sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Egregor can inject its payload into iexplore.exe process.
MITRE ATT&CK technique: T1055: Process Injection
Egregor has used regsvr32.exe to execute malicious DLLs.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
Egregor has checked for the LogMein event log in an attempt to encrypt files in remote machines.
MITRE ATT&CK technique: T1219: Remote Access Software
Egregor has used rundll32 during execution.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Egregor's payloads are custom-packed, archived and encrypted to prevent analysis.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Egregor can perform a language check of the infected system and can query the CPU information .
MITRE ATT&CK technique: T1082: System Information Discovery
Egregor can enumerate all connected drives.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Egregor has used tools to gather information about users.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Egregor contains functionality to query the local/system time.
MITRE ATT&CK technique: T1124: System Time Discovery
Egregor can perform a long sleep to evade detection.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
Egregor has used multiple anti-analysis and anti-sandbox techniques to prevent automated analysis by sandboxes.
MITRE ATT&CK technique: T1497: Virtualization/Sandbox Evasion
Egregor has communicated with its C2 servers via HTTPS protocol.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Egregor has used batch files for execution and can launch Internet Explorer from cmd.exe.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Elise injects DLL files into iexplore.exe.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Elise encrypts several of its files, including configuration files.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Elise is capable of launching a remote shell on the host to delete itself.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
A variant of Elise executes dir C:\progra~1 when initially run.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Elise can download additional files from the C2 server for execution.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Elise executes net user after initial communication is made to the remote server.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Elise creates a file in AppData\Local\Microsoft\Windows\Explorer and stores all harvested data in that file.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
If installing itself as a service fails, Elise instead writes itself as a file named svchost.exe saved in %APPDATA%\Microsoft\Network.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Elise enumerates processes via the tasklist command.
MITRE ATT&CK technique: T1057: Process Discovery
If establishing persistence by installation as a new service fails, one variant of Elise establishes persistence for the created .exe file by setting the following Registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\svchost : %APPDATA%\Microsoft\Network\svchost.exe. Other variants have set the following Registry keys for persistence: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\imejp : self and HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IAStorD.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
After copying itself to a DLL file, a variant of Elise calls the DLL file using rundll32.exe.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Elise exfiltrates data using cookie values that are Base64-encoded.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Elise encrypts exfiltrated data with RC4.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Elise executes systeminfo after initial communication is made to the remote server.
MITRE ATT&CK technique: T1082: System Information Discovery
Elise executes ipconfig /all after initial communication is made to the remote server.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Elise executes net start after initial communication is made to the remote server.
MITRE ATT&CK technique: T1007: System Service Discovery
Elise performs timestomping of a CAB file it creates.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
Elise communicates over HTTP or HTTPS for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Elise configures itself as a service.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
A variant of Emissary appends junk data to the end of its DLL file to create a large file that may exceed the maximum size that anti-virus programs can scan.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
Emissary injects its DLL file into a newly spawned Internet Explorer process.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Variants of Emissary encrypt payloads using various XOR ciphers, as well as a custom algorithm that uses the "srand" and "rand" functions.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Emissary has the capability to execute gpresult.
MITRE ATT&CK technique: T1615: Group Policy Discovery
Emissary has the capability to download files from the C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Emissary has the capability to execute the command net localgroup administrators.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
Variants of Emissary have added Run Registry keys to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Variants of Emissary have used rundll32.exe in Registry values added to establish persistence.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
The C2 server response to a beacon sent by a variant of Emissary contains a 36-character GUID value that is used as an encryption key for subsequent network communications. Some variants of Emissary use various XOR operations to encrypt C2 data.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Emissary has the capability to execute ver and systeminfo commands.
MITRE ATT&CK technique: T1082: System Information Discovery
Emissary has the capability to execute the command ipconfig /all.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Emissary has the capability to execute the command net start to interact with services.
MITRE ATT&CK technique: T1007: System Service Discovery
Emissary uses HTTP or HTTPS for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Emissary has the capability to create a remote shell and execute specified commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Emissary is capable of configuring itself as a service.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Emotet inflates malicious files and malware as an evasion technique.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
Emotet has obfuscated macros within malicious documents to hide the URLs hosting the malware, CMD.exe arguments, and PowerShell scripts.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
Emotet has been observed leveraging a module that retrieves passwords stored on a system for the current logged-on user.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
Emotet has been observed dropping browser password grabber modules.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Emotet has used a self-extracting RAR file to deliver modules to victims. Emotet has also extracted embedded executables from files using hard-coded buffer offsets.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Emotet has been observed injecting in to Explorer.exe and other processes.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Emotet has been observed leveraging a module that can scrape email addresses from Outlook.
MITRE ATT&CK technique: T1087.003: Account Discovery- Email Account
Emotet has been observed leveraging a module that can scrape email addresses from Outlook.
MITRE ATT&CK technique: T1114: Email Collection
Emotet has dropped an embedded executable at `%Temp%\setup.exe`. Additionally, Emotet may embed entire code into other files.
MITRE ATT&CK technique: T1027.009: Obfuscated Files or Information- Embedded Payloads
Emotet has encrypted data before sending to the C2 server.
MITRE ATT&CK technique: T1573: Encrypted Channel
Emotet uses obfuscated URLs to download a ZIP file.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Emotet has exfiltrated data over its C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Emotet has been seen exploiting SMB via a vulnerability exploit like EternalBlue to achieve lateral movement and propagation.
MITRE ATT&CK technique: T1210: Exploitation of Remote Services
Emotet has been observed dropping and executing password grabber modules including Mimikatz.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Emotet has copied itself to remote systems using the `service.exe` filename.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
Emotet can brute force a local admin password, then use it to facilitate lateral movement.
MITRE ATT&CK technique: T1078.003: Valid Accounts- Local Accounts
Emotet has been observed leveraging a module that scrapes email data from Outlook.
MITRE ATT&CK technique: T1114.001: Email Collection- Local Email Collection
Emotet has relied upon users clicking on a malicious attachment delivered through spearphishing.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Emotet has relied upon users clicking on a malicious link delivered through spearphishing.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Emotet has installed itself as a new service with the service name `Windows Defender System Service` and display name `WinDefService`.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Emotet has used `CreateProcess` to create a new process to run its executable and `WNetEnumResourceW` to enumerate non-hidden shares.
MITRE ATT&CK technique: T1106: Native API
Emotet has enumerated non-hidden network shares using `WNetEnumResourceW`.
MITRE ATT&CK technique: T1135: Network Share Discovery
Emotet has been observed to hook network APIs to monitor network traffic.
MITRE ATT&CK technique: T1040: Network Sniffing
Emotet has used HTTP over ports such as 20, 22, 443, 7080, and 50000, in addition to using ports commonly associated with HTTP/S.
MITRE ATT&CK technique: T1571: Non-Standard Port
Emotet has been observed using a hard coded list of passwords to brute force user accounts.
MITRE ATT&CK technique: T1110.001: Brute Force- Password Guessing
Emotet has used Powershell to retrieve the malicious payload and download additional resources like Mimikatz.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Emotet has been observed enumerating local processes.
MITRE ATT&CK technique: T1057: Process Discovery
Emotet uses a copy of `certutil.exe` stored in a temporary directory for process hollowing, starting the program in a suspended state before loading malicious code.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
Emotet has reflectively loaded payloads into memory.
MITRE ATT&CK technique: T1620: Reflective Code Loading
Emotet has been observed adding the downloaded payload to the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key to maintain persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Emotet uses RegSvr32 to execute the DLL payload.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
Emotet has leveraged the Admin$, C$, and IPC$ shares for lateral movement.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Emotet has maintained persistence through a scheduled task, e.g. though a .dll file in the Registry.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Emotet has used custom packers to protect its payloads.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Emotet has been delivered by phishing emails containing attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Emotet has been delivered by phishing emails containing links.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Emotet has used Google’s Protobufs to serialize data sent to and from the C2 server. Additionally, Emotet has used Base64 to encode data before sending to the C2 server.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Emotet is known to use RSA keys for encrypting C2 traffic.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Emotet has enumerated all users connected to network shares.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Emotet has the ability to duplicate the user’s token. For example, Emotet may use a variant of Google’s ProtoBuf to send messages that specify how code will be executed.
MITRE ATT&CK technique: T1134.001: Access Token Manipulation- Token Impersonation/Theft
Emotet has sent Microsoft Word documents with embedded macros that will invoke scripts to download additional payloads.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Emotet has used HTTP for command and control.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Emotet can extract names of all locally reachable Wi-Fi networks and then perform a brute-force attack to spread to new networks.
MITRE ATT&CK technique: T1016.002: System Network Configuration Discovery- Wi-Fi Discovery
Emotet has used cmd.exe to run a PowerShell script.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Emotet has used WMI to execute powershell.exe.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Emotet has been observed creating new services to maintain persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Empire can use PowerSploit's Invoke-TokenManipulation to manipulate access tokens.
MITRE ATT&CK technique: T1134: Access Token Manipulation
Empire can leverage WMI debugging to remotely replace binaries like sethc.exe, Utilman.exe, and Magnify.exe with cmd.exe.
MITRE ATT&CK technique: T1546.008: Event Triggered Execution- Accessibility Features
Empire can ZIP directories on the target system.
MITRE ATT&CK technique: T1560: Archive Collected Data
Empire can use TLS to encrypt its C2 channel.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Empire can automatically gather the username, domain name, machine name, and other information from a compromised system.
MITRE ATT&CK technique: T1119: Automated Collection
Empire has the ability to automatically send collected data back to the threat actors' C2.
MITRE ATT&CK technique: T1020: Automated Exfiltration
Empire can use Dropbox and GitHub for C2.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
Empire has the ability to gather browser data such as bookmarks and visited sites.
MITRE ATT&CK technique: T1217: Browser Information Discovery
Empire includes various modules to attempt to bypass UAC for escalation of privileges.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
Empire can harvest clipboard data on both Windows and macOS systems.
MITRE ATT&CK technique: T1115: Clipboard Data
Empire has the ability to obfuscate commands using Invoke-Obfuscation.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
Empire uses a command-line interface to interact with systems.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
Empire can use Invoke-RunAs to make tokens.
MITRE ATT&CK technique: T1134.002: Access Token Manipulation- Create Process with Token
Empire contains some modules that leverage API hooking to carry out tasks, such as netripper.
MITRE ATT&CK technique: T1056.004: Input Capture- Credential API Hooking
Empire can use various modules to search for files containing passwords.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
Empire can use modules that extract passwords from common web browsers such as Firefox and Chrome.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Empire contains modules that can discover and exploit various DLL hijacking opportunities.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
Empire can utilize Invoke-DCOM to leverage remote COM execution for lateral movement.
MITRE ATT&CK technique: T1021.003: Remote Services- Distributed Component Object Model
Empire can acquire local and domain user account information.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
Empire has a module for creating a new domain user if permissions allow.
MITRE ATT&CK technique: T1136.002: Create Account- Domain Account
Empire has modules for enumerating domain trusts.
MITRE ATT&CK technique: T1482: Domain Trust Discovery
Empire has a dylib hijacker module that generates a malicious dylib given the path to a legitimate dylib of a vulnerable application.
MITRE ATT&CK technique: T1574.004: Hijack Execution Flow- Dylib Hijacking
Empire can send data gathered from a target through the command and control channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Empire can use Dropbox for data exfiltration.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
Empire can use GitHub for data exfiltration.
MITRE ATT&CK technique: T1567.001: Exfiltration Over Web Service- Exfiltration to Code Repository
Empire can exploit vulnerabilities such as MS16-032 and MS16-135.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
Empire has a limited number of built-in modules for exploiting remote SMB, JBoss, and Jenkins servers.
MITRE ATT&CK technique: T1210: Exploitation of Remote Services
Empire includes various modules for finding files of interest on hosts and network shares.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Empire can leverage its implementation of Mimikatz to obtain and use golden tickets.
MITRE ATT&CK technique: T1558.001: Steal or Forge Kerberos Tickets- Golden Ticket
Empire includes various modules for enumerating Group Policy.
MITRE ATT&CK technique: T1615: Group Policy Discovery
Empire can use New-GPOImmediateTask to modify a GPO that will install and execute a malicious Scheduled Task/Job.
MITRE ATT&CK technique: T1484.001: Domain or Tenant Policy Modification- Group Policy Modification
Empire can upload and download to and from a victim machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Empire uses PowerSploit's Invoke-Kerberoast to request service tickets and return crackable ticket hashes.
MITRE ATT&CK technique: T1558.003: Steal or Forge Kerberos Tickets- Kerberoasting
Empire includes keylogging capabilities for Windows, Linux, and macOS systems.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Empire can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks.
MITRE ATT&CK technique: T1557.001: Adversary-in-the-Middle- LLMNR/NBT-NS Poisoning and SMB Relay
Empire contains an implementation of Mimikatz to gather credentials from memory.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Empire can acquire local and domain user account information.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Empire has a module for creating a local user if permissions allow.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
Empire has the ability to collect emails on a target system.
MITRE ATT&CK technique: T1114.001: Email Collection- Local Email Collection
Empire can use built-in modules to abuse trusted utilities like MSBuild.exe.
MITRE ATT&CK technique: T1127.001: Trusted Developer Utilities Proxy Execution- MSBuild
Empire contains a variety of enumeration modules that have an option to use API calls to carry out tasks.
MITRE ATT&CK technique: T1106: Native API
Empire can perform port scans from an infected host.
MITRE ATT&CK technique: T1046: Network Service Discovery
Empire can find shared drives on the local system.
MITRE ATT&CK technique: T1135: Network Share Discovery
Empire can be used to conduct packet captures on target hosts.
MITRE ATT&CK technique: T1040: Network Sniffing
Empire can perform pass the hash attacks.
MITRE ATT&CK technique: T1550.002: Use Alternate Authentication Material- Pass the Hash
Empire contains modules that can discover and exploit path interception opportunities in the PATH environment variable.
MITRE ATT&CK technique: T1574.007: Hijack Execution Flow- Path Interception by PATH Environment Variable
Empire contains modules that can discover and exploit search order hijacking vulnerabilities.
MITRE ATT&CK technique: T1574.008: Hijack Execution Flow- Path Interception by Search Order Hijacking
Empire contains modules that can discover and exploit unquoted path vulnerabilities.
MITRE ATT&CK technique: T1574.009: Hijack Execution Flow- Path Interception by Unquoted Path
Empire leverages PowerShell for the majority of its client-side agent tasks. Empire also contains the ability to conduct PowerShell remoting with the Invoke-PSRemoting module.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Empire can use modules like Invoke-SessionGopher to extract private key and session information.
MITRE ATT&CK technique: T1552.004: Unsecured Credentials- Private Keys
Empire can find information about processes running on local and remote systems.
MITRE ATT&CK technique: T1057: Process Discovery
Empire contains multiple modules for injecting into processes, such as Invoke-PSInject.
MITRE ATT&CK technique: T1055: Process Injection
Empire can modify the registry run keys HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Empire can add a SID-History to a user if on a domain controller.
MITRE ATT&CK technique: T1134.005: Access Token Manipulation- SID-History Injection
Empire contains modules for executing commands over SSH as well as in-memory VNC agent injection.
MITRE ATT&CK technique: T1021.004: Remote Services- SSH
Empire has modules to interact with the Windows task scheduler.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Empire is capable of capturing screenshots on Windows and macOS systems.
MITRE ATT&CK technique: T1113: Screen Capture
Empire can enumerate antivirus software on the target.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Empire can enumerate Security Support Providers as well as utilize PowerSploit's Install-SSP and Invoke-Mimikatz to install malicious SSPs and log authentication events.
MITRE ATT&CK technique: T1547.005: Boot or Logon Autostart Execution- Security Support Provider
Empire can use PsExec to execute a payload on a remote host.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Empire can persist by modifying a .LNK file to include a backdoor.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
Empire can leverage its implementation of Mimikatz to obtain and use silver tickets.
MITRE ATT&CK technique: T1558.002: Steal or Forge Kerberos Tickets- Silver Ticket
Empire can enumerate host system information like OS, architecture, domain name, applied patches, and more.
MITRE ATT&CK technique: T1082: System Information Discovery
Empire can acquire network configuration information like DNS servers, public IP, and network proxies used by a host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Empire can enumerate the current network connections of a host.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Empire can enumerate the username on targeted hosts.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Empire can timestomp any files or payloads placed on a target machine to help them blend in.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
Empire can capture webcam data on Windows and macOS systems.
MITRE ATT&CK technique: T1125: Video Capture
Empire can conduct command and control over protocols like HTTP and HTTPS.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Empire has modules for executing scripts.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Empire can use WMI to deliver a payload to a remote host.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Empire can utilize built-in modules to modify service binaries and restore them to their original state.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
EnvyScout can collect sensitive NTLM material from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
EnvyScout can deobfuscate and write malicious ISO files to disk.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
EnvyScout can Base64 encode payloads.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
EnvyScout can call window.location.pathname to ensure that embedded files are being executed from the C: drive, and will terminate if they are not.
MITRE ATT&CK technique: T1480: Execution Guardrails
EnvyScout can use protocol handlers to coax the operating system to send NTLMv2 authentication responses to attacker-controlled infrastructure.
MITRE ATT&CK technique: T1187: Forced Authentication
EnvyScout contains JavaScript code that can extract an encoded blob from its HTML body and write it to disk.
MITRE ATT&CK technique: T1027.006: Obfuscated Files or Information- HTML Smuggling
EnvyScout can use hidden directories and files to hide malicious executables.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
EnvyScout can write files to disk with JavaScript using a modified version of the open-source tool FileSaver.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
EnvyScout has been executed through malicious files attached to e-mails.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
EnvyScout has used folder icons for malicious files to lure victims into opening them.
MITRE ATT&CK technique: T1036: Masquerading
EnvyScout has the ability to proxy execution of malicious files with Rundll32.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
EnvyScout has been distributed via spearphishing as an email attachment.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
EnvyScout can determine whether the ISO payload was received by a Windows or iOS device.
MITRE ATT&CK technique: T1082: System Information Discovery
EnvyScout can use cmd.exe to execute malicious files on compromised hosts.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Epic encrypts collected data using a public key framework before sending it over the C2 channel. Some variants encrypt the collected data with AES and encode it with base64 before transmitting it to the C2 server.
MITRE ATT&CK technique: T1560: Archive Collected Data
Epic compresses the collected data with bzip2 before sending it to the C2 server.
MITRE ATT&CK technique: T1560.002: Archive Collected Data- Archive via Library
Turla has used valid digital certificates from Sysprint AG to sign its Epic dropper.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Epic has overwritten the function pointer in the extra window memory of Explorer's Shell_TrayWnd in order to execute malicious code in the context of the explorer.exe process.
MITRE ATT&CK technique: T1055.011: Process Injection- Extra Window Memory Injection
Epic has a command to delete a file from the machine.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Epic recursively searches for all .doc files on the system and collects a directory listing of the Desktop, %TEMP%, and %WINDOWS%\Temp directories.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Epic gathers a list of all user accounts, privilege classes, and time of last logon.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Epic gathers information on local group names.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
Epic heavily obfuscates its code to make analysis more difficult.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Epic uses the tasklist /v command to obtain a list of processes.
MITRE ATT&CK technique: T1057: Process Discovery
Epic uses the rem reg query command to obtain values from Registry keys.
MITRE ATT&CK technique: T1012: Query Registry
Epic uses the net view command on the victim’s machine.
MITRE ATT&CK technique: T1018: Remote System Discovery
Epic searches for anti-malware services running on the victim’s machine and terminates itself if it finds them.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Epic encrypts commands from the C2 server using a hardcoded key.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Epic collects the OS version, hardware information, computer name, available system memory status, disk space information, and system and user language settings.
MITRE ATT&CK technique: T1082: System Information Discovery
Epic uses the nbtstat -n and nbtstat -s commands on the victim’s machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Epic uses the net use, net session, and netstat commands to gather information on network connections.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Epic collects the user name from the victim’s machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Epic uses the tasklist /svc command to list the services on the system.
MITRE ATT&CK technique: T1007: System Service Discovery
Epic uses the net time command to get the system time from the machine and collect the current date and time zone information.
MITRE ATT&CK technique: T1124: System Time Discovery
Epic uses HTTP and HTTPS for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
EvilBunny has exploited CVE-2011-4369, a vulnerability in the PRC component in Adobe Reader.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
EvilBunny has deleted the initial dropper after running through the environment checks.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
EvilBunny has downloaded additional Lua scripts from the C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
EvilBunny has used Lua scripts to execute payloads.
MITRE ATT&CK technique: T1059.011: Command and Scripting Interpreter- Lua
EvilBunny has used various API calls as part of its checks to see if the malware is running in a sandbox.
MITRE ATT&CK technique: T1106: Native API
EvilBunny has used EnumProcesses to identify how many process are running in the environment.
MITRE ATT&CK technique: T1057: Process Discovery
EvilBunny has created Registry keys for persistence in HKLM|HKCU\…\CurrentVersion\Run.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
EvilBunny has executed commands via scheduled tasks.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
EvilBunny has been observed querying installed antivirus software.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
EvilBunny's dropper has checked the number of processes and the length and strings of its own file name to identify if the malware is in a sandbox environment.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
EvilBunny has used the API calls NtQuerySystemTime, GetSystemTimeAsFileTime, and GetTickCount to gather time metrics as part of its checks to see if the malware is running in a sandbox.
MITRE ATT&CK technique: T1124: System Time Discovery
EvilBunny has used time measurements from 3 different APIs before and after performing sleep operations to check and abort if the malware is running in a sandbox.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
EvilBunny has executed C2 commands directly via HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
EvilBunny has an integrated scripting engine to download and execute Lua scripts.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
EvilBunny has used WMI to gather information about the system.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
EvilGrab has the capability to capture audio from a victim machine.
MITRE ATT&CK technique: T1123: Audio Capture
EvilGrab has the capability to capture keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
EvilGrab adds a Registry Run key for ctfmon.exe to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
EvilGrab has the capability to capture screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
EvilGrab has the capability to capture video from a victim machine.
MITRE ATT&CK technique: T1125: Video Capture
Exaramel for Linux has a hardcoded location that it uses to achieve persistence if the startup system is Upstart or System V and it is running as root.
MITRE ATT&CK technique: T1543: Create or Modify System Process
Exaramel for Linux uses crontab for persistence if it does not have root privileges.
MITRE ATT&CK technique: T1053.003: Scheduled Task/Job- Cron
Exaramel for Linux can decrypt its configuration file.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Exaramel for Linux uses RC4 for encrypting the configuration.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Exaramel for Linux can attempt to find a new C2 server if it receives an error.
MITRE ATT&CK technique: T1008: Fallback Channels
Exaramel for Linux can uninstall its persistence mechanism and delete its configuration file.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Exaramel for Linux has a command to download a file from and to a remote C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Exaramel for Linux can execute commands with high privileges via a specific binary with setuid functionality.
MITRE ATT&CK technique: T1548.001: Abuse Elevation Control Mechanism- Setuid and Setgid
Exaramel for Linux can run whoami to identify the system owner.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Exaramel for Linux has a hardcoded location under systemd that it uses to achieve persistence if it is running as root.
MITRE ATT&CK technique: T1543.002: Create or Modify System Process- Systemd Service
Exaramel for Linux has a command to execute a shell command on the system.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
Exaramel for Linux uses HTTPS for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Exaramel for Windows automatically encrypts files before sending them to the C2 server.
MITRE ATT&CK technique: T1560: Archive Collected Data
Exaramel for Windows stores the backdoor's configuration in the Registry in XML format.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
Exaramel for Windows specifies a path to store files scheduled for exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
The Exaramel for Windows dropper creates and starts a Windows service named wsmprovav with the description “Windows Check AV” in an apparent attempt to masquerade as a legitimate service.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Exaramel for Windows adds the configuration to the Registry in XML format.
MITRE ATT&CK technique: T1112: Modify Registry
Exaramel for Windows has a command to execute VBS scripts on the victim’s machine.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Exaramel for Windows has a command to launch a remote shell and executes commands on the victim’s machine.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
The Exaramel for Windows dropper creates and starts a Windows service named wsmprovav with the description “Windows Check AV.”
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Expand can be used to decompress a local or remote CAB file into an executable.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Expand can be used to download or upload a file over a network share.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
Expand can be used to download or copy a file into an alternate data stream.
MITRE ATT&CK technique: T1564.004: Hide Artifacts- NTFS File Attributes
Explosive has a function to use the OpenClipboard wrapper.
MITRE ATT&CK technique: T1115: Clipboard Data
Explosive can scan all .exe files located in the USB drive.
MITRE ATT&CK technique: T1025: Data from Removable Media
Explosive has commonly set file and path attributes to hidden.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
Explosive has a function to download a file to the infected system.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Explosive has leveraged its keylogging capabilities to gain access to administrator accounts on target servers.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Explosive has a function to write itself to Registry values.
MITRE ATT&CK technique: T1112: Modify Registry
Explosive has a function to call the OpenClipboard wrapper.
MITRE ATT&CK technique: T1106: Native API
Explosive has encrypted communications with the RC4 method.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Explosive has collected the computer name from the infected host.
MITRE ATT&CK technique: T1082: System Information Discovery
Explosive has collected the MAC address from the victim's machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Explosive has collected the username from the infected host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Explosive has used HTTP for communication.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
FALLCHILL can delete malware and associated artifacts from the victim.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
FALLCHILL can search files on a victim.
MITRE ATT&CK technique: T1083: File and Directory Discovery
FALLCHILL uses fake Transport Layer Security to communicate with its C2 server.
MITRE ATT&CK technique: T1001.003: Data Obfuscation- Protocol or Service Impersonation
FALLCHILL encrypts C2 data with RC4 encryption.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
FALLCHILL can collect operating system version information, processor information, system name, and information about installed disks from the victim.
MITRE ATT&CK technique: T1082: System Information Discovery
FALLCHILL collects MAC address and local IP address information from the victim.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
FALLCHILL can modify file or directory timestamps.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
FALLCHILL has been installed as a Windows service.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
FELIXROOT encrypts collected data with AES and Base64 and then sends it to the C2 server.
MITRE ATT&CK technique: T1560: Archive Collected Data
FELIXROOT encrypts strings in the backdoor using a custom XOR algorithm.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
FELIXROOT deletes the .LNK file from the startup directory as well as the dropper components.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
FELIXROOT downloads and uploads files to and from the victim’s machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
FELIXROOT deletes the Registry key HKCU\Software\Classes\Applications\rundll32.exe\shell\open.
MITRE ATT&CK technique: T1112: Modify Registry
FELIXROOT collects a list of running processes.
MITRE ATT&CK technique: T1057: Process Discovery
FELIXROOT queries the Registry for specific keys for potential privilege escalation and proxy information. FELIXROOT has also used WMI to query the Windows Registry.
MITRE ATT&CK technique: T1012: Query Registry
FELIXROOT adds a shortcut file to the startup folder for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
FELIXROOT uses Rundll32 for executing the dropper program.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
FELIXROOT checks for installed security software like antivirus and firewall.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
FELIXROOT creates a .LNK file for persistence.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
FELIXROOT collects the victim’s computer name, processor architecture, OS version, volume serial number, and system type.
MITRE ATT&CK technique: T1082: System Information Discovery
FELIXROOT collects information about the network including the IP address and DHCP server.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
FELIXROOT collects the username from the victim’s machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
FELIXROOT gathers the time zone information from the victim’s machine.
MITRE ATT&CK technique: T1124: System Time Discovery
FELIXROOT uses HTTP and HTTPS to communicate with the C2 server.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
FELIXROOT executes batch scripts on the victim’s machine, and can launch a reverse shell for command execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
FELIXROOT uses WMI to query the Windows Registry.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
FIVEHANDS can receive a command line argument to limit file encryption to specified directories.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
FIVEHANDS can use an embedded NTRU public key to encrypt data for ransom.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
FIVEHANDS has the ability to decrypt its payload prior to execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
The FIVEHANDS payload is encrypted with AES-128.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
FIVEHANDS has the ability to enumerate files on a compromised host in order to encrypt files with specific extensions.
MITRE ATT&CK technique: T1083: File and Directory Discovery
FIVEHANDS has the ability to delete volume shadow copies on compromised hosts.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
FIVEHANDS can enumerate network shares and mounted drives on a network.
MITRE ATT&CK technique: T1135: Network Share Discovery
FIVEHANDS can use WMI to delete files on a target machine.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
FLASHFLOOD employs the same encoding scheme as SPACESHIP for data it stages. Data is compressed with zlib, and bytes are rotated four times before being XOR'ed with 0x23.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
FLASHFLOOD searches for interesting files on the local system. FLASHFLOOD will scan the My Recent Documents, Desktop, Temporary Internet Files, and TEMP directories. FLASHFLOOD also collects information stored in the Windows Address Book.
MITRE ATT&CK technique: T1005: Data from Local System
FLASHFLOOD searches for interesting files on removable media and copies them to a staging area. The default file types copied would include data copied to the drive by SPACESHIP.
MITRE ATT&CK technique: T1025: Data from Removable Media
FLASHFLOOD searches for interesting files on the local system and removable media.
MITRE ATT&CK technique: T1083: File and Directory Discovery
FLASHFLOOD stages data it copies from the local system or removable drives in the "%WINDIR%\$NtUninstallKB885884$\" directory.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
FLASHFLOOD achieves persistence by making an entry in the Registry's Run key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
FLIPSIDE uses RDP to tunnel traffic from a victim environment.
MITRE ATT&CK technique: T1572: Protocol Tunneling
FRAMESTING can embed itself in the CAV Python package of an Ivanti Connect Secure VPN located in `/home/venv3/lib/python3.6/site-packages/cav-0.1-py3.6.egg/cav/api/resources/category.py.`
MITRE ATT&CK technique: T1554: Compromise Host Software Binary
FRAMESTING can send and receive zlib compressed data within `POST` requests.
MITRE ATT&CK technique: T1001: Data Obfuscation
FRAMESTING can decompress data received within `POST` requests.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
FRAMESTING uses a cookie named `DSID` to mimic the name of a cookie used by Ivanti Connect Secure appliances for maintaining VPN sessions.
MITRE ATT&CK technique: T1001.003: Data Obfuscation- Protocol or Service Impersonation
FRAMESTING is a Python web shell that can embed in the Ivanti Connect Secure CAV Python package.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
FRAMESTING can retrieve C2 commands from values stored in the `DSID` cookie from the current HTTP request or from decompressed zlib data within the request's `POST` data.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
FRAMESTING is a web shell capable of enabling arbitrary command execution on compromised Ivanti Connect Secure VPNs.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
FRP can be configured to only accept TLS connections.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
FRP can support the use of a JSON configuration file.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
The FRP client can be configured to connect to the server through a proxy.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
As part of load balancing FRP can set `healthCheck.type = "tcp"` or `healthCheck.type = "http"` to check service status on specific hosts with TCPing or an HTTP request.
MITRE ATT&CK technique: T1046: Network Service Discovery
FRP can communicate over TCP, TCP stream multiplexing, KERN Communications Protocol , QUIC, and UDP.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
FRP can tunnel SSH and Unix Domain Socket communications over TCP between external nodes and exposed resources behind firewalls or NAT.
MITRE ATT&CK technique: T1572: Protocol Tunneling
FRP can proxy communications through a server in public IP space to local servers located behind a NAT or firewall.
MITRE ATT&CK technique: T1090: Proxy