual basic scripts for first-stage execution.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Snip3 can download additional payloads from web services including Pastebin and top4top.
MITRE ATT&CK technique: T1102: Web Service
Snip3 can query the WMI class `Win32_ComputerSystem` to gather information.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
SocGholish can profile compromised systems to identify domain trust relationships.
MITRE ATT&CK technique: T1482: Domain Trust Discovery
SocGholish has been distributed through compromised websites with malicious content often masquerading as browser updates.
MITRE ATT&CK technique: T1189: Drive-by Compromise
The SocGholish JavaScript payload has been delivered within a compressed ZIP archive. SocGholish has also single or double Base-64 encoded references to its second-stage server URLs.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
SocGholish can exfiltrate data directly to its C2 domain via HTTP.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
SocGholish can download additional malware to infected hosts.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
The SocGholish payload is executed as JavaScript.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
SocGholish can send output from `whoami` to a local temp file using the naming convention `rad<5-hex-chars>.tmp`.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
SocGholish has lured victims into interacting with malicious links on compromised websites for execution.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
SocGholish has been named `AutoUpdater.js` to mimic legitimate update files.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
SocGholish can list processes on targeted hosts.
MITRE ATT&CK technique: T1057: Process Discovery
SocGholish can identify the victim's browser in order to serve the correct fake update page.
MITRE ATT&CK technique: T1518: Software Discovery
SocGholish has been spread via emails containing malicious links.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
SocGholish has the ability to enumerate system information including the victim computer name.
MITRE ATT&CK technique: T1082: System Information Discovery
SocGholish can use IP-based geolocation to limit infections to victims in North America, Europe, and a small number of Asian-Pacific nations.
MITRE ATT&CK technique: T1614: System Location Discovery
SocGholish has the ability to enumerate the domain name of a victim, as well as if the host is a member of an Active Directory domain.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
SocGholish can use `whoami` to obtain the username from a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
SocGholish has used Amazon Web Services to host second-stage servers.
MITRE ATT&CK technique: T1102: Web Service
SocGholish has used WMI calls for script execution and system profiling.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Socksbot creates a suspended svchost process and injects its DLL into it.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Socksbot can write and execute PowerShell scripts.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Socksbot can list all running processes.
MITRE ATT&CK technique: T1057: Process Discovery
Socksbot can start SOCKS proxy threads.
MITRE ATT&CK technique: T1090: Proxy
Socksbot can take screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
SodaMaster can use a hardcoded RSA key to encrypt some of its C2 traffic.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
SodaMaster has the ability to download additional payloads from C2 to the targeted system.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
SodaMaster can use RegOpenKeyW to access the Registry.
MITRE ATT&CK technique: T1106: Native API
SodaMaster can use "stackstrings" for obfuscation.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
SodaMaster can search a list of running processes.
MITRE ATT&CK technique: T1057: Process Discovery
SodaMaster has the ability to query the Registry to detect a key specific to VMware.
MITRE ATT&CK technique: T1012: Query Registry
SodaMaster can use RC4 to encrypt C2 communications.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
SodaMaster can check for the presence of the Registry key HKEY_CLASSES_ROOT\\Applications\\VMwareHostOpen.exe before proceeding to its main functionality.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
SodaMaster can enumerate the host name and OS version on a target system.
MITRE ATT&CK technique: T1082: System Information Discovery
SodaMaster can identify the username on a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
SodaMaster has the ability to put itself to "sleep" for a specified time.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
SombRAT has encrypted collected data with AES-256 using a hardcoded key.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
SombRAT can SSL encrypt C2 traffic.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
SombRAT can communicate over DNS with the C2 server.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
SombRAT has collected data and files from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
SombRAT can run upload to decrypt and upload files from storage.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
SombRAT can use a custom DGA to generate a subdomain for C2.
MITRE ATT&CK technique: T1568.002: Dynamic Resolution- Domain Generation Algorithms
SombRAT can execute loadfromfile, loadfromstorage, and loadfrommem to inject a DLL from disk, storage, or memory respectively.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
SombRAT has uploaded collected data and files from a compromised host to its C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
SombRAT has the ability to run cancel or closeanddeletestorage to remove all files from storage and delete the storage temp file on a compromised host.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
SombRAT can execute enum to enumerate files in storage on a compromised system.
MITRE ATT&CK technique: T1083: File and Directory Discovery
SombRAT has the ability to download and execute additional payloads.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
SombRAT can store harvested data in a custom database under the %TEMP% directory.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
SombRAT can use a legitimate process name to hide itself.
MITRE ATT&CK technique: T1036: Masquerading
SombRAT has the ability to respawn itself using ShellExecuteW and CreateProcessW.
MITRE ATT&CK technique: T1106: Native API
SombRAT has the ability to use TCP sockets to send data and ICMP to ping the C2 server.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
SombRAT can encrypt strings with XOR-based routines and use a custom AES storage format for plugins, configuration, C2 domains, and harvested data.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
SombRAT has the ability to modify its process memory to hide process command-line arguments.
MITRE ATT&CK technique: T1564.010: Hide Artifacts- Process Argument Spoofing
SombRAT can use the getprocesslist command to enumerate processes on a compromised host.
MITRE ATT&CK technique: T1057: Process Discovery
SombRAT has the ability to use an embedded SOCKS proxy in C2 communications.
MITRE ATT&CK technique: T1090: Proxy
SombRAT has encrypted its C2 communications with AES.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
SombRAT can execute getinfo to enumerate the computer name and OS version of a compromised system.
MITRE ATT&CK technique: T1082: System Information Discovery
SombRAT can execute getinfo to identify the username on a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
SombRAT can enumerate services on a victim machine.
MITRE ATT&CK technique: T1007: System Service Discovery
SombRAT can execute getinfo to discover the current time on a compromised host.
MITRE ATT&CK technique: T1124: System Time Discovery
SoreFang can decode and decrypt exfiltrated data sent to C2.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
SoreFang can enumerate domain accounts via net.exe user /domain.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
SoreFang can enumerate domain groups by executing net.exe group /domain.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
SoreFang can gain access by exploiting a Sangfor SSL VPN vulnerability that allows for the placement and delivery of malicious update binaries.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
SoreFang has the ability to list directories.
MITRE ATT&CK technique: T1083: File and Directory Discovery
SoreFang can download additional payloads from C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
SoreFang can collect usernames from the local system via net.exe user.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
SoreFang has the ability to encode and RC6 encrypt data sent to C2.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
SoreFang can enumerate processes on a victim machine through use of Tasklist.
MITRE ATT&CK technique: T1057: Process Discovery
SoreFang can gain persistence through use of scheduled tasks.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
SoreFang can collect the hostname, operating system configuration, product ID, and disk space on victim machines by executing Systeminfo.
MITRE ATT&CK technique: T1082: System Information Discovery
SoreFang can collect the TCP/IP, DNS, DHCP, and network adapter configuration on a compromised host via ipconfig.exe /all.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
SoreFang can use HTTP in C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Spark has used a custom XOR algorithm to decrypt the payload.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Spark has exfiltrated data over the C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Spark has been packed with Enigma Protector to obfuscate its contents.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Spark has encoded communications with the C2 server with base64.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Spark can collect the hostname, keyboard layout, and language from the system.
MITRE ATT&CK technique: T1082: System Information Discovery
Spark has checked the results of the GetKeyboardLayoutList and the language name returned by GetLocaleInfoA to make sure they contain the word “Arabic” before executing.
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
Spark has run the whoami command and has a built-in command to identify the user logged in.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Spark has used a splash screen to check whether an user actively clicks on the screen before running malicious code.
MITRE ATT&CK technique: T1497.002: Virtualization/Sandbox Evasion- User Activity Based Checks
Spark has used HTTP POST requests to communicate with its C2 server to receive commands.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Spark can use cmd.exe to run commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
SpeakUp uses Perl scripts.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
SpeakUp uses cron tasks to ensure persistence.
MITRE ATT&CK technique: T1053.003: Scheduled Task/Job- Cron
SpeakUp encodes its second-stage payload with Base64.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
SpeakUp attempts to exploit the following vulnerabilities in order to execute its malicious script: CVE-2012-0874, CVE-2010-1871, CVE-2017-10271, CVE-2018-2894, CVE-2016-3088, JBoss AS 3/4/5/6, and the Hadoop YARN ResourceManager.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
SpeakUp deletes files to remove evidence on the machine.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
SpeakUp downloads and executes additional files from a remote server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
SpeakUp checks for availability of specific ports on servers.
MITRE ATT&CK technique: T1046: Network Service Discovery
SpeakUp can perform brute forcing using a pre-defined list of usernames and passwords in an attempt to log in to administrative panels.
MITRE ATT&CK technique: T1110.001: Brute Force- Password Guessing
SpeakUp uses Python scripts.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
SpeakUp encodes C&C communication using Base64.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
SpeakUp uses the cat /proc/cpuinfo | grep -c “cpu family” 2>&1 command to gather system information.
MITRE ATT&CK technique: T1082: System Information Discovery
SpeakUp uses the ifconfig -a command.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
SpeakUp uses the arp -a command.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
SpeakUp uses the whoami command.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
SpeakUp uses POST and GET requests over HTTP to communicate with its main C&C server.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Spica can archive collected documents for exfiltration.
MITRE ATT&CK technique: T1560: Archive Collected Data
Upon execution Spica can decode an embedded .pdf and write it to the desktop as a decoy document.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Spica can list filesystem contents on targeted systems.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Spica can upload and download files to and from compromised hosts.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Spica has created a scheduled task named `CalendarChecker` for persistence on compromised hosts.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Spica can use JSON over WebSockets for C2 communications.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Spica can use an obfuscated PowerShell command to create a scheduled task for persistence.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Spica has created a scheduled task named `CalendarChecker` to establish persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Spica has the ability to steal cookies from Chrome, Firefox, Opera, and Edge browsers.
MITRE ATT&CK technique: T1539: Steal Web Session Cookie
SpicyOmelette has been signed with valid digital certificates.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
SpicyOmelette has collected data and other information from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
SpicyOmelette can download malicious files from threat actor controlled AWS URL's.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
SpicyOmelette has the ability to execute arbitrary JavaScript code on a compromised host.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
SpicyOmelette has been executed through malicious links within spearphishing emails.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
SpicyOmelette can identify payment systems, payment gateways, and ATM systems in compromised environments.
MITRE ATT&CK technique: T1018: Remote System Discovery
SpicyOmelette can check for the presence of 29 different antivirus tools.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
SpicyOmelette can enumerate running software on a targeted system.
MITRE ATT&CK technique: T1518: Software Discovery
SpicyOmelette has been distributed via emails containing a malicious link that appears to be a PDF document.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
SpicyOmelette can identify the system name of a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
SpicyOmelette can identify the IP of a compromised system.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Squirrelwaffle has encrypted collected data using a XOR-based algorithm.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
Squirrelwaffle has decrypted files and payloads using a XOR-based algorithm.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Squirrelwaffle has been obfuscated with a XOR-based algorithm.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Squirrelwaffle has exfiltrated victim data using HTTP POST requests to its C2 servers.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Squirrelwaffle has downloaded and executed additional encoded payloads.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Squirrelwaffle has relied on users enabling malicious macros within Microsoft Excel and Word attachments.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Squirrelwaffle has relied on victims to click on a malicious link send via phishing campaigns.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Squirrelwaffle has used PowerShell to execute its payload.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Squirrelwaffle has been executed using `regsvr32.exe`.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
Squirrelwaffle has been executed using `rundll32.exe`.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Squirrelwaffle has been packed with a custom packer to hide payloads.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Squirrelwaffle has been distributed via malicious Microsoft Office documents within spam emails.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Squirrelwaffle has been distributed through phishing emails containing a malicious URL.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Squirrelwaffle has encoded its communications to C2 servers using Base64.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Squirrelwaffle has gathered victim computer information and configurations.
MITRE ATT&CK technique: T1082: System Information Discovery
Squirrelwaffle has collected the victim’s external IP address.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Squirrelwaffle can collect the user name from a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Squirrelwaffle has contained a hardcoded list of IP addresses to block that belong to sandboxes and analysis platforms.
MITRE ATT&CK technique: T1497: Virtualization/Sandbox Evasion
Squirrelwaffle has used malicious VBA macros in Microsoft Word documents and Excel spreadsheets that execute an `AutoOpen` subroutine.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Squirrelwaffle has used HTTP POST requests for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Squirrelwaffle has used `cmd.exe` for execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
SslMM contains a feature to manipulate process privileges and tokens.
MITRE ATT&CK technique: T1134: Access Token Manipulation
SslMM identifies and kills anti-malware processes.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
SslMM has a hard-coded primary and backup C2 string.
MITRE ATT&CK technique: T1008: Fallback Channels
SslMM creates a new thread implementing a keylogging facility using Windows Keyboard Accelerators.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
SslMM sends information to its hard-coded C2, including OS version, service pack information, processor speed, system name, and OS install date.
MITRE ATT&CK technique: T1082: System Information Discovery
SslMM sends the logged-on username to its hard-coded C2.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Starloader decrypts and executes shellcode from a file called Stars.jps.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Starloader has masqueraded as legitimate software update packages such as Adobe Acrobat Reader and Intel.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
StoneDrill has a disk wiper module that targets files other than those in the Windows directory.
MITRE ATT&CK technique: T1485: Data Destruction
StoneDrill can wipe the accessible physical or logical drives of the infected machine.
MITRE ATT&CK technique: T1561.001: Disk Wipe- Disk Content Wipe
StoneDrill can wipe the master boot record of an infected computer.
MITRE ATT&CK technique: T1561.002: Disk Wipe- Disk Structure Wipe
StoneDrill has obfuscated its module with an alphabet-based table or XOR encryption.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
StoneDrill has been observed deleting the temporary files once they fulfill their task.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
StoneDrill has downloaded and dropped temporary files containing scripts; it additionally has a function to upload files from the victims machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
StoneDrill has relied on injecting its payload directly into the process memory of the victim's preferred browser.
MITRE ATT&CK technique: T1055: Process Injection
StoneDrill has looked in the registry to find the default browser path.
MITRE ATT&CK technique: T1012: Query Registry
StoneDrill can take screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
StoneDrill can check for antivirus and antimalware programs.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
StoneDrill has the capability to discover the system OS, Windows version, architecture and environment.
MITRE ATT&CK technique: T1082: System Information Discovery
StoneDrill can obtain the current date and time of the victim machine.
MITRE ATT&CK technique: T1124: System Time Discovery
StoneDrill has used several anti-emulation techniques to prevent automated analysis by emulators or sandboxes.
MITRE ATT&CK technique: T1497: Virtualization/Sandbox Evasion
StoneDrill has several VBS scripts used throughout the malware's lifecycle.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
StoneDrill has used the WMI command-line utility to run tasks.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
StreamEx has the ability to enumerate drive types.
MITRE ATT&CK technique: T1083: File and Directory Discovery
StreamEx has the ability to modify the Registry.
MITRE ATT&CK technique: T1112: Modify Registry
StreamEx obfuscates some commands by using statically programmed fragments of strings when starting a DLL. It also uses a one-byte xor against 0x91 to encode configuration data.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
StreamEx has the ability to enumerate processes.
MITRE ATT&CK technique: T1057: Process Discovery
StreamEx uses rundll32 to call an exported function.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
StreamEx has the ability to scan for security tools such as firewalls and antivirus tools.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
StreamEx has the ability to enumerate system information.
MITRE ATT&CK technique: T1082: System Information Discovery
StreamEx has the ability to remotely execute commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
StreamEx establishes persistence by installing a new service pointing to its DLL and setting the service to auto-start.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
StrifeWater can collect data from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
StrifeWater can send data and files from a compromised host to its C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
StrifeWater can self delete to cover its tracks.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
StrifeWater can enumerate files on a compromised host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
StrifeWater can download updates and auxiliary modules.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
StrifeWater has been named `calc.exe` to appear as a legitimate calculator program.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
StrifeWater can use a variety of APIs for execution.
MITRE ATT&CK technique: T1106: Native API
StrifeWater has create a scheduled task named `Mozilla\Firefox Default Browser Agent 409046Z0FF4A39CB` for persistence.
MITRE ATT&CK technique: T1053: Scheduled Task/Job
StrifeWater has the ability to take screen captures.
MITRE ATT&CK technique: T1113: Screen Capture
StrifeWater can encrypt C2 traffic using XOR with a hard coded key.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
StrifeWater can collect the OS version, architecture, and machine name to create a unique token for the infected host.
MITRE ATT&CK technique: T1082: System Information Discovery
StrifeWater can collect the user name from the victim's machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
StrifeWater can collect the time zone from the victim's machine.
MITRE ATT&CK technique: T1124: System Time Discovery
StrifeWater can modify its sleep time responses from the default of 20-22 seconds.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
StrifeWater can execute shell commands using `cmd.exe`.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
StrongPity can compress and encrypt archived files into multiple .sft files with a repeated xor encryption scheme.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
StrongPity has encrypted C2 traffic using SSL/TLS.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
StrongPity has a file searcher component that can automatically collect and archive files based on a predefined list of file extensions.
MITRE ATT&CK technique: T1119: Automated Collection
StrongPity can automatically exfiltrate collected documents to the C2 server.
MITRE ATT&CK technique: T1020: Automated Exfiltration
StrongPity has been signed with self-signed certificates.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
StrongPity can add directories used by the malware to the Windows Defender exclusions list to prevent detection.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
StrongPity has used encrypted strings in its dropper component.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
StrongPity can exfiltrate collected documents through C2 channels.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
StrongPity can delete previously exfiltrated files from the compromised host.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
StrongPity can parse the hard drive on a compromised host to identify specific file extensions.
MITRE ATT&CK technique: T1083: File and Directory Discovery
StrongPity has the ability to hide the console window for its document search module from the user.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
StrongPity can download files to specified targets.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
StrongPity has been executed via compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
StrongPity has named services to appear legitimate.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
StrongPity has been bundled with legitimate software installation files for disguise.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
StrongPity can use multiple layers of proxy servers to hide terminal nodes in its infrastructure.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
StrongPity has used HTTPS over port 1402 in C2 communication.
MITRE ATT&CK technique: T1571: Non-Standard Port
StrongPity can use PowerShell to add files to the Windows Defender exclusions list.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
StrongPity can determine if a user is logged in by checking to see if explorer.exe is running.
MITRE ATT&CK technique: T1057: Process Discovery
StrongPity can use the HKCU\Software\Microsoft\Windows\CurrentVersion\Run Registry key for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
StrongPity can identify if ESET or BitDefender antivirus are installed before dropping its payload.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
StrongPity can install a service to execute itself as a service.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
StrongPity can identify the hard disk volume serial number on a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
StrongPity can identify the IP address of a compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
StrongPity can use HTTP and HTTPS in C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
StrongPity has created new services and modified existing services for persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Stuxnet encrypts exfiltrated data via C2 with static 31-byte long XOR keys.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
Stuxnet used a digitally signed driver with a compromised Realtek certificate.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Stuxnet infected WinCC machines via a hardcoded database server password.
MITRE ATT&CK technique: T1078.001: Valid Accounts- Default Accounts
Stuxnet decrypts resources that are loaded into memory and executed.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Stuxnet enumerates user accounts of the domain.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
Stuxnet attempts to access network resources with a domain account’s credentials.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Stuxnet uses encrypted configuration blocks and writes encrypted files to disk.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Stuxnet checks for specific operating systems on 32-bit machines, Registry keys, and dates for vulnerabilities, and will exit execution if the values are not met.
MITRE ATT&CK technique: T1480: Execution Guardrails
Stuxnet sends compromised victim information via HTTP.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Stuxnet used MS10-073 and an undisclosed Task Scheduler vulnerability to escalate privileges on local Windows machines.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
Stuxnet propagates using the MS10-061 Print Spooler and MS08-067 Windows Server Service vulnerabilities.
MITRE ATT&CK technique: T1210: Exploitation of Remote Services
Stuxnet has the ability to generate new C2 domains.
MITRE ATT&CK technique: T1008: Fallback Channels
Stuxnet uses an RPC server that contains a routine for file deletion and also removes itself from the system through a DLL export by deleting specific files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Stuxnet uses a driver to scan for specific filesystem driver objects.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Stuxnet reduces the integrity level of objects to allow write actions.
MITRE ATT&CK technique: T1562: Impair Defenses
Stuxnet can delete OLE Automation and SQL stored procedures used to store malicious payloads.
MITRE ATT&CK technique: T1070: Indicator Removal
Stuxnet installs an RPC server for P2P communications.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy