sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Stuxnet uses an RPC server that contains a file dropping routine and support for payload version updates for P2P communications within a victim network.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
Stuxnet enumerates user accounts of the local host.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Stuxnet can create registry keys to load driver files.
MITRE ATT&CK technique: T1112: Modify Registry
Stuxnet uses the SetSecurityDescriptorDacl API to reduce object integrity levels.
MITRE ATT&CK technique: T1106: Native API
Stuxnet enumerates the directories of a network resource.
MITRE ATT&CK technique: T1135: Network Share Discovery
Stuxnet enumerates removable drives for infection.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
Stuxnet searches the Registry for indicators of security programs.
MITRE ATT&CK technique: T1012: Query Registry
Stuxnet can propagate via peer-to-peer communication and updates using RPC.
MITRE ATT&CK technique: T1021: Remote Services
Stuxnet can propagate via removable media using an autorun.inf file or the CVE-2010-2568 LNK vulnerability.
MITRE ATT&CK technique: T1091: Replication Through Removable Media
Stuxnet uses a Windows rootkit to mask its binaries and other relevant files.
MITRE ATT&CK technique: T1014: Rootkit
Stuxnet propagates to available network shares.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Stuxnet used xp_cmdshell to store and execute SQL code.
MITRE ATT&CK technique: T1505.001: Server Software Component- SQL Stored Procedures
Stuxnet schedules a network job to execute two minutes after host infection.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Stuxnet enumerates the currently running processes related to a variety of security products.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Stuxnet calls LoadLibrary then executes exports from a DLL.
MITRE ATT&CK technique: T1129: Shared Modules
Stuxnet transforms encrypted binary data into an ASCII string in order to use it as a URL parameter value.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Stuxnet encodes the payload of system information sent to the command and control servers using a one byte 0xFF XOR key. Stuxnet also uses a 31-byte long static byte string to XOR data sent to command and control servers. The servers use a different static key to encrypt replies to the implant.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Stuxnet collects system information including computer and domain names, OS version, and S7P paths.
MITRE ATT&CK technique: T1082: System Information Discovery
Stuxnet collects the IP address of a compromised system.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Stuxnet collects the time and date of a system when it is infected.
MITRE ATT&CK technique: T1124: System Time Discovery
Stuxnet infects remote servers via network shares and by infecting WinCC database views with malicious code.
MITRE ATT&CK technique: T1080: Taint Shared Content
Stuxnet extracts and writes driver files that match the times of other legitimate files.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
Stuxnet attempts to impersonate an anonymous token to enumerate bindings in the service control manager.
MITRE ATT&CK technique: T1134.001: Access Token Manipulation- Token Impersonation/Theft
Stuxnet uses HTTP to communicate with a command and control server.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Stuxnet used WMI with an explorer.exe token to execute on a remote share.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Stuxnet uses a driver registered as a boot start service as the main load-point.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Sykipot uses SSL for encrypting C2 communications.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Sykipot may use net group "domain admins" /domain to display accounts in the "domain admins" permissions group and net localgroup "administrators" to list local system administrator group membership.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
Sykipot injects itself into running instances of outlook.exe, iexplore.exe, or firefox.exe.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Sykipot contains keylogging functionality to steal passwords.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Sykipot is known to contain functionality that enables targeting of smart card technologies to proxy authentication for connections to restricted network resources using detected hardware tokens.
MITRE ATT&CK technique: T1111: Multi-Factor Authentication Interception
Sykipot may gather a list of running processes by running tasklist /v.
MITRE ATT&CK technique: T1057: Process Discovery
Sykipot has been known to establish persistence by adding programs to the Run Registry key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Sykipot may use net view /domain to display hostnames of available systems on a network.
MITRE ATT&CK technique: T1018: Remote System Discovery
Sykipot may use ipconfig /all to gather system network configuration details.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Sykipot may use netstat -ano to display active network connections.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Sykipot may use net start to display running services.
MITRE ATT&CK technique: T1007: System Service Discovery
SynAck clears event logs.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
SynAck encrypts the victims machine followed by asking the victim to pay a ransom.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
SynAck checks its directory location in an attempt to avoid launching in a sandbox.
MITRE ATT&CK technique: T1083: File and Directory Discovery
SynAck can manipulate Registry keys.
MITRE ATT&CK technique: T1112: Modify Registry
SynAck parses the export tables of system DLLs to locate and call various Windows API functions.
MITRE ATT&CK technique: T1106: Native API
SynAck payloads are obfuscated prior to compilation to inhibit analysis and/or reverse engineering.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
SynAck enumerates all running processes.
MITRE ATT&CK technique: T1057: Process Discovery
SynAck abuses NTFS transactions to launch and conceal malicious processes.
MITRE ATT&CK technique: T1055.013: Process Injection- Process Doppelgänging
SynAck enumerates Registry keys associated with event logs.
MITRE ATT&CK technique: T1012: Query Registry
SynAck checks its directory location in an attempt to avoid launching in a sandbox.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
SynAck gathers computer names, OS version info, and also checks installed keyboard layouts to estimate if it has been launched from a certain list of countries.
MITRE ATT&CK technique: T1082: System Information Discovery
SynAck lists all the keyboard layouts installed on the victim’s system using GetKeyboardLayoutList API and checks against a hardcoded language code list. If a match if found, SynAck sleeps for 300 seconds and then exits without encrypting files.
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
SynAck gathers user names from infected hosts.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
SynAck enumerates all running services.
MITRE ATT&CK technique: T1007: System Service Discovery
Sys10 collects the group name of the logged-in user and sends it to the C2.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
Sys10 uses an XOR 0x1 loop to encrypt its C2 domain.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Sys10 collects the computer name, OS versioning information, and OS install date and sends the information to the C2.
MITRE ATT&CK technique: T1082: System Information Discovery
Sys10 collects the local IP address of the victim and sends it to the C2.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Sys10 collects the account name of the logged-in user and sends it to the C2.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Sys10 uses HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
SysUpdate has been signed with stolen digital certificates.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
SysUpdate can load DLLs through vulnerable legitimate executables.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
SysUpdate has used DNS TXT requests as for its C2 communication.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
SysUpdate can collect information and files from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
SysUpdate can deobfuscate packed binaries in memory.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
SysUpdate can encrypt and encode its configuration file.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
SysUpdate has exfiltrated data over its C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
SysUpdate can delete its configuration file from the targeted system.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
SysUpdate can search files on a compromised host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
SysUpdate can store its encoded configuration file within Software\Classes\scConfig in either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
SysUpdate has the ability to set file attributes to hidden.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
SysUpdate has the ability to download files to a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
SysUpdate can contact the DNS server operated by Google as part of its C2 establishment process.
MITRE ATT&CK technique: T1016.001: System Network Configuration Discovery- Internet Connection Discovery
SysUpdate has named their unit configuration file similarly to other unit files residing in the same directory, `/usr/lib/systemd/system/`, to appear benign.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
SysUpdate can write its configuration file to Software\Classes\scConfig in either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER.
MITRE ATT&CK technique: T1112: Modify Registry
SysUpdate can call the `GetNetworkParams` API as part of its C2 establishment process.
MITRE ATT&CK technique: T1106: Native API
SysUpdate can collect information about running processes.
MITRE ATT&CK technique: T1057: Process Discovery
SysUpdate can use a Registry Run key to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
SysUpdate has the ability to capture screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
SysUpdate can manage services and processes.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
SysUpdate has been packed with VMProtect.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
SysUpdate has used Base64 to encode its C2 traffic.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
SysUpdate has used DES to encrypt all C2 communications.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
SysUpdate can collect a system's architecture, operating system version, hostname, and drive information.
MITRE ATT&CK technique: T1082: System Information Discovery
SysUpdate can collected the IP address and domain name of a compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
SysUpdate can collect the username from a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
SysUpdate can collect a list of services on a victim machine.
MITRE ATT&CK technique: T1007: System Service Discovery
SysUpdate can copy a script to the user owned `/usr/lib/systemd/system/` directory with a symlink mapped to a `root` owned directory, `/etc/ystem/system`, in the unit configuration file's `ExecStart` directive to establish persistence and elevate privileges.
MITRE ATT&CK technique: T1543.002: Create or Modify System Process- Systemd Service
SysUpdate can use WMI for execution on a compromised host.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
SysUpdate can create a service to establish persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Systeminfo can be used to gather information about the operating system.
MITRE ATT&CK technique: T1082: System Information Discovery
If a victim meets certain criteria, T9000 uses the AppInit_DLL functionality to achieve persistence by ensuring that every user mode process that is spawned will load its malicious DLL, ResN32.dll. It does this by creating the following Registry keys: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs – %APPDATA%\Intel\ResN32.dll and HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs – 0x1.
MITRE ATT&CK technique: T1546.010: Event Triggered Execution- AppInit DLLs
T9000 encrypts collected data using a single byte XOR key.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
T9000 uses the Skype API to record audio and video calls. It writes encrypted data to %APPDATA%\Intel\Skype.
MITRE ATT&CK technique: T1123: Audio Capture
T9000 searches removable storage devices for files with a pre-defined list of file extensions . Any matching files are encrypted and written to a local user directory.
MITRE ATT&CK technique: T1119: Automated Collection
During the T9000 installation process, it drops a copy of the legitimate Microsoft binary igfxtray.exe. The executable contains a side-loading weakness which is used to load a portion of the malware.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
T9000 searches through connected drives for removable storage devices.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
T9000 can take screenshots of the desktop and target application windows, saving them to user directories as one byte XOR encrypted .dat files.
MITRE ATT&CK technique: T1113: Screen Capture
T9000 performs checks for various antivirus and security products during installation.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
T9000 gathers and beacons the operating system build number and CPU Architecture during installation.
MITRE ATT&CK technique: T1082: System Information Discovery
T9000 gathers and beacons the MAC and IP addresses during installation.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
T9000 gathers and beacons the username of the logged in account during installation. It will also gather the username of running processes to determine if it is running as SYSTEM.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
T9000 gathers and beacons the system time during installation.
MITRE ATT&CK technique: T1124: System Time Discovery
T9000 uses the Skype API to record audio and video calls. It writes encrypted data to %APPDATA%\Intel\Skype.
MITRE ATT&CK technique: T1125: Video Capture
TAINTEDSCRIBE has used FileReadZipSend to compress a file and send to C2.
MITRE ATT&CK technique: T1560: Archive Collected Data
TAINTEDSCRIBE can execute FileRecvWriteRand to append random bytes to the end of a file received from C2.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
TAINTEDSCRIBE can randomly pick one of five hard-coded IP addresses for C2 communication; if one of the IP fails, it will wait 60 seconds and then try another IP address.
MITRE ATT&CK technique: T1008: Fallback Channels
TAINTEDSCRIBE can delete files from a compromised host.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
TAINTEDSCRIBE can use DirectoryList to enumerate files in a specified directory.
MITRE ATT&CK technique: T1083: File and Directory Discovery
TAINTEDSCRIBE can download additional modules from its C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
The TAINTEDSCRIBE main executable has disguised itself as Microsoft’s Narrator.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
TAINTEDSCRIBE can execute ProcessList for process discovery.
MITRE ATT&CK technique: T1057: Process Discovery
TAINTEDSCRIBE has used FakeTLS for session authentication.
MITRE ATT&CK technique: T1001.003: Data Obfuscation- Protocol or Service Impersonation
TAINTEDSCRIBE can copy itself into the current user’s Startup folder as “Narrator.exe” for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
The TAINTEDSCRIBE command and execution module can perform target system enumeration.
MITRE ATT&CK technique: T1018: Remote System Discovery
TAINTEDSCRIBE uses a Linear Feedback Shift Register algorithm for network encryption.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
TAINTEDSCRIBE can use DriveList to retrieve drive information.
MITRE ATT&CK technique: T1082: System Information Discovery
TAINTEDSCRIBE can execute GetLocalTime for time discovery.
MITRE ATT&CK technique: T1124: System Time Discovery
TAINTEDSCRIBE can change the timestamp of specified filenames.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
TAINTEDSCRIBE can enable Windows CLI access and execute files.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
TDTESS creates then deletes log files during installation of itself as a service.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
TDTESS has a command to download and execute an additional file.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
After creating a new service for persistence, TDTESS sets the file creation time for the service to the creation time of the victim's legitimate svchost.exe file.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
TDTESS provides a reverse shell on the victim.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
If running as administrator, TDTESS installs itself as a new service named bmwappushservice to establish persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
TEARDROP was decoded using a custom rolling XOR algorithm to execute a customized Cobalt Strike payload.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
TEARDROP files had names that resembled legitimate Window file and directory names.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
TEARDROP modified the Registry to create a Windows service for itself on a compromised host.
MITRE ATT&CK technique: T1112: Modify Registry
TEARDROP created and read from a file with a fake JPG header, and its payload was encrypted with a simple rotating XOR cipher.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
TEARDROP checked that HKU\SOFTWARE\Microsoft\CTF existed before decoding its embedded payload.
MITRE ATT&CK technique: T1012: Query Registry
TEARDROP ran as a Windows service from the c:\windows\syswow64 folder.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
TEXTMATE uses DNS TXT records for C2.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
TEXTMATE executes cmd.exe to provide a reverse shell to adversaries.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
When a document is found matching one of the extensions in the configuration, TINYTYPHON uploads it to the C2 server.
MITRE ATT&CK technique: T1020: Automated Exfiltration
TINYTYPHON has used XOR with 0x90 to obfuscate its configuration file.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
TINYTYPHON searches through the drive containing the OS, then all drive letters C through to Z, for documents matching certain extensions.
MITRE ATT&CK technique: T1083: File and Directory Discovery
TINYTYPHON installs itself under Registry Run key to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
TSCookie has the ability to steal saved passwords from the Internet Explorer, Edge, Firefox, and Chrome browsers.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
TSCookie has the ability to decrypt, load, and execute a DLL and its resources.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
TSCookie has the ability to discover drive information on the infected host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
TSCookie has the ability to upload and download files to and from the infected host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
TSCookie has been executed via malicious links embedded in e-mails spoofing the Ministries of Education, Culture, Sports, Science and Technology of Japan.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
TSCookie can use ICMP to receive information on the destination server.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
TSCookie has the ability to list processes on the infected host.
MITRE ATT&CK technique: T1057: Process Discovery
TSCookie has the ability to inject code into the svchost.exe, iexplorer.exe, explorer.exe, and default browser processes.
MITRE ATT&CK technique: T1055: Process Injection
TSCookie has the ability to proxy communications with command and control servers.
MITRE ATT&CK technique: T1090: Proxy
TSCookie has encrypted network communications with RC4.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
TSCookie has the ability to identify the IP of the infected host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
TSCookie can multiple protocols including HTTP and HTTPS in communication with command and control servers.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
TSCookie has the ability to execute shell commands on the infected host.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
TURNEDUP is capable of injecting code into the APC queue of a created Rundll32 process as part of an "Early Bird injection."
MITRE ATT&CK technique: T1055.004: Process Injection- Asynchronous Procedure Call
TURNEDUP is capable of downloading additional files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
TURNEDUP is capable of writing to a Registry Run key to establish.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
TURNEDUP is capable of taking screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
TURNEDUP is capable of gathering system information.
MITRE ATT&CK technique: T1082: System Information Discovery
TURNEDUP is capable of creating a reverse shell.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
One TYPEFRAME variant decrypts an archive using an RC4 key, then decompresses and installs the decrypted malicious DLL module. Another variant decodes the embedded file by XORing it with the value "0x35".
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
TYPEFRAME can open the Windows Firewall on the victim’s machine to allow incoming connections.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
APIs and strings in some TYPEFRAME variants are RC4 encrypted. Another variant is encoded with XOR.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
TYPEFRAME can delete files off the system.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
TYPEFRAME can search directories for files on the victim’s machine.
MITRE ATT&CK technique: T1083: File and Directory Discovery
TYPEFRAME can install and store encrypted configuration data under the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\laxhost.dll and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
TYPEFRAME can upload and download files to the victim’s machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
A Word document delivering TYPEFRAME prompts the user to enable macro execution.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
TYPEFRAME can install encrypted configuration data under the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\laxhost.dll and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs.
MITRE ATT&CK technique: T1112: Modify Registry
TYPEFRAME has used ports 443, 8080, and 8443 with a FakeTLS method.
MITRE ATT&CK technique: T1571: Non-Standard Port
A TYPEFRAME variant can force the compromised system to function as a proxy server.
MITRE ATT&CK technique: T1090: Proxy
TYPEFRAME can gather the disk volume information.
MITRE ATT&CK technique: T1082: System Information Discovery
TYPEFRAME has used a malicious Word document for delivery with VBA macros for execution.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
TYPEFRAME can uninstall malware components using a batch script. TYPEFRAME can execute commands using a shell.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
TYPEFRAME variants can add malicious DLL modules as new services.TYPEFRAME can also delete services from the victim’s machine.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Taidoor can upload data and files from a victim's machine.
MITRE ATT&CK technique: T1005: Data from Local System
Taidoor can use a stream cipher to decrypt stings used by the malware.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Taidoor can perform DLL loading.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Taidoor can use encrypted string blocks for obfuscation.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Taidoor can use DeleteFileA to remove files from infected hosts.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Taidoor can search for specific files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Taidoor has downloaded additional files onto a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Taidoor has relied upon a victim to click on a malicious email attachment.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Taidoor has the ability to modify the Registry on compromised hosts using RegDeleteValueA and RegCreateKeyExA.
MITRE ATT&CK technique: T1112: Modify Registry
Taidoor has the ability to use native APIs for execution including GetProcessHeap, GetProcAddress, and LoadLibrary.
MITRE ATT&CK technique: T1106: Native API
Taidoor can use TCP for C2 communications.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Taidoor can use GetCurrentProcessId for process discovery.
MITRE ATT&CK technique: T1057: Process Discovery
Taidoor can query the Registry on compromised hosts using RegQueryValueExA.
MITRE ATT&CK technique: T1012: Query Registry
Taidoor has modified the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run key for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Taidoor has been delivered through spearphishing emails.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Taidoor uses RC4 to encrypt the message body of HTTP content.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Taidoor has collected the MAC address of a compromised host; it can also use GetAdaptersInfo to identify network adapters.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Taidoor can use GetLocalTime and GetSystemTime to collect system time.
MITRE ATT&CK technique: T1124: System Time Discovery
Taidoor has used HTTP GET and POST requests for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Taidoor can copy cmd.exe into the system temp folder.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
TajMahal has the ability to use the open source libraries XZip/Xunzip and zlib to compress files.
MITRE ATT&CK technique: T1560.002: Archive Collected Data- Archive via Library
TajMahal has the ability to capture VoiceIP application audio on an infected host.
MITRE ATT&CK technique: T1123: Audio Capture
TajMahal has the ability to index and compress files into a send queue for exfiltration.
MITRE ATT&CK technique: T1119: Automated Collection
TajMahal has the ability to manage an automated queue of egress files and commands sent to its C2.
MITRE ATT&CK technique: T1020: Automated Exfiltration
TajMahal has the ability to steal data from the clipboard of an infected host.
MITRE ATT&CK technique: T1115: Clipboard Data
TajMahal has the ability to steal documents from the local system including the print spooler queue.
MITRE ATT&CK technique: T1005: Data from Local System
TajMahal has the ability to steal written CD images and files of interest from previously connected removable drives when they become available again.
MITRE ATT&CK technique: T1025: Data from Removable Media
TajMahal has the ability to inject DLLs for malicious plugins into running processes.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
TajMahal has the ability to send collected files over its C2.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
TajMahal has the ability to index files from drives, user profiles, and removable drives.
MITRE ATT&CK technique: T1083: File and Directory Discovery
TajMahal has the ability to capture keystrokes on an infected host.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
TajMahal can set the KeepPrintedJobs attribute for configured printers in SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers to enable document stealing.
MITRE ATT&CK technique: T1112: Modify Registry
TajMahal has used an encrypted Virtual File System to store plugins.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
TajMahal has the ability to identify connected Apple devices.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
TajMahal has the ability to identify running processes and associated plugins on an infected host.
MITRE ATT&CK technique: T1057: Process Discovery
TajMahal has the ability to take screenshots on an infected host including capturing content from windows of instant messaging applications.
MITRE ATT&CK technique: T1113: Screen Capture
TajMahal has the ability to identify which anti-virus products, firewalls, and anti-spyware products are in use.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
TajMahal has the ability to inject the LoadLibrary call template DLL into running processes.
MITRE ATT&CK technique: T1129: Shared Modules
TajMahal has the ability to identify the Internet Explorer version on an infected host.
MITRE ATT&CK technique: T1518: Software Discovery
TajMahal has the ability to steal web session cookies from Internet Explorer, Netscape Navigator, FireFox and RealNetworks applications.
MITRE ATT&CK technique: T1539: Steal Web Session Cookie
TajMahal has the ability to identify hardware information, the computer name, and OS information on an infected host.
MITRE ATT&CK technique: T1082: System Information Discovery
TajMahal has the ability to identify the MAC address on an infected host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
TajMahal has the ability to determine local time on a compromised host.
MITRE ATT&CK technique: T1124: System Time Discovery
TajMahal has the ability to capture webcam video.
MITRE ATT&CK technique: T1125: Video Capture
Tarrask is able to create “hidden” scheduled tasks by deleting the Security Descriptor registry value.
MITRE ATT&CK technique: T1564: Hide Artifacts
Tarrask creates a scheduled task called “WinUpdate” to re-establish any dropped C2 connections.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Tarrask has masqueraded as executable files such as `winupdate.exe`, `date.exe`, or `win.exe`.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Tarrask is able to delete the Security Descriptor registry subkey in order to “hide” scheduled tasks.
MITRE ATT&CK technique: T1112: Modify Registry
Tarrask is able to create “hidden” scheduled tasks for persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Tarrask leverages token theft to obtain `lsass.exe` security permissions.
MITRE ATT&CK technique: T1134.001: Access Token Manipulation- Token Impersonation/Theft
Tarrask may abuse the Windows schtasks command-line tool to create "hidden" scheduled tasks.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Tasklist can be used to discover processes running on a system.
MITRE ATT&CK technique: T1057: Process Discovery
Tasklist can be used to enumerate security software currently running on a system by process name of known products.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Tasklist can be used to discover services running on a system.
MITRE ATT&CK technique: T1007: System Service Discovery
ThiefQuest uses AppleScript's osascript -e command to launch ThiefQuest's persistence via Launch Agent and Launch Daemon.
MITRE ATT&CK technique: T1059.002: Command and Scripting Interpreter- AppleScript
ThiefQuest searches through the /Users/ folder looking for executable files. For each executable, ThiefQuest prepends a copy of itself to the beginning of the file. When the file is executed, the ThiefQuest code is executed first. ThiefQuest creates a hidden file, copies the original target executable to the file, then executes the new hidden file to maintain the appearance of normal behavior.
MITRE ATT&CK technique: T1554: Compromise Host Software Binary
ThiefQuest encrypts a set of file extensions on a host, deletes the original files, and provides a ransom note with no contact information.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
ThiefQuest uses a function named is_debugging to perform anti-debugging logic. The function invokes sysctl checking the returned value of P_TRACED. ThiefQuest also calls ptrace with the PTRACE_DENY_ATTACH flag to prevent debugging.
MITRE ATT&CK technique: T1622: Debugger Evasion
ThiefQuest uses the function kill_unwanted to obtain a list of running processes and kills each process matching a list of security related processes.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
ThiefQuest exfiltrates targeted file extensions in the /Users/ folder to the command and control server via unencrypted HTTP. Network packets contain a string with two pieces of information: a file path and the contents of the file in a base64 encoded string.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
ThiefQuest hides a copy of itself in the user's ~/Library directory by using a . at the beginning of the file name followed by 9 random characters.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
ThiefQuest can download and execute payloads in-memory or from disk.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
ThiefQuest uses the CGEventTap functions to perform keylogging.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
ThiefQuest installs a launch item using an embedded encrypted launch agent property list template. The plist file is installed in the ~/Library/LaunchAgents/ folder and configured with the path to the persistent binary located in the ~/Library/ folder.
MITRE ATT&CK technique: T1543.001: Create or Modify System Process- Launch Agent
When running with root privileges after a Launch Agent is installed, ThiefQuest installs a plist file to the /Library/LaunchDaemons/ folder with the RunAtLoad key set to true establishing persistence as a Launch Daemon.
MITRE ATT&CK technique: T1543.004: Create or Modify System Process- Launch Daemon
ThiefQuest prepends a copy of itself to the beginning of an executable file while maintaining the name of the executable.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
ThiefQuest uses various API to perform behaviors such as executing payloads and performing local enumeration.
MITRE ATT&CK technique: T1106: Native API
ThiefQuest obtains a list of running processes using the function kill_unwanted.
MITRE ATT&CK technique: T1057: Process Discovery
ThiefQuest uses various API functions such as NSCreateObjectFileImageFromMemory to load and link in-memory payloads.
MITRE ATT&CK technique: T1620: Reflective Code Loading
ThiefQuest uses the kill_unwanted function to get a list of running processes, compares each process with an encrypted list of “unwanted” security related programs, and kills the processes for security related programs.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
ThiefQuest invokes time call to check the system's time, executes a sleep command, invokes a second time call, and then compares the time difference between the two time calls and the amount of time the system slept to identify the sandbox.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
ThiefQuest uploads files via unencrypted HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
ThreatNeedle can collect data and files from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
ThreatNeedle can decrypt its payload using RC4, AES, or one-byte XORing.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
ThreatNeedle has been compressed and obfuscated using RC4, AES, or XOR.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
ThreatNeedle can obtain file and directory information.
MITRE ATT&CK technique: T1083: File and Directory Discovery
ThreatNeedle can save its configuration data as a RC4-encrypted Registry key under `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\GameCon`.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
ThreatNeedle can download additional tools to enable lateral movement.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
ThreatNeedle relies on a victim to click on a malicious document for initial execution.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
ThreatNeedle chooses its payload creation path from a randomly selected service name from netsvc.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
ThreatNeedle can modify the Registry to save its configuration data as the following RC4-encrypted Registry key: `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\GameCon`.
MITRE ATT&CK technique: T1112: Modify Registry
ThreatNeedle can be loaded into the Startup folder as a Shortcut file for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
ThreatNeedle has been distributed via a malicious Word document within a spearphishing email.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
ThreatNeedle can collect system profile information from a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
ThreatNeedle can run in memory and register its payload as a Windows service.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
TinyTurla has the ability to encrypt C2 traffic with SSL/TLS.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
TinyTurla can upload files from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
TinyTurla can go through a list of C2 server IPs and will try to register with each until one responds.
MITRE ATT&CK technique: T1008: Fallback Channels
TinyTurla can save its configuration parameters in the Registry.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
TinyTurla has the ability to act as a second-stage dropper used to infect the system with additional malware.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
TinyTurla has mimicked an existing Windows service by being installed as Windows Time Service.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
TinyTurla has been deployed as `w64time.dll` to appear legitimate.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
TinyTurla can set its configuration parameters in the Registry.
MITRE ATT&CK technique: T1112: Modify Registry
TinyTurla has used `WinHTTP`, `CreateProcess`, and other APIs for C2 communications and other functions.
MITRE ATT&CK technique: T1106: Native API
TinyTurla can query the Registry for its configuration information.
MITRE ATT&CK technique: T1012: Query Registry
TinyTurla contacts its C2 based on a scheduled timing set in its configuration.
MITRE ATT&CK technique: T1029: Scheduled Transfer
TinyTurla can install itself as a service on compromised machines.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
TinyTurla can use HTTPS in C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
TinyTurla has been installed using a .bat file.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
TinyZBot contains functionality to collect information from the clipboard.
MITRE ATT&CK technique: T1115: Clipboard Data
TinyZBot can disable Avira anti-virus.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
TinyZBot contains keylogger functionality.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
TinyZBot can create a shortcut in the Windows startup folder for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
TinyZBot contains screen capture functionality.
MITRE ATT&CK technique: T1113: Screen Capture
TinyZBot can create a shortcut in the Windows startup folder for persistence.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
TinyZBot supports execution from the command-line.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
TinyZBot can install as a Windows service for persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Tomiris has the ability to collect recent files matching a hardcoded list of extensions prior to exfiltration.
MITRE ATT&CK technique: T1005: Data from Local System
Tomiris has connected to a signalization server that provides a URL and port, and then Tomiris sends a GET request to that URL to establish C2.
MITRE ATT&CK technique: T1568: Dynamic Resolution
Tomiris can upload files matching a hardcoded set of extensions, such as .doc, .docx, .pdf, and .rar, to its C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Tomiris can download files and execute them on a victim's system.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Tomiris has used `SCHTASKS /CREATE /SC DAILY /TN StartDVL /TR "path to self" /ST 10:00` to establish persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Tomiris has been packed with UPX.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Tomiris has the ability to sleep for at least nine minutes to evade sandbox-based analysis systems.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
Tomiris can use HTTP to establish C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Tor encapsulates traffic in multiple layers of encryption, using TLS by default.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Traffic traversing the Tor network will be forwarded to multiple nodes before exiting the Tor network and continuing on to its intended destination.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
Torisma has used XOR and Base64 to decode C2 data.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Torisma has been Base64 encoded and AES encrypted.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Torisma is only delivered to a compromised host if the victim's IP address is on an allow-list.
MITRE ATT&CK technique: T1480: Execution Guardrails
Torisma can send victim data to an actor-controlled C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Torisma has used various Windows API calls.
MITRE ATT&CK technique: T1106: Native API
Torisma has been packed with Iz4 compression.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Torisma has encoded C2 communications with Base64.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Torisma has encrypted its C2 communications using XOR and VEST-32.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Torisma can use `GetlogicalDrives` to get a bitmask of all drives available on a compromised system. It can also use `GetDriveType` to determine if a new drive is a CD-ROM drive.
MITRE ATT&CK technique: T1082: System Information Discovery
Torisma can collect the local MAC address using `GetAdaptersInfo` as well as the system's IP address.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Torisma can use `WTSEnumerateSessionsW` to monitor remote desktop connections.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Torisma can collect the current time on a victim machine.
MITRE ATT&CK technique: T1124: System Time Discovery
Torisma can use HTTP and HTTPS for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
TrailBlazer can masquerade its C2 traffic as legitimate Google Notifications HTTP requests.
MITRE ATT&CK technique: T1001: Data Obfuscation
TrailBlazer has used random identifier strings to obscure its C2 operations and result codes.
MITRE ATT&CK technique: T1001.001: Data Obfuscation- Junk Data
TrailBlazer has used filenames that match the name of the compromised system in attempt to avoid detection.
MITRE ATT&CK technique: T1036: Masquerading
TrailBlazer has used HTTP requests for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
TrailBlazer has the ability to use WMI for persistence.
MITRE ATT&CK technique: T1546.003: Event Triggered Execution- Windows Management Instrumentation Event Subscription
TrickBot can implant malicious code into a compromised device's firmware.
MITRE ATT&CK technique: T1542.003: Pre-OS Boot- Bootkit
TrickBot uses web injects and browser redirection to trick the user into providing their login credentials on a fake or modified web page.
MITRE ATT&CK technique: T1185: Browser Session Hijacking
TrickBot has come with a signed downloader component.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
TrickBot used COM to setup scheduled task for persistence.
MITRE ATT&CK technique: T1559.001: Inter-Process Communication- Component Object Model
TrickBot has the ability to capture RDP credentials by capturing the CredEnumerateA API
MITRE ATT&CK technique: T1056.004: Input Capture- Credential API Hooking
TrickBot uses brute-force attack against RDP with rdpscanDll module.
MITRE ATT&CK technique: T1110.004: Brute Force- Credential Stuffing